JWT와 갱신 토큰 — 짧은 접근 권한, 오래가는 세션

# 라이브러리 없이 손으로 JWT decode
import base64, json

token = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1XzQyIiwiZXhwIjoxNzYwMDAwMDAwfQ.signature'
header_b64, payload_b64, sig_b64 = token.split('.')

# Base64url 이 padding 생략하니 패딩 추가
def b64url_decode(s: str) -> bytes:
    return base64.urlsafe_b64decode(s + '=' * (-len(s) % 4))

header  = json.loads(b64url_decode(header_b64))
payload = json.loads(b64url_decode(payload_b64))
print(header)   # {'alg': 'HS256', 'typ': 'JWT'}
print(payload)  # {'sub': 'u_42', 'exp': 1760000000}
# Signature 가 유일 보호 부분 — 누구든 나머지 읽음.

# PyJWT 로 발급 + 검증 (production-grade)
import jwt, time

SECRET = 'env 에서 온 super-long-random-secret'

# Token 발급
def issue_token(user_id: str, role: str) -> str:
    payload = {
        'iss': 'cwkpippa',
        'sub': user_id,
        'aud': 'cwkpippa-api',
        'iat': int(time.time()),
        'exp': int(time.time()) + 900,  # 15분
        'role': role,
    }
    return jwt.encode(payload, SECRET, algorithm='HS256')

# Token 검증 (algorithm-pinned)
def verify_token(token: str) -> dict:
    return jwt.decode(
        token,
        SECRET,
        algorithms=['HS256'],          # 핀 — 다른 거 절대 받지 마
        audience='cwkpippa-api',
        issuer='cwkpippa',
        options={'require': ['exp', 'sub', 'iat']},
    )

# 사용
token = issue_token('u_42', 'daughter')
claims = verify_token(token)
print(claims)  # {'iss': 'cwkpippa', 'sub': 'u_42', 'role': 'daughter', ...}

# Rotation 가진 refresh flow (canonical 패턴)
import jwt, secrets, time
from fastapi import FastAPI, HTTPException, Cookie, Response

app = FastAPI()
ACCESS_SECRET  = 'env 에서 온 access-secret'
REFRESH_STORE: dict[str, dict] = {}  # refresh_token -> {user_id, family_id, used: bool}

def issue_access(user_id: str) -> str:
    return jwt.encode({'sub': user_id, 'exp': int(time.time()) + 900}, ACCESS_SECRET, algorithm='HS256')

def issue_refresh(user_id: str, family_id: str | None = None) -> str:
    rt = secrets.token_urlsafe(32)
    REFRESH_STORE[rt] = {
        'user_id': user_id,
        'family_id': family_id or secrets.token_hex(8),
        'used': False,
    }
    return rt

@app.post('/auth/refresh')
async def refresh(response: Response, refresh_token: str | None = Cookie(None)):
    record = REFRESH_STORE.get(refresh_token or '')
    if not record or record['used']:
        # 재사용 감지 — 전체 family revoke
        if record and record['used']:
            for rt, r in list(REFRESH_STORE.items()):
                if r['family_id'] == record['family_id']:
                    del REFRESH_STORE[rt]
        raise HTTPException(401, detail='refresh token 무효 혹은 재사용')

    # Used 표시, 새 쌍 발급
    record['used'] = True
    new_refresh = issue_refresh(record['user_id'], record['family_id'])
    response.set_cookie('refresh_token', new_refresh, httponly=True, secure=True, samesite='strict')
    return {'access_token': issue_access(record['user_id']), 'expires_in': 900}