Update app/oauth_proxy/routes.py

app/oauth_proxy/routes.py

@@ -3,11 +3,6 @@ GPTs OAuth Proxy Routes
 =======================
 
 GPTs Actions OAuth 플로우를 Seats.aero OAuth로 프록시
-
-플로우:
-1. GPTs -> /oauth2/authorize -> Seats.aero consent
-2. Seats.aero -> /oauth2/callback -> GPTs callback  
-3. GPTs -> /oauth2/token -> Seats.aero token (프록시)
 """
 
 import logging
@@ -35,6 +30,7 @@ from .config import (
 logger = logging.getLogger("seats-proxy.oauth-proxy")
 
 # State 저장소 (메모리 기반)
+# 구조: {proxy_state: {gpts_redirect_uri, gpts_state, seats_state, created_at}}
 _state_store: Dict[str, dict] = {}
 STATE_TTL = 600  # 10분
 MAX_STATES = 1000
@@ -69,12 +65,22 @@ def _create_proxy_state(gpts_redirect_uri: str, gpts_state: str) -> str:
     return proxy_state
 
 
-def _get_and_consume_state(proxy_state: str) -> Optional[dict]:
+def _get_state_data(proxy_state: str) -> Optional[dict]:
+    """State 조회 (삭제하지 않음 - 토큰 교환에도 필요)"""
+    _cleanup_expired_states()
+    return _state_store.get(proxy_state)
+
+
+def _consume_state(proxy_state: str) -> Optional[dict]:
     """State 조회 및 삭제 (일회용)"""
     _cleanup_expired_states()
     return _state_store.pop(proxy_state, None)
 
 
+# Authorization code와 state 매핑 저장 (토큰 교환 시 state 찾기용)
+_code_to_state: Dict[str, str] = {}
+
+
 async def oauth2_authorize(request: Request):
     """GPTs OAuth 시작점"""
     if not is_configured():
@@ -150,7 +156,7 @@ async def oauth2_callback(request: Request):
     if error:
         logger.error(f"OAuth error from Seats.aero: {error} - {error_description}")
         if proxy_state:
-            state_data = _get_and_consume_state(proxy_state)
+            state_data = _consume_state(proxy_state)
             if state_data:
                 error_params = urlencode({
                     "error": error,
@@ -169,18 +175,21 @@ async def oauth2_callback(request: Request):
     if not proxy_state:
         return _error_html_response("missing_state", "State parameter not provided")
     
-    state_data = _get_and_consume_state(proxy_state)
+    state_data = _get_state_data(proxy_state)
     if not state_data:
         logger.warning(f"Invalid or expired proxy_state")
         return _error_html_response("invalid_state", "State expired or invalid")
     
+    # code와 proxy_state 매핑 저장 (토큰 교환 시 사용)
+    _code_to_state[code] = proxy_state
+    
     gpts_redirect_uri = state_data["gpts_redirect_uri"]
     gpts_state = state_data["gpts_state"]
     
     redirect_params = urlencode({"code": code, "state": gpts_state})
     redirect_url = f"{gpts_redirect_uri}?{redirect_params}"
     
-    logger.info(f"Redirecting to GPTs callback")
+    logger.info(f"Redirecting to GPTs callback, code mapped to proxy_state")
     return RedirectResponse(redirect_url, status_code=302)
 
 
@@ -197,14 +206,12 @@ async def oauth2_token(request: Request) -> JSONResponse:
     content_type = request.headers.get("content-type", "")
     
     logger.info(f"Token request: content-type={content_type}")
-    logger.debug(f"Token request body: {body_bytes[:500]}")
     
     # 파싱 시도
     data = {}
     
     try:
         if "application/x-www-form-urlencoded" in content_type:
-            # Form 데이터 파싱
             body_str = body_bytes.decode("utf-8")
             parsed = parse_qs(body_str)
             data = {k: v[0] if len(v) == 1 else v for k, v in parsed.items()}
@@ -214,7 +221,6 @@ async def oauth2_token(request: Request) -> JSONResponse:
             data = json.loads(body_bytes)
             logger.info(f"Parsed as JSON: {list(data.keys())}")
         else:
-            # 둘 다 시도
             body_str = body_bytes.decode("utf-8")
             try:
                 import json
@@ -231,14 +237,13 @@ async def oauth2_token(request: Request) -> JSONResponse:
             "error_description": f"Could not parse request body: {str(e)}"
         }, status_code=400)
     
-    # 파라미터 추출
     grant_type = data.get("grant_type")
     client_id = data.get("client_id")
     client_secret = data.get("client_secret")
     
     logger.info(f"Token params: grant_type={grant_type}, client_id={client_id}")
     
-    # 클라이언트 인증 - client_id 검증
+    # 클라이언트 인증
     if client_id and client_id != PROXY_CLIENT_ID:
         logger.warning(f"Invalid client_id: {client_id}")
         return JSONResponse({
@@ -246,7 +251,6 @@ async def oauth2_token(request: Request) -> JSONResponse:
             "error_description": "Unknown client_id"
         }, status_code=401)
     
-    # 클라이언트 인증 - client_secret 검증
     if client_secret and client_secret != PROXY_CLIENT_SECRET:
         logger.warning("Invalid client_secret")
         return JSONResponse({
@@ -254,7 +258,6 @@ async def oauth2_token(request: Request) -> JSONResponse:
             "error_description": "Invalid client_secret"
         }, status_code=401)
     
-    # grant_type 검증
     if not grant_type:
         return JSONResponse({
             "error": "invalid_request",
@@ -276,14 +279,24 @@ async def oauth2_token(request: Request) -> JSONResponse:
                 "error_description": "code is required"
             }, status_code=400)
         
+        # code에서 proxy_state 찾기
+        proxy_state = _code_to_state.pop(code, None)
+        if not proxy_state:
+            logger.warning(f"No proxy_state found for code")
+            # proxy_state 없이도 시도해봄
+            proxy_state = ""
+        
+        # state_data에서 정보 가져오기 (있으면)
+        if proxy_state:
+            state_data = _consume_state(proxy_state)
+            logger.info(f"Found state_data for token exchange")
+        
         seats_data["code"] = code
         seats_data["redirect_uri"] = PROXY_CALLBACK_URL
+        seats_data["state"] = proxy_state  # Seats.aero에 보냈던 원래 state
         seats_data["scope"] = "openid"
         
-        # state가 있으면 전달
-        state = data.get("state")
-        if state:
-            seats_data["state"] = state
+        logger.info(f"Token exchange: code={code[:20]}..., state={proxy_state[:10] if proxy_state else 'none'}...")
             
     elif grant_type == "refresh_token":
         refresh_token = data.get("refresh_token")
@@ -301,8 +314,8 @@ async def oauth2_token(request: Request) -> JSONResponse:
             "error_description": f"grant_type '{grant_type}' is not supported"
         }, status_code=400)
     
-    logger.info(f"Calling Seats.aero token endpoint with grant_type={grant_type}")
-    logger.debug(f"Seats.aero request data keys: {list(seats_data.keys())}")
+    logger.info(f"Calling Seats.aero token endpoint")
+    logger.debug(f"Seats.aero request: {seats_data}")
     
     # Seats.aero 토큰 엔드포인트 호출
     async with httpx.AsyncClient(timeout=30) as client:
@@ -314,6 +327,7 @@ async def oauth2_token(request: Request) -> JSONResponse:
             )
             
             logger.info(f"Seats.aero response: {response.status_code}")
+            logger.debug(f"Seats.aero response body: {response.text[:500]}")
             
             if response.status_code != 200:
                 logger.error(f"Seats.aero token error: {response.status_code} - {response.text[:500]}")