refs #710: remove POC4 URL remember tokens

poc4_active_source_20260714/apps/poc4/mcp_discovery_ui.py

@@ -10,8 +10,6 @@ with the Bearer token entered on the screen.
 
 from __future__ import annotations
 
-import base64
-import binascii
 import hashlib
 import hmac
 import html
@@ -86,8 +84,6 @@ VPD_OPERATIONS_URL = "https://smilegate-backoffice.cloud-handson.com/"
 PORTAL_AUTHENTICATED_KEY = "poc4_portal_authenticated"
 PORTAL_AUTH_USER_KEY = "poc4_portal_auth_user"
 PORTAL_LOGIN_FAILURE_KEY = "poc4_portal_login_failed"
-PORTAL_REMEMBER_TOKEN_PARAM = "poc4_remember"
-PORTAL_REMEMBER_MAX_AGE_SECONDS = 7 * 24 * 60 * 60
 AUDIT_SCHEMA = "SGMP_POC"
 REFERENCE_EVIDENCE_ENABLED = (
     os.environ.get("POC4_REFERENCE_EVIDENCE_ENABLED", "").strip().lower()
@@ -2106,63 +2102,6 @@ def _portal_credentials_are_valid(username: str, password: str) -> bool:
     return username_matches and password_matches
 
 
-def _portal_remember_secret() -> str:
-    return _portal_auth_value("POC4_LOGIN_REMEMBER_SECRET")
-
-
-def _portal_remember_token(username: str) -> str:
-    secret = _portal_remember_secret()
-    if not secret:
-        return ""
-    payload = {
-        "v": 1,
-        "u": username.strip(),
-        "e": int(datetime.now(timezone.utc).timestamp()) + PORTAL_REMEMBER_MAX_AGE_SECONDS,
-    }
-    encoded = base64.urlsafe_b64encode(
-        json.dumps(payload, separators=(",", ":")).encode("utf-8")
-    ).decode("ascii").rstrip("=")
-    signature = hmac.new(
-        secret.encode("utf-8"), encoded.encode("ascii"), hashlib.sha256
-    ).hexdigest()
-    return f"{encoded}.{signature}"
-
-
-def _restore_portal_remembered_session() -> None:
-    if st.session_state.get(PORTAL_AUTHENTICATED_KEY, False):
-        return
-    token = st.query_params.get(PORTAL_REMEMBER_TOKEN_PARAM, "")
-    if not isinstance(token, str) or not token or len(token) > 2048:
-        return
-    secret = _portal_remember_secret()
-    expected_username = _portal_auth_value("POC4_LOGIN_USER")
-    try:
-        encoded, supplied_signature = token.split(".", 1)
-        expected_signature = hmac.new(
-            secret.encode("utf-8"), encoded.encode("ascii"), hashlib.sha256
-        ).hexdigest()
-        padded = encoded + "=" * (-len(encoded) % 4)
-        payload = json.loads(base64.urlsafe_b64decode(padded).decode("utf-8"))
-        expires_at = int(payload["e"])
-        username = str(payload["u"])
-    except (binascii.Error, KeyError, TypeError, ValueError, UnicodeDecodeError):
-        return
-    if not secret or not hmac.compare_digest(supplied_signature, expected_signature):
-        return
-    if expires_at < int(datetime.now(timezone.utc).timestamp()):
-        return
-    if not hmac.compare_digest(username, expected_username):
-        return
-    st.session_state[PORTAL_AUTHENTICATED_KEY] = True
-    st.session_state[PORTAL_AUTH_USER_KEY] = username
-    st.session_state[PORTAL_LOGIN_FAILURE_KEY] = False
-
-
-def _clear_portal_remembered_session() -> None:
-    if PORTAL_REMEMBER_TOKEN_PARAM in st.query_params:
-        del st.query_params[PORTAL_REMEMBER_TOKEN_PARAM]
-
-
 def _render_portal_login(profile: AppProfile) -> None:
     with st.container(key="console_login_container"):
         render_login_brand(st, profile)
@@ -2181,23 +2120,12 @@ def _render_portal_login(profile: AppProfile) -> None:
                 max_chars=200,
                 placeholder="비밀번호를 입력하세요.",
             )
-            remember_login = st.checkbox(
-                "로그인 유지 (7일)",
-                disabled=not bool(_portal_remember_secret()),
-                help="이 브라우저에서 7일 동안 로그인 상태를 유지합니다.",
-            )
             submitted = st.form_submit_button("로그인", use_container_width=True)
         if submitted:
             if _portal_credentials_are_valid(username, password):
                 st.session_state[PORTAL_AUTHENTICATED_KEY] = True
                 st.session_state[PORTAL_AUTH_USER_KEY] = username.strip()
                 st.session_state[PORTAL_LOGIN_FAILURE_KEY] = False
-                if remember_login:
-                    token = _portal_remember_token(username)
-                    if token:
-                        st.query_params[PORTAL_REMEMBER_TOKEN_PARAM] = token
-                else:
-                    _clear_portal_remembered_session()
                 st.rerun()
             st.session_state[PORTAL_LOGIN_FAILURE_KEY] = True
         if st.session_state.get(PORTAL_LOGIN_FAILURE_KEY, False):
@@ -2209,7 +2137,6 @@ def _render_portal_login(profile: AppProfile) -> None:
 
 
 def _logout_portal() -> None:
-    _clear_portal_remembered_session()
     st.session_state.pop(PORTAL_AUTHENTICATED_KEY, None)
     st.session_state.pop(PORTAL_AUTH_USER_KEY, None)
     st.session_state.pop(PORTAL_LOGIN_FAILURE_KEY, None)
@@ -7221,7 +7148,6 @@ def main() -> None:
         page_title=profile.page_title, page_icon=profile.page_icon, layout="wide"
     )
     _apply_console_theme(profile)
-    _restore_portal_remembered_session()
     if not st.session_state.get(PORTAL_AUTHENTICATED_KEY, False):
         _render_portal_login(profile)
         return