Token Upgrade시 챌린지를 거치도록 변경

src/routes/api/auth/login/+server.ts

@@ -10,14 +10,12 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
     .object({
       email: z.string().email().nonempty(),
       password: z.string().nonempty(),
-      pubKey: z.string().base64().nonempty().optional(),
     })
     .safeParse(await request.json());
   if (!zodRes.success) error(400, "Invalid request body");
+  const { email, password } = zodRes.data;
 
-  const { email, password, pubKey } = zodRes.data;
-  const { accessToken, refreshToken } = await login(email.trim(), password.trim(), pubKey?.trim());
-
+  const { accessToken, refreshToken } = await login(email.trim(), password.trim());
   cookies.set("accessToken", accessToken, {
     path: "/",
     maxAge: Math.floor(ms(env.jwt.accessExp) / 1000),
@@ -28,5 +26,6 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
     maxAge: Math.floor(ms(env.jwt.refreshExp) / 1000),
     sameSite: "strict",
   });
+
   return text("Logged in", { headers: { "Content-Type": "text/plain" } });
 };

src/routes/api/auth/logout/+server.ts

@@ -7,8 +7,8 @@ export const POST: RequestHandler = async ({ cookies }) => {
   if (!token) error(401, "Refresh token not found");
 
   await logout(token.trim());
-
   cookies.delete("accessToken", { path: "/" });
   cookies.delete("refreshToken", { path: "/api/auth" });
+
   return text("Logged out", { headers: { "Content-Type": "text/plain" } });
 };

src/routes/api/auth/refreshToken/+server.ts

@@ -1,13 +1,12 @@
 import { error, text } from "@sveltejs/kit";
-import { refreshTokens } from "$lib/server/services/auth";
+import { refreshToken as doRefreshToken } from "$lib/server/services/auth";
 import type { RequestHandler } from "./$types";
 
 export const POST: RequestHandler = async ({ cookies }) => {
   const token = cookies.get("refreshToken");
   if (!token) error(401, "Refresh token not found");
 
-  const { accessToken, refreshToken } = await refreshTokens(token.trim());
-
+  const { accessToken, refreshToken } = await doRefreshToken(token.trim());
   cookies.set("accessToken", accessToken, {
     path: "/",
     sameSite: "strict",
@@ -16,5 +15,6 @@ export const POST: RequestHandler = async ({ cookies }) => {
     path: "/api/auth",
     sameSite: "strict",
   });
+
   return text("Token refreshed", { headers: { "Content-Type": "text/plain" } });
 };

src/routes/api/auth/upgradeToken/+server.ts

@@ -1,29 +1,26 @@
-import { error, text } from "@sveltejs/kit";
+import { error, json } from "@sveltejs/kit";
 import { z } from "zod";
-import { upgradeTokens } from "$lib/server/services/auth";
+import { createTokenUpgradeChallenge } from "$lib/server/services/auth";
 import type { RequestHandler } from "./$types";
 
-export const POST: RequestHandler = async ({ request, cookies }) => {
+export const POST: RequestHandler = async ({ request, cookies, getClientAddress }) => {
   const token = cookies.get("refreshToken");
   if (!token) error(401, "Refresh token not found");
 
   const zodRes = z
     .object({
-      pubKey: z.string().base64().nonempty(),
+      encPubKey: z.string().base64().nonempty(),
+      sigPubKey: z.string().base64().nonempty(),
     })
     .safeParse(await request.json());
   if (!zodRes.success) error(400, "Invalid request body");
+  const { encPubKey, sigPubKey } = zodRes.data;
 
-  const { pubKey } = zodRes.data;
-  const { accessToken, refreshToken } = await upgradeTokens(token.trim(), pubKey.trim());
-
-  cookies.set("accessToken", accessToken, {
-    path: "/",
-    sameSite: "strict",
-  });
-  cookies.set("refreshToken", refreshToken, {
-    path: "/api/auth",
-    sameSite: "strict",
-  });
-  return text("Token upgraded", { headers: { "Content-Type": "text/plain" } });
+  const { challenge } = await createTokenUpgradeChallenge(
+    token.trim(),
+    getClientAddress(),
+    encPubKey.trim(),
+    sigPubKey.trim(),
+  );
+  return json({ challenge });
 };

src/routes/api/auth/upgradeToken/verify/+server.ts

@@ -0,0 +1,35 @@
+import { error, text } from "@sveltejs/kit";
+import { z } from "zod";
+import { upgradeToken } from "$lib/server/services/auth";
+import type { RequestHandler } from "./$types";
+
+export const POST: RequestHandler = async ({ request, cookies, getClientAddress }) => {
+  const token = cookies.get("refreshToken");
+  if (!token) error(401, "Refresh token not found");
+
+  const zodRes = z
+    .object({
+      answer: z.string().base64().nonempty(),
+      sigAnswer: z.string().base64().nonempty(),
+    })
+    .safeParse(await request.json());
+  if (!zodRes.success) error(400, "Invalid request body");
+  const { answer, sigAnswer } = zodRes.data;
+
+  const { accessToken, refreshToken } = await upgradeToken(
+    token.trim(),
+    getClientAddress(),
+    answer.trim(),
+    sigAnswer.trim(),
+  );
+  cookies.set("accessToken", accessToken, {
+    path: "/",
+    sameSite: "strict",
+  });
+  cookies.set("refreshToken", refreshToken, {
+    path: "/api/auth",
+    sameSite: "strict",
+  });
+
+  return text("Token upgraded", { headers: { "Content-Type": "text/plain" } });
+};