from fastapi import FastAPI, Form, HTTPException
from fastapi.responses import RedirectResponse, HTMLResponse
import psycopg2
from psycopg2.extras import RealDictCursor
import jwt
import time
import hashlib

app = FastAPI()

# 用來暫存 Keycloak 每次登入帶過來的 nonce 安全檢查隨機字串
nonce_cache = {}

# PostgreSQL 資料庫連接設定
def get_db_connection():
    return psycopg2.connect(
        host="localhost",
        database="your_existing_db",
        user="postgres",
        password="your_password",
        cursor_factory=RealDictCursor
    )

# 1. OIDC Discovery 自動配置端點：讓 Keycloak 自動爬取此代理的所有 OIDC 端點
@app.get("/.well-known/openid-configuration")
def openid_configuration():
    # 這裡的 Issuer 必須對齊 horacenas.local.com
    base_url = "http://horacenas.local.com:8001"
    return {
        "issuer": base_url,
        "authorization_endpoint": f"{base_url}/authorize",
        "token_endpoint": f"{base_url}/token",
        "userinfo_endpoint": f"{base_url}/userinfo",
        "response_types_supported": ["code"],
        "subject_types_supported": ["public"],
        "id_token_signing_alg_values_supported": ["HS256"]
    }

# 2. 登入表單頁面：接收 Keycloak 帶來的 nonce 安全字串並在表單中隱藏傳遞
@app.get("/authorize")
def authorize(redirect_uri: str, state: str, nonce: str = None):
    return HTMLResponse(content=f"""
        

            
會員系統資料庫登入驗證
            

                
帳號: 
                
密碼: 
                
                
                
                確認認證
            
        
    """)

# 3. 驗證資料庫帳密：採用原生 hashlib 排除 python 3.14 passlib 相容衝突
@app.post("/login_check")
def login_check(username: str = Form(...), password: str = Form(...), redirect_uri: str = Form(...), state: str = Form(...), nonce: str = Form(None)):
    conn = get_db_connection()
    cursor = conn.cursor()
    cursor.execute("SELECT username, pw FROM users WHERE username = %s", (username,))
    user = cursor.fetchone()
    cursor.close()
    conn.close()
    
    if not user:
        raise HTTPException(status_code=401, detail="找不到該使用者")
        
    # 計算 SHA-256 十六進位值 (對齊資料庫內存格式)
    calculated_sha256 = hashlib.sha256(password.encode('utf-8')).hexdigest()
    
    if calculated_sha256 != user["pw"]:
        raise HTTPException(status_code=401, detail="PostgreSQL 驗證失敗：密碼錯誤")
        
    # 驗證成功，暫存該用戶這次登入專屬的 nonce
    if nonce:
        nonce_cache[username] = nonce
        
    # 轉導回 Keycloak callback
    return RedirectResponse(url=f"{redirect_uri}?code={username}&state={state}", status_code=303)

# 4. Token 交換端點：簽發真正合規、帶有 nonce 且 issuer 與金鑰長度安全的 JWT
@app.post("/token")
def token_endpoint(code: str = Form(...)):
    now = int(time.time())
    
    # 消除 HS256 長度警告，密鑰長度補齊到 32 欄位以上
    JWT_SECRET = "MY_STATIC_SHARED_SECRET_123456_ABCDE"
    
    user_nonce = nonce_cache.pop(code, None)
    
    id_token_payload = {
        "iss": "http://horacenas.local.com:8001",       # 👈 與 Discovery Issuer 完全一致
        "sub": str(code),
        "aud": "keycloak-bridge",                      # 與 Keycloak 中自訂 IdP 的 Client ID 一致
        "exp": now + 3600,
        "iat": now,
        "auth_time": now,
        "name": str(code),
        "preferred_username": str(code),
        "email": f"{code}@example.com",
        "email_verified": True
    }
    
    if user_nonce:
        id_token_payload["nonce"] = user_nonce          # 👈 核心安全修正：帶回 Nonce 避免 Replay 驗證錯誤
        
    real_jwt_id_token = jwt.encode(id_token_payload, JWT_SECRET, algorithm="HS256")
    
    return {
        "access_token": str(code),
        "id_token": real_jwt_id_token,
        "token_type": "Bearer",
        "expires_in": 3600
    }

@app.get("/userinfo")
def userinfo(authorization: str = None):
    # 此處保留防止 Keycloak 仍然呼叫，我們從 Bearer 解析用戶並動態回傳
    username = "test01"
    if authorization and "Bearer " in authorization:
        username = authorization.split("Bearer ")[1]
    return {
        "sub": str(username),
        "name": str(username),
        "preferred_username": str(username),
        "email": f"{username}@example.com",
        "email_verified": True
    }

from flask import Flask, redirect, url_for, session, jsonify
from authlib.integrations.flask_client import OAuth

app = Flask(__name__)
app.secret_key = 'FLASK_MAIN_APP_SECRET_KEY_Demo'

oauth = OAuth(app)

# OIDC Discovery 設定網址：讓 Flask 自動向 Keycloak 爬取認證端點
CONF_URL = "http://horacenas.local.com:8080/realms/demo-realm/.well-known/openid-configuration"

oauth.register(
    name='keycloak',
    client_id='python-app',
    # ⚠️ 這裡的 client_secret 必須跟 Keycloak -> Clients -> python-app -> Credentials 中的 Secret 一模一樣
    client_secret='請貼上在步驟三-2複製的_python-app_Client_Secret',
    server_metadata_url=CONF_URL,
    client_kwargs={'scope': 'openid profile email'}
)

@app.route('/')
def homepage():
    user = session.get('user')
    if user:
        return f'''
            

                
🎉 OIDC SSO 登入成功！
                
目前登入帳號: {user.get("preferred_username") or user.get("name")}
                
登入信箱: {user.get("email")}
                
JWT 解析詳細資訊:
                
{jsonify(user).data.decode('utf-8')}
                登出此 Session
            
        '''
    return '''
        

            
Python OIDC 整合環境
            
這個 Demo 應用串接了 Keycloak 單一登入體系
            使用 SSO 整合驗證
        
    '''

@app.route('/login')
def login():
    # 轉導到 Keycloak 的認證管道
    redirect_uri = url_for('auth', _external=True)
    return oauth.keycloak.authorize_redirect(redirect_uri)

@app.route('/auth')
def auth():
    # 接收 Keycloak 回傳的 Code，並用 Client Secret 換取完整的 ID Token
    token = oauth.keycloak.authorize_access_token()
    userinfo = token.get('userinfo')
    if userinfo:
        session['user'] = userinfo
    return redirect('/')

@app.route('/logout')
def logout():
    session.pop('user', None)
    return redirect('/')

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000, debug=True)