[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_108":109,"_110":111},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","marketadapter","name","roadmap-api","path","lib/auth.ts","project",{"_22":48,"_11":12,"_35":49,"_50":-5,"_51":44,"_52":53,"_54":53,"_55":56,"_57":-5,"_58":59,"_60":61,"_62":34,"_63":-5,"_64":-5,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":86,"_87":88,"_89":90,"_91":44},"file",{"_22":23,"_11":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":-5,"_13":46},"permalink","https://www.val.town/x/marketadapter/roadmap-api/code/lib/auth.ts","extension","id","c5cef72f-db43-438c-977c-fe9723c10e7f","auth.ts","fileId","0882c860-ab26-11f1-aeaa-1607ee4eb77e","parentId","0791e4a4-ab26-11f1-a503-1607ee4eb77e","branchId","964f7637-562b-4945-9c69-b20a92bec2d0","branchVersion",33,"latest",true,"createdAt",["D",1788841392119],"version",2,"fileType","script","content","/**\n * Firebase ID 토큰 검증 + 사용자 upsert.\n *\n * Admin SDK 를 쓰지 않는다 — Deno/Val Town 에서 무겁고 서비스 계정 키까지 필요하다.\n * 대신 구글이 공개하는 JWK 로 RS256 서명을 WebCrypto 로 직접 검증한다.\n * (x509 PEM 엔드포인트가 아니라 JWK 엔드포인트를 쓰는 이유: importKey('jwk') 로 바로 들어간다.)\n */\nimport { CONFIG } from \"../config.ts\";\nimport { AuthUser, forbidden, unauthorized } from \"./http.ts\";\nimport { exec, one } from \"./sqlite.ts\";\nimport { nowIso } from \"./time.ts\";\n\nconst JWK_URL =\n \"https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com\";\n\ninterface Jwk {\n kid: string;\n kty: string;\n n: string;\n e: string;\n alg: string;\n}\n\nlet keyCache: { keys: Map; expiresAt: number } | null = null;\n\nasync function getKeys(): Promise> {\n if (keyCache && keyCache.expiresAt > Date.now()) return keyCache.keys;\n\n const res = await fetch(JWK_URL);\n if (!res.ok) throw unauthorized(\"인증 키를 가져오지 못했습니다.\");\n\n const maxAge = Number(\n (res.headers.get(\"cache-control\") ?? \"\").match(/max-age=(\\d+)/)?.[1] ?? \"3600\",\n );\n const data = (await res.json()) as { keys: Jwk[] };\n\n const keys = new Map();\n for (const jwk of data.keys) {\n const key = await crypto.subtle.importKey(\n \"jwk\",\n { kty: jwk.kty, n: jwk.n, e: jwk.e, alg: \"RS256\", ext: true },\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n false,\n [\"verify\"],\n );\n keys.set(jwk.kid, key);\n }\n\n keyCache = { keys, expiresAt: Date.now() + maxAge * 1000 };\n return keys;\n}\n\nfunction b64urlToBytes(s: string): Uint8Array {\n const b64 = s.replace(/-/g, \"+\").replace(/_/g, \"/\").padEnd(\n s.length + ((4 - (s.length % 4)) % 4),\n \"=\",\n );\n const bin = atob(b64);\n // WebCrypto 는 ArrayBuffer 기반 뷰만 받는다(SharedArrayBuffer 불가) — 버퍼를 직접 만들어 맞춘다.\n const out = new Uint8Array(new ArrayBuffer(bin.length));\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nfunction b64urlToJson(s: string): T {\n return JSON.parse(new TextDecoder().decode(b64urlToBytes(s))) as T;\n}\n\nexport interface FirebaseClaims {\n sub: string;\n email?: string;\n email_verified?: boolean;\n name?: string;\n picture?: string;\n aud: string;\n iss: string;\n exp: number;\n iat: number;\n}\n\n/** Firebase ID 토큰을 검증하고 클레임을 돌려준다. */\nexport async function verifyIdToken(token: string): Promise {\n const parts = token.split(\".\");\n if (parts.length !== 3) throw unauthorized(\"토큰 형식이 올바르지 않습니다.\");\n\n const [headerB64, payloadB64, sigB64] = parts;\n\n // 깨진 토큰은 base64/JSON 파싱에서 터진다. 그대로 두면 500 이 나가므로 401 로 바꾼다.\n let header: { alg: string; kid: string };\n try {\n header = b64urlToJson<{ alg: string; kid: string }>(headerB64);\n } catch {\n throw unauthorized(\"토큰을 해석할 수 없습니다. 다시 로그인해 주세요.\");\n }\n if (header.alg !== \"RS256\") throw unauthorized(\"지원하지 않는 서명 알고리즘입니다.\");\n\n const keys = await getKeys();\n const key = keys.get(header.kid);\n if (!key) throw unauthorized(\"토큰 서명 키를 찾을 수 없습니다.\");\n\n let valid: boolean;\n try {\n valid = await crypto.subtle.verify(\n \"RSASSA-PKCS1-v1_5\",\n key,\n b64urlToBytes(sigB64),\n new TextEncoder().encode(`${headerB64}.${payloadB64}`),\n );\n } catch {\n throw unauthorized(\"토큰 서명을 확인할 수 없습니다.\");\n }\n if (!valid) throw unauthorized(\"토큰 서명이 올바르지 않습니다.\");\n\n let claims: FirebaseClaims;\n try {\n claims = b64urlToJson(payloadB64);\n } catch {\n throw unauthorized(\"토큰을 해석할 수 없습니다. 다시 로그인해 주세요.\");\n }\n const projectId = CONFIG.firebaseProjectId;\n const now = Math.floor(Date.now() / 1000);\n\n if (!projectId) throw unauthorized(\"서버에 FIREBASE_PROJECT_ID 가 설정되지 않았습니다.\");\n if (claims.aud !== projectId) throw unauthorized(\"토큰 대상(aud)이 일치하지 않습니다.\");\n if (claims.iss !== `https://securetoken.google.com/${projectId}`) {\n throw unauthorized(\"토큰 발급자(iss)가 일치하지 않습니다.\");\n }\n if (claims.exp <= now) throw unauthorized(\"토큰이 만료되었습니다. 다시 로그인해 주세요.\");\n if (claims.iat > now + 300) throw unauthorized(\"토큰 발급 시각이 올바르지 않습니다.\");\n if (!claims.sub) throw unauthorized(\"토큰에 사용자 식별자가 없습니다.\");\n\n return claims;\n}\n\ninterface UserRow {\n id: string;\n email: string | null;\n name: string;\n role: \"student\" | \"coach\" | \"admin\";\n status: string;\n}\n\n/** 첫 로그인이면 만들고, 있으면 마지막 로그인 시각만 갱신한다. */\nasync function upsertUser(claims: {\n sub: string;\n email?: string;\n name?: string;\n picture?: string;\n}): Promise {\n const now = nowIso();\n const email = claims.email?.toLowerCase() ?? null;\n const existing = await one(\n \"SELECT id, email, name, role, status, photo_url FROM users WHERE id = ?\",\n [claims.sub],\n );\n\n if (existing) {\n await exec(\"UPDATE users SET last_login_at = ?, updated_at = ? WHERE id = ?\", [\n now,\n now,\n claims.sub,\n ]);\n /*\n * ★ 비어 있는 항목만 토큰 값으로 채운다.\n * 이메일/비밀번호 가입은 계정이 먼저 만들어지고 displayName 이 나중에 붙는다.\n * 그래서 첫 로그인 토큰에는 name 이 없고, 이 분기에서 갱신하지 않으면\n * 화면에 영원히 \"이름 없음\" 으로 남는다(실제로 그랬다).\n * 이미 값이 있으면 덮지 않는다 — 운영자가 고친 이름을 로그인할 때마다 되돌리면 안 된다.\n */\n if (!existing.name && claims.name) {\n await exec(\"UPDATE users SET name = ? WHERE id = ?\", [claims.name, claims.sub]);\n existing.name = claims.name;\n }\n if (!existing.photo_url && claims.picture) {\n await exec(\"UPDATE users SET photo_url = ? WHERE id = ?\", [claims.picture, claims.sub]);\n }\n\n // 운영자 이메일이 나중에 추가된 경우를 위해 매 로그인마다 승격 여부를 본다.\n if (email && CONFIG.adminEmails.includes(email) && existing.role !== \"admin\") {\n await exec(\"UPDATE users SET role = 'admin' WHERE id = ?\", [claims.sub]);\n existing.role = \"admin\";\n }\n return existing;\n }\n\n const role = email && CONFIG.adminEmails.includes(email) ? \"admin\" : \"student\";\n await exec(\n `INSERT INTO users (id, email, name, role, status, photo_url, created_at, updated_at, last_login_at)\n VALUES (?, ?, ?, ?, 'active', ?, ?, ?, ?)`,\n [claims.sub, email, claims.name ?? \"\", role, claims.picture ?? null, now, now, now],\n );\n\n return { id: claims.sub, email, name: claims.name ?? \"\", role, status: \"active\" };\n}\n\n/**\n * 요청에서 사용자를 뽑는다. 토큰이 없으면 null.\n * AUTH_MODE=dev 이면 \"dev::\" 형태를 허용한다(로컬 전용).\n */\nexport async function resolveUser(req: Request): Promise {\n const header = req.headers.get(\"authorization\") ?? \"\";\n if (!header.toLowerCase().startsWith(\"bearer \")) return null;\n const token = header.slice(7).trim();\n if (!token) return null;\n\n if (CONFIG.authMode === \"dev\" && token.startsWith(\"dev:\")) {\n const [, uid, role = \"student\"] = token.split(\":\");\n const row = await upsertUser({ sub: uid, email: `${uid}@dev.local`, name: `dev-${uid}` });\n if (role === \"admin\" || role === \"coach\") {\n await exec(\"UPDATE users SET role = ? WHERE id = ?\", [role, uid]);\n row.role = role as UserRow[\"role\"];\n }\n return { id: row.id, email: row.email, name: row.name, role: row.role };\n }\n\n const claims = await verifyIdToken(token);\n const row = await upsertUser(claims);\n if (row.status === \"left\") throw forbidden(\"이용이 종료된 계정입니다. 관리자에게 문의하세요.\");\n return { id: row.id, email: row.email, name: row.name, role: row.role };\n}\n\nexport function requireStaff(user: AuthUser): void {\n if (user.role !== \"admin\" && user.role !== \"coach\") {\n throw forbidden(\"관리자 또는 관리쌤만 사용할 수 있습니다.\");\n }\n}\n\nexport function requireAdmin(user: AuthUser): void {\n if (user.role !== \"admin\") throw forbidden(\"관리자만 사용할 수 있습니다.\");\n}\n\nexport const isStaff = (user: AuthUser) => user.role === \"admin\" || user.role === \"coach\";\n","deleted",false,"label",[47,24],"lib","19e69952-e1a2-467a-8d0c-9197e6be008a",["D",1788831523479],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","관리형 독서실 학습 관리 API","imageUrl","userId","62e039ee-902a-49bb-8a64-406c241f4c74","pinnedFileId","08a8e9dc-ab26-11f1-b9b1-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a07e6b-1ded-75cb-baf4-27bab987c121","tursoName","19e69952e1a2467a8d0c9197e6be008a","tursoHostname","19e69952e1a2467a8d0c9197e6be008a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789529498250],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_107":103},"org",{"_9":10,"_101":10,"_102":103,"_58":59,"_104":105,"_106":44},"branch",{"_37":32,"_11":92,"_22":30,"_93":48,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":12,"_100":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://lh3.googleusercontent.com/a/ACg8ocIP-2ZbzXrHkL2_NvgLmOKbrq2boZbhR3VJZY8_uH0a2c56-zs=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_85":-5,"_141":142,"_143":144,"_145":146,"_147":44,"_148":44,"_149":44,"_150":34,"_151":-5,"_152":-7,"_153":-7,"_154":66,"_155":44,"_156":44,"_157":-5,"_158":44,"_159":44,"_160":44,"_161":-5},"ENV",{"_112":113,"_114":115,"_116":92,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138,"_139":140},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]