自有网站与第三方订单系统授权

AstroBox 客户端 (已登录用户 A)
       │
       ▼ 1. 请求解密挑战 (携带用户 A 的官方认证 Session Token)
AstroBox 官方服务器
       │  (服务端提取 Session 里的真正用户 ID，生成 Challenge，并用官方私钥签名)
       ▼ 2. 下发带平台 RS256 签名的 Challenge 凭证 (其中 sub = 用户 A)
AstroBox 客户端
       │
       ▼ 3. 将 Challenge 原封不动转发给创作者授权接口
创作者授权服务器
       │  (使用 AstroBox 官方公钥验签 -> 确认 sub 真实无篡改 -> 查询本地订单确认已付款)
       ▼ 4. 用创作者自己的 RSA 私钥签发 Grant 凭证
AstroBox 客户端
       │
       ▼ 5. 将 Grant 提交给 AstroBox 官方服务器
AstroBox 官方服务器
       │  (使用创作者登记的公钥验签 Grant -> 原子消费挑战防重放 -> 下发 AES 解密密钥)
AstroBox 客户端 (成功解密并推送到手表)

# 生成 3072 位 RSA 私钥（保留在服务器，严禁上传！）
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out creator-private.pem

# 导出 RSA 公钥（稍后填写到 CreatorConsole）
openssl pkey -in creator-private.pem -pubout -out creator-public.pem

import crypto from "crypto";
import fs from "fs";

// 1. 配置参数
const PLATFORM_ISSUER = "https://astrobox-api.astralsight.space";
const PLATFORM_KEY_URL = `${PLATFORM_ISSUER}/resource/external_authorization/platform_key`;
const CHALLENGE_TYP = "astrobox-external-challenge+jwt";
const GRANT_TYP = "astrobox-external-grant+jwt";

const ISSUER = process.env.CREATOR_ISSUER ?? "https://shop.example.com";
const PRIVATE_KEY_PEM = fs.readFileSync(process.env.CREATOR_PRIVATE_KEY_PATH ?? "./creator-private.pem", "utf8");
const privateKey = crypto.createPrivateKey(PRIVATE_KEY_PEM);

// 计算创作者公钥的 KID（SPKI DER 的 SHA-256 Base64URL）
const creatorPublicKey = crypto.createPublicKey(privateKey);
const creatorKid = crypto
  .createHash("sha256")
  .update(creatorPublicKey.export({ type: "spki", format: "der" }))
  .digest("base64url");

// 2. 缓存 AstroBox 平台公钥
let cachedPlatformKey: { kid: string; key: crypto.KeyObject } | null = null;
async function getPlatformKey() {
  if (cachedPlatformKey) return cachedPlatformKey;
  const res = await fetch(PLATFORM_KEY_URL);
  const data = (await res.json()) as { kid: string; publicKey: string; issuer: string };
  if (data.issuer !== PLATFORM_ISSUER) throw new Error("Invalid platform issuer");
  cachedPlatformKey = { kid: data.kid, key: crypto.createPublicKey(data.publicKey) };
  return cachedPlatformKey;
}

function base64UrlDecode(str: string) {
  return JSON.parse(Buffer.from(str, "base64url").toString("utf8"));
}

// 3. 校验平台发来的 Challenge
async function verifyChallenge(token: string) {
  if (typeof token !== "string" || token.length > 8192) return null;
  const parts = token.split(".");
  if (parts.length !== 3) return null;
  const [h, p, s] = parts;

  let header: any;
  try {
    header = base64UrlDecode(h);
  } catch {
    return null;
  }

  const platform = await getPlatformKey();
  if (header.alg !== "RS256" || header.typ !== CHALLENGE_TYP || header.kid !== platform.kid) {
    return null;
  }

  // 验证签名
  const isValid = crypto.verify("sha256", Buffer.from(`${h}.${p}`), platform.key, Buffer.from(s, "base64url"));
  if (!isValid) return null;

  const claims = base64UrlDecode(p);
  const now = Math.floor(Date.now() / 1000);
  if (claims.v !== 1 || claims.iss !== PLATFORM_ISSUER || claims.aud !== ISSUER) return null;
  if (typeof claims.exp !== "number" || claims.exp <= now) return null;

  return claims;
}

// 4. 签署创作者 Grant
function signGrant(claims: any) {
  const now = Math.floor(Date.now() / 1000);
  const header = { alg: "RS256", typ: GRANT_TYP, kid: creatorKid };
  const payload = {
    v: 1,
    iss: ISSUER,
    aud: claims.iss,
    sub: claims.sub,
    sellerUserId: claims.sellerUserId,
    resourceId: claims.resourceId,
    deviceId: claims.deviceId,
    fileHash: claims.fileHash,
    jti: claims.jti,
    nonce: claims.nonce,
    rev: claims.rev,
    iat: now,
    exp: Math.min(now + 60, claims.exp),
  };

  const tokenContent = `${Buffer.from(JSON.stringify(header)).toString("base64url")}.${Buffer.from(
    JSON.stringify(payload)
  ).toString("base64url")}`;
  const signature = crypto.sign("sha256", Buffer.from(tokenContent), privateKey).toString("base64url");
  return `${tokenContent}.${signature}`;
}

// 5. 替换为你自己的订单查询函数
async function findPaidOrder(astroboxUserId: string, resourceId: string, deviceId: string): Promise<boolean> {
  // TODO: 连接你的商城数据库：
  // SELECT 1 FROM orders WHERE user_id = $1 AND product_id = $2 AND status = 'PAID' AND refunded = false;
  console.log(`[Order Check] User: ${astroboxUserId}, Resource: ${resourceId}, Device: ${deviceId}`);
  return true; // 示例仅供演示，生产环境请务必严格核单！
}

// 6. 统一处理授权请求
export async function handleAuthorizationEndpoint(req: Request): Promise<Response> {
  const corsHeaders = {
    "Access-Control-Allow-Origin": "*",
    "Access-Control-Allow-Methods": "POST, OPTIONS",
    "Access-Control-Allow-Headers": "Content-Type",
    "Cache-Control": "no-store",
  };

  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: corsHeaders });
  if (req.method !== "POST") return new Response(null, { status: 405, headers: corsHeaders });

  try {
    const body = await req.json();
    if (body?.protocol !== "astrobox-external-auth-v1") {
      return Response.json({ error: "bad_request" }, { status: 400, headers: corsHeaders });
    }

    const claims = await verifyChallenge(body.challenge);
    if (!claims) {
      return Response.json({ error: "invalid_challenge" }, { status: 400, headers: corsHeaders });
    }

    const hasPaid = await findPaidOrder(claims.sub, claims.resourceId, claims.deviceId);
    if (!hasPaid) {
      return Response.json({ error: "denied" }, { status: 403, headers: corsHeaders });
    }

    const grant = signGrant(claims);
    return Response.json({ grant }, { headers: corsHeaders });
  } catch (err) {
    return Response.json({ error: "server_error" }, { status: 500, headers: corsHeaders });
  }
}