// Flutter에서 PKCE 구현 예시
import 'dart:convert';
import 'dart:math';
import 'package:crypto/crypto.dart';

String generateCodeVerifier() {
  final random = Random.secure();
  final values = List<int>.generate(32, (i) => random.nextInt(256));
  return base64UrlEncode(values).replaceAll('=', '');
}

String generateCodeChallenge(String verifier) {
  final bytes = utf8.encode(verifier);
  final digest = sha256.convert(bytes);
  return base64UrlEncode(digest.bytes).replaceAll('=', '');
}

// 사용
final verifier = generateCodeVerifier();
final challenge = generateCodeChallenge(verifier);
// challenge를 인가 요청에 포함, verifier는 로컬 저장

// Android Kotlin - 토큰 갱신 예시
class TokenManager(private val context: Context) {
    
    private val prefs = context.getSharedPreferences("auth", Context.MODE_PRIVATE)
    
    fun getAccessToken(): String? = prefs.getString("access_token", null)
    fun getRefreshToken(): String? = prefs.getString("refresh_token", null)
    
    suspend fun refreshAccessToken(): Result<String> {
        val refreshToken = getRefreshToken() 
            ?: return Result.failure(Exception("리프레시 토큰 없음"))
        
        return try {
            val response = authApi.refreshToken(
                grantType = "refresh_token",
                refreshToken = refreshToken,
                clientId = BuildConfig.CLIENT_ID
            )
            
            // 새 토큰 저장
            prefs.edit()
                .putString("access_token", response.accessToken)
                .putString("refresh_token", response.refreshToken)
                .apply()
                
            Result.success(response.accessToken)
        } catch (e: Exception) {
            // 리프레시 토큰도 만료 → 재로그인 필요
            clearTokens()
            Result.failure(e)
        }
    }
    
    fun clearTokens() {
        prefs.edit().clear().apply()
    }
}

// iOS Swift - JWT 검증 예시 (JWTDecode 라이브러리 활용)
import JWTDecode

class JWTValidator {
    
    func validateToken(_ tokenString: String) -> Result<JWTPayload, AuthError> {
        do {
            let jwt = try decode(jwt: tokenString)
            
            // 1. 만료 시간 검증
            guard let expiresAt = jwt.expiresAt, 
                  expiresAt > Date() else {
                return .failure(.tokenExpired)
            }
            
            // 2. 발급자 검증
            guard jwt.issuer == "https://your-auth-server.com" else {
                return .failure(.invalidIssuer)
            }
            
            // 3. 대상자 검증
            guard jwt.audience?.contains("your-app-id") == true else {
                return .failure(.invalidAudience)
            }
            
            // 4. 클레임 추출
            let payload = JWTPayload(
                userId: jwt.subject ?? "",
                email: jwt.claim(name: "email").string ?? "",
                role: jwt.claim(name: "role").string ?? "user"
            )
            
            return .success(payload)
            
        } catch {
            return .failure(.invalidToken)
        }
    }
}

// 서명 검증은 서버사이드에서 수행 (클라이언트에서 서명 검증은 공개키 필요)
// 모바일 앱에서는 HTTPS + 서버 검증이 기본 원칙!

// 서버사이드 - Refresh Token Rotation 구현 (Node.js)
async function refreshTokens(refreshToken) {
    // 1. DB에서 리프레시 토큰 조회
    const storedToken = await db.refreshTokens.findOne({ 
        token: refreshToken,
        isRevoked: false 
    });
    
    if (!storedToken) {
        // 이미 사용된 토큰 → 토큰 탈취 의심!
        // 해당 사용자의 모든 토큰 무효화
        await db.refreshTokens.updateMany(
            { userId: storedToken?.userId },
            { isRevoked: true }
        );
        throw new Error('토큰 재사용 감지 - 보안 위협!');
    }
    
    // 2. 만료 시간 확인
    if (storedToken.expiresAt < new Date()) {
        throw new Error('리프레시 토큰 만료');
    }
    
    // 3. 기존 토큰 무효화
    await db.refreshTokens.updateOne(
        { _id: storedToken._id },
        { isRevoked: true }
    );
    
    // 4. 새 토큰 쌍 발급
    const newAccessToken = generateAccessToken(storedToken.userId);
    const newRefreshToken = generateRefreshToken();
    
    // 5. 새 리프레시 토큰 저장
    await db.refreshTokens.create({
        token: newRefreshToken,
        userId: storedToken.userId,
        expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000) // 30일
    });
    
    return { accessToken: newAccessToken, refreshToken: newRefreshToken };
}

// pubspec.yaml
dependencies:
  firebase_core: ^2.24.0
  firebase_auth: ^4.15.0
  google_sign_in: ^6.1.6

// main.dart - Firebase 초기화
import 'package:firebase_core/firebase_core.dart';
import 'firebase_options.dart';

void main() async {
  WidgetsFlutterBinding.ensureInitialized();
  await Firebase.initializeApp(
    options: DefaultFirebaseOptions.currentPlatform,
  );
  runApp(MyApp());
}

// auth_service.dart - 인증 서비스
import 'package:firebase_auth/firebase_auth.dart';
import 'package:google_sign_in/google_sign_in.dart';

class AuthService {
  final FirebaseAuth _auth = FirebaseAuth.instance;
  final GoogleSignIn _googleSignIn = GoogleSignIn();
  
  // 현재 사용자 스트림
  Stream<User?> get authStateChanges => _auth.authStateChanges();
  
  // 이메일/비밀번호 회원가입
  Future<UserCredential> signUpWithEmail(String email, String password) async {
    try {
      final credential = await _auth.createUserWithEmailAndPassword(
        email: email,
        password: password,
      );
      // 이메일 인증 메일 발송
      await credential.user?.sendEmailVerification();
      return credential;
    } on FirebaseAuthException catch (e) {
      throw _handleAuthException(e);
    }
  }
  
  // 구글 로그인
  Future<UserCredential?> signInWithGoogle() async {
    try {
      final GoogleSignInAccount? googleUser = await _googleSignIn.signIn();
      if (googleUser == null) return null; // 사용자가 취소
      
      final GoogleSignInAuthentication googleAuth = 
          await googleUser.authentication;
      
      final credential = GoogleAuthProvider.credential(
        accessToken: googleAuth.accessToken,
        idToken: googleAuth.idToken,
      );
      
      return await _auth.signInWithCredential(credential);
    } on FirebaseAuthException catch (e) {
      throw _handleAuthException(e);
    }
  }
  
  // 전화번호 인증 (SMS)
  Future<void> verifyPhoneNumber({
    required String phoneNumber,
    required Function(PhoneAuthCredential) onVerificationCompleted,
    required Function(FirebaseAuthException) onVerificationFailed,
    required Function(String, int?) onCodeSent,
  }) async {
    await _auth.verifyPhoneNumber(
      phoneNumber: phoneNumber, // '+82 10-1234-5678'
      verificationCompleted: onVerificationCompleted,
      verificationFailed: onVerificationFailed,
      codeSent: onCodeSent,
      codeAutoRetrievalTimeout: (verificationId) {},
      timeout: const Duration(seconds: 60),
    );
  }
  
  // ID Token 가져오기 (서버 검증용)
  Future<String?> getIdToken({bool forceRefresh = false}) async {
    return await _auth.currentUser?.getIdToken(forceRefresh);
  }
  
  // 로그아웃
  Future<void> signOut() async {
    await Future.wait([
      _auth.signOut(),
      _googleSignIn.signOut(),
    ]);
  }
  
  // 에러 처리
  String _handleAuthException(FirebaseAuthException e) {
    switch (e.code) {
      case 'weak-password': return '비밀번호가 너무 약합니다 (6자 이상)';
      case 'email-already-in-use': return '이미 사용 중인 이메일입니다';
      case 'invalid-email': return '유효하지 않은 이메일 형식입니다';
      case 'user-not-found': return '등록되지 않은 이메일입니다';
      case 'wrong-password': return '비밀번호가 틀렸습니다';
      case 'too-many-requests': return '너무 많은 시도. 잠시 후 다시 시도해주세요';
      default: return '인증 오류: ${e.message}';
    }
  }
}

// 서버사이드 - Firebase Admin SDK로 토큰 검증 (Node.js)
const admin = require('firebase-admin');

// Firebase Admin 초기화 (서비스 계정 키 사용)
admin.initializeApp({
  credential: admin.credential.cert({
    projectId: process.env.FIREBASE_PROJECT_ID,
    clientEmail: process.env.FIREBASE_CLIENT_EMAIL,
    privateKey: process.env.FIREBASE_PRIVATE_KEY.replace(/\\n/g, '\n'),
  }),
});

// 미들웨어 - 모든 보호된 라우트에 적용
async function verifyFirebaseToken(req, res, next) {
  const authHeader = req.headers.authorization;
  
  if (!authHeader?.startsWith('Bearer ')) {
    return res.status(401).json({ error: '인증 토큰이 없습니다' });
  }
  
  const idToken = authHeader.split('Bearer ')[1];
  
  try {
    const decodedToken = await admin.auth().verifyIdToken(idToken);
    
    // 이메일 인증 여부 확인 (선택적)
    if (!decodedToken.email_verified) {
      return res.status(403).json({ error: '이메일 인증이 필요합니다' });
    }
    
    req.user = {
      uid: decodedToken.uid,
      email: decodedToken.email,
      name: decodedToken.name,
    };
    
    next();
  } catch (error) {
    if (error.code === 'auth/id-token-expired') {
      return res.status(401).json({ error: '토큰이 만료되었습니다' });
    }
    return res.status(401).json({ error: '유효하지 않은 토큰' });
  }
}

// 보호된 라우트 예시
app.get('/api/profile', verifyFirebaseToken, async (req, res) => {
  const userProfile = await db.users.findOne({ uid: req.user.uid });
  res.json(userProfile);
});

// Firestore Security Rules 예시
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // 사용자 프로필 - 본인만 읽기/쓰기 가능
    match /users/{userId} {
      allow read, write: if request.auth != null 
                         && request.auth.uid == userId;
    }
    
    // 게시글 - 인증된 사용자만 읽기, 작성자만 수정/삭제
    match /posts/{postId} {
      allow read: if request.auth != null;
      allow create: if request.auth != null 
                    && request.resource.data.authorId == request.auth.uid;
      allow update, delete: if request.auth != null 
                             && resource.data.authorId == request.auth.uid;
    }
    
    // 관리자 전용 컬렉션
    match /admin/{document=**} {
      allow read, write: if request.auth != null 
                         && request.auth.token.admin == true;
    }
    
    // 공개 데이터 - 누구나 읽기 가능
    match /public/{document=**} {
      allow read: if true;
      allow write: if request.auth != null;
    }
  }
}

// Flutter - 생체 인증 구현
import 'package:local_auth/local_auth.dart';
import 'package:flutter_secure_storage/flutter_secure_storage.dart';

class BiometricAuthService {
  final LocalAuthentication _localAuth = LocalAuthentication();
  final FlutterSecureStorage _secureStorage = const FlutterSecureStorage();
  
  // 생체 인증 가능 여부 확인
  Future<bool> isBiometricAvailable() async {
    final isAvailable = await _localAuth.canCheckBiometrics;
    final isDeviceSupported = await _localAuth.isDeviceSupported();
    return isAvailable && isDeviceSupported;
  }
  
  // 사용 가능한 생체 인증 타입 확인
  Future<List<BiometricType>> getAvailableBiometrics() async {
    return await _localAuth.getAvailableBiometrics();
    // [BiometricType.fingerprint, BiometricType.face, BiometricType.iris]
  }
  
  // 생체 인증 실행
  Future<bool> authenticate() async {
    try {
      return await _localAuth.authenticate(
        localizedReason: '앱에 접근하려면 생체 인증이 필요합니다',
        options: const AuthenticationOptions(
          stickyAuth: true,
          biometricOnly: false, // PIN도 허용
        ),
      );
    } catch (e) {
      return false;
    }
  }
  
  // 생체 인증 성공 후 저장된 토큰 가져오기
  Future<String?> getTokenWithBiometric() async {
    final authenticated = await authenticate();
    if (!authenticated) return null;
    
    // Keychain/Keystore에서 안전하게 토큰 읽기
    return await _secureStorage.read(key: 'refresh_token');
  }
  
  // 토큰 안전 저장 (최초 로그인 시)
  Future<void> saveTokenSecurely(String token) async {
    await _secureStorage.write(
      key: 'refresh_token',
      value: token,
      // iOS: Keychain에 저장, Android: EncryptedSharedPreferences
      iOptions: const IOSOptions(
        accessibility: KeychainAccessibility.first_unlock_this_device,
      ),
      aOptions: const AndroidOptions(
        encryptedSharedPreferences: true,
      ),
    );
  }
}

// Android - OkHttp Certificate Pinning
val client = OkHttpClient.Builder()
    .certificatePinner(
        CertificatePinner.Builder()
            .add("api.yourapp.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
            .add("api.yourapp.com", "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=") // 백업 핀
            .build()
    )
    .build()

// iOS - URLSession Certificate Pinning
class PinnedURLSessionDelegate: NSObject, URLSessionDelegate {
    func urlSession(_ session: URLSession, 
                    didReceive challenge: URLAuthenticationChallenge,
                    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        
        guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust,
              let serverTrust = challenge.protectionSpace.serverTrust else {
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }
        
        // 서버 인증서와 로컬 저장 인증서 비교
        let pinnedCertificates = loadPinnedCertificates()
        let serverCertificates = getServerCertificates(from: serverTrust)
        
        if pinnedCertificates.contains(where: { serverCertificates.contains($0) }) {
            completionHandler(.useCredential, URLCredential(trust: serverTrust))
        } else {
            completionHandler(.cancelAuthenticationChallenge, nil)
        }
    }
}

// Flutter - Dio HTTP 인터셉터로 자동 토큰 갱신
import 'package:dio/dio.dart';
import 'package:firebase_auth/firebase_auth.dart';

class AuthInterceptor extends Interceptor {
  final Dio _dio;
  bool _isRefreshing = false;
  final List<RequestOptions> _pendingRequests = [];
  
  AuthInterceptor(this._dio);
  
  @override
  void onRequest(RequestOptions options, RequestInterceptorHandler handler) async {
    // Firebase ID Token 자동 첨부
    final user = FirebaseAuth.instance.currentUser;
    if (user != null) {
      // forceRefresh: false → 캐시된 토큰 사용 (만료 5분 전 자동 갱신)
      final token = await user.getIdToken();
      options.headers['Authorization'] = 'Bearer $token';
    }
    handler.next(options);
  }
  
  @override
  void onError(DioException err, ErrorInterceptorHandler handler) async {
    if (err.response?.statusCode == 401) {
      if (_isRefreshing) {
        // 갱신 중이면 대기열에 추가
        _pendingRequests.add(err.requestOptions);
        return;
      }
      
      _isRefreshing = true;
      
      try {
        // Firebase 토큰 강제 갱신
        final user = FirebaseAuth.instance.currentUser;
        if (user == null) throw Exception('로그인 필요');
        
        final newToken = await user.getIdToken(true); // forceRefresh: true
        
        // 대기 중인 요청들 재시도
        for (final request in _pendingRequests) {
          request.headers['Authorization'] = 'Bearer $newToken';
          await _dio.fetch(request);
        }
        _pendingRequests.clear();
        
        // 원래 요청 재시도
        err.requestOptions.headers['Authorization'] = 'Bearer $newToken';
        final response = await _dio.fetch(err.requestOptions);
        handler.resolve(response);
        
      } catch (e) {
        // 토큰 갱신 실패 → 로그아웃 처리
        await FirebaseAuth.instance.signOut();
        handler.reject(err);
      } finally {
        _isRefreshing = false;
      }
    } else {
      handler.next(err);
    }
  }
}

// Dio 설정
final dio = Dio(BaseOptions(baseUrl: 'https://api.yourapp.com'));
dio.interceptors.add(AuthInterceptor(dio));

// iOS Swift - Apple Sign In + Firebase 연동
import AuthenticationServices
import FirebaseAuth

class AppleSignInCoordinator: NSObject, ASAuthorizationControllerDelegate {
    
    private var currentNonce: String?
    
    func startSignInWithApple() {
        let nonce = randomNonceString()
        currentNonce = nonce
        
        let appleIDProvider = ASAuthorizationAppleIDProvider()
        let request = appleIDProvider.createRequest()
        request.requestedScopes = [.fullName, .email]
        request.nonce = sha256(nonce) // nonce 해시 전달
        
        let authorizationController = ASAuthorizationController(authorizationRequests: [request])
        authorizationController.delegate = self
        authorizationController.performRequests()
    }
    
    func authorizationController(
        controller: ASAuthorizationController,
        didCompleteWithAuthorization authorization: ASAuthorization
    ) {
        guard let appleIDCredential = authorization.credential as? ASAuthorizationAppleIDCredential,
              let nonce = currentNonce,
              let appleIDToken = appleIDCredential.identityToken,
              let idTokenString = String(data: appleIDToken, encoding: .utf8) else {
            return
        }
        
        // Firebase Credential 생성
        let credential = OAuthProvider.appleCredential(
            withIDToken: idTokenString,
            rawNonce: nonce,
            fullName: appleIDCredential.fullName
        )
        
        // Firebase 로그인
        Auth.auth().signIn(with: credential) { authResult, error in
            if let error = error {
                print("Apple 로그인 실패: \(error.localizedDescription)")
                return
            }
            print("Apple 로그인 성공! UID: \(authResult?.user.uid ?? "")")
        }
    }
    
    // 랜덤 nonce 생성
    private func randomNonceString(length: Int = 32) -> String {
        let charset = Array("0123456789ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvwxyz-._")
        var result = ""
        var remainingLength = length
        while remainingLength > 0 {
            let randoms: [UInt8] = (0..<16).map { _ in
                var random: UInt8 = 0
                let errorCode = SecRandomCopyBytes(kSecRandomDefault, 1, &random)
                return errorCode == errSecSuccess ? random : 0
            }
            randoms.forEach { random in
                if remainingLength == 0 { return }
                if random < charset.count {
                    result.append(charset[Int(random)])
                    remainingLength -= 1
                }
            }
        }
        return result
    }
}