Django 소셜로그인(oauth) apple 연동

$ pip install django

# restframework
$ pip install djangorestframework
$ pip install djangorestframework-simplejwt

# pyjwt[crypto]
$ pip install pyjwt[crypto]

import os

APPLE_CONFIG = {
    "APPLE_TEAM_ID": TEAM_ID,
    "APPLE_CLIENT_ID": 모바일 로그인시 Bundle ID or 웹 로그인시 Service ID,
    "APPLE_REDIRECT_URI": "https://domain/REDIRECT_URI",
    "APPLE_KEY_ID": KEY_ID,
    "APPLE_KEY_PATH": "./AuthKey_KEY_ID.p8",
    "APPLE_PRIVATE_KEY": "",
}

apple_key_path = os.path.join(CONFIG_BASE_DIR, f"./{APPLE_CONFIG['APPLE_KEY_PATH']}")
with open(apple_key_path, 'r') as apple_key_file:
    APPLE_CONFIG['APPLE_PRIVATE_KEY'] = apple_key_file.read()

apple_base_url = "https://appleid.apple.com"
apple_auth_url = f"{apple_base_url}/auth/authorize"
apple_token_url = f"{apple_base_url}/auth/token"

class AppleLoginView(APIView):
    permission_classes = (AllowAny,)
    authentication_classes = ()

    def get(self, reqeust):
        '''
        apple code 요청
        '''
        client_id = APPLE_CONFIG['APPLE_CLIENT_ID']
        redirect_uri = APPLE_CONFIG['APPLE_REDIRECT_URI']

        uri = f"{apple_auth_url}?client_id={client_id}&&redirect_uri={redirect_uri}&response_type=code"

        res = redirect(uri)
        return res

class AppleCallbackView(APIView):
    def get_key_and_secret(self):
        '''
        CLIENT_SECRET 생성       
        '''
        headers = {
            'alg': 'ES256',
            'kid': APPLE_CONFIG['APPLE_KEY_ID'],
        }

        payload = {
            'iss': APPLE_CONFIG['APPLE_TEAM_ID'],
            'iat': time.time(),
            'exp': time.time() + 600,  # 인증유효기간 10분
            'aud': apple_base_url,
            'sub': APPLE_CONFIG['APPLE_CLIENT_ID'],
        }

        client_secret = jwt.encode(
            payload=payload, 
            key=APPLE_CONFIG['APPLE_PRIVATE_KEY'], 
            algorithm='ES256', 
            headers=headers
        )

        return client_secret

    def get(self, request):
        '''
        apple id_token 요청 및 user_info 조회
        '''
        data = request.query_params.copy()
        code = data.get('code')
        # id_token 서명을 에러로 인해 검증할 수 없어 자체 발급한 id_token 사용

        # CLIENT_SECRET 생성
        client_secret = self.get_key_and_secret()

        headers = {'Content-type': "application/x-www-form-urlencoded"}
        request_data = {
            'client_id': APPLE_CONFIG['APPLE_CLIENT_ID'],
            'client_secret': client_secret,
            'code': code,
            'grant_type': 'authorization_code',
            'redirect_uri': APPLE_CONFIG['APPLE_REDIRECT_URI'],
        }

        # client_secret 유효성 검사
        res = requests.post(apple_token_url, data=request_data, headers=headers)
        response_json = res.json()
        id_token = response_json.get('id_token')
        if not id_token:
            return Response(status=status.HTTP_400_BAD_REQUEST)
        
        # 백엔드 자체적으로 id_token 발급받은 경우 서명을 검증할 필요 없음
        token_decode = jwt.decode(id_token, '', options={"verify_signature": False})
        # sub : (subject) is the unique user id
        # email : is the email address of the user

        if (not token_decode.get('sub')) or (not token_decode.get('email')) or (not token_decode.get('email_verified')):
            return Response(status=status.HTTP_400_BAD_REQUEST)

        # Apple에서 받은 id_token에서 sub, email 조회
        social_type = 'apple'
        social_id = f"{social_type}_{token_decode['sub']}"
        user_email = token_decode['email']

        '''
        # 회원가입 및 로그인 처리 알고리즘 추가필요
        '''

        # 테스트 값 확인용
        res = {
            'social_type': social_type,
            'social_id': social_id,
            'user_email': user_email,
        }
        response = Response(status=status.HTTP_200_OK)
        response.data = res
        return response