OIDC

# OIDC Authorization Code Flow + PKCE 구현 - Python (FastAPI)
import secrets
import hashlib
import base64
from urllib.parse import urlencode
import httpx
from jose import jwt, JWTError
from jose.exceptions import ExpiredSignatureError
from fastapi import FastAPI, Request, HTTPException, Depends
from fastapi.responses import RedirectResponse
from pydantic import BaseModel

app = FastAPI()

# OIDC 설정
OIDC_CONFIG = {
    "issuer": "https://accounts.google.com",
    "client_id": "your-client-id",
    "client_secret": "your-client-secret",
    "redirect_uri": "http://localhost:8000/callback",
    "scopes": ["openid", "profile", "email"],
}

# 세션 저장소 (실제로는 Redis 등 사용)
sessions = {}


def generate_pkce():
    """PKCE code_verifier와 code_challenge 생성"""
    # 1. code_verifier: 43-128자의 랜덤 문자열
    code_verifier = secrets.token_urlsafe(64)

    # 2. code_challenge: code_verifier의 SHA256 해시를 Base64 URL 인코딩
    digest = hashlib.sha256(code_verifier.encode()).digest()
    code_challenge = base64.urlsafe_b64encode(digest).rstrip(b'=').decode()

    return code_verifier, code_challenge


async def get_oidc_config(issuer: str):
    """Discovery Document에서 OIDC 설정 가져오기"""
    async with httpx.AsyncClient() as client:
        response = await client.get(
            f"{issuer}/.well-known/openid-configuration"
        )
        return response.json()


async def get_jwks(jwks_uri: str):
    """JWKS(공개키 세트) 가져오기"""
    async with httpx.AsyncClient() as client:
        response = await client.get(jwks_uri)
        return response.json()


@app.get("/login")
async def login(request: Request):
    """로그인 시작 - IdP로 리다이렉트"""
    # PKCE 생성
    code_verifier, code_challenge = generate_pkce()

    # state (CSRF 방지)
    state = secrets.token_urlsafe(32)

    # nonce (리플레이 공격 방지)
    nonce = secrets.token_urlsafe(32)

    # 세션에 저장 (토큰 교환 시 검증용)
    session_id = secrets.token_urlsafe(16)
    sessions[session_id] = {
        "code_verifier": code_verifier,
        "state": state,
        "nonce": nonce,
    }

    # OIDC 설정 가져오기
    oidc_config = await get_oidc_config(OIDC_CONFIG["issuer"])

    # Authorization URL 구성
    params = {
        "client_id": OIDC_CONFIG["client_id"],
        "response_type": "code",
        "scope": " ".join(OIDC_CONFIG["scopes"]),
        "redirect_uri": OIDC_CONFIG["redirect_uri"],
        "state": state,
        "nonce": nonce,
        "code_challenge": code_challenge,
        "code_challenge_method": "S256",  # PKCE 필수
    }

    auth_url = f"{oidc_config['authorization_endpoint']}?{urlencode(params)}"

    response = RedirectResponse(url=auth_url)
    response.set_cookie("oidc_session", session_id, httponly=True, secure=True)
    return response


@app.get("/callback")
async def callback(request: Request, code: str, state: str):
    """IdP로부터 콜백 처리"""
    # 세션 확인
    session_id = request.cookies.get("oidc_session")
    if not session_id or session_id not in sessions:
        raise HTTPException(400, "Invalid session")

    session_data = sessions[session_id]

    # state 검증 (CSRF 방지)
    if state != session_data["state"]:
        raise HTTPException(400, "Invalid state")

    # OIDC 설정 가져오기
    oidc_config = await get_oidc_config(OIDC_CONFIG["issuer"])

    # Authorization Code를 토큰으로 교환
    async with httpx.AsyncClient() as client:
        token_response = await client.post(
            oidc_config["token_endpoint"],
            data={
                "grant_type": "authorization_code",
                "code": code,
                "redirect_uri": OIDC_CONFIG["redirect_uri"],
                "client_id": OIDC_CONFIG["client_id"],
                "client_secret": OIDC_CONFIG["client_secret"],
                "code_verifier": session_data["code_verifier"],  # PKCE
            },
        )

    if token_response.status_code != 200:
        raise HTTPException(400, f"Token exchange failed: {token_response.text}")

    tokens = token_response.json()
    id_token = tokens["id_token"]
    access_token = tokens["access_token"]

    # ID Token 검증
    jwks = await get_jwks(oidc_config["jwks_uri"])

    try:
        # JWT 검증 (서명, 만료, 발급자, 대상)
        claims = jwt.decode(
            id_token,
            jwks,
            algorithms=["RS256"],
            audience=OIDC_CONFIG["client_id"],
            issuer=OIDC_CONFIG["issuer"],
        )

        # nonce 검증 (리플레이 공격 방지)
        if claims.get("nonce") != session_data["nonce"]:
            raise HTTPException(400, "Invalid nonce")

    except ExpiredSignatureError:
        raise HTTPException(401, "Token expired")
    except JWTError as e:
        raise HTTPException(401, f"Token validation failed: {str(e)}")

    # 세션 정리
    del sessions[session_id]

    # 사용자 정보 반환 (실제로는 세션 생성)
    return {
        "user": {
            "sub": claims["sub"],
            "email": claims.get("email"),
            "name": claims.get("name"),
            "picture": claims.get("picture"),
        },
        "access_token": access_token,
    }


@app.get("/userinfo")
async def userinfo(access_token: str):
    """UserInfo 엔드포인트에서 추가 사용자 정보 가져오기"""
    oidc_config = await get_oidc_config(OIDC_CONFIG["issuer"])

    async with httpx.AsyncClient() as client:
        response = await client.get(
            oidc_config["userinfo_endpoint"],
            headers={"Authorization": f"Bearer {access_token}"},
        )

    return response.json()

# GitHub Actions OIDC를 사용한 AWS 인증 (비밀번호 없음!)
# .github/workflows/deploy.yml

name: Deploy to AWS with OIDC

on:
  push:
    branches: [main]

# OIDC 토큰 발급을 위한 권한
permissions:
  id-token: write   # OIDC 토큰 요청 허용
  contents: read    # 코드 체크아웃 허용

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      # GitHub OIDC로 AWS 인증 (장기 credential 불필요!)
      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          # AWS IAM Role ARN (OIDC 신뢰 관계 설정 필요)
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsRole
          # 세션 이름 (CloudTrail 추적용)
          role-session-name: github-actions-${{ github.run_id }}
          # AWS 리전
          aws-region: ap-northeast-2

      # OIDC 토큰 확인 (디버깅용)
      - name: Check OIDC token claims
        run: |
          # GitHub가 발급한 OIDC 토큰 요청
          OIDC_TOKEN=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sts.amazonaws.com" \
            | jq -r '.value')

          # 토큰 페이로드 확인 (서명 검증 없이 디코딩만)
          echo "OIDC Token Claims:"
          echo $OIDC_TOKEN | cut -d. -f2 | base64 -d 2>/dev/null | jq .

          # 주요 클레임:
          # - iss: https://token.actions.githubusercontent.com
          # - sub: repo:owner/repo:ref:refs/heads/main
          # - aud: sts.amazonaws.com
          # - repository: owner/repo
          # - ref: refs/heads/main
          # - workflow: Deploy to AWS

      - name: Deploy to S3
        run: |
          aws s3 sync ./dist s3://my-bucket/
          echo "Deployed with OIDC authentication!"

---
# AWS IAM Role 신뢰 정책 (Trust Policy)
# 이 정책을 role에 적용해야 GitHub Actions가 인증 가능

# {
#   "Version": "2012-10-17",
#   "Statement": [
#     {
#       "Effect": "Allow",
#       "Principal": {
#         "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
#       },
#       "Action": "sts:AssumeRoleWithWebIdentity",
#       "Condition": {
#         "StringEquals": {
#           "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
#         },
#         "StringLike": {
#           "token.actions.githubusercontent.com:sub": "repo:my-org/my-repo:*"
#         }
#       }
#     }
#   ]
# }

# OIDC Provider 생성 (AWS CLI)
# aws iam create-open-id-connect-provider \
#   --url https://token.actions.githubusercontent.com \
#   --client-id-list sts.amazonaws.com \
#   --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1