[TB -17] 로그아웃과 비밀번호 재설정, 비회원 조회 링크 생성 (#23)

Co-authored-by: baekjaehyuk <bjh010321@naver.com>

Author: tiemo0708

build.gradle

@@ -41,6 +41,7 @@ dependencies {
     implementation 'com.auth0:java-jwt:4.4.0'
     implementation 'com.google.guava:guava:32.1.2-jre'
     implementation 'org.springframework.boot:spring-boot-starter-mail'
+    implementation 'org.springframework.boot:spring-boot-starter-validation'
 }
 
 tasks.withType(Test).configureEach {

src/main/java/com/ClubAccount_BE/auth/adapter/in/web/logout/LogoutApiPresentation.java

@@ -0,0 +1,12 @@
+package com.ClubAccount_BE.auth.adapter.in.web.logout;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+@Tag(name = "Logout", description = "로그아웃 API")
+public interface LogoutApiPresentation {
+    @Operation(summary = "로그아웃", description = "리프레시 토큰 쿠키를 제거하여 로그아웃합니다.")
+     void logout(HttpServletRequest request, HttpServletResponse response);
+}

src/main/java/com/ClubAccount_BE/auth/adapter/in/web/logout/LogoutController.java

@@ -0,0 +1,49 @@
+package com.ClubAccount_BE.auth.adapter.in.web.logout;
+
+import com.ClubAccount_BE.auth.application.port.in.SignOutUseCase;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.ResponseCookie;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Arrays;
+import java.util.Optional;
+
+@RestController
+@RequestMapping("/api/v1/auth")
+@RequiredArgsConstructor
+public class LogoutController implements LogoutApiPresentation{
+
+    private final SignOutUseCase signOutUseCase;
+
+    @PostMapping("/logout")
+    public void logout(HttpServletRequest request, HttpServletResponse response) {
+        extractRefreshToken(request)
+                .ifPresent(signOutUseCase::logout);
+
+        ResponseCookie deleteCookie = ResponseCookie.from("refreshToken", "")
+                .httpOnly(true)
+                .path("/")
+                .maxAge(0)
+                .sameSite("Lax")
+                .secure(true)
+                .build();
+
+        response.addHeader(HttpHeaders.SET_COOKIE, deleteCookie.toString());
+    }
+
+    private Optional<String> extractRefreshToken(HttpServletRequest request) {
+        return Optional.ofNullable(request.getCookies())
+                .flatMap(cookies -> Arrays.stream(cookies)
+                        .filter(cookie -> "refreshToken".equals(cookie.getName()))
+                        .map(Cookie::getValue)
+                        .filter(value -> !value.isBlank())
+                        .findFirst()
+                );
+    }
+}

src/main/java/com/ClubAccount_BE/auth/adapter/out/persistence/InMemoryDeleteRefreshTokenAdapter.java

@@ -0,0 +1,18 @@
+package com.ClubAccount_BE.auth.adapter.out.persistence;
+
+import com.ClubAccount_BE.auth.adapter.out.persistence.repository.InMemoryTokenRepository;
+import com.ClubAccount_BE.auth.application.port.out.DeleteRefreshTokenPort;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+
+@Component
+@RequiredArgsConstructor
+public class InMemoryDeleteRefreshTokenAdapter implements DeleteRefreshTokenPort {
+
+    private final InMemoryTokenRepository tokenRepository;
+
+    @Override
+    public void deleteByRefreshToken(String refreshToken) {
+        tokenRepository.deleteRefreshToken(refreshToken);
+    }
+}

src/main/java/com/ClubAccount_BE/auth/adapter/out/persistence/repository/InMemoryTokenRepository.java

@@ -27,4 +27,8 @@ public void saveRefreshToken(String refreshToken, Long userId) {
     public Optional<Long> getByRefreshToken(String refreshToken) {
         return Optional.ofNullable(TOKEN_REPOSITORY.getIfPresent(refreshToken));
     }
+
+    public void deleteRefreshToken(String refreshToken) {
+        TOKEN_REPOSITORY.invalidate(refreshToken);
+    }
 }

src/main/java/com/ClubAccount_BE/auth/application/port/in/SignOutUseCase.java

@@ -0,0 +1,5 @@
+package com.ClubAccount_BE.auth.application.port.in;
+
+public interface SignOutUseCase {
+    void logout(String refreshToken);
+}

src/main/java/com/ClubAccount_BE/auth/application/port/out/DeleteRefreshTokenPort.java

@@ -0,0 +1,5 @@
+package com.ClubAccount_BE.auth.application.port.out;
+
+public interface DeleteRefreshTokenPort {
+    void deleteByRefreshToken(String refreshToken);
+}

src/main/java/com/ClubAccount_BE/auth/application/service/SignOutService.java

@@ -0,0 +1,20 @@
+package com.ClubAccount_BE.auth.application.service;
+
+import com.ClubAccount_BE.auth.application.port.in.SignOutUseCase;
+import com.ClubAccount_BE.auth.application.port.out.DeleteRefreshTokenPort;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+@RequiredArgsConstructor
+@Transactional
+public class SignOutService implements SignOutUseCase {
+
+    private final DeleteRefreshTokenPort deleteRefreshTokenPort;
+
+    @Override
+    public void logout(String refreshToken) {
+        deleteRefreshTokenPort.deleteByRefreshToken(refreshToken);
+    }
+}

src/main/java/com/ClubAccount_BE/core/config/SecurityConfig.java

@@ -41,6 +41,7 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                     API_V1_PREFIX + "/users/sign-up/check-duplicate-auth-id",
                     API_V1_PREFIX + "/email/send",
                     API_V1_PREFIX + "/email/verify",
+                    API_V1_PREFIX + "/auth/reset-password",
                     "/api-docs",
                     "/swagger-custom-ui.html",
                     "/v3/api-docs",

src/main/java/com/ClubAccount_BE/core/config/WebConfig.java

@@ -22,7 +22,7 @@ public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers)
     @Override
     public void addCorsMappings(CorsRegistry registry) {
         registry.addMapping("/**")
-                .allowedOrigins("http://localhost:5173")
+                .allowedOrigins("http://localhost:5173", "http://172.20.10.3:5173")
                 .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH")
                 .allowedHeaders("*")
                 .exposedHeaders("Authorization", "Set-Cookie")