pushpasskey:
  api-key: ${PUSHPASSKEY_API_KEY}
  test-mode: ${PUSHPASSKEY_TEST_MODE:true}
  test-user-key: ${PUSHPASSKEY_TEST_USER_KEY:test-user-001}
  request-timeout-seconds: ${PUSHPASSKEY_REQUEST_TIMEOUT_SECONDS:15}

server:
  servlet:
    session:
      timeout: 30m
      cookie:
        http-only: true
        secure: true
        same-site: lax

package com.example.pushpasskey;

import java.net.URI;
import java.time.Duration;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.Map;

import com.fasterxml.jackson.core.type.TypeReference;
import com.fasterxml.jackson.databind.ObjectMapper;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpSession;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpStatusCode;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.http.client.JdkClientHttpRequestFactory;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.client.RestClient;

@RestController
@RequestMapping("/pushpasskey")
public class PushPasskeyController {
    private static final Logger log = LoggerFactory.getLogger(
        PushPasskeyController.class
    );
    private static final String API_BASE = "https://auth.jintec.com";

    private final String apiKey;
    private final boolean testMode;
    private final String testUserKey;
    private final RestClient restClient;
    private final ObjectMapper objectMapper;

    public PushPasskeyController(
        @Value("${pushpasskey.api-key}") String apiKey,
        @Value("${pushpasskey.test-mode:true}") boolean testMode,
        @Value("${pushpasskey.test-user-key:test-user-001}") String testUserKey,
        @Value("${pushpasskey.request-timeout-seconds:15}") long timeoutSeconds,
        ObjectMapper objectMapper
    ) {
        this.apiKey = apiKey.trim();
        this.testMode = testMode;
        this.testUserKey = testUserKey.trim();
        this.objectMapper = objectMapper;

        JdkClientHttpRequestFactory factory = new JdkClientHttpRequestFactory();
        factory.setReadTimeout(Duration.ofSeconds(timeoutSeconds));
        this.restClient = RestClient.builder()
            .requestFactory(factory)
            .baseUrl(API_BASE)
            .build();
    }

    @GetMapping("/status")
    public Map<String, Object> status(HttpSession session) {
        return Map.of(
            "ok", true,
            "authenticated_user_key",
            stringValue(session.getAttribute("authenticated_user_key"))
        );
    }

    @PostMapping(
        value = "/endpoint",
        consumes = MediaType.APPLICATION_JSON_VALUE,
        produces = MediaType.APPLICATION_JSON_VALUE
    )
    public ResponseEntity<Map<String, Object>> endpoint(
        @RequestBody Map<String, Object> body,
        HttpServletRequest request,
        HttpSession session
    ) {
        try {
            verifySameOrigin(request);
            String action = stringValue(body.get("action"));

            return switch (action) {
                case "regist_start" -> registStart(body, request, session);
                case "auth_start" -> authStart(body, request, session);
                case "regist_result" -> registResult(body, session);
                case "auth_result" -> authResult(body, session);
                default -> jsonError(400, "処理の指定が正しくありません。");
            };
        } catch (IllegalArgumentException e) {
            return jsonError(400, e.getMessage());
        } catch (SecurityException e) {
            return jsonError(403, e.getMessage());
        } catch (Exception e) {
            log.error("Push! Passkey endpoint error", e);
            return jsonError(500, "Push! Passkeyの処理を完了できませんでした。");
        }
    }

    // 本番接続時に変更する箇所1
    private String getLoggedInUserKey(HttpSession session) {
        if (testMode) {
            return testUserKey;
        }
        Object userId = session.getAttribute("user_id");
        return userId == null ? "" : String.valueOf(userId).trim();
    }

    // 本番接続時に変更する箇所2
    private void afterRegistSuccess(
        Map<String, Object> result,
        HttpSession session
    ) {
        session.setAttribute("passkey_message", "パスキーの登録が完了しました。");
    }

    // 本番接続時に変更する箇所3
    private void afterAuthSuccess(
        Map<String, Object> result,
        HttpServletRequest request
    ) {
        String userKey = stringValue(result.get("user_key"));
        if (userKey.isBlank()) {
            throw new IllegalStateException("認証ユーザーを確認できません。");
        }

        HttpSession oldSession = request.getSession(false);
        if (oldSession != null) {
            oldSession.invalidate();
        }
        HttpSession newSession = request.getSession(true);
        newSession.setAttribute("authenticated_user_key", userKey);
    }

    private ResponseEntity<Map<String, Object>> registStart(
        Map<String, Object> body,
        HttpServletRequest request,
        HttpSession session
    ) {
        String userKey = getLoggedInUserKey(session);
        if (userKey.isBlank()) {
            return jsonError(401, "ログイン状態を確認できません。");
        }

        Map<String, Object> result = callApi("/regist_url", Map.of(
            "api_key", apiKey,
            "user_key", userKey,
            "return_page_url", returnPageUrl(body, request)
        ));
        savePending(result, "regist", userKey, session);
        return ResponseEntity.ok(result);
    }

    private ResponseEntity<Map<String, Object>> authStart(
        Map<String, Object> body,
        HttpServletRequest request,
        HttpSession session
    ) {
        Map<String, Object> result = callApi("/auth_url", Map.of(
            "api_key", apiKey,
            "return_page_url", returnPageUrl(body, request)
        ));
        savePending(result, "auth", "", session);
        return ResponseEntity.ok(result);
    }

    private ResponseEntity<Map<String, Object>> registResult(
        Map<String, Object> body,
        HttpSession session
    ) {
        String requestId = requiredRequestId(body);
        Map<String, String> pending = pending(requestId, "regist", session);
        Map<String, Object> result = callApi("/regist_result", Map.of(
            "api_key", apiKey,
            "request_id", requestId
        ));

        if (booleanValue(result.get("is_success"))) {
            if (!stringValue(result.get("user_key")).equals(pending.get("user_key"))) {
                throw new IllegalStateException("登録ユーザーが一致しません。");
            }
            afterRegistSuccess(result, session);
        }
        if (booleanValue(result.get("is_completed"))) {
            clearPending(requestId, session);
        }
        return ResponseEntity.ok(result);
    }

    private ResponseEntity<Map<String, Object>> authResult(
        Map<String, Object> body,
        HttpServletRequest request,
        HttpSession session
    ) {
        String requestId = requiredRequestId(body);
        pending(requestId, "auth", session);
        Map<String, Object> result = callApi("/auth_result", Map.of(
            "api_key", apiKey,
            "request_id", requestId
        ));

        String status = stringValue(result.get("status")).toLowerCase();
        boolean success = booleanValue(result.get("is_success"))
            || "success".equals(status);
        boolean completed = booleanValue(result.get("is_completed"))
            || java.util.Set.of("success", "failed", "expired", "cancelled")
                .contains(status);

        if (success) {
            clearPending(requestId, session);
            afterAuthSuccess(result, request);
        } else if (completed) {
            clearPending(requestId, session);
        }
        return ResponseEntity.ok(result);
    }

    private Map<String, Object> callApi(String path, Map<String, Object> payload) {
        if (apiKey.isBlank()) {
            throw new IllegalStateException("Push! Passkeyの設定を確認してください。");
        }

        ResponseEntity<String> response = restClient.post()
            .uri(path)
            .contentType(MediaType.APPLICATION_JSON)
            .accept(MediaType.APPLICATION_JSON)
            .body(payload)
            .retrieve()
            .onStatus(HttpStatusCode::isError, (req, res) -> { })
            .toEntity(String.class);

        try {
            Map<String, Object> result = objectMapper.readValue(
                response.getBody(), new TypeReference<>() { }
            );
            if (!response.getStatusCode().is2xxSuccessful()) {
                result.put("ok", false);
            }
            return result;
        } catch (Exception e) {
            throw new IllegalStateException(
                "Push! PasskeyからJSON以外の応答が返されました。", e
            );
        }
    }

    @SuppressWarnings("unchecked")
    private void savePending(
        Map<String, Object> result,
        String kind,
        String userKey,
        HttpSession session
    ) {
        String requestId = stringValue(result.get("request_id"));
        if (!booleanValue(result.get("ok")) || requestId.isBlank()) {
            return;
        }
        Map<String, Map<String, String>> requests = (Map<String, Map<String, String>>)
            session.getAttribute("pushpasskey_requests");
        requests = requests == null ? new HashMap<>() : new HashMap<>(requests);
        requests.put(requestId, Map.of("kind", kind, "user_key", userKey));
        session.setAttribute("pushpasskey_requests", requests);
    }

    @SuppressWarnings("unchecked")
    private Map<String, String> pending(
        String requestId,
        String kind,
        HttpSession session
    ) {
        Map<String, Map<String, String>> requests = (Map<String, Map<String, String>>)
            session.getAttribute("pushpasskey_requests");
        Map<String, String> value = requests == null ? null : requests.get(requestId);
        if (value == null || !kind.equals(value.get("kind"))) {
            throw new IllegalArgumentException(
                "処理情報を確認できません。最初からやり直してください。"
            );
        }
        return value;
    }

    @SuppressWarnings("unchecked")
    private void clearPending(String requestId, HttpSession session) {
        Map<String, Map<String, String>> requests = (Map<String, Map<String, String>>)
            session.getAttribute("pushpasskey_requests");
        if (requests != null) {
            Map<String, Map<String, String>> copy = new HashMap<>(requests);
            copy.remove(requestId);
            session.setAttribute("pushpasskey_requests", copy);
        }
    }

    private String requiredRequestId(Map<String, Object> body) {
        String value = stringValue(body.get("request_id"));
        if (value.isBlank()) {
            throw new IllegalArgumentException("処理情報を確認できません。");
        }
        return value;
    }

    private String returnPageUrl(
        Map<String, Object> body,
        HttpServletRequest request
    ) {
        String value = stringValue(body.get("return_page_url"));
        try {
            URI uri = URI.create(value);
            return request.getServerName().equalsIgnoreCase(uri.getHost())
                ? value : "";
        } catch (Exception e) {
            return "";
        }
    }

    private void verifySameOrigin(HttpServletRequest request) {
        String origin = request.getHeader("Origin");
        if (origin == null || origin.isBlank()) {
            return;
        }
        URI uri = URI.create(origin);
        if (!request.getServerName().equalsIgnoreCase(uri.getHost())) {
            throw new SecurityException("このページからは処理を開始できません。");
        }
    }

    private static String stringValue(Object value) {
        return value == null ? "" : String.valueOf(value).trim();
    }

    private static boolean booleanValue(Object value) {
        return Boolean.TRUE.equals(value) || "true".equalsIgnoreCase(stringValue(value));
    }

    private ResponseEntity<Map<String, Object>> jsonError(
        int status,
        String message
    ) {
        Map<String, Object> body = new LinkedHashMap<>();
        body.put("ok", false);
        body.put("message", message);
        return ResponseEntity.status(status).body(body);
    }
}

package com.example.pushpasskey;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {
    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers(
                    "/pushpasskey/endpoint",
                    "/pushpasskey/status",
                    "/pushpasskey-test.html"
                ).permitAll()
                .anyRequest().permitAll()
            )
            .csrf(csrf -> csrf
                .ignoringRequestMatchers("/pushpasskey/endpoint")
            );
        return http.build();
    }
}

<!doctype html>
<html lang="ja">
<head>
  <meta charset="utf-8">
  <title>Push! Passkey Javaテスト</title>
</head>
<body>
  <h1>Push! Passkey Javaテスト</h1>
  <p id="pushpasskey-message"></p>

  <button type="button"
    data-pushpasskey="regist"
    data-endpoint="/pushpasskey/endpoint"
    data-success-url="/pushpasskey-test.html">
    パスキー登録
  </button>

  <button type="button"
    data-pushpasskey="auth"
    data-endpoint="/pushpasskey/endpoint"
    data-success-url="/pushpasskey-test.html">
    パスキー認証
  </button>

  <pre id="status"></pre>
  <script src="https://auth.jintec.com/js/passkey.js"></script>
  <script>
    fetch('/pushpasskey/status')
      .then(response => response.json())
      .then(data => {
        document.getElementById('status').textContent =
          data.authenticated_user_key
            ? '認証したuser_key：' + data.authenticated_user_key
            : '認証したuser_keyはまだありません。';
      });
  </script>
</body>
</html>