7장: 인증과 인가

import jwt from 'jsonwebtoken';
 
interface JWTPayload {
  sub: string;  // 사용자 ID
  role: string;
  iat: number;
  exp: number;
}
 
interface AuthenticatedUser {
  id: string;
  role: 'ADMIN' | 'USER' | 'EDITOR';
  permissions: string[];
}
 
async function authenticateRequest(req: Request): Promise<AuthenticatedUser | null> {
  const authHeader = req.headers.get('authorization');
  if (!authHeader?.startsWith('Bearer ')) {
    return null;
  }
 
  const token = authHeader.slice(7);
 
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET!) as JWTPayload;
    
    // 필요 시 DB에서 추가 정보 조회
    const user = await prisma.user.findUnique({
      where: { id: decoded.sub },
      select: { id: true, role: true, permissions: true },
    });
 
    if (!user) return null;
 
    return {
      id: user.id,
      role: user.role as AuthenticatedUser['role'],
      permissions: user.permissions,
    };
  } catch {
    // 토큰 만료, 위조 등
    return null;
  }
}

async function createContext({ req }: { req: Request }): Promise<Context> {
  const currentUser = await authenticateRequest(req);
 
  return {
    currentUser,
    dataSources: createDataSources(prisma),
    loaders: createLoaders(prisma),
    prisma,
  };
}

import { GraphQLError } from 'graphql';
 
function requireAuth(context: Context): AuthenticatedUser {
  if (!context.currentUser) {
    throw new GraphQLError('Authentication required', {
      extensions: { code: 'UNAUTHENTICATED' },
    });
  }
  return context.currentUser;
}
 
function requireRole(context: Context, roles: string[]): AuthenticatedUser {
  const user = requireAuth(context);
  if (!roles.includes(user.role)) {
    throw new GraphQLError('Insufficient permissions', {
      extensions: { code: 'FORBIDDEN' },
    });
  }
  return user;
}
 
const resolvers = {
  Query: {
    // 공개 쿼리 — 인증 불필요
    posts: async (_parent: unknown, args: PaginationArgs, context: Context) => {
      return context.dataSources.posts.findPublished(args);
    },
    // 인증 필요
    me: async (_parent: unknown, _args: unknown, context: Context) => {
      const user = requireAuth(context);
      return context.dataSources.users.findById(user.id);
    },
    // 관리자 전용
    adminDashboard: async (_parent: unknown, _args: unknown, context: Context) => {
      requireRole(context, ['ADMIN']);
      return context.dataSources.admin.getDashboardStats();
    },
  },
  Mutation: {
    updatePost: async (
      _parent: unknown,
      args: { id: string; input: UpdatePostInput },
      context: Context,
    ) => {
      const user = requireAuth(context);
      const post = await context.dataSources.posts.findById(args.id);
 
      if (!post) {
        throw new GraphQLError('Post not found', {
          extensions: { code: 'NOT_FOUND' },
        });
      }
 
      // 소유자 또는 관리자만 수정 가능
      if (post.authorId !== user.id && user.role !== 'ADMIN') {
        throw new GraphQLError('Not authorized to update this post', {
          extensions: { code: 'FORBIDDEN' },
        });
      }
 
      return context.dataSources.posts.update(args.id, args.input);
    },
  },
};

directive @auth(
  requires: Role = USER
) on FIELD_DEFINITION | OBJECT
 
enum Role {
  ADMIN
  EDITOR
  USER
}
 
type Query {
  posts: [Post!]!                          # 공개
  me: User! @auth                          # 인증 필요 (기본 USER)
  adminDashboard: Dashboard! @auth(requires: ADMIN)  # ADMIN만
}
 
type Mutation {
  createPost(input: CreatePostInput!): Post! @auth
  deletePost(id: ID!): Boolean! @auth(requires: ADMIN)
  publishPost(id: ID!): Post! @auth(requires: EDITOR)
}

import { mapSchema, getDirective, MapperKind } from '@graphql-tools/utils';
import { defaultFieldResolver, GraphQLSchema, GraphQLError } from 'graphql';
 
function authDirectiveTransformer(schema: GraphQLSchema): GraphQLSchema {
  return mapSchema(schema, {
    [MapperKind.OBJECT_FIELD]: (fieldConfig) => {
      const authDirective = getDirective(schema, fieldConfig, 'auth')?.[0];
 
      if (authDirective) {
        const requiredRole = authDirective['requires'] ?? 'USER';
        const originalResolve = fieldConfig.resolve ?? defaultFieldResolver;
 
        fieldConfig.resolve = async (parent, args, context, info) => {
          if (!context.currentUser) {
            throw new GraphQLError('Authentication required', {
              extensions: { code: 'UNAUTHENTICATED' },
            });
          }
 
          const roleHierarchy: Record<string, number> = {
            USER: 1,
            EDITOR: 2,
            ADMIN: 3,
          };
 
          const userLevel = roleHierarchy[context.currentUser.role] ?? 0;
          const requiredLevel = roleHierarchy[requiredRole] ?? 0;
 
          if (userLevel < requiredLevel) {
            throw new GraphQLError(
              `Role ${requiredRole} required`,
              { extensions: { code: 'FORBIDDEN' } },
            );
          }
 
          return originalResolve(parent, args, context, info);
        };
      }
 
      return fieldConfig;
    },
  });
}

type User {
  id: ID!
  name: String!
  email: String! @auth                    # 본인 또는 관리자만
  phone: String @auth(requires: ADMIN)    # 관리자만
  posts: [Post!]!                         # 공개
}

const resolvers = {
  User: {
    email: (parent: User, _args: unknown, context: Context) => {
      // 본인이거나 관리자면 실제 이메일 반환
      if (
        context.currentUser?.id === parent.id ||
        context.currentUser?.role === 'ADMIN'
      ) {
        return parent.email;
      }
      // 그 외에는 마스킹
      return maskEmail(parent.email);
    },
  },
};
 
function maskEmail(email: string): string {
  const [local, domain] = email.split('@');
  const masked = local.slice(0, 2) + '***';
  return `${masked}@${domain}`;
}

const ROLE_PERMISSIONS: Record<string, string[]> = {
  ADMIN: ['read', 'write', 'delete', 'manage_users', 'view_analytics'],
  EDITOR: ['read', 'write', 'delete'],
  USER: ['read', 'write'],
  GUEST: ['read'],
};
 
function hasPermission(user: AuthenticatedUser, permission: string): boolean {
  const permissions = ROLE_PERMISSIONS[user.role] ?? [];
  return permissions.includes(permission);
}
 
// 리졸버에서 사용
const resolvers = {
  Mutation: {
    deletePost: async (_parent: unknown, args: { id: string }, context: Context) => {
      const user = requireAuth(context);
      if (!hasPermission(user, 'delete')) {
        throw new GraphQLError('Delete permission required', {
          extensions: { code: 'FORBIDDEN' },
        });
      }
      return context.dataSources.posts.delete(args.id);
    },
  },
};

interface AccessContext {
  user: AuthenticatedUser;
  resource: Record<string, unknown>;
  action: string;
  environment: {
    time: Date;
    ipAddress: string;
  };
}
 
type PolicyRule = (ctx: AccessContext) => boolean;
 
const policies: Record<string, PolicyRule[]> = {
  'post:update': [
    // 작성자 본인이거나 관리자
    (ctx) =>
      ctx.resource['authorId'] === ctx.user.id || ctx.user.role === 'ADMIN',
    // 업무 시간 외 관리자 수정 차단 (선택)
    (ctx) => {
      if (ctx.user.role !== 'ADMIN') return true;
      const hour = ctx.environment.time.getHours();
      return hour >= 6 && hour <= 22;
    },
  ],
  'post:delete': [
    // 관리자만 삭제 가능
    (ctx) => ctx.user.role === 'ADMIN',
    // 발행 후 30일이 지난 글은 삭제 불가
    (ctx) => {
      const publishedAt = ctx.resource['publishedAt'] as Date | undefined;
      if (!publishedAt) return true;
      const daysSincePublish =
        (Date.now() - publishedAt.getTime()) / (1000 * 60 * 60 * 24);
      return daysSincePublish <= 30;
    },
  ],
};
 
function checkAccess(ctx: AccessContext): boolean {
  const rules = policies[ctx.action];
  if (!rules) return false;
  return rules.every((rule) => rule(ctx));
}

class AuthorizationFacade {
  constructor(
    private currentUser: AuthenticatedUser | null,
    private prisma: PrismaClient,
  ) {}
 
  requireAuthenticated(): AuthenticatedUser {
    if (!this.currentUser) {
      throw new GraphQLError('Authentication required', {
        extensions: { code: 'UNAUTHENTICATED' },
      });
    }
    return this.currentUser;
  }
 
  async canUpdatePost(postId: string): Promise<boolean> {
    const user = this.requireAuthenticated();
    if (user.role === 'ADMIN') return true;
 
    const post = await this.prisma.post.findUnique({
      where: { id: postId },
      select: { authorId: true },
    });
 
    return post?.authorId === user.id;
  }
 
  async canViewAnalytics(teamId: string): Promise<boolean> {
    const user = this.requireAuthenticated();
    if (user.role === 'ADMIN') return true;
 
    const membership = await this.prisma.teamMember.findFirst({
      where: { userId: user.id, teamId, role: 'MANAGER' },
    });
 
    return membership !== null;
  }
}
 
// 컨텍스트에 통합
async function createContext({ req }: { req: Request }): Promise<Context> {
  const currentUser = await authenticateRequest(req);
  return {
    currentUser,
    auth: new AuthorizationFacade(currentUser, prisma),
    dataSources: createDataSources(prisma),
    loaders: createLoaders(prisma),
    prisma,
  };
}
 
// 리졸버가 깔끔해짐
const resolvers = {
  Mutation: {
    updatePost: async (
      _parent: unknown,
      args: { id: string; input: UpdatePostInput },
      context: Context,
    ) => {
      const canUpdate = await context.auth.canUpdatePost(args.id);
      if (!canUpdate) {
        throw new GraphQLError('Not authorized', {
          extensions: { code: 'FORBIDDEN' },
        });
      }
      return context.dataSources.posts.update(args.id, args.input);
    },
  },
};