Verify API 빠른 시작

"use client";

import Script from "next/script";
import { useState } from "react";

type VerifyResult =
  | { ok: true; verified: boolean; sub: string; cohort: string | null; campus: string | null; authTime: number }
  | { ok: false; errorCode: string; requestId: string | null };

declare global {
  interface Window {
    ssafyVerify?: {
      verify(options: {
        clientId: string;
        redirectUri: string;
        scopes: string[];
        waitForCallback: true;
      }): Promise<{
        code: string | null;
        state: string | null;
        iss: string | null;
        error: string | null;
        error_code: string | null;
        request_id: string | null;
        message?: string | null;
        phase?: string | null;
        codeVerifier: string;
      }>;
    };
  }
}

export default function SsafyVerifyPage() {
  const [result, setResult] = useState<VerifyResult | null>(null);
  const expectedIssuer = process.env.NEXT_PUBLIC_SSAFY_VERIFY_ISSUER!;

  async function startVerify() {
    if (!window.ssafyVerify) {
      setResult({ ok: false, errorCode: "SDK_NOT_READY", requestId: null });
      return;
    }

    const redirectUri = `${window.location.origin}/ssafy`;

    const callbackResult = await window.ssafyVerify.verify({
      clientId: process.env.NEXT_PUBLIC_SSAFY_VERIFY_CLIENT_ID!,
      redirectUri,
      scopes: ["ssafy.verify", "ssafy.affiliation", "ssafy.name"],
      waitForCallback: true,
    }).then(
      (value) => ({ ok: true as const, value }),
      (error) => ({ ok: false as const, error: error as { error_code?: string; request_id?: string | null } }),
    );

    if (!callbackResult.ok) {
      const sdkError = callbackResult.error;
      setResult({
        ok: false,
        errorCode: sdkError.error_code ?? "VERIFY_POPUP_FAILED",
        requestId: sdkError.request_id ?? null,
      });
      return;
    }
    const callback = callbackResult.value;

    if (callback.error || !callback.code) {
      setResult({
        ok: false,
        errorCode: callback.error_code ?? "VERIFY_CANCELLED",
        requestId: callback.request_id,
      });
      return;
    }

    if (callback.iss !== expectedIssuer) {
      setResult({
        ok: false,
        errorCode: "CALLBACK_ISSUER_MISMATCH",
        requestId: callback.request_id,
      });
      return;
    }

    const response = await fetch("/api/ssafy/verify-token", {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify({
        code: callback.code,
        codeVerifier: callback.codeVerifier,
        iss: callback.iss,
        redirectUri,
      }),
    }).then((value) => value, () => null);

    if (!response) {
      setResult({ ok: false, errorCode: "VERIFY_NETWORK_FAILED", requestId: null });
      return;
    }

    const responseBody = await response.json().then(
      (value) => value as VerifyResult,
      () => ({ ok: false as const, errorCode: "VERIFY_RESPONSE_INVALID", requestId: null }),
    );
    setResult(responseBody);
  }

  return (
    <main>
      <Script src="https://verify.myknow.xyz/sdk/ssafy-verify.js" strategy="afterInteractive" />
      <h1>SSAFY 구성원 인증</h1>
      <button type="button" onClick={startVerify}>
        SSAFY 인증하기
      </button>
      {result?.ok ? <p role="status">SSAFY 인증이 완료되었습니다.</p> : null}
      {result && !result.ok ? <p role="alert">인증에 실패했습니다. request_id: {result.requestId ?? "없음"}</p> : null}
      {/*
        Local debugging only: inspect result in devtools if needed.
        Do not render pairwise sub, authTime, or raw verification results
        on user-facing screens.
      */}
    </main>
  );
}

import { createRemoteJWKSet, jwtVerify, type JWTPayload } from "jose";
import { NextResponse } from "next/server";
import { z } from "zod";

const issuer = process.env.SSAFY_VERIFY_ISSUER!;
const clientId = process.env.SSAFY_VERIFY_CLIENT_ID!;
const redirectPath = process.env.SSAFY_VERIFY_REDIRECT_PATH ?? "/ssafy";
const expectedAcr = "urn:ssafy:verify:assurance:mattermost-team-dm:v1";
const jwks = createRemoteJWKSet(new URL(`${issuer}/verify/jwks`));

const pkceVerifierPattern = /^[A-Za-z0-9._~-]{43,128}$/;

const callbackBodySchema = z.object({
  code: z.string().min(16).max(256),
  codeVerifier: z.string().regex(pkceVerifierPattern),
  redirectUri: z.string().url().max(2000),
  iss: z.literal(issuer),
}).strict();

const tokenSuccessSchema = z.object({
  verification_token: z.string().min(32).max(8192),
}).passthrough();

const tokenErrorSchema = z.object({
  error: z.object({
    code: z.string().min(1).max(80).optional(),
    request_id: z.string().min(1).max(120).nullable().optional(),
  }).optional(),
}).passthrough();

function publicError(errorCode: string, requestId: string | null, status = 400) {
  return NextResponse.json({ ok: false, errorCode, requestId }, { status });
}

function logSafe(event: string, metadata: Record<string, unknown>) {
  console.warn("ssafy_verify", { event, ...metadata });
}

function expectedRedirectUri(request: Request) {
  return new URL(redirectPath, request.url).toString();
}

function readJson(request: Request) {
  return request.json().then(
    (value) => ({ ok: true as const, value }),
    () => ({ ok: false as const }),
  );
}

function readResponseJson(response: Response) {
  return response.json().then(
    (value) => ({ ok: true as const, value }),
    () => ({ ok: false as const }),
  );
}

function validateVerificationClaims(claims: JWTPayload) {
  if (claims.client_id !== clientId) return false;
  if (claims.verified !== true) return false;
  if (typeof claims.sub !== "string" || claims.sub.length === 0) return false;
  if (typeof claims.auth_time !== "number") return false;
  if (!Array.isArray(claims.amr) || !claims.amr.includes("mattermost_dm")) return false;
  if (claims.acr !== expectedAcr) return false;
  return true;
}

export async function POST(request: Request) {
  const rawBody = await readJson(request);
  if (!rawBody.ok) {
    return publicError("INVALID_REQUEST", null, 400);
  }

  const parsedBody = callbackBodySchema.safeParse(rawBody.value);
  if (!parsedBody.success) {
    return publicError("INVALID_REQUEST", null, 400);
  }

  const body = parsedBody.data;
  if (body.redirectUri !== expectedRedirectUri(request)) {
    return publicError("REDIRECT_URI_MISMATCH", null, 400);
  }

  const params = new URLSearchParams({
    grant_type: "verification_code",
    client_id: clientId,
    code: body.code,
    code_verifier: body.codeVerifier,
  });

  if (process.env.SSAFY_VERIFY_CLIENT_SECRET) {
    params.set("client_secret", process.env.SSAFY_VERIFY_CLIENT_SECRET);
  }

  const tokenResponse = await fetch(`${issuer}/verify/token`, {
    method: "POST",
    headers: { "content-type": "application/x-www-form-urlencoded" },
    body: params,
    cache: "no-store",
  }).then((response) => response, () => null);

  if (!tokenResponse) {
    logSafe("token_endpoint_unreachable", { issuer });
    return publicError("VERIFY_TOKEN_FAILED", null, 502);
  }

  const tokenJson = await readResponseJson(tokenResponse);
  if (!tokenJson.ok) {
    logSafe("token_endpoint_non_json", { status: tokenResponse.status });
    return publicError("VERIFY_TOKEN_FAILED", null, 502);
  }

  if (!tokenResponse.ok) {
    const errorPayload = tokenErrorSchema.safeParse(tokenJson.value);
    return NextResponse.json(
      {
        ok: false,
        errorCode: errorPayload.success ? errorPayload.data.error?.code ?? "VERIFY_TOKEN_FAILED" : "VERIFY_TOKEN_FAILED",
        requestId: errorPayload.success ? errorPayload.data.error?.request_id ?? null : null,
      },
      { status: tokenResponse.status },
    );
  }

  const tokenPayload = tokenSuccessSchema.safeParse(tokenJson.value);
  if (!tokenPayload.success) {
    logSafe("token_endpoint_invalid_shape", { status: tokenResponse.status });
    return publicError("VERIFY_TOKEN_FAILED", null, 502);
  }

  const verified = await jwtVerify(tokenPayload.data.verification_token, jwks, {
    issuer,
    audience: clientId,
  }).then(
    (result) => ({ ok: true as const, claims: result.payload }),
    () => ({ ok: false as const }),
  );

  if (!verified.ok || !validateVerificationClaims(verified.claims)) {
    logSafe("verification_token_invalid", { issuer, clientId });
    return publicError("VERIFY_TOKEN_INVALID", null, 401);
  }

  return NextResponse.json({
    ok: true,
    verified: verified.claims.verified === true,
    cohort: verified.claims.ssafy_cohort ?? null,
    campus: verified.claims.ssafy_campus ?? null,
    sub: verified.claims.sub,
    authTime: verified.claims.auth_time,
  });
}