472 lines
19 KiB
TypeScript
472 lines
19 KiB
TypeScript
import { randomBytes } from 'node:crypto';
|
|
|
|
import { TRPCError } from '@trpc/server';
|
|
import { addHours, addSeconds, isAfter, isValid, parseISO } from 'date-fns';
|
|
import { z } from 'zod';
|
|
|
|
import { decryptGameSessionToken, encryptGameSessionToken } from '@sammo-ts/common/auth/gameToken';
|
|
|
|
import { procedure, router } from './trpc.js';
|
|
import { toPublicUser } from './auth/userRepository.js';
|
|
import type { UserOAuthInfo } from './auth/userRepository.js';
|
|
import { adminRouter } from './adminRouter.js';
|
|
import { accountRouter } from './account/router.js';
|
|
|
|
const zUsername = z.string().min(2).max(32);
|
|
const zPassword = z.string().min(6).max(128);
|
|
const zProfile = z.string().min(1).max(64);
|
|
const zOAuthMode = z.enum(['login', 'change_pw']);
|
|
const zBootstrapToken = z.string().min(1);
|
|
|
|
const parseDate = (value: string): Date | null => {
|
|
const parsed = parseISO(value);
|
|
return isValid(parsed) ? parsed : null;
|
|
};
|
|
|
|
export const appRouter = router({
|
|
health: router({
|
|
ping: procedure.query(() => ({
|
|
ok: true,
|
|
now: new Date().toISOString(),
|
|
})),
|
|
}),
|
|
me: procedure.query(async ({ ctx }) => {
|
|
const sessionToken = ctx.requestHeaders['x-session-token'] as string | undefined;
|
|
if (!sessionToken) return null;
|
|
const session = await ctx.sessions.getSession(sessionToken);
|
|
if (!session) return null;
|
|
const user = await ctx.users.findById(session.userId);
|
|
return user ? toPublicUser(user) : null;
|
|
}),
|
|
lobby: router({
|
|
notice: procedure.query(async ({ ctx }) => {
|
|
const setting = await ctx.prisma.systemSetting.findUnique({
|
|
where: { id: 1 },
|
|
});
|
|
return setting?.notice ?? '';
|
|
}),
|
|
profiles: procedure
|
|
.input(
|
|
z
|
|
.object({
|
|
sessionToken: z.string().min(1).optional(),
|
|
})
|
|
.optional()
|
|
)
|
|
.query(async ({ ctx, input }) => {
|
|
const sessionToken = input?.sessionToken;
|
|
const session = sessionToken ? await ctx.sessions.getSession(sessionToken) : null;
|
|
return ctx.profileStatus.listLobbyProfiles({
|
|
userId: session?.userId,
|
|
});
|
|
}),
|
|
}),
|
|
admin: adminRouter,
|
|
account: accountRouter,
|
|
auth: router({
|
|
bootstrapLocal: procedure
|
|
.input(
|
|
z.object({
|
|
token: zBootstrapToken,
|
|
username: zUsername,
|
|
password: zPassword,
|
|
displayName: z.string().min(2).max(40).optional(),
|
|
})
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const expected = process.env.GATEWAY_BOOTSTRAP_TOKEN ?? '';
|
|
if (!expected) {
|
|
throw new TRPCError({
|
|
code: 'FORBIDDEN',
|
|
message: 'Bootstrap is disabled.',
|
|
});
|
|
}
|
|
if (input.token !== expected) {
|
|
throw new TRPCError({
|
|
code: 'UNAUTHORIZED',
|
|
message: 'Invalid bootstrap token.',
|
|
});
|
|
}
|
|
const existing = await ctx.prisma.appUser.findFirst({
|
|
select: { id: true },
|
|
});
|
|
if (existing) {
|
|
throw new TRPCError({
|
|
code: 'CONFLICT',
|
|
message: 'Bootstrap is already completed.',
|
|
});
|
|
}
|
|
const created = await ctx.users.createUser({
|
|
username: input.username,
|
|
password: input.password,
|
|
displayName: input.displayName,
|
|
});
|
|
const bootstrappedUser = {
|
|
...created,
|
|
roles: ['superuser'],
|
|
};
|
|
await ctx.users.updateRoles(created.id, bootstrappedUser.roles);
|
|
const session = await ctx.sessions.createSession(bootstrappedUser);
|
|
return {
|
|
user: toPublicUser(bootstrappedUser),
|
|
sessionToken: session.sessionToken,
|
|
issuedAt: session.issuedAt,
|
|
};
|
|
}),
|
|
kakaoStart: procedure
|
|
.input(
|
|
z
|
|
.object({
|
|
mode: zOAuthMode.optional(),
|
|
scopes: z.array(z.string()).optional(),
|
|
})
|
|
.optional()
|
|
)
|
|
.query(async ({ ctx, input }) => {
|
|
const mode = input?.mode ?? 'login';
|
|
const scopes = input?.scopes ?? ['account_email'];
|
|
const pending = await ctx.oauthSessions.createPendingState(mode, scopes);
|
|
const authUrl = ctx.kakaoClient.buildAuthUrl(pending.state, pending.scopes);
|
|
return {
|
|
mode,
|
|
state: pending.state,
|
|
authUrl,
|
|
};
|
|
}),
|
|
kakaoExchange: procedure
|
|
.input(
|
|
z.object({
|
|
code: z.string().min(1),
|
|
state: z.string().min(1),
|
|
})
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const pending = await ctx.oauthSessions.consumePendingState(input.state);
|
|
if (!pending) {
|
|
throw new TRPCError({
|
|
code: 'UNAUTHORIZED',
|
|
message: 'Invalid OAuth state.',
|
|
});
|
|
}
|
|
const token = await ctx.kakaoClient.exchangeCode(input.code);
|
|
const tokenIssuedAt = new Date();
|
|
const accessTokenValidUntil = addSeconds(tokenIssuedAt, token.accessTokenExpiresIn).toISOString();
|
|
const refreshTokenValidUntil = token.refreshTokenExpiresIn
|
|
? addSeconds(tokenIssuedAt, token.refreshTokenExpiresIn).toISOString()
|
|
: undefined;
|
|
|
|
const signupResult = await ctx.kakaoClient.signup(token.accessToken);
|
|
if (!signupResult.id && signupResult.msg !== 'already registered') {
|
|
throw new TRPCError({
|
|
code: 'BAD_REQUEST',
|
|
message: '카카오 앱 연결에 실패했습니다.',
|
|
});
|
|
}
|
|
const me = await ctx.kakaoClient.getMe(token.accessToken);
|
|
const kakaoAccount = me.kakaoAccount;
|
|
if (!kakaoAccount.hasEmail || !kakaoAccount.email) {
|
|
throw new TRPCError({
|
|
code: 'BAD_REQUEST',
|
|
message: '이메일 정보 제공에 동의해야 합니다.',
|
|
});
|
|
}
|
|
if (!kakaoAccount.isEmailValid || !kakaoAccount.isEmailVerified) {
|
|
throw new TRPCError({
|
|
code: 'BAD_REQUEST',
|
|
message: '카카오 계정 이메일이 인증되지 않았습니다.',
|
|
});
|
|
}
|
|
|
|
const oauthInfo: UserOAuthInfo = {
|
|
accessToken: token.accessToken,
|
|
refreshToken: token.refreshToken,
|
|
accessTokenValidUntil,
|
|
refreshTokenValidUntil,
|
|
};
|
|
|
|
const existing =
|
|
(await ctx.users.findByOauthId('KAKAO', me.id)) ??
|
|
(await ctx.users.findByEmail(kakaoAccount.email));
|
|
|
|
if (pending.mode === 'change_pw') {
|
|
if (!existing) {
|
|
throw new TRPCError({
|
|
code: 'NOT_FOUND',
|
|
message: '카카오 계정에 연결된 사용자를 찾지 못했습니다.',
|
|
});
|
|
}
|
|
const nextPasswordChange = existing.oauthInfo?.nextPasswordChange
|
|
? parseDate(existing.oauthInfo.nextPasswordChange)
|
|
: null;
|
|
const now = new Date();
|
|
if (nextPasswordChange && isAfter(nextPasswordChange, now)) {
|
|
throw new TRPCError({
|
|
code: 'TOO_MANY_REQUESTS',
|
|
message: '비밀번호 초기화는 잠시 후 다시 시도해주세요.',
|
|
});
|
|
}
|
|
const tempPassword = randomBytes(4).toString('hex');
|
|
await ctx.kakaoClient.sendTalkMessage(
|
|
token.accessToken,
|
|
`임시 비밀번호는 ${tempPassword} 입니다. 로그인 후 바로 다른 비밀번호로 변경해주세요.`,
|
|
ctx.publicBaseUrl
|
|
);
|
|
const nextChange = addHours(now, 4).toISOString();
|
|
await ctx.users.updatePassword(existing.id, tempPassword);
|
|
await ctx.users.updateOAuthInfo(existing.id, {
|
|
...oauthInfo,
|
|
nextPasswordChange: nextChange,
|
|
});
|
|
return {
|
|
status: 'change_pw' as const,
|
|
ok: true,
|
|
};
|
|
}
|
|
|
|
if (existing) {
|
|
await ctx.users.updateOAuthInfo(existing.id, oauthInfo);
|
|
const session = await ctx.sessions.createSession(existing);
|
|
return {
|
|
status: 'login' as const,
|
|
user: toPublicUser(existing),
|
|
sessionToken: session.sessionToken,
|
|
issuedAt: session.issuedAt,
|
|
};
|
|
}
|
|
|
|
const stored = await ctx.oauthSessions.createSession({
|
|
mode: pending.mode,
|
|
kakaoId: me.id,
|
|
email: kakaoAccount.email,
|
|
accessToken: token.accessToken,
|
|
refreshToken: token.refreshToken,
|
|
accessTokenValidUntil,
|
|
refreshTokenValidUntil,
|
|
createdAt: new Date().toISOString(),
|
|
});
|
|
|
|
return {
|
|
status: 'join' as const,
|
|
oauthSessionId: stored.id,
|
|
email: stored.email,
|
|
};
|
|
}),
|
|
register: procedure
|
|
.input(
|
|
z.object({
|
|
oauthSessionId: z.string().min(1),
|
|
username: zUsername,
|
|
password: zPassword,
|
|
displayName: z.string().min(2).max(40).optional(),
|
|
})
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const oauthSession = await ctx.oauthSessions.consumeSession(input.oauthSessionId);
|
|
if (!oauthSession) {
|
|
throw new TRPCError({
|
|
code: 'UNAUTHORIZED',
|
|
message: 'OAuth 세션이 만료되었습니다.',
|
|
});
|
|
}
|
|
const existing = await ctx.users.findByUsername(input.username);
|
|
if (existing) {
|
|
throw new TRPCError({
|
|
code: 'CONFLICT',
|
|
message: 'Username already exists.',
|
|
});
|
|
}
|
|
const existingOAuth =
|
|
(await ctx.users.findByOauthId('KAKAO', oauthSession.kakaoId)) ??
|
|
(await ctx.users.findByEmail(oauthSession.email));
|
|
if (existingOAuth) {
|
|
throw new TRPCError({
|
|
code: 'CONFLICT',
|
|
message: 'OAuth account already registered.',
|
|
});
|
|
}
|
|
const oauthInfo: UserOAuthInfo = {
|
|
accessToken: oauthSession.accessToken,
|
|
refreshToken: oauthSession.refreshToken,
|
|
accessTokenValidUntil: oauthSession.accessTokenValidUntil,
|
|
refreshTokenValidUntil: oauthSession.refreshTokenValidUntil,
|
|
};
|
|
let created: Awaited<ReturnType<typeof ctx.users.createUser>>;
|
|
try {
|
|
created = await ctx.users.createUser({
|
|
username: input.username,
|
|
password: input.password,
|
|
displayName: input.displayName,
|
|
oauth: {
|
|
type: 'KAKAO',
|
|
id: oauthSession.kakaoId,
|
|
email: oauthSession.email,
|
|
info: oauthInfo,
|
|
},
|
|
});
|
|
} catch (error) {
|
|
throw new TRPCError({
|
|
code: 'CONFLICT',
|
|
message: 'Username already exists.',
|
|
cause: error,
|
|
});
|
|
}
|
|
const session = await ctx.sessions.createSession(created);
|
|
return {
|
|
user: toPublicUser(created),
|
|
sessionToken: session.sessionToken,
|
|
issuedAt: session.issuedAt,
|
|
};
|
|
}),
|
|
login: procedure
|
|
.input(
|
|
z.object({
|
|
username: zUsername,
|
|
password: zPassword,
|
|
})
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const user = await ctx.users.findByUsername(input.username);
|
|
if (!user) {
|
|
throw new TRPCError({
|
|
code: 'UNAUTHORIZED',
|
|
message: 'Invalid username or password.',
|
|
});
|
|
}
|
|
if (user.deleteAfter) {
|
|
throw new TRPCError({
|
|
code: 'FORBIDDEN',
|
|
message: 'Account deletion is pending.',
|
|
});
|
|
}
|
|
const ok = await ctx.users.verifyPassword(user, input.password);
|
|
if (!ok) {
|
|
throw new TRPCError({
|
|
code: 'UNAUTHORIZED',
|
|
message: 'Invalid username or password.',
|
|
});
|
|
}
|
|
const session = await ctx.sessions.createSession(user);
|
|
return {
|
|
user: toPublicUser(user),
|
|
sessionToken: session.sessionToken,
|
|
issuedAt: session.issuedAt,
|
|
};
|
|
}),
|
|
me: procedure
|
|
.input(
|
|
z.object({
|
|
sessionToken: z.string().min(1),
|
|
})
|
|
)
|
|
.query(async ({ ctx, input }) => {
|
|
const session = await ctx.sessions.getSession(input.sessionToken);
|
|
if (!session) {
|
|
return null;
|
|
}
|
|
return {
|
|
user: {
|
|
id: session.userId,
|
|
username: session.username,
|
|
displayName: session.displayName,
|
|
},
|
|
issuedAt: session.issuedAt,
|
|
};
|
|
}),
|
|
logout: procedure
|
|
.input(
|
|
z.object({
|
|
sessionToken: z.string().min(1),
|
|
})
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const session = await ctx.sessions.getSession(input.sessionToken);
|
|
await ctx.sessions.revokeSession(input.sessionToken, { revokeGames: true });
|
|
if (session) {
|
|
await ctx.flushPublisher.publishUserFlush(session.userId, 'logout');
|
|
}
|
|
return { ok: true };
|
|
}),
|
|
issueGameSession: procedure
|
|
.input(
|
|
z.object({
|
|
sessionToken: z.string().min(1),
|
|
profile: zProfile,
|
|
})
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const gameSession = await ctx.sessions.createGameSession(input.sessionToken, input.profile);
|
|
if (!gameSession) {
|
|
throw new TRPCError({
|
|
code: 'UNAUTHORIZED',
|
|
message: 'Session is not valid.',
|
|
});
|
|
}
|
|
const now = new Date();
|
|
const payload = {
|
|
version: 1,
|
|
profile: gameSession.profile,
|
|
issuedAt: now.toISOString(),
|
|
expiresAt: addSeconds(now, ctx.gameSessionTtlSeconds).toISOString(),
|
|
sessionId: gameSession.gameToken,
|
|
user: {
|
|
id: gameSession.userId,
|
|
username: gameSession.username,
|
|
displayName: gameSession.displayName,
|
|
roles: gameSession.roles,
|
|
createdAt: gameSession.createdAt,
|
|
},
|
|
sanctions: gameSession.sanctions,
|
|
} as const;
|
|
const gameToken = encryptGameSessionToken(payload, ctx.gameTokenSecret);
|
|
return {
|
|
profile: gameSession.profile,
|
|
gameToken,
|
|
issuedAt: payload.issuedAt,
|
|
};
|
|
}),
|
|
flushUser: procedure
|
|
.input(
|
|
z.object({
|
|
userId: z.string().min(1),
|
|
reason: z.string().min(1).optional(),
|
|
})
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
await ctx.flushPublisher.publishUserFlush(input.userId, input.reason);
|
|
return { ok: true };
|
|
}),
|
|
validateGameSession: procedure
|
|
.input(
|
|
z.object({
|
|
profile: zProfile,
|
|
gameToken: z.string().min(1),
|
|
})
|
|
)
|
|
.query(async ({ ctx, input }) => {
|
|
const payload = decryptGameSessionToken(input.gameToken, ctx.gameTokenSecret);
|
|
if (!payload) {
|
|
return null;
|
|
}
|
|
if (payload.profile !== input.profile) {
|
|
return null;
|
|
}
|
|
const expiresAt = parseDate(payload.expiresAt);
|
|
if (!expiresAt || isAfter(new Date(), expiresAt)) {
|
|
return null;
|
|
}
|
|
return {
|
|
profile: payload.profile,
|
|
sessionToken: payload.sessionId,
|
|
user: {
|
|
id: payload.user.id,
|
|
username: payload.user.username,
|
|
displayName: payload.user.displayName,
|
|
},
|
|
issuedAt: payload.issuedAt,
|
|
};
|
|
}),
|
|
}),
|
|
});
|
|
|
|
export type AppRouter = typeof appRouter;
|