Shell 플레이어 연동 가이드

<?php
// APP_SECRET 는 앱 빌드와 같은 값. 서버에만 둔다.
const TTL = 30;
$APP_SECRET = getenv('APP_SECRET');

// 토큰 저장소는 예시로 파일/DB/redis 등 서버 공유 저장소를 쓴다 (아래는 개념용)
function store_put($token, $data) { /* redis/DB 에 TTL 로 저장 */ }
function store_take($token)       { /* 조회 후 삭제(1회용) 하여 반환, 없으면 null */ }

$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
$in   = json_decode(file_get_contents('php://input'), true) ?: [];

// ① 실행 토큰 발급
if ($path === '/api/app-launch-token') {
  header('Content-Type: application/json');
  if (empty($in['play_url'])) { http_response_code(400); echo '{"error":"missing_play_url"}'; exit; }

  $token = bin2hex(random_bytes(16));
  store_put($token, [
    'userId' => $in['user_id'] ?? 'demo',
    'url'    => $in['play_url'],
    'ip'     => $_SERVER['REMOTE_ADDR'],
    'exp'    => time() + TTL,
  ]);
  $proto   = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
  $authUrl = $proto . '://' . $_SERVER['HTTP_HOST'] . '/api/app-launch-verify';
  $q = http_build_query([
    'token'   => $token,
    'url'     => $in['play_url'],
    'authUrl' => $authUrl,
    'referer' => parse_url($in['play_url'], PHP_URL_SCHEME) . '://' . parse_url($in['play_url'], PHP_URL_HOST),
  ]);
  echo json_encode(['token' => $token, 'expiresIn' => TTL, 'launchUrl' => "starplayerapp://play?$q"]);
  exit;
}

// ② 앱 서명 검증
if ($path === '/api/app-launch-verify') {
  header('Content-Type: application/json');
  $token = $in['token'] ?? '';
  $sig   = $_SERVER['HTTP_X_APP_SIGNATURE'] ?? '';
  $ts    = $_SERVER['HTTP_X_APP_TIMESTAMP'] ?? null;      // 구버전 호환
  $target   = ($ts !== null) ? "$token:$ts" : $token;
  $expected = hash_hmac('sha256', $target, $APP_SECRET);

  if (!$sig || !hash_equals($expected, $sig)) { http_response_code(403); echo '{"error":"bad_signature"}'; exit; }

  $sess = store_take($token);
  if (!$sess)                       { http_response_code(401); echo '{"error":"invalid_token"}'; exit; }
  if (time() > $sess['exp'])        { http_response_code(401); echo '{"error":"expired"}'; exit; }
  if ($sess['ip'] !== $_SERVER['REMOTE_ADDR']) { http_response_code(401); echo '{"error":"ip_mismatch"}'; exit; }

  $host = parse_url($sess['url'], PHP_URL_HOST);
  echo json_encode([
    'user' => ['id' => $sess['userId'], 'name' => null],
    'url'  => $sess['url'],
    'auth' => ['type' => 'cookie', 'cookies' => [[
      'name' => 'STAR_SESSION', 'value' => 'sess_' . bin2hex(random_bytes(12)),
      'domain' => $host, 'path' => '/', 'secure' => true, 'httpOnly' => true,
      'sameSite' => 'lax', 'expire' => 86400,
    ]]],
  ]);
  exit;
}

// APP_SECRET 는 앱 빌드와 같은 값. 서버에만 둔다.
const int TTL = 30;
static readonly string AppSecret = Environment.GetEnvironmentVariable("APP_SECRET");
// 다중 인스턴스면 분산 캐시(Redis 등)로 교체
static readonly ConcurrentDictionary<string, (string userId, string url, string ip, long exp)> Tokens = new();

// ① 실행 토큰 발급
app.MapPost("/api/app-launch-token", (HttpContext ctx, LaunchReq req) => {
    if (string.IsNullOrEmpty(req.play_url)) return Results.BadRequest(new { error = "missing_play_url" });
    var token = Guid.NewGuid().ToString();
    var ip = ctx.Connection.RemoteIpAddress?.ToString();
    Tokens[token] = (req.user_id ?? "demo", req.play_url, ip, DateTimeOffset.UtcNow.ToUnixTimeSeconds() + TTL);
    var origin  = new Uri(req.play_url).GetLeftPart(UriPartial.Authority);
    var authUrl = $"{ctx.Request.Scheme}://{ctx.Request.Host}/api/app-launch-verify";
    var q = $"token={Uri.EscapeDataString(token)}&url={Uri.EscapeDataString(req.play_url)}" +
            $"&authUrl={Uri.EscapeDataString(authUrl)}&referer={Uri.EscapeDataString(origin)}";
    return Results.Ok(new { token, expiresIn = TTL, launchUrl = $"starplayerapp://play?{q}" });
});

// ② 앱 서명 검증
app.MapPost("/api/app-launch-verify", (HttpContext ctx, VerifyReq body) => {
    var sig = ctx.Request.Headers["X-App-Signature"].ToString();
    var ts  = ctx.Request.Headers["X-App-Timestamp"].ToString();     // 구버전 호환
    var target = string.IsNullOrEmpty(ts) ? body.token : $"{body.token}:{ts}";
    using var h = new HMACSHA256(Encoding.UTF8.GetBytes(AppSecret));
    var expected = Convert.ToHexString(h.ComputeHash(Encoding.UTF8.GetBytes(target))).ToLower();
    if (string.IsNullOrEmpty(sig) || !CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(expected), Encoding.UTF8.GetBytes(sig)))
        return Results.StatusCode(403);
    if (!Tokens.TryRemove(body.token, out var s))            return Results.StatusCode(401);  // 1회용
    if (DateTimeOffset.UtcNow.ToUnixTimeSeconds() > s.exp)   return Results.StatusCode(401);
    if (s.ip != ctx.Connection.RemoteIpAddress?.ToString()) return Results.StatusCode(401);
    var host = new Uri(s.url).Host;
    return Results.Ok(new {
        user = new { id = s.userId, name = (string)null }, url = s.url,
        auth = new { type = "cookie", cookies = new[] { new {
            name = "STAR_SESSION", value = "sess_" + Guid.NewGuid(), domain = host,
            path = "/", secure = true, httpOnly = true, sameSite = "lax", expire = 86400 } } },
    });
});
record LaunchReq(string play_url, string user_id);
record VerifyReq(string token);

# APP_SECRET 는 앱 빌드와 같은 값. 서버에만 둔다.
import os, time, uuid, hmac, hashlib
from urllib.parse import urlencode, urlparse
from flask import Flask, request, jsonify

app = Flask(__name__)
APP_SECRET = os.environ["APP_SECRET"].encode()
TTL = 30
tokens = {}   # token -> {userId,url,ip,exp}  (다중 인스턴스면 redis 등 공유 저장소)

# ① 실행 토큰 발급
@app.post("/api/app-launch-token")
def launch_token():
    body = request.get_json(silent=True) or {}
    if not body.get("play_url"):
        return jsonify(error="missing_play_url"), 400
    token = uuid.uuid4().hex
    tokens[token] = {"userId": body.get("user_id", "demo"), "url": body["play_url"],
                     "ip": request.remote_addr, "exp": time.time() + TTL}
    u = urlparse(body["play_url"])
    q = urlencode({"token": token, "url": body["play_url"],
                   "authUrl": f"{request.scheme}://{request.host}/api/app-launch-verify",
                   "referer": f"{u.scheme}://{u.netloc}"})
    return jsonify(token=token, expiresIn=TTL, launchUrl=f"starplayerapp://play?{q}")

# ② 앱 서명 검증
@app.post("/api/app-launch-verify")
def launch_verify():
    body = request.get_json(silent=True) or {}
    token = body.get("token", "")
    sig = request.headers.get("X-App-Signature", "")
    ts  = request.headers.get("X-App-Timestamp")        # 구버전 호환
    target = f"{token}:{ts}" if ts is not None else token
    expected = hmac.new(APP_SECRET, target.encode(), hashlib.sha256).hexdigest()
    if not sig or not hmac.compare_digest(expected, sig):
        return jsonify(error="bad_signature"), 403
    sess = tokens.pop(token, None)   # 1회용
    if not sess:                          return jsonify(error="invalid_token"), 401
    if time.time() > sess["exp"]:         return jsonify(error="expired"), 401
    if sess["ip"] != request.remote_addr: return jsonify(error="ip_mismatch"), 401
    host = urlparse(sess["url"]).hostname
    return jsonify(user={"id": sess["userId"], "name": None}, url=sess["url"],
                   auth={"type": "cookie", "cookies": [{"name": "STAR_SESSION",
                        "value": "sess_" + uuid.uuid4().hex, "domain": host, "path": "/",
                        "secure": True, "httpOnly": True, "sameSite": "lax", "expire": 86400}]})

// APP_SECRET 는 앱 빌드와 같은 값. 서버에만 둔다.
static final int TTL = 30;
static final String APP_SECRET = System.getenv("APP_SECRET");
// 다중 인스턴스면 Redis 등 공유 저장소로 교체
static final Map<String, String[]> TOKENS = new ConcurrentHashMap<>();  // token -> [userId,url,ip,exp]

// ① 실행 토큰 발급
@PostMapping("/api/app-launch-token")
public Map<String,Object> token(@RequestBody Map<String,String> req, HttpServletRequest http) {
    String url = req.get("play_url");
    if (url == null) throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "missing_play_url");
    String token = UUID.randomUUID().toString();
    TOKENS.put(token, new String[]{ req.getOrDefault("user_id", "demo"), url,
        http.getRemoteAddr(), String.valueOf(Instant.now().getEpochSecond() + TTL) });
    URI u = URI.create(url);
    String q = "token=" + enc(token) + "&url=" + enc(url)
        + "&authUrl=" + enc(http.getScheme() + "://" + http.getHeader("host") + "/api/app-launch-verify")
        + "&referer=" + enc(u.getScheme() + "://" + u.getAuthority());
    return Map.of("token", token, "expiresIn", TTL, "launchUrl", "starplayerapp://play?" + q);
}

// ② 앱 서명 검증
@PostMapping("/api/app-launch-verify")
public Map<String,Object> verify(@RequestBody Map<String,String> body,
        @RequestHeader(value="X-App-Signature", required=false) String sig,
        @RequestHeader(value="X-App-Timestamp", required=false) String ts,   // 구버전 호환
        HttpServletRequest http) throws Exception {
    String token = body.getOrDefault("token", "");
    String target = (ts != null) ? token + ":" + ts : token;
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(APP_SECRET.getBytes(), "HmacSHA256"));
    String expected = HexFormat.of().formatHex(mac.doFinal(target.getBytes()));
    if (sig == null || !MessageDigest.isEqual(expected.getBytes(), sig.getBytes()))
        throw new ResponseStatusException(HttpStatus.FORBIDDEN);
    String[] s = TOKENS.remove(token);   // 1회용
    if (s == null) throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
    if (Instant.now().getEpochSecond() > Long.parseLong(s[3])) throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
    if (!s[2].equals(http.getRemoteAddr())) throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
    String host = URI.create(s[1]).getHost();
    return Map.of("user", Map.of("id", s[0]), "url", s[1],
        "auth", Map.of("type", "cookie", "cookies", List.of(Map.of(
            "name", "STAR_SESSION", "value", "sess_" + UUID.randomUUID(), "domain", host,
            "path", "/", "secure", true, "httpOnly", true, "sameSite", "lax", "expire", 86400))));
}
static String enc(String v) { return URLEncoder.encode(v, StandardCharsets.UTF_8); }