┌──────────┐     ①  인가 요청      ┌──────────┐     ②  로그인/동의     ┌──────────┐
│          │ ─────────────────────> │          │ ─────────────────────> │          │
│  클라이언트  │                       │  DAuth   │                       │   사용자   │
│  (서비스)  │ <───────────────────── │  Server  │ <───────────────────── │          │
│          │     ③ 인가코드 전달      │          │     동의 승인           │          │
└──────────┘                       └──────────┘                       └──────────┘
     │                                   │
     │  ④ 토큰 교환 (code + PKCE)        │
     │ ─────────────────────────────────>│
     │                                   │
     │  ⑤ Access Token 발급              │
     │ <─────────────────────────────────│
     │                                   │
     │  ⑥ 사용자 정보 조회               │
     │ ─────────────────────────────────>│
     │                                   │
     │  ⑦ 사용자 정보 응답               │
     │ <─────────────────────────────────│

https://dauth.b1nd.com/authorize

https://dauth.b1nd.com/authorize?
  response_type=code&
  client_id=abc123&
  redirect_uri=https://myapp.com/callback&
  scope=profile:read&
  state=random_state_string&
  code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&
  code_challenge_method=S256

https://myapp.com/callback?code=AUTHORIZATION_CODE&state=random_state_string

https://myapp.com/callback?error=access_denied&state=random_state_string

POST https://dodam-api.b1nd.com/oauth/token
Content-Type: application/json

{
  "grant_type": "authorization_code",
  "code": "AUTHORIZATION_CODE",
  "redirect_uri": "https://myapp.com/callback",
  "client_id": "abc123",
  "client_secret": "dcs_xxxxxxxxxxxx",
  "code_verifier": "원본_code_verifier_문자열"
}

{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "eyJhbGciOiJIUzI1NiIs..."
}

GET https://dodam-api.b1nd.com/user/me
Authorization: Bearer {access_token}

{
  "publicId": "uuid-string",
  "username": "hong123",
  "name": "홍길동",
  "phone": "010-1234-5678",
  "profileImage": "https://...",
  "status": "ACTIVE",
  "roles": ["STUDENT"],
  "student": {
    "grade": 2,
    "room": 3,
    "number": 15
  },
  "teacher": null,
  "createdAt": "2024-03-15T10:30:00"
}

function generateCodeVerifier() {
  const array = new Uint8Array(32);
  crypto.getRandomValues(array);
  return btoa(String.fromCharCode(...array))
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=+$/, '');
}

async function generateCodeChallenge(verifier) {
  const encoder = new TextEncoder();
  const data = encoder.encode(verifier);
  const digest = await crypto.subtle.digest('SHA-256', data);
  return btoa(String.fromCharCode(...new Uint8Array(digest)))
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=+$/, '');
}

import hashlib
import base64
import secrets

def generate_code_verifier():
    return secrets.token_urlsafe(32)

def generate_code_challenge(verifier: str) -> str:
    digest = hashlib.sha256(verifier.encode()).digest()
    return base64.urlsafe_b64encode(digest).rstrip(b'=').decode()

import java.security.MessageDigest
import java.util.Base64

fun generateCodeVerifier(): String {
    val bytes = ByteArray(32)
    java.security.SecureRandom().nextBytes(bytes)
    return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes)
}

fun generateCodeChallenge(verifier: String): String {
    val digest = MessageDigest.getInstance("SHA-256").digest(verifier.toByteArray())
    return Base64.getUrlEncoder().withoutPadding().encodeToString(digest)
}

GET https://dodam-api.b1nd.com/oauth/clients/scopes

[
  { "scopeKey": "profile:read", "description": "프로필 조회 권한" },
  ...
]

scope=profile:read student:read

// 1. 인가 요청 시작
function startLogin() {
  const codeVerifier = generateCodeVerifier();
  sessionStorage.setItem('code_verifier', codeVerifier);

  const state = crypto.randomUUID();
  sessionStorage.setItem('oauth_state', state);

  const codeChallenge = await generateCodeChallenge(codeVerifier);

  const params = new URLSearchParams({
    response_type: 'code',
    client_id: 'YOUR_CLIENT_ID',
    redirect_uri: 'https://myapp.com/callback',
    scope: 'profile:read',
    state,
    code_challenge: codeChallenge,
    code_challenge_method: 'S256',
  });

  window.location.href = `https://dauth.b1nd.com/authorize?${params}`;
}

// 2. 콜백 처리 (서버 사이드)
// pages/api/callback.ts 또는 app/callback/route.ts
export async function GET(request: Request) {
  const { searchParams } = new URL(request.url);
  const code = searchParams.get('code');
  const state = searchParams.get('state');

  // state 검증 (생략)

  // 토큰 교환
  const tokenRes = await fetch('https://dodam-api.b1nd.com/oauth/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      grant_type: 'authorization_code',
      code,
      redirect_uri: 'https://myapp.com/callback',
      client_id: 'YOUR_CLIENT_ID',
      client_secret: process.env.DAUTH_CLIENT_SECRET,
      code_verifier: '세션에서_가져온_code_verifier',
    }),
  });

  const tokens = await tokenRes.json();

  // 사용자 정보 조회
  const userRes = await fetch('https://dodam-api.b1nd.com/user/me', {
    headers: { Authorization: `Bearer ${tokens.access_token}` },
  });

  const user = await userRes.json();
  // 사용자 정보로 세션 생성 또는 회원 연동 처리
}

@RestController
@RequestMapping("/auth")
class AuthController(
    private val restTemplate: RestTemplate,
    @Value("\${dauth.client-id}") private val clientId: String,
    @Value("\${dauth.client-secret}") private val clientSecret: String,
    @Value("\${dauth.redirect-uri}") private val redirectUri: String,
) {
    @GetMapping("/callback")
    fun callback(
        @RequestParam code: String,
        @RequestParam state: String,
        session: HttpSession,
    ): ResponseEntity<*> {
        // state 검증
        val savedState = session.getAttribute("oauth_state") as? String
        require(state == savedState) { "Invalid state" }

        val codeVerifier = session.getAttribute("code_verifier") as String

        // 토큰 교환
        val tokenResponse = restTemplate.postForObject(
            "https://dodam-api.b1nd.com/oauth/token",
            mapOf(
                "grant_type" to "authorization_code",
                "code" to code,
                "redirect_uri" to redirectUri,
                "client_id" to clientId,
                "client_secret" to clientSecret,
                "code_verifier" to codeVerifier,
            ),
            TokenResponse::class.java,
        )

        // 사용자 정보 조회
        val headers = HttpHeaders().apply {
            setBearerAuth(tokenResponse!!.accessToken)
        }
        val userInfo = restTemplate.exchange(
            "https://dodam-api.b1nd.com/user/me",
            HttpMethod.GET,
            HttpEntity<Void>(headers),
            UserInfo::class.java,
        ).body

        // 세션 생성 또는 회원 연동
        return ResponseEntity.ok(userInfo)
    }
}

GET /oauth/clients/{clientId}

PUT /oauth/clients/{clientId}
Content-Type: application/json

{
  "clientSecret": "현재_시크릿",
  "clientName": "수정된 서비스명",
  "redirectUris": ["https://myapp.com/callback"],
  "scopes": ["profile:read"],
  "description": "서비스 설명",
  "websiteUrl": "https://myapp.com",
  "logoUrl": "https://..."
}

DELETE /oauth/clients/{clientId}
Content-Type: application/json

{
  "clientSecret": "현재_시크릿"
}

POST /oauth/clients/{clientId}/secret/reset
Content-Type: application/json

{
  "clientSecret": "현재_시크릿"
}

POST /oauth/clients/{clientId}/transfer
Content-Type: application/json

{
  "clientSecret": "현재_시크릿",
  "newOwnerPublicId": "대상_사용자_publicId"
}

POST https://dodam-api.b1nd.com/oauth/token
Content-Type: application/json

{
  "grant_type": "refresh_token",
  "refresh_token": "발급받은_리프레시_토큰",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET"
}