interface TrustSignals {
  // 사용자 인증 관련
  authMethod: "passkey" | "mfa" | "password" | "sso";
  authAge: number;          // 인증 후 경과 시간 (초)
  authSessionRisk: number;  // 세션 위험 점수 (0~1)
 
  // 디바이스 관련
  deviceManaged: boolean;   // 관리 디바이스 여부
  deviceCompliant: boolean; // 보안 정책 준수 여부
  deviceOs: string;
  devicePatched: boolean;   // 최신 패치 적용 여부
 
  // 네트워크/위치 관련
  networkType: "corporate" | "vpn" | "home" | "public";
  geoLocation: string;
  geoAnomalyDetected: boolean; // 불가능한 이동 감지
 
  // 행동 관련
  requestPatternNormal: boolean;
  dataAccessVolume: "normal" | "elevated" | "excessive";
}
 
function calculateTrustScore(signals: TrustSignals): number {
  let score = 100;
 
  // 인증 방법에 따른 점수
  const authScores: Record<string, number> = {
    passkey: 0,      // 최고 수준, 감점 없음
    mfa: -5,
    sso: -10,
    password: -25,   // 비밀번호만 사용 시 큰 감점
  };
  score += authScores[signals.authMethod] ?? -30;
 
  // 인증 경과 시간 (시간이 지날수록 감점)
  const hoursElapsed = signals.authAge / 3600;
  score -= Math.min(hoursElapsed * 2, 20);
 
  // 디바이스 신뢰
  if (!signals.deviceManaged) score -= 15;
  if (!signals.deviceCompliant) score -= 20;
  if (!signals.devicePatched) score -= 10;
 
  // 네트워크 위치
  const networkScores: Record<string, number> = {
    corporate: 0,
    vpn: -5,
    home: -10,
    public: -25,
  };
  score += networkScores[signals.networkType] ?? -30;
 
  // 이상 탐지
  if (signals.geoAnomalyDetected) score -= 40;
  if (!signals.requestPatternNormal) score -= 15;
  if (signals.dataAccessVolume === "excessive") score -= 25;
  else if (signals.dataAccessVolume === "elevated") score -= 10;
 
  return Math.max(0, Math.min(100, score));
}
 
// 접근 결정
interface AccessDecision {
  allowed: boolean;
  requireStepUp: boolean;   // 추가 인증 필요
  restrictions: string[];   // 적용할 제한사항
}
 
function makeAccessDecision(
  trustScore: number,
  resourceSensitivity: "low" | "medium" | "high" | "critical",
): AccessDecision {
  const thresholds: Record<string, number> = {
    low: 30,
    medium: 50,
    high: 70,
    critical: 85,
  };
 
  const requiredScore = thresholds[resourceSensitivity];
 
  if (trustScore >= requiredScore) {
    return { allowed: true, requireStepUp: false, restrictions: [] };
  }
 
  if (trustScore >= requiredScore - 15) {
    return {
      allowed: true,
      requireStepUp: true,
      restrictions: ["read_only", "log_enhanced"],
    };
  }
 
  return {
    allowed: false,
    requireStepUp: false,
    restrictions: ["blocked"],
  };
}

interface DevicePosture {
  // 디바이스 식별
  deviceId: string;
  platform: "windows" | "macos" | "ios" | "android" | "linux";
  osVersion: string;
 
  // 관리 상태
  mdmEnrolled: boolean;     // MDM(Mobile Device Management) 등록
  managedProfile: boolean;  // 기업 프로필 적용
 
  // 보안 상태
  diskEncrypted: boolean;   // 디스크 암호화
  firewallEnabled: boolean; // 방화벽 활성화
  antivirusActive: boolean; // 안티바이러스 동작 중
  screenLockEnabled: boolean;
  jailbroken: boolean;      // 탈옥/루팅 여부
 
  // 패치 상태
  osUpToDate: boolean;
  lastPatchDate: Date;
  criticalPatchesMissing: number;
 
  // 인증서
  clientCertificateValid: boolean;
  certificateExpiry: Date;
}
 
function evaluateDeviceTrust(posture: DevicePosture): {
  trusted: boolean;
  score: number;
  issues: string[];
} {
  const issues: string[] = [];
  let score = 100;
 
  if (posture.jailbroken) {
    issues.push("탈옥/루팅된 디바이스");
    return { trusted: false, score: 0, issues };
  }
 
  if (!posture.diskEncrypted) {
    issues.push("디스크 암호화 미적용");
    score -= 25;
  }
 
  if (!posture.screenLockEnabled) {
    issues.push("화면 잠금 미설정");
    score -= 20;
  }
 
  if (!posture.osUpToDate) {
    issues.push("OS 업데이트 필요");
    score -= 15;
  }
 
  if (posture.criticalPatchesMissing > 0) {
    issues.push(`주요 패치 ${posture.criticalPatchesMissing}개 누락`);
    score -= posture.criticalPatchesMissing * 10;
  }
 
  if (!posture.mdmEnrolled) {
    issues.push("MDM 미등록");
    score -= 15;
  }
 
  return {
    trusted: score >= 60 && issues.length <= 2,
    score: Math.max(0, score),
    issues,
  };
}

import { IncomingMessage, ServerResponse } from "http";
import httpProxy from "http-proxy";
 
const proxy = httpProxy.createProxyServer({});
 
interface ProxyConfig {
  target: string;
  requiredTrustLevel: number;
  requiredRoles?: string[];
  allowedMethods?: string[];
}
 
const routeConfigs: Record<string, ProxyConfig> = {
  "/admin": {
    target: "http://admin-service:3000",
    requiredTrustLevel: 85,
    requiredRoles: ["admin"],
    allowedMethods: ["GET", "POST", "PUT", "DELETE"],
  },
  "/api": {
    target: "http://api-service:8080",
    requiredTrustLevel: 50,
    allowedMethods: ["GET", "POST"],
  },
  "/docs": {
    target: "http://docs-service:3000",
    requiredTrustLevel: 30,
    allowedMethods: ["GET"],
  },
};
 
async function handleRequest(
  req: IncomingMessage,
  res: ServerResponse,
): Promise<void> {
  // 1. 토큰 검증
  const token = extractBearerToken(req);
  if (!token) {
    redirectToLogin(res);
    return;
  }
 
  const userContext = await verifyAndEnrichToken(token);
  if (!userContext) {
    res.writeHead(401);
    res.end("인증이 필요합니다.");
    return;
  }
 
  // 2. 디바이스 신뢰 확인
  const devicePosture = await getDevicePosture(
    req.headers["x-device-id"] as string
  );
 
  // 3. 신뢰 점수 계산
  const trustScore = calculateTrustScore({
    authMethod: userContext.authMethod,
    authAge: Date.now() / 1000 - userContext.authTime,
    authSessionRisk: userContext.sessionRisk,
    deviceManaged: devicePosture.mdmEnrolled,
    deviceCompliant: devicePosture.trusted,
    deviceOs: devicePosture.platform,
    devicePatched: devicePosture.osUpToDate,
    networkType: classifyNetwork(req.socket.remoteAddress ?? ""),
    geoLocation: userContext.geoLocation,
    geoAnomalyDetected: await detectGeoAnomaly(userContext),
    requestPatternNormal: await checkRequestPattern(userContext.userId),
    dataAccessVolume: "normal",
  });
 
  // 4. 라우트별 정책 적용
  const routeConfig = findRouteConfig(req.url ?? "/");
  if (!routeConfig) {
    res.writeHead(404);
    res.end("Not Found");
    return;
  }
 
  if (trustScore < routeConfig.requiredTrustLevel) {
    res.writeHead(403);
    res.end("신뢰 수준이 부족합니다. 추가 인증이 필요합니다.");
    await logAccessDenied(userContext, req.url ?? "/", trustScore);
    return;
  }
 
  // 5. 인증 정보를 헤더로 전달
  req.headers["x-authenticated-user"] = userContext.userId;
  req.headers["x-user-roles"] = userContext.roles.join(",");
  req.headers["x-trust-score"] = trustScore.toString();
  req.headers["x-device-trust"] = devicePosture.trusted.toString();
 
  // 6. 백엔드로 프록시
  proxy.web(req, res, { target: routeConfig.target });
 
  // 7. 감사 로그
  await logAccess(userContext, req.url ?? "/", trustScore, "allowed");
}

interface AccessPolicy {
  name: string;
  description: string;
  conditions: PolicyCondition[];
  effect: "allow" | "deny" | "step_up";
}
 
type PolicyCondition =
  | { type: "trust_score_min"; value: number }
  | { type: "auth_method"; value: string[] }
  | { type: "device_managed"; value: boolean }
  | { type: "network_type"; value: string[] }
  | { type: "time_range"; start: string; end: string }
  | { type: "geo_country"; value: string[] };
 
const policies: AccessPolicy[] = [
  {
    name: "critical-data-access",
    description: "기밀 데이터 접근 정책",
    conditions: [
      { type: "trust_score_min", value: 85 },
      { type: "auth_method", value: ["passkey", "mfa"] },
      { type: "device_managed", value: true },
      { type: "geo_country", value: ["KR", "US"] },
    ],
    effect: "allow",
  },
  {
    name: "after-hours-restriction",
    description: "근무 시간 외 접근 제한",
    conditions: [
      { type: "time_range", start: "22:00", end: "06:00" },
    ],
    effect: "step_up",
  },
  {
    name: "public-wifi-restriction",
    description: "공용 네트워크 접근 제한",
    conditions: [
      { type: "network_type", value: ["public"] },
    ],
    effect: "deny",
  },
];