import crypto from "crypto";
 
// 1단계: code_verifier 생성
function generateCodeVerifier(): string {
  // 43~128자의 URL-safe 랜덤 문자열
  return crypto.randomBytes(32)
    .toString("base64url")
    .substring(0, 128);
}
 
// 2단계: code_challenge 생성
function generateCodeChallenge(verifier: string): string {
  return crypto
    .createHash("sha256")
    .update(verifier)
    .digest("base64url");
}
 
// 3단계: 인가 요청 URL 구성
function buildAuthorizationUrl(config: {
  authorizationEndpoint: string;
  clientId: string;
  redirectUri: string;
  scopes: string[];
  codeChallenge: string;
  state: string;
}): string {
  const params = new URLSearchParams({
    response_type: "code",
    client_id: config.clientId,
    redirect_uri: config.redirectUri,
    scope: config.scopes.join(" "),
    code_challenge: config.codeChallenge,
    code_challenge_method: "S256",
    state: config.state,
  });
 
  return `${config.authorizationEndpoint}?${params.toString()}`;
}
 
// 4단계: 토큰 교환
async function exchangeCodeForTokens(config: {
  tokenEndpoint: string;
  clientId: string;
  code: string;
  redirectUri: string;
  codeVerifier: string;
}): Promise<TokenResponse> {
  const response = await fetch(config.tokenEndpoint, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      client_id: config.clientId,
      code: config.code,
      redirect_uri: config.redirectUri,
      code_verifier: config.codeVerifier,
    }),
  });
 
  return response.json() as Promise<TokenResponse>;
}
 
interface TokenResponse {
  access_token: string;
  token_type: string;
  expires_in: number;
  refresh_token?: string;
  id_token?: string;
  scope: string;
}

{
  "iss": "https://auth.example.com",
  "sub": "user-123",
  "aud": "my-app-client-id",
  "exp": 1719903600,
  "iat": 1719900000,
  "auth_time": 1719899900,
  "nonce": "n-0S6_WzA2Mj",
  "acr": "urn:mace:incommon:iap:silver",
  "amr": ["pwd", "otp"],
  "at_hash": "HK6E_P6Dh8Y93mRNtsDB1Q",
  "name": "홍길동",
  "email": "hong@example.com",
  "email_verified": true,
  "picture": "https://example.com/photo.jpg"
}

// ID Token: 클라이언트 앱이 사용자 정보를 확인할 때
function handleIdToken(idToken: string): UserProfile {
  const payload = decodeAndVerifyJwt(idToken);
 
  // ID Token의 aud가 내 클라이언트 ID인지 확인
  if (payload.aud !== MY_CLIENT_ID) {
    throw new Error("ID Token audience mismatch");
  }
 
  return {
    id: payload.sub,
    name: payload.name,
    email: payload.email,
  };
}
 
// Access Token: API 서버에 요청할 때
async function callProtectedApi(accessToken: string) {
  const response = await fetch("https://api.example.com/data", {
    headers: {
      Authorization: `Bearer ${accessToken}`,
    },
  });
  return response.json();
}

POST /oauth/introspect HTTP/1.1
Host: auth.example.com
Content-Type: application/x-www-form-urlencoded
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
 
token=eyJhbGciOiJSUzI1NiIs...&
token_type_hint=access_token

{
  "active": true,
  "scope": "read write",
  "client_id": "my-app",
  "username": "hong",
  "token_type": "Bearer",
  "exp": 1719903600,
  "iat": 1719900000,
  "sub": "user-123",
  "aud": "https://api.example.com",
  "iss": "https://auth.example.com"
}

import { SignJWT, generateKeyPair, exportJWK } from "jose";
 
async function createDPoPProof(config: {
  privateKey: CryptoKey;
  publicKey: CryptoKey;
  method: string;      // HTTP 메서드 (GET, POST 등)
  url: string;         // 요청 대상 URL
  accessToken?: string; // 리소스 요청 시 포함
}): Promise<string> {
  const publicJwk = await exportJWK(config.publicKey);
 
  const builder = new SignJWT({
    htm: config.method,
    htu: config.url,
    iat: Math.floor(Date.now() / 1000),
    jti: crypto.randomUUID(),
    ...(config.accessToken && {
      ath: await sha256base64url(config.accessToken),
    }),
  })
    .setProtectedHeader({
      alg: "ES256",
      typ: "dpop+jwt",
      jwk: publicJwk,
    });
 
  return builder.sign(config.privateKey);
}
 
async function sha256base64url(input: string): Promise<string> {
  const encoder = new TextEncoder();
  const data = encoder.encode(input);
  const hash = await crypto.subtle.digest("SHA-256", data);
  return btoa(String.fromCharCode(...new Uint8Array(hash)))
    .replace(/\+/g, "-")
    .replace(/\//g, "_")
    .replace(/=+$/, "");
}

{
  "issuer": "https://auth.example.com",
  "authorization_endpoint": "https://auth.example.com/authorize",
  "token_endpoint": "https://auth.example.com/token",
  "userinfo_endpoint": "https://auth.example.com/userinfo",
  "introspection_endpoint": "https://auth.example.com/introspect",
  "jwks_uri": "https://auth.example.com/.well-known/jwks.json",
  "scopes_supported": ["openid", "profile", "email"],
  "response_types_supported": ["code"],
  "grant_types_supported": [
    "authorization_code",
    "refresh_token",
    "client_credentials"
  ],
  "code_challenge_methods_supported": ["S256"],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "private_key_jwt"
  ],
  "dpop_signing_alg_values_supported": ["ES256", "RS256"]
}

async function refreshAccessToken(
  refreshToken: string,
  clientId: string,
  tokenEndpoint: string,
): Promise<TokenResponse> {
  const response = await fetch(tokenEndpoint, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "refresh_token",
      refresh_token: refreshToken,
      client_id: clientId,
    }),
  });
 
  if (!response.ok) {
    // Refresh Token이 무효화된 경우 재인증 필요
    if (response.status === 400) {
      throw new ReauthenticationRequiredError(
        "Refresh token이 폐기되었습니다. 재로그인이 필요합니다."
      );
    }
    throw new TokenRefreshError("토큰 갱신 실패");
  }
 
  const tokens: TokenResponse = await response.json();
  // 새로운 refresh_token을 저장하고, 기존 것은 폐기
  await storeRefreshToken(tokens.refresh_token);
  return tokens;
}