API 보안: OAuth2 + API Key + Rate Limit

1. Authorization Code (가장 안전)
   - 웹·앱 사용자 로그인
   - PKCE 추가 (모바일·SPA)

2. Client Credentials
   - 서버 간 통신
   - 사용자 컨텍스트 없음

3. Resource Owner Password (구식·금지)
   - 사용자 비밀번호 직접 전달
   - 신뢰 관계 있을 때만

4. Refresh Token
   - 액세스 토큰 갱신
   - 별도 그랜트

[1] 클라이언트 → /authorize
   ?client_id=...
   &redirect_uri=...
   &response_type=code
   &scope=read:user
   &state=random
   &code_challenge=hash(verifier)
   &code_challenge_method=S256

[2] 사용자 로그인 + 동의

[3] 리다이렉트 → /callback?code=AUTH_CODE&state=...

[4] 클라이언트 → /token
   client_id, code, code_verifier
   → access_token, refresh_token

import crypto from 'crypto';

// 1. /authorize
app.get('/authorize', requireLogin, (req, res) => {
  const { client_id, redirect_uri, code_challenge, state } = req.query;
  const code = crypto.randomBytes(32).toString('hex');

  redis.setex(`auth_code:${code}`, 600, JSON.stringify({
    userId: req.user!.id,
    clientId: client_id,
    redirectUri: redirect_uri,
    codeChallenge: code_challenge,
  }));

  res.redirect(`${redirect_uri}?code=${code}&state=${state}`);
});

// 2. /token
app.post('/token', async (req, res) => {
  const { code, code_verifier, client_id } = req.body;

  const stored = await redis.get(`auth_code:${code}`);
  if (!stored) return res.status(400).json({ error: 'invalid_grant' });
  await redis.del(`auth_code:${code}`);

  const data = JSON.parse(stored);

  // PKCE 검증
  const challenge = crypto.createHash('sha256')
    .update(code_verifier).digest('base64url');
  if (challenge !== data.codeChallenge) {
    return res.status(400).json({ error: 'invalid_code_verifier' });
  }

  const tokens = issueTokens(data.userId, client_id);
  res.json(tokens);
});

// API Key 생성
async function createApiKey(userId: string, name: string, scopes: string[]) {
  const rawKey = crypto.randomBytes(32).toString('base64url');
  const prefix = rawKey.slice(0, 8);  // 표시용
  const hash = crypto.createHash('sha256').update(rawKey).digest('hex');

  await db.apiKey.create({
    data: {
      userId,
      name,
      prefix,
      hash,
      scopes,
      lastUsedAt: null,
      expiresAt: new Date(Date.now() + 365 * 86400 * 1000),
    },
  });

  // 평문 키는 1번만 표시
  return `sk_live_${rawKey}`;
}


// 검증 미들웨어
async function apiKeyAuth(req: Request, res: Response, next: NextFunction) {
  const auth = req.headers.authorization;
  if (!auth?.startsWith('Bearer sk_')) {
    return res.status(401).json({ error: 'invalid_api_key' });
  }
  const rawKey = auth.slice(11);
  const hash = crypto.createHash('sha256').update(rawKey).digest('hex');

  const apiKey = await db.apiKey.findUnique({ where: { hash } });
  if (!apiKey || apiKey.revokedAt || apiKey.expiresAt < new Date()) {
    return res.status(401).json({ error: 'invalid_api_key' });
  }

  // 비동기 — 사용 시각 기록
  db.apiKey.update({
    where: { id: apiKey.id },
    data: { lastUsedAt: new Date() },
  }).catch(console.error);

  req.apiKey = apiKey;
  next();
}

// 발신자
const signature = crypto.createHmac('sha256', WEBHOOK_SECRET)
  .update(JSON.stringify(payload))
  .digest('hex');

await fetch(targetUrl, {
  method: 'POST',
  headers: {
    'X-Signature': signature,
    'X-Timestamp': Date.now().toString(),
  },
  body: JSON.stringify(payload),
});


// 수신자 검증
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-signature'] as string;
  const timestamp = parseInt(req.headers['x-timestamp'] as string);

  // Replay 공격 방지
  if (Math.abs(Date.now() - timestamp) > 5 * 60 * 1000) {
    return res.status(401).json({ error: 'timestamp_too_old' });
  }

  const expected = crypto.createHmac('sha256', WEBHOOK_SECRET)
    .update(req.body)
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).json({ error: 'invalid_signature' });
  }

  const payload = JSON.parse(req.body.toString());
  // ... 처리
  res.json({ received: true });
});

function requireScope(...scopes: string[]) {
  return (req: Request, res: Response, next: NextFunction) => {
    const granted = req.apiKey?.scopes ?? req.user?.scopes ?? [];
    const hasAll = scopes.every(s => granted.includes(s));
    if (!hasAll) {
      return res.status(403).json({
        error: 'insufficient_scope',
        required: scopes,
      });
    }
    next();
  };
}


// 사용
app.get('/users', apiKeyAuth, requireScope('read:users'), listUsers);
app.delete('/users/:id', apiKeyAuth, requireScope('write:users', 'admin'), deleteUser);