acs/server/routes/auth.ts

import bcrypt from 'bcryptjs';
import type { NextFunction, Request, Response } from 'express';
import { Router } from 'express';
import { ok } from '../http/apiResponse.js';
import { ApiError } from '../http/errors.js';
import { query } from '../db/pool.js';
import { findUserById, findUserByUsername, requireCurrentUser, type QueryFn, type UserRow } from './security.js';

interface CurrentUser {
  id: number;
  username: string;
  fullName: string;
  department?: string;
  email?: string;
  roles: string[];
  mustChangePassword: boolean;
}

interface AuthRouterDeps {
  query: QueryFn;
}

function asyncRoute(
  handler: (req: Request, res: Response, next: NextFunction) => Promise<void>,
) {
  return (req: Request, res: Response, next: NextFunction) => {
    handler(req, res, next).catch(next);
  };
}

function toCurrentUser(user: UserRow): CurrentUser {
  return {
    id: Number(user.id),
    username: user.username,
    fullName: user.full_name,
    department: user.department ?? undefined,
    email: user.email ?? undefined,
    roles: user.roles,
    mustChangePassword: user.must_change_password,
  };
}

export function createAuthRouter(deps: AuthRouterDeps = { query }): Router {
  const router = Router();
  const dbQuery = deps.query;

  router.post('/login', asyncRoute(async (req, res) => {
    const username = String(req.body?.username ?? '').trim();
    const password = String(req.body?.password ?? '');

    if (!username || !password) {
      throw new ApiError(400, '아이디와 비밀번호를 입력하세요.');
    }

    const user = await findUserByUsername(dbQuery, username);
    const matches = user ? await bcrypt.compare(password, user.password_hash) : false;
    if (!user || !matches || !user.enabled || user.locked) {
      throw new ApiError(401, '아이디 또는 비밀번호가 올바르지 않습니다.');
    }

    req.session.userId = Number(user.id);
    ok(res, toCurrentUser(user));
  }));

  router.post('/logout', (req, res, next) => {
    req.session.destroy((error) => {
      if (error) {
        next(error);
        return;
      }
      res.clearCookie('connect.sid');
      ok(res, '로그아웃되었습니다.');
    });
  });

  router.get('/me', asyncRoute(async (req, res) => {
    const user = await requireCurrentUser(dbQuery, req);
    ok(res, toCurrentUser(user));
  }));

  router.post('/change-password', asyncRoute(async (req, res) => {
    const user = await requireCurrentUser(dbQuery, req);
    const oldPassword = String(req.body?.oldPassword ?? '');
    const newPassword = String(req.body?.newPassword ?? '');

    if (newPassword.length < 8) {
      throw new ApiError(400, '새 비밀번호는 8자 이상이어야 합니다.');
    }

    if (!(await bcrypt.compare(oldPassword, user.password_hash))) {
      throw new ApiError(400, '현재 비밀번호가 올바르지 않습니다.');
    }

    if (await bcrypt.compare(newPassword, user.password_hash)) {
      throw new ApiError(400, '기존 비밀번호와 다른 비밀번호를 입력하세요.');
    }

    const passwordHash = await bcrypt.hash(newPassword, 12);
    await dbQuery(
      `
        UPDATE users
        SET password_hash = $1,
            must_change_password = FALSE,
            updated_at = now()
        WHERE id = $2
      `,
      [passwordHash, Number(user.id)],
    );

    ok(res, '비밀번호가 변경되었습니다.');
  }));

  router.post('/diagnostics', asyncRoute(async (_req, res) => {
    const tableResult = await dbQuery<{
      current_schema: string;
      users_table: string | null;
      user_roles_table: string | null;
      sessions_table: string | null;
      migrations_table: string | null;
    }>(
      `
        SELECT
          current_schema() AS current_schema,
          to_regclass('users')::text AS users_table,
          to_regclass('user_roles')::text AS user_roles_table,
          to_regclass('user_sessions')::text AS sessions_table,
          to_regclass('schema_migrations')::text AS migrations_table
      `,
    );
    const tables = tableResult.rows[0];
    let users: Array<{
      username: string;
      enabled: boolean;
      locked: boolean;
      must_change_password: boolean;
      password_hash_length: number;
      roles: string[];
    }> = [];
    let userQueryError: string | undefined;
    let migrations: string[] = [];
    let migrationQueryError: string | undefined;

    if (tables?.users_table && tables.user_roles_table) {
      try {
        const userResult = await dbQuery<{
          username: string;
          enabled: boolean;
          locked: boolean;
          must_change_password: boolean;
          password_hash_length: number;
          roles: string[];
        }>(
          `
            SELECT
              u.username,
              u.enabled,
              u.locked,
              u.must_change_password,
              length(u.password_hash) AS password_hash_length,
              COALESCE(array_agg(ur.role) FILTER (WHERE ur.role IS NOT NULL), '{}') AS roles
            FROM users u
            LEFT JOIN user_roles ur ON ur.user_id = u.id
            WHERE u.username IN ('admin', 'security', 'host', 'a', 's', 'h')
            GROUP BY u.id
            ORDER BY u.username
          `,
        );
        users = userResult.rows;
      } catch (error) {
        userQueryError = error instanceof Error ? error.message : String(error);
      }
    }

    if (tables?.migrations_table) {
      try {
        const migrationResult = await dbQuery<{ filename: string }>(
          'SELECT filename FROM schema_migrations ORDER BY filename',
        );
        migrations = migrationResult.rows.map((row) => row.filename);
      } catch (error) {
        migrationQueryError = error instanceof Error ? error.message : String(error);
      }
    }

    ok(res, {
      authApi: true,
      checkedAt: new Date().toISOString(),
      tables,
      users,
      userQueryError,
      migrations,
      migrationQueryError,
    });
  }));

  return router;
}

export const authRouter = createAuthRouter();