앱 연동 API

import { createPublicKey, verify } from 'node:crypto'
 
function verifyPayriResponse({ rawBody, signatureHeader, requestNonce, publicKeys }) {
  const match = /^kid=([^,]+),\s*ed25519=([A-Za-z0-9+/=]+)$/.exec(signatureHeader ?? '')
  if (!match) throw new Error('Payri-Signature 형식이 올바르지 않아요.')
  const publicKeyBase64 = publicKeys.get(match[1])
  if (!publicKeyBase64) throw new Error('공개 키를 찾을 수 없어요.')
 
  const rawPublicKey = Buffer.from(publicKeyBase64, 'base64')
  if (rawPublicKey.length !== 32) throw new Error('공개 키 길이가 올바르지 않아요.')
  const spkiPrefix = Buffer.from('302a300506032b6570032100', 'hex')
  const publicKey = createPublicKey({
    key: Buffer.concat([spkiPrefix, rawPublicKey]),
    format: 'der',
    type: 'spki'
  })
  const signature = Buffer.from(match[2], 'base64')
  if (!verify(null, rawBody, publicKey, signature)) {
    throw new Error('응답 서명이 올바르지 않아요.')
  }
 
  const body = JSON.parse(rawBody.toString('utf8'))
  if (body.nonce !== requestNonce) throw new Error('nonce가 일치하지 않아요.')
  const issuedAt = Date.parse(body.issuedAt)
  if (!Number.isFinite(issuedAt) || Math.abs(Date.now() - issuedAt) > 5 * 60 * 1000) {
    throw new Error('응답 발급 시각이 허용 범위를 벗어났어요.')
  }
  return body
}

async function verifyPayriResponse({ response, requestNonce, publicKeys }) {
  const header = response.headers.get('Payri-Signature') ?? ''
  const match = /^kid=([^,]+),\s*ed25519=([A-Za-z0-9+/=]+)$/.exec(header)
  if (!match) throw new Error('Payri-Signature 형식이 올바르지 않아요.')
  const publicKeyBase64 = publicKeys.get(match[1])
  if (!publicKeyBase64) throw new Error('공개 키를 찾을 수 없어요.')
 
  const keyBytes = Uint8Array.from(atob(publicKeyBase64), char => char.charCodeAt(0))
  const publicKey = await crypto.subtle.importKey(
    'raw',
    keyBytes,
    { name: 'Ed25519' },
    false,
    ['verify']
  )
  const rawBody = new Uint8Array(await response.arrayBuffer())
  const signature = Uint8Array.from(atob(match[2]), char => char.charCodeAt(0))
  const valid = await crypto.subtle.verify(
    { name: 'Ed25519' },
    publicKey,
    signature,
    rawBody
  )
  if (!valid) throw new Error('응답 서명이 올바르지 않아요.')
 
  const body = JSON.parse(new TextDecoder().decode(rawBody))
  if (body.nonce !== requestNonce) throw new Error('nonce가 일치하지 않아요.')
  const issuedAt = Date.parse(body.issuedAt)
  if (!Number.isFinite(issuedAt) || Math.abs(Date.now() - issuedAt) > 5 * 60 * 1000) {
    throw new Error('응답 발급 시각이 허용 범위를 벗어났어요.')
  }
  return body
}