토스 앱
  └ 미니앱 번들 (<appName>.ait — 화면만, 키 없음)
       │  POST https://<이름>.ridm.ai/api/today   (생년월일)
       ▼
  내 서버 (RIDM Apps — HRUM_API_KEY 를 환경변수로 보관)
       │  POST https://api.hrum.ai/api/v1/partners/v1/today
       │  X-Partner-Api-Key: (서버만 아는 키)
       ▼
  HRUM 오늘의 사주 API → 결과 → 서버가 필요한 칸만 골라 미니앱에 돌려줌

{
  "name": "toss-today-server",
  "private": true,
  "type": "module",
  "engines": {
    "node": ">=22"
  },
  "scripts": {
    "start": "node server.mjs",
    "mock": "node mock-hrum.mjs",
    "test": "node --test test/server.test.mjs"
  }
}

// server.mjs — the mini-app's own server. It holds the HRUM API key and calls HRUM for the mini-app.
// The key never goes to the mini-app bundle: the bundle only knows this server's https address.
// Node 22, no dependencies. Run: node server.mjs  (PORT defaults to 3000, as RIDM Apps expects)
import { createServer } from 'node:http';
import { createHash } from 'node:crypto';
import { fileURLToPath } from 'node:url';

const MAX_BODY_BYTES = 2048;
const UPSTREAM_TIMEOUT_MS = 10_000;
const CACHE_MAX_ENTRIES = 5000;
const PER_VISITOR_PER_MINUTE = 20;
const VISITORS_MAX = 10_000; // distinct visitors tracked per minute (memory bound)

/** Read settings from the environment (names only; values are never logged). */
export function loadConfig(env = process.env) {
  const appName = (env.TOSS_APP_NAME || '').trim();
  const extra = (env.EXTRA_ORIGINS || '').split(',').map((s) => s.trim()).filter(Boolean);
  return {
    apiKey: env.HRUM_API_KEY || '',
    hrumBase: (env.HRUM_BASE_URL || 'https://api.hrum.ai/api/v1/partners/v1').replace(/\/+$/, ''),
    appName,
    // Mini-app origins from the Apps-in-Toss docs (SDK 3.1.0+ and 1.x~2.x): live + console QR test.
    origins: new Set([
      ...(appName ? [`https://${appName}.apps.tossmini.com`, `https://${appName}.private-apps.tossmini.com`] : []),
      ...extra,
    ]),
    // Upper bound of HRUM calls per day for this server (a leaked address cannot drain the credit).
    // Use the X-Real-IP header only behind a proxy that overwrites it (RIDM Apps does). Anywhere else a
    // visitor could send a fake header per request and never hit the per-visitor limit.
    trustProxy: env.TRUST_PROXY === '1',
    dailyCap: Number.isFinite(Number(env.DAILY_UPSTREAM_CAP)) && env.DAILY_UPSTREAM_CAP ? Number(env.DAILY_UPSTREAM_CAP) : 2000,
  };
}

/** YYYY-MM-DD in Korea time (fixed +9, no daylight saving). */
export function kstToday(now = new Date()) {
  return new Date(now.getTime() + 9 * 3600 * 1000).toISOString().slice(0, 10);
}

const isInt = (v, min, max) => Number.isInteger(v) && v >= min && v <= max;

/** Validate the mini-app's input; returns { body } for HRUM or { error }. */
export function buildTodayRequest(input, date) {
  if (!input || typeof input !== 'object' || Array.isArray(input)) return { error: 'body must be a JSON object' };
  const { year, month, day, hour, minute, gender, calendar, isLeapMonth } = input;
  if (!isInt(year, 1900, 2100) || !isInt(month, 1, 12) || !isInt(day, 1, 31)) return { error: 'year/month/day' };
  if (hour !== undefined && hour !== null && !isInt(hour, 0, 23)) return { error: 'hour' };
  if (minute !== undefined && minute !== null && !isInt(minute, 0, 59)) return { error: 'minute' };
  if (gender !== 'male' && gender !== 'female') return { error: 'gender' };
  if (calendar !== undefined && calendar !== 'solar' && calendar !== 'lunar') return { error: 'calendar' };
  if (isLeapMonth !== undefined && typeof isLeapMonth !== 'boolean') return { error: 'isLeapMonth' };
  const body = { year, month, day, timezone: 'Asia/Seoul', gender, date };
  // Unknown birth time: leave hour out (HRUM calculates it as noon and says so in birthHour).
  if (hour !== undefined && hour !== null) {
    body.hour = hour;
    body.minute = minute ?? 0;
  }
  if (calendar) body.calendar = calendar;
  if (calendar === 'lunar' && isLeapMonth) body.isLeapMonth = true;
  return { body };
}

/** Only what the screen shows — not the whole HRUM response. */
export function pickToday(data) {
  const s = data?.summary ?? {};
  const o = data?.omen ?? {};
  return {
    date: data?.date ?? null,
    dayGanji: s.today_ganji ?? null,
    dailyFlow: s.daily_flow ?? null,
    relation: o.relation?.label ?? null,
    color: o.color ? { name: o.color.name, hex: o.color.hex } : null,
    food: o.food ?? null,
    keyword: o.keyword ?? null,
    message: o.message ?? null,
    luckyHour: o.luckyHour ?? null,
    avoidHour: o.avoidHour ?? null,
    activity: o.activity ?? null,
  };
}

function send(res, status, payload, headers = {}) {
  const text = payload === null ? '' : JSON.stringify(payload);
  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store', ...headers });
  res.end(text);
}

function readBody(req) {
  return new Promise((resolve, reject) => {
    let size = 0;
    const chunks = [];
    req.on('data', (c) => {
      size += c.length;
      if (size > MAX_BODY_BYTES) { reject(Object.assign(new Error('too large'), { status: 413 })); req.destroy(); return; }
      chunks.push(c);
    });
    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
    req.on('error', reject);
  });
}

/** Build the request handler. Everything that varies (env, fetch, clock) can be injected for tests. */
export function createApp({ config = loadConfig(), fetchImpl = fetch, now = () => new Date(), log = console } = {}) {
  const cache = new Map(); // key → { day, value }
  const inflight = new Map(); // key → Promise
  const visitors = new Map(); // ip → requests in the current minute (emptied when the minute changes)
  let visitorsMinute = -1;
  let upstream = { day: '', count: 0 };

  function corsHeaders(origin) {
    return origin && config.origins.has(origin)
      ? { 'Access-Control-Allow-Origin': origin, Vary: 'Origin' }
      : { Vary: 'Origin' };
  }

  function clientIp(req) {
    const header = config.trustProxy ? req.headers['x-real-ip'] : undefined;
    return String((typeof header === 'string' && header) || req.socket.remoteAddress || 'unknown');
  }

  function tooMany(ip) {
    const minute = Math.floor(now().getTime() / 60000);
    if (minute !== visitorsMinute) { visitors.clear(); visitorsMinute = minute; }
    const count = (visitors.get(ip) ?? 0) + 1;
    // Too many different visitors in one minute: refuse newcomers instead of growing without bound.
    if (count === 1 && visitors.size >= VISITORS_MAX) return true;
    visitors.set(ip, count);
    return count > PER_VISITOR_PER_MINUTE;
  }

  async function callHrum(body) {
    const res = await fetchImpl(`${config.hrumBase}/today`, {
      method: 'POST',
      headers: { 'X-Partner-Api-Key': config.apiKey, 'Content-Type': 'application/json', 'User-Agent': 'toss-today-miniapp/1.0' },
      body: JSON.stringify(body),
      signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS),
    });
    let json = null;
    try { json = await res.json(); } catch { /* non-JSON error page */ }
    return { status: res.status, json, retryAfter: res.headers.get('retry-after') };
  }

  async function today(req, res, cors) {
    if (!config.apiKey) { log.error('HRUM_API_KEY is not set'); return send(res, 500, { error: 'server_not_configured' }, cors); }
    if (tooMany(clientIp(req))) return send(res, 429, { error: 'too_many_requests' }, { ...cors, 'Retry-After': '60' });

    let input;
    try { input = JSON.parse(await readBody(req)); } catch (e) {
      return send(res, e.status === 413 ? 413 : 400, { error: e.status === 413 ? 'body_too_large' : 'invalid_json' }, cors);
    }
    const date = kstToday(now());
    const { body, error } = buildTodayRequest(input, date);
    if (error) return send(res, 400, { error: 'invalid_input', field: error }, cors);

    // Same birth data + same day = same result: HRUM is called once per day per person.
    const key = createHash('sha256').update(JSON.stringify(body)).digest('hex');
    const hit = cache.get(key);
    if (hit && hit.day === date) return send(res, 200, { ...hit.value, cached: true }, cors);

    // Two taps at once share one HRUM call.
    let pending = inflight.get(key);
    if (!pending) {
      if (upstream.day !== date) upstream = { day: date, count: 0 };
      if (upstream.count >= config.dailyCap) { log.error('daily upstream cap reached'); return send(res, 503, { error: 'daily_limit' }, cors); }
      upstream.count += 1;
      pending = callHrum(body).finally(() => inflight.delete(key));
      inflight.set(key, pending);
    }
    let r;
    try { r = await pending; } catch (e) {
      log.error('HRUM call failed:', e.name);
      return send(res, 502, { error: 'upstream_unavailable' }, cors);
    }
    if (r.status === 200 && r.json?.success) {
      const value = pickToday(r.json.data);
      if (cache.size >= CACHE_MAX_ENTRIES) cache.delete(cache.keys().next().value);
      cache.set(key, { day: date, value });
      return send(res, 200, value, cors);
    }
    const code = r.json?.code ?? '';
    log.error(`HRUM answered ${r.status} ${code}`); // status + code only — never the key or the birth data
    if (r.status === 400) return send(res, 400, { error: 'invalid_input' }, cors);
    if (r.status === 429) return send(res, 429, { error: 'too_many_requests' }, { ...cors, 'Retry-After': r.retryAfter || '60' });
    if (r.status === 401 || r.status === 402 || r.status === 403 || r.status === 404) return send(res, 503, { error: 'temporarily_unavailable' }, cors);
    return send(res, 502, { error: 'upstream_unavailable' }, cors);
  }

  async function handle(req, res) {
    const origin = req.headers.origin;
    const cors = corsHeaders(origin);
    const path = (req.url || '/').split('?')[0];
    try {
      if (req.method === 'GET' && (path === '/' || path === '/health')) {
        return send(res, 200, { ok: true, keySet: Boolean(config.apiKey), appNameSet: Boolean(config.appName) });
      }
      if (path !== '/api/today') return send(res, 404, { error: 'not_found' });
      // A browser sends Origin; only the mini-app origins may read the answer (CORS).
      if (origin && !config.origins.has(origin)) return send(res, 403, { error: 'origin_not_allowed' }, { Vary: 'Origin' });
      if (req.method === 'OPTIONS') {
        return send(res, 204, null, { ...cors, 'Access-Control-Allow-Methods': 'POST', 'Access-Control-Allow-Headers': 'Content-Type', 'Access-Control-Max-Age': '600' });
      }
      if (req.method !== 'POST') return send(res, 405, { error: 'method_not_allowed' }, { ...cors, Allow: 'POST, OPTIONS' });
      return await today(req, res, cors);
    } catch (e) {
      log.error('unexpected error:', e.name);
      if (!res.headersSent) send(res, 500, { error: 'internal' }, cors);
    }
  }
  // For tests: how many entries the in-memory maps hold.
  handle.stats = () => ({ visitors: visitors.size, cache: cache.size });
  return handle;
}

// Started directly (node server.mjs) → listen. Imported (tests) → nothing runs.
if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
  const config = loadConfig();
  const port = Number(process.env.PORT || 3000);
  createServer(createApp({ config })).listen(port, process.env.HOSTNAME || '0.0.0.0', () => {
    console.log(`listening on ${port} · key ${config.apiKey ? 'set' : 'MISSING'} · origins ${config.origins.size}`);
  });
}

// mock-hrum.mjs — a local stand-in for POST https://api.hrum.ai/api/v1/partners/v1/today.
// It answers with the response example of the HRUM docs (오늘의 사주 API) so you can build and test
// without a key and without spending credit. It does NOT calculate anything — the values are fixed.
// Run: node mock-hrum.mjs  (port 4010) → then HRUM_BASE_URL=http://127.0.0.1:4010/api/v1/partners/v1
import { createServer } from 'node:http';
import { fileURLToPath } from 'node:url';

export const MOCK_KEY = 'mock-key-for-local-tests';

export function mockData(date) {
  return {
    date,
    summary: {
      ilju: '경진', day_master: '경', today_date: date, today_ganji: '정사', today_day_ohaeng: '화',
      today_sipsin: '정관', flow_score: 60, flow_tier: 'good',
      daily_flow: '오늘(정사일) 화 에너지가 흘러 소통·확장에 유리해.',
    },
    omen: {
      relation: { type: 'GEUK', label: '조율의 날' },
      color: { name: '주황', hex: '#FFA45B', ohaeng: '화' },
      food: '고추장비빔밥',
      keyword: '공개',
      message: '표현하고 싶은 마음과 주변 반응이 엇갈릴 수 있는 날이에요. 즉흥적인 말보다 한 박자 늦춘 표현이 좋아요.',
      luckyHour: '오전 11시 ~ 오후 1시',
      avoidHour: '밤 11시 이후',
      activity: '칭찬 먼저 하기',
    },
    taskAffinity: [],
  };
}

export function createMock() {
  const state = { calls: 0, lastBody: null, failWith: null };
  const server = createServer((req, res) => {
    let raw = '';
    req.on('data', (c) => { raw += c; });
    req.on('end', () => {
      const reply = (status, body) => { res.writeHead(status, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(body)); };
      if (req.method !== 'POST' || req.url !== '/api/v1/partners/v1/today') return reply(404, { success: false, statusCode: 404, code: 'NOT_FOUND' });
      if (req.headers['x-partner-api-key'] !== MOCK_KEY) return reply(401, { success: false, statusCode: 401, code: 'UNAUTHORIZED', message: 'Invalid API key' });
      state.calls += 1;
      try { state.lastBody = JSON.parse(raw); } catch { return reply(400, { success: false, statusCode: 400 }); }
      if (state.failWith) return reply(state.failWith, { success: false, statusCode: state.failWith, code: state.failWith === 402 ? 'INSUFFICIENT_BALANCE' : 'ERROR' });
      reply(200, { success: true, data: mockData(state.lastBody.date) });
    });
  });
  return { server, state };
}

if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
  createMock().server.listen(4010, '127.0.0.1', () => console.log(`mock HRUM on http://127.0.0.1:4010 (key: ${MOCK_KEY})`));
}

// test/server.test.mjs — runs the real server against the local mock HRUM (no key, no credit).
// Run: npm test
import { test, before, after } from 'node:test';
import assert from 'node:assert/strict';
import { createServer } from 'node:http';
import { createApp, loadConfig, buildTodayRequest, kstToday } from '../server.mjs';
import { createMock, MOCK_KEY } from '../mock-hrum.mjs';

const APP = 'my-today';
const LIVE = `https://${APP}.apps.tossmini.com`;
const QR = `https://${APP}.private-apps.tossmini.com`;
const quiet = { error() {}, log() {} };
let mock, server, base;

function start(handler) {
  return new Promise((resolve) => {
    const s = createServer(handler).listen(0, '127.0.0.1', () => resolve(s));
  });
}

before(async () => {
  mock = createMock();
  await new Promise((r) => mock.server.listen(0, '127.0.0.1', r));
  const config = loadConfig({
    HRUM_API_KEY: MOCK_KEY,
    TOSS_APP_NAME: APP,
    HRUM_BASE_URL: `http://127.0.0.1:${mock.server.address().port}/api/v1/partners/v1`,
  });
  server = await start(createApp({ config, log: quiet }));
  base = `http://127.0.0.1:${server.address().port}`;
});
after(() => { server.close(); mock.server.close(); });

const birth = { year: 1990, month: 5, day: 15, hour: 12, minute: 0, gender: 'male' };
const post = (body, origin = LIVE) =>
  fetch(`${base}/api/today`, { method: 'POST', headers: { 'Content-Type': 'application/json', Origin: origin }, body: JSON.stringify(body) });

test('health answers on / without showing the key', async () => {
  const r = await fetch(`${base}/`);
  assert.equal(r.status, 200);
  const j = await r.json();
  assert.deepEqual(j, { ok: true, keySet: true, appNameSet: true });
});

test('preflight: mini-app origins are allowed, others are refused', async () => {
  for (const origin of [LIVE, QR]) {
    const r = await fetch(`${base}/api/today`, { method: 'OPTIONS', headers: { Origin: origin, 'Access-Control-Request-Method': 'POST' } });
    assert.equal(r.status, 204);
    assert.equal(r.headers.get('access-control-allow-origin'), origin);
  }
  const bad = await fetch(`${base}/api/today`, { method: 'OPTIONS', headers: { Origin: 'https://evil.example' } });
  assert.equal(bad.status, 403);
  assert.equal(bad.headers.get('access-control-allow-origin'), null);
});

test('today: sends the key in X-Partner-Api-Key, today (KST) as date, and returns only screen fields', async () => {
  const r = await post(birth);
  assert.equal(r.status, 200);
  const j = await r.json();
  assert.equal(j.relation, '조율의 날');
  assert.equal(j.color.hex, '#FFA45B');
  assert.equal(j.date, kstToday());
  assert.equal(mock.state.lastBody.timezone, 'Asia/Seoul');
  assert.equal(mock.state.lastBody.date, kstToday());
  assert.equal('summary' in j, false);
});

test('same person, same day → second answer comes from the cache (one HRUM call)', async () => {
  const before = mock.state.calls;
  const a = await post({ ...birth, day: 16 });
  const b = await post({ ...birth, day: 16 });
  assert.equal(a.status, 200);
  assert.equal((await b.json()).cached, true);
  assert.equal(mock.state.calls - before, 1);
});

test('unknown birth time: hour is left out of the HRUM request', async () => {
  const r = await post({ year: 1991, month: 2, day: 3, gender: 'female' });
  assert.equal(r.status, 200);
  assert.equal('hour' in mock.state.lastBody, false);
});

test('bad input → 400 and no HRUM call', async () => {
  const before = mock.state.calls;
  const r = await post({ ...birth, month: 13 });
  assert.equal(r.status, 400);
  assert.equal(mock.state.calls, before);
});

test('HRUM 402 (no credit) → 503 to the mini-app, nothing cached', async () => {
  mock.state.failWith = 402;
  const r = await post({ ...birth, day: 20 });
  mock.state.failWith = null;
  assert.equal(r.status, 503);
  assert.deepEqual(await r.json(), { error: 'temporarily_unavailable' });
  const again = await post({ ...birth, day: 20 });
  assert.equal(again.status, 200);
});

test('a wrong key never reaches the screen as a key problem', async () => {
  const s = await start(createApp({
    config: loadConfig({ HRUM_API_KEY: 'wrong', TOSS_APP_NAME: APP, HRUM_BASE_URL: `http://127.0.0.1:${mock.server.address().port}/api/v1/partners/v1` }),
    log: quiet,
  }));
  const r = await fetch(`http://127.0.0.1:${s.address().port}/api/today`, { method: 'POST', headers: { Origin: LIVE, 'Content-Type': 'application/json' }, body: JSON.stringify(birth) });
  s.close();
  assert.equal(r.status, 503);
});

test('no key configured → 500 server_not_configured', async () => {
  const s = await start(createApp({ config: loadConfig({ TOSS_APP_NAME: APP }), log: quiet }));
  const r = await fetch(`http://127.0.0.1:${s.address().port}/api/today`, { method: 'POST', headers: { Origin: LIVE }, body: '{}' });
  s.close();
  assert.equal(r.status, 500);
});

test('buildTodayRequest: lunar leap month is passed only with calendar lunar', () => {
  assert.equal(buildTodayRequest({ ...birth, calendar: 'lunar', isLeapMonth: true }, '2026-10-28').body.isLeapMonth, true);
  assert.equal(buildTodayRequest({ ...birth, isLeapMonth: true }, '2026-10-28').body.isLeapMonth, undefined);
  assert.equal(buildTodayRequest({ ...birth, gender: 'x' }, '2026-10-28').error, 'gender');
});

// A fresh app with its own clock: rate-limit tests must not share counters with the tests above.
async function limitApp(env, clock) {
  const app = createApp({
    config: loadConfig({ HRUM_API_KEY: MOCK_KEY, TOSS_APP_NAME: APP, HRUM_BASE_URL: `http://127.0.0.1:${mock.server.address().port}/api/v1/partners/v1`, ...env }),
    now: () => clock.t,
    log: quiet,
  });
  const s = await start(app);
  const hit = (ip) => fetch(`http://127.0.0.1:${s.address().port}/api/today`, {
    method: 'POST', headers: { Origin: LIVE, 'Content-Type': 'application/json', 'X-Real-IP': ip }, body: '{}',
  });
  return { app, s, hit };
}

test('a fake X-Real-IP does not escape the per-visitor limit (no TRUST_PROXY)', async () => {
  const { s, hit } = await limitApp({}, { t: new Date('2026-10-28T03:00:00Z') });
  const codes = [];
  for (let i = 0; i < 21; i++) codes.push((await hit(`10.0.0.${i}`)).status);
  s.close();
  assert.equal(codes.filter((c) => c === 429).length, 1); // the 21st request from the same socket
});

test('TRUST_PROXY=1: the proxy-set X-Real-IP separates visitors', async () => {
  const { s, hit } = await limitApp({ TRUST_PROXY: '1' }, { t: new Date('2026-10-28T03:00:00Z') });
  const codes = [];
  for (let i = 0; i < 21; i++) codes.push((await hit(`10.0.0.${i}`)).status);
  s.close();
  assert.equal(codes.includes(429), false);
});

test('visitor counters of a past minute are dropped', async () => {
  const clock = { t: new Date('2026-10-28T03:00:00Z') };
  const { app, s, hit } = await limitApp({ TRUST_PROXY: '1' }, clock);
  for (let i = 0; i < 5; i++) await hit(`10.0.1.${i}`);
  assert.equal(app.stats().visitors, 5);
  clock.t = new Date('2026-10-28T03:01:00Z');
  await hit('10.0.2.1');
  s.close();
  assert.equal(app.stats().visitors, 1);
});

npm test

npm run mock

HRUM_API_KEY=mock-key-for-local-tests \
HRUM_BASE_URL=http://127.0.0.1:4010/api/v1/partners/v1 \
TOSS_APP_NAME=my-today EXTRA_ORIGINS=http://localhost:5173 \
npm start

curl -s -X POST http://localhost:3000/api/today \
  -H "Content-Type: application/json" -H "Origin: http://localhost:5173" \
  -d '{"year":1990,"month":5,"day":15,"hour":12,"minute":0,"gender":"male"}'

{
  "name": "toss-today-miniapp",
  "private": true,
  "type": "module",
  "scripts": {
    "dev": "vite",
    "build": "vite build && node scripts/check-bundle.mjs dist && ait build"
  },
  "dependencies": {
    "@apps-in-toss/web-framework": "3.8.0"
  },
  "devDependencies": {
    "@apps-in-toss/devtools": "3.8.0",
    "vite": "7.3.7"
  }
}

import { defineConfig } from '@apps-in-toss/web-framework/config';

// appName must be exactly the appName registered in the Apps-in-Toss console (it cannot be changed later).
export default defineConfig({
  appName: 'my-today',
  brand: {
    primaryColor: '#3182F6',
  },
  webView: {},
  permissions: [],
  webBundleDir: 'dist',
});

import { defineConfig } from 'vite';
import aitDevtools from '@apps-in-toss/devtools/unplugin';

// devtools: Apps-in-Toss SDK calls (Storage etc.) work in a local browser while developing.
export default defineConfig({
  plugins: [aitDevtools.vite()],
});

<!doctype html>
<html lang="ko">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
<meta name="color-scheme" content="light">
<title>오늘의 운세</title>
</head>
<body>
<main class="page">
  <header class="intro">
    <h1>오늘의 운세</h1>
    <p>생년월일을 넣으면 오늘의 흐름과 행운 색·시간을 알려 줘요. 재미로 보는 운세예요.</p>
  </header>

  <form id="birth" class="card" novalidate>
    <label>생년월일 <input id="date" type="date" min="1900-01-01" max="2100-12-31" required></label>
    <label>태어난 시각 <input id="time" type="time"></label>
    <label class="check"><input id="noTime" type="checkbox"> 태어난 시각을 몰라요</label>
    <fieldset>
      <legend>성별</legend>
      <label class="check"><input type="radio" name="gender" value="female" required> 여성</label>
      <label class="check"><input type="radio" name="gender" value="male"> 남성</label>
    </fieldset>
    <button id="submit" type="submit">오늘의 운세 보기</button>
    <p id="status" class="status" role="status" aria-live="polite"></p>
  </form>

  <section id="result" class="card result" hidden aria-live="polite">
    <p class="relation" id="relation"></p>
    <p class="message" id="message"></p>
    <dl class="facts">
      <div><dt>행운 색</dt><dd><span id="swatch" class="swatch"></span><span id="color"></span></dd></div>
      <div><dt>좋은 시간</dt><dd id="lucky"></dd></div>
      <div><dt>피할 시간</dt><dd id="avoid"></dd></div>
      <div><dt>추천 활동</dt><dd id="activity"></dd></div>
      <div><dt>행운 음식</dt><dd id="food"></dd></div>
      <div><dt>키워드</dt><dd id="keyword"></dd></div>
    </dl>
    <p class="flow" id="flow"></p>
    <button id="edit" type="button" class="ghost">생년월일 다시 넣기</button>
  </section>
</main>
<script type="module" src="/src/main.js"></script>
</body>
</html>

// src/main.js — the mini-app screen. It talks only to OUR server (VITE_API_BASE), never to HRUM directly:
// the HRUM API key lives on the server, so nothing secret is inside this bundle.
import { Storage } from '@apps-in-toss/web-framework';
import './style.css';

const API_BASE = (import.meta.env.VITE_API_BASE || '').replace(/\/+$/, '');
const SAVED_KEY = 'birth-v1';
const $ = (id) => document.getElementById(id);

// Saved birth data stays on the phone (Apps-in-Toss Storage). If storage fails, the app still works.
async function loadSaved() {
  try {
    const raw = await Storage.getItem(SAVED_KEY);
    return raw ? JSON.parse(raw) : null;
  } catch {
    return null;
  }
}
async function save(birth) {
  try { await Storage.setItem(SAVED_KEY, JSON.stringify(birth)); } catch { /* keep going without saving */ }
}

function readForm() {
  const date = $('date').value; // YYYY-MM-DD
  const gender = document.querySelector('input[name="gender"]:checked')?.value;
  if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) return { error: '생년월일을 넣어 주세요.' };
  if (!gender) return { error: '성별을 골라 주세요.' };
  const [year, month, day] = date.split('-').map(Number);
  const birth = { year, month, day, gender };
  if (!$('noTime').checked && $('time').value) {
    const [hour, minute] = $('time').value.split(':').map(Number);
    Object.assign(birth, { hour, minute });
  }
  return { birth };
}

function fillForm(b) {
  $('date').value = `${b.year}-${String(b.month).padStart(2, '0')}-${String(b.day).padStart(2, '0')}`;
  if (b.hour !== undefined) $('time').value = `${String(b.hour).padStart(2, '0')}:${String(b.minute ?? 0).padStart(2, '0')}`;
  $('noTime').checked = b.hour === undefined;
  $('time').disabled = $('noTime').checked;
  const g = document.querySelector(`input[name="gender"][value="${b.gender}"]`);
  if (g) g.checked = true;
}

const MESSAGES = {
  400: '입력한 생년월일을 다시 확인해 주세요.',
  429: '잠시 후 다시 시도해 주세요.',
  503: '지금은 운세를 불러올 수 없어요. 잠시 후 다시 시도해 주세요.',
};

async function fetchToday(birth) {
  const res = await fetch(`${API_BASE}/api/today`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(birth),
    signal: AbortSignal.timeout(15000),
  });
  if (!res.ok) throw new Error(MESSAGES[res.status] || '운세를 불러오지 못했어요. 잠시 후 다시 시도해 주세요.');
  return res.json();
}

function show(t) {
  $('relation').textContent = t.relation ? `오늘은 ${t.relation}` : '오늘의 운세';
  $('message').textContent = t.message ?? '';
  $('color').textContent = t.color?.name ?? '-';
  $('swatch').style.background = /^#[0-9a-f]{6}$/i.test(t.color?.hex ?? '') ? t.color.hex : 'transparent';
  $('lucky').textContent = t.luckyHour ?? '-';
  $('avoid').textContent = t.avoidHour ?? '-';
  $('activity').textContent = t.activity ?? '-';
  $('food').textContent = t.food ?? '-';
  $('keyword').textContent = t.keyword ?? '-';
  $('flow').textContent = t.dailyFlow ?? '';
  $('birth').hidden = true;
  $('result').hidden = false;
}

let busy = false; // one request at a time — no repeated calls from double taps
async function run(birth) {
  if (busy) return;
  busy = true;
  $('submit').disabled = true;
  $('status').textContent = '불러오는 중이에요…';
  try {
    show(await fetchToday(birth));
    $('status').textContent = '';
  } catch (e) {
    $('status').textContent = e.name === 'TimeoutError' || e.name === 'TypeError'
      ? '연결이 원활하지 않아요. 잠시 후 다시 시도해 주세요.'
      : e.message;
  } finally {
    busy = false;
    $('submit').disabled = false;
  }
}

$('noTime').addEventListener('change', () => { $('time').disabled = $('noTime').checked; });
$('birth').addEventListener('submit', async (ev) => {
  ev.preventDefault();
  const { birth, error } = readForm();
  if (error) { $('status').textContent = error; return; }
  await save(birth);
  await run(birth);
});
$('edit').addEventListener('click', () => { $('result').hidden = true; $('birth').hidden = false; });

// On open: show the form filled with the saved birth data. Nothing pops up by itself.
const saved = await loadSaved();
if (saved) fillForm(saved);
if (!API_BASE) $('status').textContent = 'VITE_API_BASE 가 비어 있어요 (.env 확인).';

/* Light theme only (Apps-in-Toss non-game checklist: the mini-app theme is light mode). */
:root {
  --bg: #f4f5f7;
  --card: #ffffff;
  --ink: #191f28;
  --muted: #6b7684;
  --line: #e5e8eb;
  --accent: #3182f6;
  --on-accent: #ffffff;
  --radius: 16px;
  color-scheme: light;
}
* { box-sizing: border-box; }
body {
  margin: 0;
  background: var(--bg);
  color: var(--ink);
  font-family: -apple-system, BlinkMacSystemFont, 'Apple SD Gothic Neo', 'Noto Sans KR', sans-serif;
  line-height: 1.6;
  word-break: keep-all;
}
.page { max-width: 480px; margin: 0 auto; padding: 20px 16px 40px; }
.intro h1 { font-size: 24px; margin: 8px 0 4px; }
.intro p { margin: 0 0 16px; color: var(--muted); font-size: 15px; }
.card { background: var(--card); border-radius: var(--radius); padding: 20px; display: grid; gap: 14px; }
label { display: grid; gap: 6px; font-size: 14px; color: var(--muted); }
input[type='date'], input[type='time'] {
  font: inherit; font-size: 16px; color: var(--ink);
  padding: 12px; border: 1px solid var(--line); border-radius: 12px; background: #fff; width: 100%;
}
input:focus-visible, button:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
.check { display: flex; align-items: center; gap: 8px; color: var(--ink); font-size: 15px; }
fieldset { border: 0; padding: 0; margin: 0; display: flex; gap: 20px; flex-wrap: wrap; }
legend { font-size: 14px; color: var(--muted); margin-bottom: 6px; width: 100%; }
button {
  font: inherit; font-weight: 700; font-size: 16px; border: 0; border-radius: 12px; padding: 14px;
  background: var(--accent); color: var(--on-accent); cursor: pointer;
}
button:active { transform: scale(0.99); }
button:disabled { opacity: 0.6; }
button.ghost { background: transparent; color: var(--accent); border: 1px solid var(--line); }
.status { margin: 0; min-height: 1.4em; font-size: 14px; color: var(--muted); }
.relation { font-size: 20px; font-weight: 700; margin: 0; }
.message { margin: 0; font-size: 16px; }
.facts { margin: 0; display: grid; grid-template-columns: 1fr 1fr; gap: 10px; }
.facts div { background: var(--bg); border-radius: 12px; padding: 10px 12px; min-width: 0; }
.facts dt { font-size: 12px; color: var(--muted); }
.facts dd { margin: 2px 0 0; font-weight: 600; overflow-wrap: anywhere; display: flex; align-items: center; gap: 6px; }
.swatch { width: 14px; height: 14px; border-radius: 50%; border: 1px solid var(--line); flex: 0 0 auto; }
.flow { margin: 0; color: var(--muted); font-size: 14px; }
[hidden] { display: none !important; }

// scripts/check-bundle.mjs — stops the build when the mini-app bundle could expose the HRUM key.
// The bundle is downloaded to every phone: anything in dist/ is public. Run by "npm run build".
import { readdirSync, readFileSync, statSync } from 'node:fs';
import { join } from 'node:path';

const DIR = process.argv[2] || 'dist';
const RULES = [
  [/X-Partner-Api-Key/i, 'calls HRUM directly with a key header — call your own server instead'],
  [/api\.hrum\.ai/i, 'calls api.hrum.ai directly — only the server may call HRUM'],
  [/HRUM_API_KEY/, 'mentions HRUM_API_KEY — the key belongs to the server environment only'],
];

function* files(dir) {
  for (const name of readdirSync(dir)) {
    const p = join(dir, name);
    if (statSync(p).isDirectory()) yield* files(p);
    else yield p;
  }
}

let bad = 0;
for (const file of files(DIR)) {
  const text = readFileSync(file, 'utf8');
  for (const [re, why] of RULES) {
    if (re.test(text)) { console.error(`BLOCKED ${file}: ${why}`); bad++; }
  }
}
if (bad) process.exit(1);
console.log(`check-bundle: ${DIR} has no HRUM key or direct HRUM call`);

# The https address of YOUR server (part 5). Not a secret — it goes into the bundle.
# Never put the HRUM API key here: every VITE_* value ends up inside the mini-app.
VITE_API_BASE=https://my-today.ridm.ai

cd miniapp
npm install
npm run dev

VITE_API_BASE=https://내앱.ridm.ai npm run build

# RIDM Apps: Dockerfile at the repository root, app answers HTTP on port 3000, runs as user 1000.
# Only the server goes into the image — the mini-app (miniapp/) is uploaded to the Apps-in-Toss console instead.
FROM node:22-alpine
WORKDIR /app
ENV NODE_ENV=production
COPY --chown=1000:1000 package.json server.mjs ./
USER 1000
EXPOSE 3000
CMD ["node", "server.mjs"]

node_modules
miniapp
test
.git
.env*
*.log

node_modules/
dist/
*.ait
.env
.env.local
*.log
*.orig

curl -s https://내앱.ridm.ai/health

curl -s -X POST https://내앱.ridm.ai/api/today \
  -H "Content-Type: application/json" \
  -H "Origin: https://<appName>.private-apps.tossmini.com" \
  -d '{"year":1990,"month":5,"day":15,"hour":12,"minute":0,"gender":"male"}'

{
  "date": "2026-10-28",
  "dayGanji": "을해",
  "dailyFlow": "오늘(을해일) 목 에너지가 흘러 성장·시작에 유리해.",
  "relation": "만남의 날",
  "color": {
    "name": "아이보리",
    "hex": "#FFF4D9"
  },
  "food": "흰살생선 구이",
  "keyword": "투명",
  "message": "만남이 선택과 정리로 이어지는 날이에요. 좋은 인연과 아닌 인연, 필요한 일과 덜어낼 일을 구분하기 좋아요.",
  "luckyHour": "오후 5시 ~ 오후 7시",
  "avoidHour": "오전 3시 ~ 오전 5시",
  "activity": "결산·회계 정리"
}

npx ait token add
npx ait deploy -m "첫 테스트"

curl -sO https://console.hrum.ai/tossEbook/get-book-code.mjs && node get-book-code.mjs && rm get-book-code.mjs

// scripts/get-book-code.mjs — writes every "[완전 코드]" file of the book into this project, exactly as printed.
// First run (empty folder):  curl -sO https://console.hrum.ai/tossEbook/get-book-code.mjs && node get-book-code.mjs && rm get-book-code.mjs
// Later:  node scripts/get-book-code.mjs          → adds missing files, lists files that differ from the book
//         node scripts/get-book-code.mjs --force  → puts the book's text back into differing files (the old text stays in <file>.orig)
// Files the book lets you design (YOURS below) are created when missing but never overwritten.
// package.json files: only "name" is yours — --force keeps it and puts the book's versions and scripts back.
// This script updates itself first: an old copy must not decide what a newer book protects.
import { readFileSync, writeFileSync, existsSync, mkdirSync, realpathSync, copyFileSync } from 'node:fs';
import { dirname, join } from 'node:path';
import { fileURLToPath } from 'node:url';

const BOOK_URL = 'https://console.hrum.ai/tossEbook.html';
// Files the reader may reshape: never overwritten, never compared
const YOURS = new Set([
  'miniapp/apps-in-toss.config.ts', 'miniapp/index.html', 'miniapp/src/style.css', 'miniapp/.env.example',
]);
const SELF = 'scripts/get-book-code.mjs';

// The project is found from where this file sits, not from the current folder (running it from inside scripts/ is fine).
// realpath + lower case: a symlinked folder or macOS's case-insensitive disk must not make the scripts/ copy look like a stray one
const here = realpathSync(fileURLToPath(import.meta.url));
const isSelf = existsSync(join(here, '../..', SELF)) && realpathSync(join(here, '../..', SELF)).toLowerCase() === here.toLowerCase();
const ROOT = isSelf ? dirname(dirname(here)) : dirname(here);
const at = (path) => join(ROOT, path);
if (!isSelf && existsSync(at(SELF))) {
  // The first-run copy in the project root goes stale; only the scripts/ copy keeps itself up to date
  console.error(`${SELF} 로 실행하세요 (루트 사본은 지우세요: git rm --cached --ignore-unmatch get-book-code.mjs && rm get-book-code.mjs)`);
  process.exit(2);
}

const unescape = (s) =>
  s.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"')
    .replace(/&#x27;/g, "'").replace(/&#39;/g, "'").replace(/&amp;/g, '&');
// The book's package.json with your "name" in it (a different dependency must show up as a difference)
const withYourName = (path, text, file) => {
  if (!(path === 'package.json' || path.endsWith('/package.json')) || !existsSync(file)) return text;
  try {
    const book = JSON.parse(text);
    return JSON.stringify({ ...book, name: JSON.parse(readFileSync(file, 'utf8')).name ?? book.name }, null, 2) + '\n';
  } catch { return text; }
};

const args = process.argv.slice(2);
const force = args.includes('--force');
const src = args.find((a) => !a.startsWith('--'));
const html = src ? readFileSync(src, 'utf8') : await (await fetch(BOOK_URL)).text();
const blocks = [...html.matchAll(/\[완전 코드\] ([^\s<]+)[^<]*<\/div><pre>\n?([\s\S]*?)<\/pre>/g)];
if (blocks.length === 0) {
  console.error('책에서 [완전 코드] 블록을 찾지 못했어요 — 주소나 파일을 확인하세요');
  process.exit(1);
}

const selfBlock = blocks.find(([, path]) => path === SELF);
if (selfBlock && isSelf) {
  const text = unescape(selfBlock[2]).trimEnd() + '\n';
  if (readFileSync(at(SELF), 'utf8').trim() !== text.trim()) {
    writeFileSync(at(SELF), text);
    console.log('이 스크립트가 책의 최신판으로 바뀌었어요 — 같은 명령을 한 번 더 실행하세요');
    process.exit(3);
  }
}

const created = [], differs = [], restored = [];
for (const [, path, body] of blocks) {
  if (path.startsWith('/') || path.split('/').includes('..')) continue; // only paths inside this project
  const file = at(path);
  const text = withYourName(path, unescape(body).trimEnd() + '\n', file);
  if (!existsSync(file)) {
    mkdirSync(dirname(file), { recursive: true });
    writeFileSync(file, text);
    created.push(path);
    continue;
  }
  if (readFileSync(file, 'utf8').trim() === text.trim() || YOURS.has(path)) continue;
  if (!force) { differs.push(path); continue; }
  let orig = `${file}.orig`; // your version is kept (*.orig is in .gitignore); an older .orig is never overwritten
  for (let i = 1; existsSync(orig); i++) orig = `${file}.${i}.orig`;
  copyFileSync(file, orig);
  writeFileSync(file, text);
  restored.push([path, path + orig.slice(file.length)]);
}
console.log(`[완전 코드] ${blocks.length}개 — 새로 만듦 ${created.length} · 책 원문으로 되돌림 ${restored.length} · 책과 다름 ${differs.length}`);
// Quoted: paths are printed in quotes so they can be pasted into any shell
for (const [p, orig] of restored) console.log(`  되돌림  "${p}"   (전 내용: "${orig}")`);
// Named only when updating an existing project (a first run creates everything): these must be committed
if (created.length < blocks.length) for (const p of created) console.log(`  새로 만듦  "${p}"   (커밋에 넣으세요)`);
if (restored.some(([p]) => p.endsWith('package.json'))) console.log('  package.json 은 name 줄만 그대로 두고 나머지가 책판으로 바뀌었어요 — 그 폴더에서 npm install 로 package-lock.json 도 맞추세요');
for (const p of differs) console.log(`  다름  "${p}"   (책 원문으로: node scripts/get-book-code.mjs --force)`);
process.exit(differs.length === 0 ? 0 : 1);