From d7d3de7fb6265031ed46dbb9774afa4701198ae4 Mon Sep 17 00:00:00 2001 From: GUARDiA Date: Sat, 4 Jul 2026 01:01:22 +0900 Subject: [PATCH] =?UTF-8?q?feat(auth):=20OTP=202FA=20+=20admin=20=EC=95=94?= =?UTF-8?q?=ED=98=B8=ED=99=94=20=EC=9E=AC=EC=8B=9C=EB=93=9C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- backend/pom.xml | 3 + .../zioinfo/mes/admin/AdminController.java | 6 + .../zioinfo/mes/admin/AdminUserService.java | 11 ++ .../mes/admin/mapper/AdminUserMapper.java | 3 + .../com/zioinfo/mes/auth/AuthController.java | 66 ++++++- .../com/zioinfo/mes/auth/AuthService.java | 36 +++- .../java/com/zioinfo/mes/auth/MesUser.java | 4 +- .../mes/auth/dto/ChangePasswordRequest.java | 12 ++ .../mes/auth/dto/OtpConfirmRequest.java | 7 + .../mes/auth/dto/OtpSetupResponse.java | 13 ++ .../mes/auth/dto/OtpVerifyRequest.java | 10 ++ .../zioinfo/mes/auth/mapper/UserMapper.java | 14 ++ .../mes/config/AdminPasswordSeeder.java | 130 ++++++++++++++ .../zioinfo/mes/uiws/auth/OtpAuthService.java | 167 ++++++++++++++++++ .../zioinfo/mes/uiws/auth/TotpService.java | 81 +++++++++ .../mes/uiws/common/UiwsErrorCode.java | 4 + .../mes/uiws/config/UiwsProperties.java | 5 + backend/src/main/resources/application.yml | 2 +- backend/src/main/resources/db/93_auth_otp.sql | 11 ++ .../main/resources/db/ops_otp_reset_all.sql | 16 ++ .../main/resources/mapper/AdminUserMapper.xml | 4 + .../src/main/resources/mapper/UserMapper.xml | 7 +- frontend/index.html | 1 + frontend/public/favicon.ico | Bin 0 -> 17542 bytes 24 files changed, 602 insertions(+), 11 deletions(-) create mode 100644 backend/src/main/java/com/zioinfo/mes/auth/dto/ChangePasswordRequest.java create mode 100644 backend/src/main/java/com/zioinfo/mes/auth/dto/OtpConfirmRequest.java create mode 100644 backend/src/main/java/com/zioinfo/mes/auth/dto/OtpSetupResponse.java create mode 100644 backend/src/main/java/com/zioinfo/mes/auth/dto/OtpVerifyRequest.java create mode 100644 backend/src/main/java/com/zioinfo/mes/config/AdminPasswordSeeder.java create mode 100644 backend/src/main/java/com/zioinfo/mes/uiws/auth/OtpAuthService.java create mode 100644 backend/src/main/java/com/zioinfo/mes/uiws/auth/TotpService.java create mode 100644 backend/src/main/resources/db/93_auth_otp.sql create mode 100644 backend/src/main/resources/db/ops_otp_reset_all.sql create mode 100644 frontend/public/favicon.ico diff --git a/backend/pom.xml b/backend/pom.xml index f241ef8..970bff3 100644 --- a/backend/pom.xml +++ b/backend/pom.xml @@ -59,6 +59,9 @@ ${springdoc.version} + + dev.samstevens.totptotp1.7.1 + org.projectlomboklomboktrue diff --git a/backend/src/main/java/com/zioinfo/mes/admin/AdminController.java b/backend/src/main/java/com/zioinfo/mes/admin/AdminController.java index 2f7649f..523a89d 100644 --- a/backend/src/main/java/com/zioinfo/mes/admin/AdminController.java +++ b/backend/src/main/java/com/zioinfo/mes/admin/AdminController.java @@ -56,6 +56,12 @@ public class AdminController { return ApiResponse.ok(userService.resetPassword(id, req.password())); } + /** 관리자 OTP 초기화(SUPERADMIN). 대상 OTP 시크릿 폐기 → 다음 로그인 재등록. 시크릿 미노출·감사 기록. */ + @PostMapping("/users/{id}/otp-reset") + public ApiResponse resetOtp(@PathVariable Long id) { + return ApiResponse.ok(userService.resetOtp(id)); + } + @DeleteMapping("/users/{id}") public ApiResponse deleteUser(@PathVariable Long id, Authentication auth) { String currentUsername = auth != null ? auth.getName() : null; diff --git a/backend/src/main/java/com/zioinfo/mes/admin/AdminUserService.java b/backend/src/main/java/com/zioinfo/mes/admin/AdminUserService.java index 76b7c31..7353707 100644 --- a/backend/src/main/java/com/zioinfo/mes/admin/AdminUserService.java +++ b/backend/src/main/java/com/zioinfo/mes/admin/AdminUserService.java @@ -85,6 +85,17 @@ public class AdminUserService { return UserDto.from(user); } + /** + * 관리자 OTP 초기화(SUPERADMIN). 대상 사용자의 OTP 시크릿을 폐기하고 등록을 해제한다. + * 사용자는 다음 로그인 시 OTP_SETUP(재등록) 플로우를 탄다. 시크릿은 응답/로그에 노출하지 않는다. + */ + public UserDto resetOtp(Long id) { + MesUser user = require(id); + mapper.clearOtp(id); + auditService.log("USER_OTP_RESET", user.getUsername(), "OTP 초기화(다음 로그인 재등록)"); + return UserDto.from(user); + } + public void delete(Long id, String currentUsername) { MesUser user = require(id); if (user.getUsername().equals(currentUsername)) { diff --git a/backend/src/main/java/com/zioinfo/mes/admin/mapper/AdminUserMapper.java b/backend/src/main/java/com/zioinfo/mes/admin/mapper/AdminUserMapper.java index 42b74ca..05e27eb 100644 --- a/backend/src/main/java/com/zioinfo/mes/admin/mapper/AdminUserMapper.java +++ b/backend/src/main/java/com/zioinfo/mes/admin/mapper/AdminUserMapper.java @@ -22,6 +22,9 @@ public interface AdminUserMapper { int updatePassword(@Param("id") Long id, @Param("passwordHash") String passwordHash); + /** 관리자 OTP 초기화: 시크릿 폐기 + otp_enabled=false(다음 로그인 시 재등록 유도). 시크릿 미노출. */ + int clearOtp(@Param("id") Long id); + int deleteById(@Param("id") Long id); /** 활성 SUPERADMIN 계정 수 (마지막 관리자 삭제/강등 방지용). */ diff --git a/backend/src/main/java/com/zioinfo/mes/auth/AuthController.java b/backend/src/main/java/com/zioinfo/mes/auth/AuthController.java index 47eb448..8fff6ec 100644 --- a/backend/src/main/java/com/zioinfo/mes/auth/AuthController.java +++ b/backend/src/main/java/com/zioinfo/mes/auth/AuthController.java @@ -1,7 +1,15 @@ package com.zioinfo.mes.auth; +import com.zioinfo.mes.auth.dto.ChangePasswordRequest; +import com.zioinfo.mes.auth.dto.OtpConfirmRequest; +import com.zioinfo.mes.auth.dto.OtpSetupResponse; +import com.zioinfo.mes.auth.dto.OtpVerifyRequest; import com.zioinfo.mes.common.ApiResponse; +import com.zioinfo.mes.uiws.auth.OtpAuthService; import com.zioinfo.mes.uiws.auth.TwoFactorService; +import com.zioinfo.mes.uiws.common.UiwsApiException; +import com.zioinfo.mes.uiws.common.UiwsErrorCode; +import jakarta.validation.Valid; import lombok.RequiredArgsConstructor; import org.springframework.web.bind.annotation.*; @@ -9,8 +17,9 @@ import java.util.Map; /** * MES 인증 컨트롤러. - * - /login: 2FA off 면 { token, type, twofa:"false" }, 2FA on 이면 { twofa:"true", verifyToken, step, maskedEmail }. - * - /verify: (UIWS 2FA 이식) verify-token + 인증코드 → access/refresh 발급. + * - /login: 2FA off 면 { token, type, twofa:"false" }, 2FA on 이면 { twofa:"true", verifyToken, verifyMethod|step, ... }. + * - /verify: (UIWS 2FA 이식) verify-token + 이메일코드 → access/refresh 발급. + * - /verify-otp: (TOTP 이식) verify-token + 6자리 → access/refresh 발급(최초 로그인이면 등록 확정). * 기존 클라이언트(2FA off)는 응답 형태 token 보존 → 회귀 0. */ @RestController @@ -20,24 +29,75 @@ public class AuthController { private final AuthService authService; private final TwoFactorService twoFactorService; + private final OtpAuthService otpAuthService; + private final JwtUtil jwtUtil; @PostMapping("/login") public ApiResponse> login(@RequestBody LoginRequest req) { return ApiResponse.ok(authService.login(req.username(), req.password())); } - /** UIWS 2FA 이식: 2차 인증 코드 검증 → access/refresh 발급. */ + /** UIWS 2FA(이메일코드) 이식: 2차 인증 코드 검증 → access/refresh 발급. */ @PostMapping("/verify") public ApiResponse> verify(@RequestBody VerifyRequest req) { return ApiResponse.ok(twoFactorService.verify(req.verifyToken(), req.code())); } + /** TOTP 이식: 로그인 2단계 6자리 검증 → access/refresh 발급(최초 로그인이면 등록 확정). */ + @PostMapping("/verify-otp") + public ApiResponse> verifyOtp(@Valid @RequestBody OtpVerifyRequest req) { + return ApiResponse.ok(otpAuthService.verifyOtp(req.verifyToken(), req.code())); + } + @GetMapping("/me") public ApiResponse> me(@RequestHeader("Authorization") String header) { String token = header.replace("Bearer ", ""); return ApiResponse.ok(authService.me(token)); } + // ── 마이페이지: OTP 등록/재설정/해제 + 비밀번호 변경 (본인, access 토큰 필요) ────────── + + /** 마이페이지 OTP 등록/재설정 시작 → { secret, otpAuthUri, qrImage }(이 응답에서만 시크릿/QR 노출). */ + @PostMapping("/otp/setup") + public ApiResponse otpSetup(@RequestHeader("Authorization") String header) { + return ApiResponse.ok(otpAuthService.setup(requireUser(header))); + } + + /** 마이페이지 OTP 확인·활성화(앱 6자리 코드). */ + @PostMapping("/otp/confirm") + public ApiResponse> otpConfirm(@RequestHeader("Authorization") String header, + @Valid @RequestBody OtpConfirmRequest req) { + otpAuthService.confirm(requireUser(header), req.code()); + return ApiResponse.ok(Map.of("result", "ok")); + } + + /** 마이페이지 OTP 해제. */ + @PostMapping("/otp/disable") + public ApiResponse> otpDisable(@RequestHeader("Authorization") String header) { + otpAuthService.disable(requireUser(header)); + return ApiResponse.ok(Map.of("result", "ok")); + } + + /** 마이페이지 비밀번호 변경(현재 비번 검증 + BCrypt). 새 비번은 응답/로그 미포함. */ + @PostMapping("/change-password") + public ApiResponse> changePassword(@RequestHeader("Authorization") String header, + @Valid @RequestBody ChangePasswordRequest req) { + authService.changePassword(requireUser(header), req); + return ApiResponse.ok(Map.of("result", "ok")); + } + + /** + * Authorization 헤더에서 인증 사용자를 해석한다. verify-token(2fa 단계용)은 거부. + * (/api/mes/auth/** 는 permitAll 이라 필터 인증이 없으므로 여기서 access 토큰을 명시 검증.) + */ + private String requireUser(String header) { + String token = header == null ? "" : header.replace("Bearer ", "").trim(); + if (token.isEmpty() || jwtUtil.isVerifyToken(token) || !jwtUtil.isValid(token)) { + throw new UiwsApiException(UiwsErrorCode.UNAUTHORIZED); + } + return jwtUtil.getUsername(token); + } + record LoginRequest(String username, String password) {} record VerifyRequest(String verifyToken, String code) {} diff --git a/backend/src/main/java/com/zioinfo/mes/auth/AuthService.java b/backend/src/main/java/com/zioinfo/mes/auth/AuthService.java index cec649e..f880cfd 100644 --- a/backend/src/main/java/com/zioinfo/mes/auth/AuthService.java +++ b/backend/src/main/java/com/zioinfo/mes/auth/AuthService.java @@ -1,11 +1,14 @@ package com.zioinfo.mes.auth; +import com.zioinfo.mes.admin.AuditService; import com.zioinfo.mes.auth.dto.AuthHelperResult; +import com.zioinfo.mes.auth.dto.ChangePasswordRequest; import com.zioinfo.mes.auth.dto.FindIdRequest; import com.zioinfo.mes.auth.dto.FindIdResponse; import com.zioinfo.mes.auth.dto.ResetPasswordRequest; import com.zioinfo.mes.auth.dto.SignupRequest; import com.zioinfo.mes.auth.mapper.UserMapper; +import com.zioinfo.mes.uiws.auth.OtpAuthService; import com.zioinfo.mes.uiws.auth.TwoFactorService; import com.zioinfo.mes.uiws.common.UiwsApiException; import com.zioinfo.mes.uiws.common.UiwsErrorCode; @@ -39,7 +42,9 @@ public class AuthService { private final PasswordEncoder passwordEncoder; private final JwtUtil jwtUtil; private final TwoFactorService twoFactorService; + private final OtpAuthService otpAuthService; private final MailSender mailSender; + private final AuditService auditService; /** * 1차 로그인. 2FA 활성 시 verify-token + 이메일코드 흐름으로 분기, @@ -63,8 +68,8 @@ public class AuthService { throw new RuntimeException("ERR-AUTH-003: 승인 대기 중인 계정입니다. 관리자 승인 후 이용 가능합니다."); } if (!passwordEncoder.matches(password, user.getPasswordHash())) { - // 2FA 활성 시 실패 누적/잠금. 비활성 시 기존 동작(메시지만) 유지. - if (twoFactorService.isEnabled()) { + // 2FA(OTP 또는 이메일) 활성 시 실패 누적/잠금. 비활성 시 기존 동작(메시지만) 유지. + if (otpAuthService.isEnabled() || twoFactorService.isEnabled()) { twoFactorService.recordLoginFailure(username); MesUser after = userMapper.findByUsername(username); if (after != null && Boolean.TRUE.equals(after.getLocked())) { @@ -74,7 +79,11 @@ public class AuthService { throw new RuntimeException("ERR-AUTH-002: 비밀번호 불일치"); } - // 비밀번호 검증 통과 + // 비밀번호 검증 통과 — 2단계 우선순위: OTP > 이메일코드 > 단일 로그인 + if (otpAuthService.isEnabled()) { + // { twofa:true, verifyToken, verifyMethod:(OTP|OTP_SETUP), secret?, otpAuthUri?, qrImage? } + return otpAuthService.beginOtp(user); + } if (twoFactorService.isEnabled()) { Map step1 = twoFactorService.beginTwoFactor(user); // verifyToken/step/maskedEmail + twofa 플래그 @@ -179,6 +188,27 @@ public class AuthService { return new AuthHelperResult(true, okMsg); } + /** + * 마이페이지 비밀번호 변경(현재 비밀번호 검증 + BCrypt 저장). UIWS changePassword 미러. + * 현재 비번 불일치 → PASSWORD_MISMATCH, 기존과 동일 → PASSWORD_SAME_AS_OLD. + * 새 비밀번호 평문은 로그/응답/감사에 절대 기록하지 않는다(보안 불변규칙). + */ + @Transactional + public void changePassword(String username, ChangePasswordRequest req) { + MesUser user = userMapper.findByUsername(username); + if (user == null) { + throw new UiwsApiException(UiwsErrorCode.USER_NOT_FOUND); + } + if (!passwordEncoder.matches(req.currentPassword(), user.getPasswordHash())) { + throw new UiwsApiException(UiwsErrorCode.PASSWORD_MISMATCH); + } + if (passwordEncoder.matches(req.newPassword(), user.getPasswordHash())) { + throw new UiwsApiException(UiwsErrorCode.PASSWORD_SAME_AS_OLD); + } + userMapper.updatePasswordHash(username, passwordEncoder.encode(req.newPassword())); + auditService.log(username, "PASSWORD_CHANGE", username, "본인 비밀번호 변경"); + } + private static String generateTempPassword() { StringBuilder sb = new StringBuilder(10); for (int i = 0; i < 10; i++) { diff --git a/backend/src/main/java/com/zioinfo/mes/auth/MesUser.java b/backend/src/main/java/com/zioinfo/mes/auth/MesUser.java index ca58e63..149d3a5 100644 --- a/backend/src/main/java/com/zioinfo/mes/auth/MesUser.java +++ b/backend/src/main/java/com/zioinfo/mes/auth/MesUser.java @@ -29,8 +29,10 @@ public class MesUser { private Integer loginFailCount; /** 계정 잠금 여부(기본 false). */ private Boolean locked; - /** TOTP 시크릿(UIWS OTP 경로 대비, 현재 이메일 흐름에서는 미사용). */ + /** TOTP 시크릿(보류/확정 공용). API 응답·로그 미노출. */ private String otpSecret; + /** OTP 등록 확정 여부(최초 로그인 verify 성공 시 true). db/93_auth_otp.sql ALTER. */ + private Boolean otpEnabled; // ── 로그인 보조 이식(회원가입 승인 게이트) mes_user.approved ─────────────── /** 회원가입 승인 여부(기본 true). 신규 가입자는 false → SUPERADMIN 승인 전 로그인 차단. */ diff --git a/backend/src/main/java/com/zioinfo/mes/auth/dto/ChangePasswordRequest.java b/backend/src/main/java/com/zioinfo/mes/auth/dto/ChangePasswordRequest.java new file mode 100644 index 0000000..4c0125b --- /dev/null +++ b/backend/src/main/java/com/zioinfo/mes/auth/dto/ChangePasswordRequest.java @@ -0,0 +1,12 @@ +package com.zioinfo.mes.auth.dto; + +import jakarta.validation.constraints.NotBlank; +import jakarta.validation.constraints.Size; + +/** 마이페이지 비밀번호 변경 요청 — 현재 비밀번호 검증 + 새 비밀번호(BCrypt 저장). */ +public record ChangePasswordRequest( + @NotBlank(message = "현재 비밀번호는 필수입니다.") String currentPassword, + @NotBlank(message = "새 비밀번호는 필수입니다.") + @Size(min = 8, message = "새 비밀번호는 최소 8자입니다.") String newPassword +) { +} diff --git a/backend/src/main/java/com/zioinfo/mes/auth/dto/OtpConfirmRequest.java b/backend/src/main/java/com/zioinfo/mes/auth/dto/OtpConfirmRequest.java new file mode 100644 index 0000000..8a2fda5 --- /dev/null +++ b/backend/src/main/java/com/zioinfo/mes/auth/dto/OtpConfirmRequest.java @@ -0,0 +1,7 @@ +package com.zioinfo.mes.auth.dto; + +import jakarta.validation.constraints.NotBlank; + +/** Authenticator(TOTP) 등록 확인 요청 — 앱에 표시된 6자리 코드. */ +public record OtpConfirmRequest(@NotBlank String code) { +} diff --git a/backend/src/main/java/com/zioinfo/mes/auth/dto/OtpSetupResponse.java b/backend/src/main/java/com/zioinfo/mes/auth/dto/OtpSetupResponse.java new file mode 100644 index 0000000..bd962da --- /dev/null +++ b/backend/src/main/java/com/zioinfo/mes/auth/dto/OtpSetupResponse.java @@ -0,0 +1,13 @@ +package com.zioinfo.mes.auth.dto; + +/** + * Authenticator(TOTP) 등록 셋업 응답 — UIWS OtpSetupResponse 미러. + *
    + *
  • secret : Base32 TOTP 시크릿(수동 입력용)
    • + *
  • otpAuthUri : otpauth://totp/... (Authenticator 앱 직접 등록용 URI)
    • + *
  • qrImage : data:image/png;base64,... (QR 이미지, <img src> 로 표시)
    • + *
+ * 보안 불변: 이 응답(등록 순간)에서만 시크릿/QR 노출. 조회/목록/재조회 응답에 재노출 금지. + */ +public record OtpSetupResponse(String secret, String otpAuthUri, String qrImage) { +} diff --git a/backend/src/main/java/com/zioinfo/mes/auth/dto/OtpVerifyRequest.java b/backend/src/main/java/com/zioinfo/mes/auth/dto/OtpVerifyRequest.java new file mode 100644 index 0000000..e06a00c --- /dev/null +++ b/backend/src/main/java/com/zioinfo/mes/auth/dto/OtpVerifyRequest.java @@ -0,0 +1,10 @@ +package com.zioinfo.mes.auth.dto; + +import jakarta.validation.constraints.NotBlank; + +/** 로그인 2단계 TOTP 검증 요청 — { verifyToken, code }. */ +public record OtpVerifyRequest( + @NotBlank(message = "verifyToken은 필수입니다.") String verifyToken, + @NotBlank(message = "code는 필수입니다.") String code +) { +} diff --git a/backend/src/main/java/com/zioinfo/mes/auth/mapper/UserMapper.java b/backend/src/main/java/com/zioinfo/mes/auth/mapper/UserMapper.java index fa6061b..dbd376b 100644 --- a/backend/src/main/java/com/zioinfo/mes/auth/mapper/UserMapper.java +++ b/backend/src/main/java/com/zioinfo/mes/auth/mapper/UserMapper.java @@ -49,6 +49,20 @@ public interface UserMapper { @Update("UPDATE mes_user SET locked = false, login_fail_count = 0 WHERE username = #{username}") int unlock(@Param("username") String username); + // ── TOTP(OTP 2차 인증) 이식 (멱등 UPDATE) ──────────────────────────────────── + + /** 보류 시크릿 저장(등록 확정 전). otp_enabled 은 건드리지 않는다(verify/confirm 에서 확정). */ + @Update("UPDATE mes_user SET otp_secret = #{secret} WHERE username = #{username}") + int updateOtpSecret(@Param("username") String username, @Param("secret") String secret); + + /** 등록 확정: otp_enabled=true (시크릿은 유지). */ + @Update("UPDATE mes_user SET otp_enabled = true WHERE username = #{username}") + int enableOtp(@Param("username") String username); + + /** 해제/초기화: 시크릿 폐기 + otp_enabled=false. (마이페이지 해제) */ + @Update("UPDATE mes_user SET otp_secret = NULL, otp_enabled = false WHERE username = #{username}") + int disableOtp(@Param("username") String username); + // ── 로그인 보조 이식: 회원가입 / 아이디찾기 / 비밀번호 초기화 (XML 정의) ─────────────── /** username 존재 여부(회원가입 중복 검사). */ diff --git a/backend/src/main/java/com/zioinfo/mes/config/AdminPasswordSeeder.java b/backend/src/main/java/com/zioinfo/mes/config/AdminPasswordSeeder.java new file mode 100644 index 0000000..bb5e096 --- /dev/null +++ b/backend/src/main/java/com/zioinfo/mes/config/AdminPasswordSeeder.java @@ -0,0 +1,130 @@ +package com.zioinfo.mes.config; + +import com.zioinfo.mes.auth.mapper.UserMapper; +import lombok.RequiredArgsConstructor; +import lombok.extern.slf4j.Slf4j; +import org.springframework.beans.factory.annotation.Value; +import org.springframework.boot.ApplicationArguments; +import org.springframework.boot.ApplicationRunner; +import org.springframework.core.annotation.Order; +import org.springframework.security.crypto.password.PasswordEncoder; +import org.springframework.stereotype.Component; + +import javax.crypto.Cipher; +import javax.crypto.spec.GCMParameterSpec; +import javax.crypto.spec.SecretKeySpec; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.Path; +import java.util.Arrays; +import java.util.Base64; + +/** + * admin 비밀번호 암호화 재시드(UIMS 방식 + 암호화 저장). + * + *

기동 시 멱등 재시드: + * 

+ *   ADMIN_KEY_FILE(hex 32바이트 키 파일) 로드 → ADMIN_PASSWORD_ENC(base64(nonce12 + ct + tag), AES-256-GCM) 복호
+ *   → admin 계정 BCrypt 해시 갱신(하드코딩 admin123 시드를 env 값으로 덮어씀).
+ *
+ * + *

안전 규칙: + *

    + *
  • env 미설정 / 키 로드 실패 / 복호 실패 시 재시드 스킵(기동 계속). WARN 로그에 값(평문/키/시크릿) 미기록.
    • + *
  • 새 admin 비밀번호 값은 서버 env 에만 존재 — 코드/DB/로그/응답에 평문 미기재(보안 불변규칙).
    • + *
  • 키 값은 별도 파일(root 600)에만 — env/코드/git 에 키 미기재. 여기서는 파일 경로만 읽는다.
    • + *
+ * + *

스키마 시드(admin/admin123) 이후 실행되어 기존 해시를 덮어쓴다(멱등: 매 기동 동일 결과). + */ +@Slf4j +@Component +@Order(Integer.MIN_VALUE + 10) +@RequiredArgsConstructor +public class AdminPasswordSeeder implements ApplicationRunner { + + private static final String ADMIN_USERNAME = "admin"; + private static final int GCM_TAG_BITS = 128; + private static final int NONCE_LEN = 12; + + @Value("${ADMIN_PASSWORD_ENC:}") + private String adminPasswordEnc; + + @Value("${ADMIN_KEY_FILE:}") + private String adminKeyFile; + + private final UserMapper userMapper; + private final PasswordEncoder passwordEncoder; + + @Override + public void run(ApplicationArguments args) { + if (isBlank(adminPasswordEnc) || isBlank(adminKeyFile)) { + log.info("[admin-reseed] ADMIN_PASSWORD_ENC/ADMIN_KEY_FILE 미설정 — 재시드 스킵(기동 계속)"); + return; + } + char[] plain = null; + byte[] key = null; + try { + key = loadHexKey(adminKeyFile); // hex 32바이트 → 32B (AES-256) + plain = decrypt(adminPasswordEnc, key); // base64(nonce12+ct+tag) → 평문 + String hash = passwordEncoder.encode(new String(plain)); + int updated = userMapper.updatePasswordHash(ADMIN_USERNAME, hash); + if (updated > 0) { + log.info("[admin-reseed] admin 비밀번호 env 값으로 재시드 완료(멱등)"); + } else { + log.warn("[admin-reseed] admin 계정 미존재 — 재시드 스킵"); + } + } catch (Exception e) { + // 값 미기록: 예외 클래스명만(메시지에 평문/키가 섞일 여지 차단) + log.warn("[admin-reseed] 복호/재시드 실패 — 스킵(기동 계속). cause={}", e.getClass().getSimpleName()); + } finally { + if (plain != null) Arrays.fill(plain, '\0'); + if (key != null) Arrays.fill(key, (byte) 0); + } + } + + /** 키 파일(hex 문자열, 공백/개행 무시)을 32바이트 키로 로드. 32바이트가 아니면 예외. */ + private static byte[] loadHexKey(String path) throws Exception { + String hex = Files.readString(Path.of(path), StandardCharsets.UTF_8) + .replaceAll("\\s", ""); + byte[] key = hexToBytes(hex); + if (key.length != 32) { + throw new IllegalStateException("key length != 32 bytes"); + } + return key; + } + + /** base64(nonce12 + ciphertext + tag) → AES-256-GCM 복호 평문(char[]). */ + private static char[] decrypt(String encBase64, byte[] key) throws Exception { + byte[] blob = Base64.getDecoder().decode(encBase64.trim()); + if (blob.length <= NONCE_LEN) { + throw new IllegalStateException("cipher blob too short"); + } + byte[] nonce = Arrays.copyOfRange(blob, 0, NONCE_LEN); + byte[] ct = Arrays.copyOfRange(blob, NONCE_LEN, blob.length); + Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding"); + cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(key, "AES"), + new GCMParameterSpec(GCM_TAG_BITS, nonce)); + byte[] out = cipher.doFinal(ct); + char[] chars = new String(out, StandardCharsets.UTF_8).toCharArray(); + Arrays.fill(out, (byte) 0); + return chars; + } + + private static byte[] hexToBytes(String hex) { + int len = hex.length(); + if (len % 2 != 0) { + throw new IllegalStateException("odd hex length"); + } + byte[] out = new byte[len / 2]; + for (int i = 0; i < len; i += 2) { + out[i / 2] = (byte) ((Character.digit(hex.charAt(i), 16) << 4) + + Character.digit(hex.charAt(i + 1), 16)); + } + return out; + } + + private static boolean isBlank(String s) { + return s == null || s.isBlank(); + } +} diff --git a/backend/src/main/java/com/zioinfo/mes/uiws/auth/OtpAuthService.java b/backend/src/main/java/com/zioinfo/mes/uiws/auth/OtpAuthService.java new file mode 100644 index 0000000..0a2f86c --- /dev/null +++ b/backend/src/main/java/com/zioinfo/mes/uiws/auth/OtpAuthService.java @@ -0,0 +1,167 @@ +package com.zioinfo.mes.uiws.auth; + +import com.zioinfo.mes.admin.AuditService; +import com.zioinfo.mes.auth.JwtUtil; +import com.zioinfo.mes.auth.MesUser; +import com.zioinfo.mes.auth.dto.OtpSetupResponse; +import com.zioinfo.mes.auth.mapper.UserMapper; +import com.zioinfo.mes.uiws.common.UiwsApiException; +import com.zioinfo.mes.uiws.common.UiwsErrorCode; +import com.zioinfo.mes.uiws.config.UiwsProperties; +import lombok.RequiredArgsConstructor; +import lombok.extern.slf4j.Slf4j; +import org.springframework.stereotype.Service; +import org.springframework.transaction.annotation.Transactional; + +import java.util.LinkedHashMap; +import java.util.Map; + +/** + * TOTP(OTP 2차 인증) 오케스트레이션 레이어 — UIWS AuthService 의 OTP 경로 미러. + * + *

흐름: + *

    + *
  1. 1차 로그인 성공 → {@link #beginOtp}: verify-token 발급 + (미등록이면 보류 시크릿+QR) 반환.
    2. + *
  2. {@code POST /verify-otp}(verifyToken+code) → {@link #verifyOtp}: 6자리 검증 후 access/refresh 발급. + * 최초 로그인이면 등록 확정(otp_enabled=true).
    3. + *
  3. 마이페이지: {@link #setup}/{@link #confirm}/{@link #disable}.
    4. + *
+ * + *

보안 불변: 시크릿·QR·otpauth URI 는 setup/OTP_SETUP 응답에서만 노출. 로그·감사에 시크릿/코드 미기록. + * 기존 auth(JWT·RBAC) 엔진 교체 없음 — TOTP 레이어만 추가. + */ +@Slf4j +@Service +@RequiredArgsConstructor +public class OtpAuthService { + + private final UserMapper userMapper; + private final JwtUtil jwtUtil; + private final TotpService totpService; + private final UiwsProperties properties; + private final AuditService auditService; + + /** 로그인 2단계에 OTP 경로를 사용할지. */ + public boolean isEnabled() { + return properties.getAuth().isOtpEnabled(); + } + + private static boolean blank(String s) { + return s == null || s.isBlank(); + } + + /** + * 1차 로그인 성공 후 OTP 2단계 시작. + * @return 미등록: { twofa:true, verifyToken, verifyMethod:OTP_SETUP, secret, otpAuthUri, qrImage } + * 등록됨: { twofa:true, verifyToken, verifyMethod:OTP } + */ + @Transactional + public Map beginOtp(MesUser user) { + long tokenValidity = properties.getAuth().getVerifyTokenValiditySeconds(); + String verifyToken = jwtUtil.generateVerifyToken(user.getUsername(), tokenValidity); + // 성공 시 실패카운트 초기화(잠금 회복) + userMapper.resetLoginFail(user.getUsername()); + + Map resp = new LinkedHashMap<>(); + resp.put("twofa", "true"); + resp.put("verifyToken", verifyToken); + + if (blank(user.getOtpSecret())) { + // 미등록 최초 로그인 — 보류 시크릿 발급 + QR(이 응답에서만 노출) + String secret = totpService.generateSecret(); + userMapper.updateOtpSecret(user.getUsername(), secret); + resp.put("verifyMethod", "OTP_SETUP"); + resp.put("secret", secret); + resp.put("otpAuthUri", totpService.otpAuthUri(secret, user.getUsername())); + resp.put("qrImage", totpService.qrImageDataUri(secret, user.getUsername())); + } else { + resp.put("verifyMethod", "OTP"); + } + return resp; + } + + /** + * 2단계 검증: verify-token + 6자리 코드 → access/refresh 발급. 최초 로그인이면 등록 확정. + * @return { token, refreshToken, type, username, role } + */ + @Transactional + public Map verifyOtp(String verifyToken, String code) { + String username = jwtUtil.parseVerifyTokenUsername(verifyToken); + if (username == null) { + throw new UiwsApiException(UiwsErrorCode.VERIFY_TOKEN_INVALID); + } + MesUser user = userMapper.findByUsername(username); + if (user == null) { + throw new UiwsApiException(UiwsErrorCode.VERIFY_TOKEN_INVALID); + } + if (Boolean.TRUE.equals(user.getLocked())) { + throw new UiwsApiException(UiwsErrorCode.ACCOUNT_LOCKED); + } + if (!totpService.verify(user.getOtpSecret(), code)) { + // OTP 오입력도 실패 카운트에 합산(정책) — 임계 도달 시 잠금. + userMapper.incrementLoginFail(username, properties.getAuth().getMaxLoginFail()); + throw new UiwsApiException(UiwsErrorCode.VERIFY_CODE_INVALID); + } + + // 최초 로그인(보류 시크릿) → 등록 확정(멱등) + if (!Boolean.TRUE.equals(user.getOtpEnabled())) { + userMapper.enableOtp(username); + auditService.log(username, "OTP_ENROLL", username, "최초 로그인 OTP 등록 확정"); + } + userMapper.resetLoginFail(username); + + String access = jwtUtil.generate(user.getUsername(), user.getRole()); + String refresh = jwtUtil.generate(user.getUsername(), user.getRole()); + Map resp = new LinkedHashMap<>(); + resp.put("token", access); + resp.put("refreshToken", refresh); + resp.put("type", "Bearer"); + resp.put("username", user.getUsername()); + resp.put("role", user.getRole() == null ? "" : user.getRole()); + return resp; + } + + /** 마이페이지 OTP 등록/재설정 시작: 새 보류 시크릿 발급(기존 시크릿 무효화) + QR 반환. */ + @Transactional + public OtpSetupResponse setup(String username) { + MesUser user = userMapper.findByUsername(username); + if (user == null) { + throw new UiwsApiException(UiwsErrorCode.USER_NOT_FOUND); + } + String secret = totpService.generateSecret(); + userMapper.updateOtpSecret(username, secret); // 확정 전엔 otp_enabled 유지(재설정 시 confirm 재확정) + auditService.log(username, "OTP_SETUP", username, "OTP 등록/재설정 시작(새 시크릿 발급)"); + return new OtpSetupResponse( + secret, + totpService.otpAuthUri(secret, username), + totpService.qrImageDataUri(secret, username)); + } + + /** 마이페이지 OTP 확인·활성화: 앱 코드 검증 성공 시 otp_enabled=true. */ + @Transactional + public void confirm(String username, String code) { + MesUser user = userMapper.findByUsername(username); + if (user == null) { + throw new UiwsApiException(UiwsErrorCode.USER_NOT_FOUND); + } + if (blank(user.getOtpSecret())) { + throw new UiwsApiException(UiwsErrorCode.OTP_NOT_REGISTERED); + } + if (!totpService.verify(user.getOtpSecret(), code)) { + throw new UiwsApiException(UiwsErrorCode.VERIFY_CODE_INVALID); + } + userMapper.enableOtp(username); + auditService.log(username, "OTP_ENABLE", username, "OTP 2차 인증 활성화"); + } + + /** 마이페이지 OTP 해제: 시크릿 폐기 + otp_enabled=false. */ + @Transactional + public void disable(String username) { + MesUser user = userMapper.findByUsername(username); + if (user == null) { + throw new UiwsApiException(UiwsErrorCode.USER_NOT_FOUND); + } + userMapper.disableOtp(username); + auditService.log(username, "OTP_DISABLE", username, "OTP 2차 인증 해제"); + } +} diff --git a/backend/src/main/java/com/zioinfo/mes/uiws/auth/TotpService.java b/backend/src/main/java/com/zioinfo/mes/uiws/auth/TotpService.java new file mode 100644 index 0000000..77874fd --- /dev/null +++ b/backend/src/main/java/com/zioinfo/mes/uiws/auth/TotpService.java @@ -0,0 +1,81 @@ +package com.zioinfo.mes.uiws.auth; + +import dev.samstevens.totp.code.CodeGenerator; +import dev.samstevens.totp.code.CodeVerifier; +import dev.samstevens.totp.code.DefaultCodeGenerator; +import dev.samstevens.totp.code.DefaultCodeVerifier; +import dev.samstevens.totp.code.HashingAlgorithm; +import dev.samstevens.totp.exceptions.QrGenerationException; +import dev.samstevens.totp.qr.QrData; +import dev.samstevens.totp.qr.QrGenerator; +import dev.samstevens.totp.qr.ZxingPngQrGenerator; +import dev.samstevens.totp.secret.DefaultSecretGenerator; +import dev.samstevens.totp.secret.SecretGenerator; +import dev.samstevens.totp.time.SystemTimeProvider; +import dev.samstevens.totp.time.TimeProvider; +import dev.samstevens.totp.util.Utils; +import org.springframework.stereotype.Service; + +/** + * TOTP(RFC 6238, HMAC-SHA1, 30s, 6자리, ±1 윈도우) 코덱 — UIWS TotpService 미러. + * 시크릿(OTP_SECRET)은 mes_user 에 저장되어 있다고 가정. issuer 만 GUARDiA-MES 로 교체. + * + *

보안 불변: 시크릿·otpauth URI·QR 은 등록 순간 발급 응답에서만 노출. 로그 기록 금지. + */ +@Service +public class TotpService { + + private final TimeProvider timeProvider = new SystemTimeProvider(); + private final CodeGenerator codeGenerator = new DefaultCodeGenerator(HashingAlgorithm.SHA1, 6); + private final SecretGenerator secretGenerator = new DefaultSecretGenerator(); + private final CodeVerifier codeVerifier = buildVerifier(); + private final QrGenerator qrGenerator = new ZxingPngQrGenerator(); + + private static final String ISSUER = "GUARDiA-MES"; + + private CodeVerifier buildVerifier() { + DefaultCodeVerifier verifier = new DefaultCodeVerifier(codeGenerator, timeProvider); + verifier.setTimePeriod(30); + verifier.setAllowedTimePeriodDiscrepancy(1); // ±1 윈도우 허용(시계 오차) + return verifier; + } + + /** 신규 OTP 시크릿 생성(최초 로그인/마이페이지 OTP 등록용). */ + public String generateSecret() { + return secretGenerator.generate(); + } + + /** 주어진 시크릿에 대해 사용자 입력 코드가 유효한지 검증. */ + public boolean verify(String secret, String code) { + if (secret == null || secret.isBlank() || code == null || code.isBlank()) { + return false; + } + return codeVerifier.isValidCode(secret, code.trim()); + } + + /** Authenticator 앱 직접 등록용 otpauth:// URI. */ + public String otpAuthUri(String secret, String userId) { + return buildQrData(secret, userId).getUri(); + } + + /** QR 이미지(data:image/png;base64,...) — 앱으로 스캔해 등록. */ + public String qrImageDataUri(String secret, String userId) { + try { + byte[] image = qrGenerator.generate(buildQrData(secret, userId)); + return Utils.getDataUriForImage(image, qrGenerator.getImageMimeType()); + } catch (QrGenerationException e) { + throw new IllegalStateException("OTP QR 생성 실패", e); + } + } + + private QrData buildQrData(String secret, String userId) { + return new QrData.Builder() + .label(userId) + .secret(secret) + .issuer(ISSUER) + .algorithm(HashingAlgorithm.SHA1) + .digits(6) + .period(30) + .build(); + } +} diff --git a/backend/src/main/java/com/zioinfo/mes/uiws/common/UiwsErrorCode.java b/backend/src/main/java/com/zioinfo/mes/uiws/common/UiwsErrorCode.java index a3e9947..8eb6363 100644 --- a/backend/src/main/java/com/zioinfo/mes/uiws/common/UiwsErrorCode.java +++ b/backend/src/main/java/com/zioinfo/mes/uiws/common/UiwsErrorCode.java @@ -37,6 +37,10 @@ public enum UiwsErrorCode { VERIFY_TOKEN_INVALID("ERR-UIWS-2FA-401", "2차 검증 토큰이 유효하지 않거나 만료되었습니다."), VERIFY_CODE_INVALID("ERR-UIWS-2FA-401C", "인증 코드가 올바르지 않거나 만료되었습니다."), ACCOUNT_LOCKED("ERR-UIWS-2FA-LOCK", "로그인 실패 횟수 초과로 계정이 잠겼습니다. 관리자에게 문의하세요."), + OTP_NOT_REGISTERED("ERR-UIWS-2FA-OTP404", "OTP가 등록되어 있지 않습니다. 먼저 OTP 등록을 진행하세요."), + UNAUTHORIZED("ERR-UIWS-401", "인증이 필요합니다."), + PASSWORD_MISMATCH("ERR-UIWS-PW-401", "현재 비밀번호가 일치하지 않습니다."), + PASSWORD_SAME_AS_OLD("ERR-UIWS-PW-409", "새 비밀번호가 기존 비밀번호와 동일합니다."), // system (권한관리 이식 — CMS 형제 솔루션 차용) DUPLICATE_KEY("ERR-UIWS-SYS-409D", "이미 존재하는 항목입니다."), diff --git a/backend/src/main/java/com/zioinfo/mes/uiws/config/UiwsProperties.java b/backend/src/main/java/com/zioinfo/mes/uiws/config/UiwsProperties.java index 5cdb19e..a9385c0 100644 --- a/backend/src/main/java/com/zioinfo/mes/uiws/config/UiwsProperties.java +++ b/backend/src/main/java/com/zioinfo/mes/uiws/config/UiwsProperties.java @@ -24,6 +24,11 @@ public class UiwsProperties { public static class Auth { /** 2FA 레이어 on/off. 기본 on(켜짐). off 시 기존 단일 JWT 로그인 흐름 유지(회귀 0). */ private boolean twofaEnabled = true; + /** + * TOTP(OTP 2차 인증) 레이어 on/off. 기본 on. 활성 시 로그인 2단계가 OTP(등록/검증) 경로를 사용한다. + * 우선순위: otpEnabled → OTP, (off 이고 twofaEnabled) → 이메일코드, (둘 다 off) → 단일 로그인. + */ + private boolean otpEnabled = true; /** 1차 통과 후 verify-token 유효시간(초). 계획서 300(5분). */ private long verifyTokenValiditySeconds = 300; /** 이메일 인증코드 유효시간(초). 계획서 300(5분). */ diff --git a/backend/src/main/resources/application.yml b/backend/src/main/resources/application.yml index 2d2c4ee..6105819 100644 --- a/backend/src/main/resources/application.yml +++ b/backend/src/main/resources/application.yml @@ -19,7 +19,7 @@ spring: # 기존 schema.sql 은 deploy_server 가 psql 로 별도 적용(비멱등 시드 충돌 회피). mode: ${SQL_INIT_MODE:always} # 91=업무/2FA(tb_uiws_* + mes_user ALTER), 92=권한관리 system, 104=AI 플랫폼 설정 시드(멱등). 전부 멱등. - schema-locations: classpath:db/91_uiws_port.sql,classpath:db/92_uiws_system.sql,classpath:db/104_seed_ai_config.sql + schema-locations: classpath:db/91_uiws_port.sql,classpath:db/92_uiws_system.sql,classpath:db/93_auth_otp.sql,classpath:db/104_seed_ai_config.sql continue-on-error: true servlet: multipart: diff --git a/backend/src/main/resources/db/93_auth_otp.sql b/backend/src/main/resources/db/93_auth_otp.sql new file mode 100644 index 0000000..1ef2885 --- /dev/null +++ b/backend/src/main/resources/db/93_auth_otp.sql @@ -0,0 +1,11 @@ +-- ===================================================================== +-- TOTP(OTP 2차 인증) 이식 — mes_user 멱등 ALTER +-- ===================================================================== +-- otp_secret 은 db/91_uiws_port.sql 에서 이미 ADD(VARCHAR(255)). +-- 여기서는 등록 확정 플래그 otp_enabled 만 추가한다. +-- schema-locations 마지막 근처에 등재(mode=always) → 멱등 재실행 안전. + +ALTER TABLE mes_user ADD COLUMN IF NOT EXISTS otp_enabled BOOLEAN DEFAULT false; + +COMMENT ON COLUMN mes_user.otp_secret IS 'TOTP 시크릿(보류/확정 공용). API 응답·로그 미노출.'; +COMMENT ON COLUMN mes_user.otp_enabled IS 'OTP 등록 확정 여부(최초 로그인 verify 성공 시 true).'; diff --git a/backend/src/main/resources/db/ops_otp_reset_all.sql b/backend/src/main/resources/db/ops_otp_reset_all.sql new file mode 100644 index 0000000..fac4afc --- /dev/null +++ b/backend/src/main/resources/db/ops_otp_reset_all.sql @@ -0,0 +1,16 @@ +-- ===================================================================== +-- [1회 운영 작업] 전 사용자 OTP 초기화 — 멱등 +-- ===================================================================== +-- 목적: 인증 강화 전환 시점에 기존 사용자 OTP 를 초기화한다. +-- 다음 로그인부터 OTP_SETUP(QR 재등록) 플로우를 타게 한다(UIMS 방식). +-- +-- ★ 이 파일은 schema-locations 에 등재하지 않는다(자동 재실행 금지). +-- 운영자가 서버에서 1회 수동 적용: +-- psql -U mes_user -d mes_db -f db/ops_otp_reset_all.sql +-- +-- 멱등: 여러 번 실행해도 결과 동일(모두 NULL/false). + +UPDATE mes_user + SET otp_secret = NULL, + otp_enabled = false + WHERE otp_secret IS NOT NULL OR otp_enabled IS DISTINCT FROM false; diff --git a/backend/src/main/resources/mapper/AdminUserMapper.xml b/backend/src/main/resources/mapper/AdminUserMapper.xml index 0f363f1..e856bd8 100644 --- a/backend/src/main/resources/mapper/AdminUserMapper.xml +++ b/backend/src/main/resources/mapper/AdminUserMapper.xml @@ -41,6 +41,10 @@ UPDATE mes_user SET password_hash = #{passwordHash} WHERE id = #{id} + + UPDATE mes_user SET otp_secret = NULL, otp_enabled = false WHERE id = #{id} + + DELETE FROM mes_user WHERE id = #{id} diff --git a/backend/src/main/resources/mapper/UserMapper.xml b/backend/src/main/resources/mapper/UserMapper.xml index 11209f2..3d73d1a 100644 --- a/backend/src/main/resources/mapper/UserMapper.xml +++ b/backend/src/main/resources/mapper/UserMapper.xml @@ -18,13 +18,14 @@ + @@ -58,7 +59,7 @@ SELECT id, username, password_hash, display_name, role, is_active, created_at, - email, email_verify_code, email_verify_expire, login_fail_count, locked, otp_secret, approved + email, email_verify_code, email_verify_expire, login_fail_count, locked, otp_secret, otp_enabled, approved FROM mes_user WHERE username = #{username} AND email = #{email} diff --git a/frontend/index.html b/frontend/index.html index 84e5495..c5c23f8 100644 --- a/frontend/index.html +++ b/frontend/index.html @@ -3,6 +3,7 @@ + GUARDiA MES — AI 제조실행시스템 diff --git a/frontend/public/favicon.ico b/frontend/public/favicon.ico new file mode 100644 index 0000000000000000000000000000000000000000..3252b9f8cf91fd91df2906be1d4578269c46036f GIT binary patch literal 17542 zcmeHO30PFevYsRwW8yU`qKFG1MkSzPaKj*=C6qke;)C9#X#sx)%03!p87{CQZ z1W{nvh8>0-2WEy%To6TZyYAk6FZX_Vxm&L0R==uq&fs8B)JM#H@AG`$`MT$v(_Md6 zS65e6_lQJqh`NY+^%7xeELz<~BytpqL)#oGi}Bi&v+SP79$5+YQ)_^E$;H~xGf*5ri>fj zrk}U)>W|mc`qsAB1c^Yso9=i1eSEu>YNF-vDK3*N*9FeEzT`Xa<5N#jizkqDS`CXW_ zYRs51Hd8w2>FMlkenEQ^UIYhB!dPGGSRlBlG;bi z#r6lVJ&ix!rII;tVyzS8Nj-izbSSFU#o2jfpFVx`blYj`)LuHn6moq(g_=mKN9x^g zK#jBy)CBj0l918&wckChH0;~^gT3=7{PoLeR&gc+2Uxh-4_cM8L;p7EVd-SoZjYnQItXPsF(*p8i5 zD=~qD?c-`DTMe`C%)Y5F2OEo7nt-01EmQfw`zT@8$LbljAI*Lfug;*w^&i-iar2Gl zoLIzag8M=Ij;R%PlgB!cz17lryKC2O3ujGR9k9whqsv=w;R@98CG_7qAJu{UyhJ)s zBk2#RyIrfTEG;H%ba&eq^ojKiiTw}=m^=VxOtqigaqq42VQO(VI1}pv7t0Q^Gck@( zEq;%kiJAhMBVG`>*!myA(@l9h4*$)QK6&~xKtN)KboOLnL9nPFghoZs~$dso- zNl7U*X>uWNuNeF%=n1yX3`;Wz!}USve_coYkFu~B9}&K{I6ps^v!`Ug$<|Xz_O+-; z0qT-GNZPUtLZ%Nx{3AQ;|2@1GELiY)fd9AI^7NFSsUKWZ7}qcLoh4@+oop=eH%CX2 z&(uYEaD21-zk+8Bee^W>czm&Jtt=_wvQA%+pO+2i)pDq)P;#;n`sR4xz7u%LLL4cn zsm*>O{`{4tWhMVzQd|b-;+-GsKdwotT_T9x;&CI$b`aNR81}1s6D^g{zjllcM;)xt z@}Vtv&6#wjEG821yF8x1K_W(TEI-7H5nire)Oqq-=r{Jw!dyl}mAaC~o~6i6{4FYK zf5Y_Y4hyyYYRestqt5JGWDjR!UHSD`Sd-NOBFGEzYQ;`{2TwPF$oW=K8XXF%@*+^= z=RnZzz-)VadlzkgPnOjGfhAMn?9r$6kG?{%g9%9HP5M)XEC$ro)ewK|=q=Rk<7k#T zv_Gx=$IN4#FUb1@OojN1!gjF4jq~7C>;|Y!-umZI>7L3@moC|W>e8-n@FaHnP5p<> zHV5T?A2@$(4ye8rY#Xlk4H0HgA7%_hOA+dLrM>nYJ@c7iafZe$$Zjx%e>Urf1L7}J z6@JF|)B$g_(WjT~-*ft;WBWdv`je;YjJ*T;>0`to66x!`-*36oVDGBnp?_Bg@^lo^ zm&5-o{>F?lw~W~8BsU)@LWmy*x3`lokq;AJ^#q}4!!-W+coegA*`J^5kAc-!Mm zapUXj#U)^FVQ#Tvw$WBc`?1gEf4n$_XSY}~can!{TVJT$)%{^|fMbo*^vQFc-J)~f zE_MCbLldCK+ZUYwm41Exl^*O`aIHK9eGFWq{knk4PXu)sA6!cL z43yD6|BP5@{rBK$CT;v9!jQ9ncZczEdpJn{H9Pvi*+VvPS#=C*R2s<6$_8ac1zfJp zf$NIxP;q!C>{~F2^NG>lLqCM~y>)z?m!|LTHgkDPO(Li(E7AYVfvgPlp9McTJ2L~y zOG}^@@8oSOAq0Js5X={7{VW~_=VQGveIp|yleKHSb|)qrzk_}+9}ftzfUX}c_`XnH zUJi9-g^=#M3ZyfJqyIIOmjn7@FCu?ON5@&KS9$I}9)I*U`reP}3i&IdovTyluyFF= zW0kV9QmC&eg3R3;Aq@TGJx;@)i@t-yw3*4Wr0OC?-Y;2g=*pq2s1WjUvUn`on22Q2 z-i!s|pgD}(5_ z<*Tfu94@ANfNEz~I2Sz~E~!(Y@?;gtBC~aDNM5-)nV?ctLVamIWTWi&&K?C4jC(jA zAL%EC`us5|G2x1rm)ACodj{#^KwUHX`s)pT`y(T&Fi-glF9%^fODdo_V>X$G5QjRTI}}KruBL|v-#p^s2$HEr zk8KVY+mH?5F-T{A04LL8AOrg&`DWobBaUCb+Z$GhvDzdpZQas$` zbG7t242Y%am_6noohZiSX%RiVwXvJFE=Bn(Gmb%qoTpD1NLSKQ5}~xD_^vKpZQaqz z%qw{6Feus|0+%v8Ir-E2Lv~nOHpSaQoYx#ak0H?JWG=*ZM4#+H@H8{1E|8=AQ&7j! zC@%jcJUs05*BjPLhYlTzy92+zoF(~Kc}&REFbvkguuOW>rkoajD078}#JdDAAzuPL^Dg7m$D?FPajcPD5{LHe}j z5q%y0Tj^sSgfP%J2RjUfs84O7;`jkL*HDLXdlAZ7{&2a+vJeLchv)WLi2q;F7km({ z44UHYAa<1tXY)fbpA_@eT#$bKMOpo+dML!ads0IDgEd~OLom1A#y4ooY5Tu8{%s98 z{x2l2fht^QIo<^sQ2p%Tk0E`>Mo95?hqGw`&~#)rTqq9ydEfr1npv|P-HnZnjN9+M zZXA$G5Kdi zv{U5&ESl}T`(&Q8TWsJ$h1=|j%i4SY`q_W31Sn5Idqp02zs^&j5ME!uy95jk4F{T; z>RFB$@}8x>zFxoI9ncE`2o-ONJh$Hw>h_{PIWw&axpc}ZfD?MovyeuEhL>P$sG0`8+$`E+N>K$E{Vl}Ft- zGc_317q6G>{x@&N;rAU({yy>0y5B=So^p$bosY2x*>_&0?u%zH?~d1R4(J655dLbv z!L$#?;TL$|dBHs~+H+I+^{dk5iXkSG@Fk_cA#6oirhC>xx^H zCrS(6ald!3_d8t=CEFhBzgG4-W5JCJ{np-?TV$kHms37xiUe`>C-a=#w0xMGn_JAA z?c%oB!P-|L^#+OEAhv64FBa@z#5NCmmpM%huG;(#&WUmC zUR^9??%UOJz|ES8rx@X$;}9lwG-Xo6jj=ZF8JjW0kNgmRWvB1gk^a#9MNFK$Ys5yZ zNw$pLYSF-j^LJQt^IdkcxdfWx7PD&qeyqk{pIwqUuq$QhtWGXv2bMa5&*=AAsG|w) zd!wuoGu=W?maEg*GyjQ*U(@;c#akCds=gTrr@{t6OV&nqvrz$c4Hu!fu!5zfBtu%N z3`&bnvU5!>aIYZ+?wvXTWk;nDHpc<{$M*s}_d*y^)|5jv!~J?J>83h8)9TN}K5$yo z`T7&GeR1T?Qg3$eaxJT?I}3Ta3YICCGs>M|{)*0IaCOYJvb^kUcBY|$H8-4t48Qfv z$E+I@Pd1>~oz5I^I)k}jMt7_JIFtT#zWm9?O_(sjCMqf_y`k|8lgW}KVec0j8c@bX zut4j6%+IPX=377bU(a6)3yV=cK0e~+<_mvKPfh+?N^%0_?pbygcQy)3E=S8+&mReT z(yB9BUhp}7%kzfgz}5L@9B-L4j+pnYtF33(Z(Ll)9U{byN8Axle6Xfr2s1^vdHC#%H07>yEj0P(cu^!ah%^+&)hoGa#JuWgTf z(r@nE7V$*#$;`Ew}7f5Q@20;^Etgz1V5B^10TpgoK3D6j@SZNl`w|$rQq* zori5ov@uMnEMxaua@q9~e|GKqU8qp1S#nYWjt93t!+)=%GdgqnabNhJXr#(cKxt_S zYrghJmY15)EOs)#kGW!!KNH*ZL;GL#T(ft{E>|e>8ml!bw2?B74^B@}Zk!BpOmy%A;phBM^xbIxx;jt~ z8e?49?WTNaJb#@j^2=Fjaw4F9v*MxxcJ5*`+-zxP#Zf`*u=@Z_IBI8W~< z%Z~q&h35~sac|Y12Do)*KRdY*<*)1iYkmG5dhC4ST)2Hv$&@E6ez=5~?_R%*=kPYO zAX^i}YzPtu^nJ+AaJ~YqxBU7`_;J66)1N?VJ$B>fRT@i9e@QPhL!WhL_)r_cN+^hVt#9|zZ44k!6Ow7#O|Cc2A@&ASqS=?VdR?$@+BXi^Vv9FNN=?7=v*-Rq_~dZ{xso-ba~2SJ0jRM zv<0}H%OD~CD0^`K9z2Qp$=~Z-?PHIwbYwT1>ez$te}p^r;oSV?{C`3IR44hXD1Ia! zFebR$l+OZf29Z5Pyu92AANlyL{u_=7;(zSF;k!`B4`}a;wV?dd+xl3X{URHaoOJwA zS!wZ4Zfj~=d{r2nhoW^EiR zTZ4K|=S_Hf*=ma@*F*MGwNu1ys&ZJu#`P>q>og5EZ+u54e!gD?B zRB&IomKVt`rEO+)A%6g+H^(#Pp*Mn5XVQ@C%_WC*RAl)gSkp7_k=kSN&I)mr#(7!cg zl4+Kpk{x2#n-u>j_A~h})vg{~UW+?BAgpDaJ=NM)dWO2C+=BRzy*m8lKZvdMIJ=Gh zEv~7Cfd5HhQHvemb94RtO`E*8In8u%maMgkt&6b#mugoRiVZmblyZn%j!{^j1^L6P zl>ZiY*I1tq`(liw&)Jb6jcy9CT+@)(LB{l3D$xdz-^oHiR zpgUAnqW+}6LjCF8vq!&ZpY`>UxmNczIjQ&UCXIKZSm9~P+4B!Q-XGk*`!Hpq_a%*3 zpH=O88#Ji@NV39WrG5UYY&u2;cL(r~JWa3p2|DQlDeaw!_^_OpJ#< SPrKLOyq3Ug3H<+-!2bZ4KjJX} literal 0 HcmV?d00001