site11/services/oauth/backend/main.py

from fastapi import FastAPI, HTTPException, Depends, Form, Query, Request, Response
from fastapi.middleware.cors import CORSMiddleware
from fastapi.responses import RedirectResponse, JSONResponse
from contextlib import asynccontextmanager
from datetime import datetime, timedelta
from typing import Optional, List, Dict
import uvicorn
import os
import sys
import logging

from database import init_db
from models import (
    OAuthApplication, AuthorizationCode, AccessToken, 
    OAuthScope, UserConsent, GrantType, ResponseType
)
from utils import OAuthUtils, TokenGenerator, ScopeValidator
from pydantic import BaseModel, Field
from beanie import PydanticObjectId

sys.path.append('/app')
from shared.kafka import KafkaProducer, Event, EventType

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

# Pydantic models
class ApplicationCreate(BaseModel):
    name: str
    description: Optional[str] = None
    redirect_uris: List[str]
    website_url: Optional[str] = None
    logo_url: Optional[str] = None
    privacy_policy_url: Optional[str] = None
    terms_url: Optional[str] = None
    sso_enabled: Optional[bool] = False
    sso_provider: Optional[str] = None
    sso_config: Optional[Dict] = None
    allowed_domains: Optional[List[str]] = None

class ApplicationUpdate(BaseModel):
    name: Optional[str] = None
    description: Optional[str] = None
    redirect_uris: Optional[List[str]] = None
    website_url: Optional[str] = None
    logo_url: Optional[str] = None
    privacy_policy_url: Optional[str] = None
    terms_url: Optional[str] = None
    is_active: Optional[bool] = None
    sso_enabled: Optional[bool] = None
    sso_provider: Optional[str] = None
    sso_config: Optional[Dict] = None
    allowed_domains: Optional[List[str]] = None

class ApplicationResponse(BaseModel):
    id: str
    client_id: str
    name: str
    description: Optional[str]
    redirect_uris: List[str]
    allowed_scopes: List[str]
    grant_types: List[str]
    is_active: bool
    is_trusted: bool
    sso_enabled: bool
    sso_provider: Optional[str]
    allowed_domains: List[str]
    website_url: Optional[str]
    logo_url: Optional[str]
    created_at: datetime

class TokenRequest(BaseModel):
    grant_type: str
    code: Optional[str] = None
    redirect_uri: Optional[str] = None
    client_id: Optional[str] = None
    client_secret: Optional[str] = None
    refresh_token: Optional[str] = None
    scope: Optional[str] = None
    code_verifier: Optional[str] = None

# Global Kafka producer
kafka_producer: Optional[KafkaProducer] = None

@asynccontextmanager
async def lifespan(app: FastAPI):
    # Startup
    global kafka_producer
    
    await init_db()
    
    # Initialize Kafka producer
    try:
        kafka_producer = KafkaProducer(
            bootstrap_servers=os.getenv('KAFKA_BOOTSTRAP_SERVERS', 'kafka:9092')
        )
        await kafka_producer.start()
        logger.info("Kafka producer initialized")
    except Exception as e:
        logger.warning(f"Failed to initialize Kafka producer: {e}")
        kafka_producer = None
    
    yield
    
    # Shutdown
    if kafka_producer:
        await kafka_producer.stop()

app = FastAPI(
    title="OAuth 2.0 Service",
    description="OAuth 2.0 인증 서버 및 애플리케이션 관리",
    version="1.0.0",
    lifespan=lifespan
)

# CORS middleware
app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

# Health check
@app.get("/health")
async def health_check():
    return {
        "status": "healthy",
        "service": "oauth",
        "timestamp": datetime.now().isoformat()
    }

# OAuth Application Management
@app.post("/applications", response_model=ApplicationResponse, status_code=201)
async def create_application(
    app_data: ApplicationCreate,
    current_user_id: str = "test_user"  # TODO: Get from JWT token
):
    """새로운 OAuth 애플리케이션 등록"""
    client_id = OAuthUtils.generate_client_id()
    client_secret = OAuthUtils.generate_client_secret()
    hashed_secret = OAuthUtils.hash_client_secret(client_secret)
    
    # 기본 스코프 가져오기
    default_scopes = await OAuthScope.find(OAuthScope.is_default == True).to_list()
    allowed_scopes = [scope.name for scope in default_scopes]
    
    application = OAuthApplication(
        client_id=client_id,
        client_secret=hashed_secret,
        name=app_data.name,
        description=app_data.description,
        owner_id=current_user_id,
        redirect_uris=app_data.redirect_uris,
        allowed_scopes=allowed_scopes,
        grant_types=[GrantType.AUTHORIZATION_CODE, GrantType.REFRESH_TOKEN],
        sso_enabled=app_data.sso_enabled or False,
        sso_provider=app_data.sso_provider,
        sso_config=app_data.sso_config or {},
        allowed_domains=app_data.allowed_domains or [],
        website_url=app_data.website_url,
        logo_url=app_data.logo_url,
        privacy_policy_url=app_data.privacy_policy_url,
        terms_url=app_data.terms_url
    )
    
    await application.create()
    
    # 이벤트 발행
    if kafka_producer:
        event = Event(
            event_type=EventType.TASK_CREATED,
            service="oauth",
            data={
                "app_id": str(application.id),
                "client_id": client_id,
                "name": application.name,
                "owner_id": current_user_id
            }
        )
        await kafka_producer.send_event("oauth-events", event)
    
    # 클라이언트 시크릿은 생성 시에만 반환
    return {
        **ApplicationResponse(
            id=str(application.id),
            client_id=application.client_id,
            name=application.name,
            description=application.description,
            redirect_uris=application.redirect_uris,
            allowed_scopes=application.allowed_scopes,
            grant_types=[gt.value for gt in application.grant_types],
            is_active=application.is_active,
            is_trusted=application.is_trusted,
            sso_enabled=application.sso_enabled,
            sso_provider=application.sso_provider,
            allowed_domains=application.allowed_domains,
            website_url=application.website_url,
            logo_url=application.logo_url,
            created_at=application.created_at
        ).dict(),
        "client_secret": client_secret  # 최초 생성 시에만 반환
    }

@app.get("/applications", response_model=List[ApplicationResponse])
async def list_applications(
    owner_id: Optional[str] = None,
    is_active: Optional[bool] = None
):
    """OAuth 애플리케이션 목록 조회"""
    query = {}
    if owner_id:
        query["owner_id"] = owner_id
    if is_active is not None:
        query["is_active"] = is_active
    
    applications = await OAuthApplication.find(query).to_list()
    
    return [
        ApplicationResponse(
            id=str(app.id),
            client_id=app.client_id,
            name=app.name,
            description=app.description,
            redirect_uris=app.redirect_uris,
            allowed_scopes=app.allowed_scopes,
            grant_types=[gt.value for gt in app.grant_types],
            is_active=app.is_active,
            is_trusted=app.is_trusted,
            sso_enabled=app.sso_enabled,
            sso_provider=app.sso_provider,
            allowed_domains=app.allowed_domains,
            website_url=app.website_url,
            logo_url=app.logo_url,
            created_at=app.created_at
        )
        for app in applications
    ]

@app.get("/applications/{client_id}", response_model=ApplicationResponse)
async def get_application(client_id: str):
    """OAuth 애플리케이션 상세 조회"""
    application = await OAuthApplication.find_one(OAuthApplication.client_id == client_id)
    if not application:
        raise HTTPException(status_code=404, detail="Application not found")
    
    return ApplicationResponse(
        id=str(application.id),
        client_id=application.client_id,
        name=application.name,
        description=application.description,
        redirect_uris=application.redirect_uris,
        allowed_scopes=application.allowed_scopes,
        grant_types=[gt.value for gt in application.grant_types],
        is_active=application.is_active,
        is_trusted=application.is_trusted,
        sso_enabled=application.sso_enabled,
        sso_provider=application.sso_provider,
        allowed_domains=application.allowed_domains,
        website_url=application.website_url,
        logo_url=application.logo_url,
        created_at=application.created_at
    )

# OAuth 2.0 Authorization Endpoint
@app.get("/authorize")
async def authorize(
    response_type: str = Query(..., description="응답 타입 (code, token)"),
    client_id: str = Query(..., description="클라이언트 ID"),
    redirect_uri: str = Query(..., description="리다이렉트 URI"),
    scope: str = Query("", description="요청 스코프"),
    state: Optional[str] = Query(None, description="상태 값"),
    code_challenge: Optional[str] = Query(None, description="PKCE challenge"),
    code_challenge_method: Optional[str] = Query("S256", description="PKCE method"),
    current_user_id: str = "test_user"  # TODO: Get from session/JWT
):
    """OAuth 2.0 인증 엔드포인트"""
    
    # 애플리케이션 확인
    application = await OAuthApplication.find_one(OAuthApplication.client_id == client_id)
    if not application or not application.is_active:
        raise HTTPException(status_code=400, detail="Invalid client")
    
    # 리다이렉트 URI 확인
    if redirect_uri not in application.redirect_uris:
        raise HTTPException(status_code=400, detail="Invalid redirect URI")
    
    # 스코프 검증
    requested_scopes = ScopeValidator.parse_scope_string(scope)
    valid_scopes = ScopeValidator.validate_scopes(requested_scopes, application.allowed_scopes)
    
    # 사용자 동의 확인 (신뢰할 수 있는 앱이거나 이미 동의한 경우 건너뛰기)
    if not application.is_trusted:
        consent = await UserConsent.find_one(
            UserConsent.user_id == current_user_id,
            UserConsent.client_id == client_id
        )
        
        if not consent or set(valid_scopes) - set(consent.granted_scopes):
            # TODO: 동의 화면으로 리다이렉트
            pass
    
    if response_type == "code":
        # Authorization Code Flow
        code = OAuthUtils.generate_authorization_code()
        
        auth_code = AuthorizationCode(
            code=code,
            client_id=client_id,
            user_id=current_user_id,
            redirect_uri=redirect_uri,
            scopes=valid_scopes,
            code_challenge=code_challenge,
            code_challenge_method=code_challenge_method,
            expires_at=datetime.now() + timedelta(minutes=10)
        )
        
        await auth_code.create()
        
        # 리다이렉트 URL 생성
        redirect_url = f"{redirect_uri}?code={code}"
        if state:
            redirect_url += f"&state={state}"
        
        return RedirectResponse(url=redirect_url)
    
    elif response_type == "token":
        # Implicit Flow (권장하지 않음)
        raise HTTPException(status_code=400, detail="Implicit flow not supported")
    
    else:
        raise HTTPException(status_code=400, detail="Unsupported response type")

# OAuth 2.0 Token Endpoint
@app.post("/token")
async def token(
    grant_type: str = Form(...),
    code: Optional[str] = Form(None),
    redirect_uri: Optional[str] = Form(None),
    client_id: Optional[str] = Form(None),
    client_secret: Optional[str] = Form(None),
    refresh_token: Optional[str] = Form(None),
    scope: Optional[str] = Form(None),
    code_verifier: Optional[str] = Form(None)
):
    """OAuth 2.0 토큰 엔드포인트"""
    
    # 클라이언트 인증
    if not client_id or not client_secret:
        raise HTTPException(
            status_code=401, 
            detail="Client authentication required",
            headers={"WWW-Authenticate": "Basic"}
        )
    
    application = await OAuthApplication.find_one(OAuthApplication.client_id == client_id)
    if not application or not OAuthUtils.verify_client_secret(client_secret, application.client_secret):
        raise HTTPException(status_code=401, detail="Invalid client credentials")
    
    if grant_type == "authorization_code":
        # Authorization Code Grant
        if not code or not redirect_uri:
            raise HTTPException(status_code=400, detail="Missing required parameters")
        
        auth_code = await AuthorizationCode.find_one(
            AuthorizationCode.code == code,
            AuthorizationCode.client_id == client_id
        )
        
        if not auth_code:
            raise HTTPException(status_code=400, detail="Invalid authorization code")
        
        if auth_code.used:
            raise HTTPException(status_code=400, detail="Authorization code already used")
        
        if auth_code.expires_at < datetime.now():
            raise HTTPException(status_code=400, detail="Authorization code expired")
        
        if auth_code.redirect_uri != redirect_uri:
            raise HTTPException(status_code=400, detail="Redirect URI mismatch")
        
        # PKCE 검증
        if auth_code.code_challenge:
            if not code_verifier:
                raise HTTPException(status_code=400, detail="Code verifier required")
            
            if not OAuthUtils.verify_pkce_challenge(
                code_verifier,
                auth_code.code_challenge,
                auth_code.code_challenge_method
            ):
                raise HTTPException(status_code=400, detail="Invalid code verifier")
        
        # 코드를 사용됨으로 표시
        auth_code.used = True
        auth_code.used_at = datetime.now()
        await auth_code.save()
        
        # 토큰 생성
        access_token = OAuthUtils.generate_access_token()
        refresh_token = OAuthUtils.generate_refresh_token()
        
        token_doc = AccessToken(
            token=access_token,
            refresh_token=refresh_token,
            client_id=client_id,
            user_id=auth_code.user_id,
            scopes=auth_code.scopes,
            expires_at=datetime.now() + timedelta(hours=1),
            refresh_expires_at=datetime.now() + timedelta(days=30)
        )
        
        await token_doc.create()
        
        return TokenGenerator.generate_token_response(
            access_token=access_token,
            expires_in=3600,
            refresh_token=refresh_token,
            scope=" ".join(auth_code.scopes)
        )
    
    elif grant_type == "refresh_token":
        # Refresh Token Grant
        if not refresh_token:
            raise HTTPException(status_code=400, detail="Refresh token required")
        
        token_doc = await AccessToken.find_one(
            AccessToken.refresh_token == refresh_token,
            AccessToken.client_id == client_id
        )
        
        if not token_doc:
            raise HTTPException(status_code=400, detail="Invalid refresh token")
        
        if token_doc.revoked:
            raise HTTPException(status_code=400, detail="Token has been revoked")
        
        if token_doc.refresh_expires_at and token_doc.refresh_expires_at < datetime.now():
            raise HTTPException(status_code=400, detail="Refresh token expired")
        
        # 기존 토큰 폐기
        token_doc.revoked = True
        token_doc.revoked_at = datetime.now()
        await token_doc.save()
        
        # 새 토큰 생성
        new_access_token = OAuthUtils.generate_access_token()
        new_refresh_token = OAuthUtils.generate_refresh_token()
        
        new_token_doc = AccessToken(
            token=new_access_token,
            refresh_token=new_refresh_token,
            client_id=client_id,
            user_id=token_doc.user_id,
            scopes=token_doc.scopes,
            expires_at=datetime.now() + timedelta(hours=1),
            refresh_expires_at=datetime.now() + timedelta(days=30)
        )
        
        await new_token_doc.create()
        
        return TokenGenerator.generate_token_response(
            access_token=new_access_token,
            expires_in=3600,
            refresh_token=new_refresh_token,
            scope=" ".join(token_doc.scopes)
        )
    
    elif grant_type == "client_credentials":
        # Client Credentials Grant
        requested_scopes = ScopeValidator.parse_scope_string(scope) if scope else []
        valid_scopes = ScopeValidator.validate_scopes(requested_scopes, application.allowed_scopes)
        
        access_token = OAuthUtils.generate_access_token()
        
        token_doc = AccessToken(
            token=access_token,
            client_id=client_id,
            scopes=valid_scopes,
            expires_at=datetime.now() + timedelta(hours=1)
        )
        
        await token_doc.create()
        
        return TokenGenerator.generate_token_response(
            access_token=access_token,
            expires_in=3600,
            scope=" ".join(valid_scopes)
        )
    
    else:
        raise HTTPException(status_code=400, detail="Unsupported grant type")

# Token Introspection Endpoint
@app.post("/introspect")
async def introspect(
    token: str = Form(...),
    token_type_hint: Optional[str] = Form(None),
    client_id: str = Form(...),
    client_secret: str = Form(...)
):
    """토큰 검증 엔드포인트"""
    
    # 클라이언트 인증
    application = await OAuthApplication.find_one(OAuthApplication.client_id == client_id)
    if not application or not OAuthUtils.verify_client_secret(client_secret, application.client_secret):
        raise HTTPException(status_code=401, detail="Invalid client credentials")
    
    # 토큰 조회
    token_doc = await AccessToken.find_one(AccessToken.token == token)
    
    if not token_doc or token_doc.revoked or token_doc.expires_at < datetime.now():
        return {"active": False}
    
    # 토큰 사용 시간 업데이트
    token_doc.last_used_at = datetime.now()
    await token_doc.save()
    
    return {
        "active": True,
        "scope": " ".join(token_doc.scopes),
        "client_id": token_doc.client_id,
        "username": token_doc.user_id,
        "exp": int(token_doc.expires_at.timestamp())
    }

# Token Revocation Endpoint
@app.post("/revoke")
async def revoke(
    token: str = Form(...),
    token_type_hint: Optional[str] = Form(None),
    client_id: str = Form(...),
    client_secret: str = Form(...)
):
    """토큰 폐기 엔드포인트"""
    
    # 클라이언트 인증
    application = await OAuthApplication.find_one(OAuthApplication.client_id == client_id)
    if not application or not OAuthUtils.verify_client_secret(client_secret, application.client_secret):
        raise HTTPException(status_code=401, detail="Invalid client credentials")
    
    # 토큰 조회 및 폐기
    token_doc = await AccessToken.find_one(
        AccessToken.token == token,
        AccessToken.client_id == client_id
    )
    
    if token_doc and not token_doc.revoked:
        token_doc.revoked = True
        token_doc.revoked_at = datetime.now()
        await token_doc.save()
        
        # 이벤트 발행
        if kafka_producer:
            event = Event(
                event_type=EventType.TASK_COMPLETED,
                service="oauth",
                data={
                    "action": "token_revoked",
                    "token_id": str(token_doc.id),
                    "client_id": client_id
                }
            )
            await kafka_producer.send_event("oauth-events", event)
    
    return {"status": "success"}

# Scopes Management
@app.get("/scopes")
async def list_scopes():
    """사용 가능한 스코프 목록 조회"""
    scopes = await OAuthScope.find_all().to_list()
    return [
        {
            "name": scope.name,
            "display_name": scope.display_name,
            "description": scope.description,
            "is_default": scope.is_default,
            "requires_approval": scope.requires_approval
        }
        for scope in scopes
    ]

if __name__ == "__main__":
    uvicorn.run(
        "main:app",
        host="0.0.0.0",
        port=8000,
        reload=True
    )