[Feature] OAuth 로그인시 토큰 전달 방식 변경 (#286)

* feat: TokenGenerateMachine 삭제

* feat(auth): userId로 role, accessToken 조회 기능 추가

* feat(auth): 현재 액세스 토큰 기준 userInfo, accessToken 조회 엔드포인트 추가 및 개선

* feat(token): login 토큰 추가, 구조 개선

* feat(user): 유저 정보 dto 정적 팩토리 메서드 추가

* feat(user): 유저 권한 조회 기능 추가

* feat(refreshToken): 유저 아이디 기준 리프레시 토큰 조회 기능 추가

* feat(refreshToken): 유저 아이디 기준 리프레시 토큰 조회 기능 추가

* feat(cookie): 로그인 토큰 설정 기능 추가 및 로직 개선

* feat(cookie): 토큰 타입 파라미터 추가 및 로직 개선

* feat(oauth): 리디렉션 주소 변경 및 로그인 토큰 발급 추가

- 로그인이 완료되면 엑세스 토큰과 리프레시 토큰은 서버에서 관리됨.
- 쿠키에는 로그인 토큰이 설정되고 이를 활용해서 엑세스 토큰을 발급받을 수 있음.

* feat(token): 로그인 토큰 생성 기능 추가 및 로직 개선

* refactor(token): 메서드 네이밍 변경

* refactor(token): 메서드 네이밍 변경

* refactor: 병합 충돌 해결

* test: 인자 사용

* test(jwt): 사용하지 않는 메서드 삭제

* feat(auth): 메시지 수정

* test(user): 유저 아이디 기준 유저 권한 조회 테스트 추가

* refactor(token): 토큰 타입 명명 수정

* refactor: 코드 리뷰 반영

Author: m-a-king

src/main/java/com/somemore/develop/controller/TokenGenerateMachine.java

@@ -0,0 +1,45 @@
+package com.somemore.global.auth.controller;
+
+import com.somemore.global.auth.annotation.CurrentUser;
+import com.somemore.global.auth.dto.UserInfoResponseDto;
+import com.somemore.global.auth.jwt.domain.EncodedToken;
+import com.somemore.global.auth.usecase.AuthQueryUseCase;
+import com.somemore.global.common.response.ApiResponse;
+import com.somemore.user.domain.UserRole;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.UUID;
+
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/api/auth")
+public class AuthController {
+
+    private final AuthQueryUseCase authQueryUseCase;
+
+    @GetMapping("/user-info")
+    public ApiResponse<UserInfoResponseDto> getUserInfo(
+            @CurrentUser UUID userId
+    ) {
+        UserRole role = authQueryUseCase.getRoleByUserId(userId);
+
+        return ApiResponse.ok(HttpStatus.OK.value(),
+                UserInfoResponseDto.of(userId, role),
+                "유저 정보 응답 성공");
+    }
+
+    @GetMapping("/token")
+    public ApiResponse<String> getToken(
+            @CurrentUser UUID userId
+    ) {
+        EncodedToken accessToken = authQueryUseCase.getAccessTokenByUserId(userId);
+
+        return ApiResponse.ok(HttpStatus.OK.value(),
+                accessToken.getValueWithPrefix(),
+                "액세스 토큰 응답 성공");
+    }
+}

src/main/java/com/somemore/global/auth/controller/AuthController.java

@@ -13,21 +13,19 @@
 public class CookieService implements CookieUseCase {
 
     @Override
-    public void setAccessToken(HttpServletResponse response, String value) {
-        ResponseCookie cookie = generateCookie(TokenType.ACCESS, value);
+    public void setToken(HttpServletResponse response, String value, TokenType tokenType) {
+        ResponseCookie cookie = generateCookie(tokenType, value);
         response.addHeader("Set-Cookie", cookie.toString());
-        log.info("SET_COOKIE_ACCESS_TOKEN = {}", value);
     }
 
     @Override
     public void deleteAccessToken(HttpServletResponse response) {
-        ResponseCookie cookie = generateCookie(TokenType.SIGNOUT, TokenType.SIGNOUT.name());
+        ResponseCookie cookie = generateCookie(TokenType.SIGN_OUT, TokenType.SIGN_OUT.name());
         response.addHeader("Set-Cookie", cookie.toString());
-        log.info("DELETE_COOKIE_ACCESS_TOKEN");
     }
 
     private static ResponseCookie generateCookie(TokenType tokenType, String value) {
-        return ResponseCookie.from(TokenType.ACCESS.name(), value)
+        return ResponseCookie.from(TokenType.ACCESS.getDescription(), value)
                 .domain(".somemore.site")
                 .httpOnly(true)
                 .secure(true)

src/main/java/com/somemore/global/auth/controller/UserInfoQueryController.java

@@ -1,9 +1,11 @@
 package com.somemore.global.auth.cookie;
 
+import com.somemore.global.auth.jwt.domain.TokenType;
 import jakarta.servlet.http.HttpServletResponse;
 
 public interface CookieUseCase {
-    void setAccessToken(HttpServletResponse response, String value);
+
+    void setToken(HttpServletResponse response, String value, TokenType tokenType);
 
     void deleteAccessToken(HttpServletResponse response);
 }

src/main/java/com/somemore/global/auth/cookie/CookieService.java

@@ -1,8 +1,11 @@
 package com.somemore.global.auth.dto;
 
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.somemore.user.domain.UserRole;
 import io.swagger.v3.oas.annotations.media.Schema;
 
+import java.util.UUID;
+
 @Schema(description = "유저 정보 DTO")
 public record UserInfoResponseDto(
         @JsonProperty("USER_ID")
@@ -13,4 +16,7 @@ public record UserInfoResponseDto(
         @Schema(description = "유저 ROLE")
         String role
 ) {
+        public static UserInfoResponseDto of(UUID userId, UserRole role) {
+                return new UserInfoResponseDto(userId.toString(), role.getAuthority());
+        }
 }

src/main/java/com/somemore/global/auth/cookie/CookieUseCase.java

@@ -1,7 +1,6 @@
 package com.somemore.global.auth.idpw.filter;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
-import com.somemore.global.auth.cookie.CookieUseCase;
 import com.somemore.global.auth.jwt.domain.EncodedToken;
 import com.somemore.global.auth.jwt.usecase.GenerateTokensOnLoginUseCase;
 import com.somemore.user.domain.UserRole;
@@ -47,7 +46,7 @@ protected void successfulAuthentication(HttpServletRequest request, HttpServletR
         String userId = authResult.getName();
         String role = extractRole(authResult);
         EncodedToken accessToken =
-                generateTokensOnLoginUseCase.saveRefreshTokenAndReturnAccessToken(
+                generateTokensOnLoginUseCase.generateAuthTokensAndReturnAccessToken(
                         UUID.fromString(userId),
                         UserRole.from(role));
 

src/main/java/com/somemore/global/auth/dto/UserInfoResponseDto.java

@@ -1,20 +1,27 @@
 package com.somemore.global.auth.jwt.domain;
 
-import lombok.Getter;
+import lombok.RequiredArgsConstructor;
 
-@Getter
+import java.time.Duration;
+
+@RequiredArgsConstructor
 public enum TokenType {
-    ACCESS(1000 * 60 * 30),
-    REFRESH(1000 * 60 * 60 * 24 * 7),
-    SIGNOUT(0);
+    ACCESS(Duration.ofMinutes(30)),
+    REFRESH(Duration.ofDays(7)),
+    SIGN_IN(Duration.ofMinutes(1)),
+    SIGN_OUT(Duration.ZERO);
+
+    private final Duration period;
 
-    private final int period;
+    public String getDescription() {
+        return this.name() + "_TOKEN";
+    }
 
-    TokenType(int period) {
-        this.period = period;
+    public int getPeriodInMillis() {
+        return Math.toIntExact(period.toMillis());
     }
 
     public int getPeriodInSeconds() {
-        return Math.toIntExact(period / 1000);
+        return Math.toIntExact(period.getSeconds());
     }
 }

src/main/java/com/somemore/global/auth/idpw/filter/IdPwAuthFilter.java

@@ -23,7 +23,7 @@ public class HmacJwtGenerator implements JwtGenerator {
     public EncodedToken generateToken(String userId, String role, TokenType tokenType) {
         Claims claims = buildClaims(userId, role);
         Instant now = Instant.now();
-        Instant expiration = now.plusMillis(tokenType.getPeriod());
+        Instant expiration = now.plusMillis(tokenType.getPeriodInMillis());
         String uniqueId = UUID.randomUUID().toString(); // JTI
 
         return new EncodedToken(Jwts.builder()

src/main/java/com/somemore/global/auth/jwt/domain/TokenType.java

@@ -8,18 +8,26 @@
 import lombok.RequiredArgsConstructor;
 import org.springframework.stereotype.Service;
 
+import java.util.UUID;
+
 @Service
 @RequiredArgsConstructor
 public class RedisRefreshTokenManager implements RefreshTokenManager {
 
     private final RefreshTokenRepository refreshTokenRepository;
 
     @Override
-    public RefreshToken findRefreshToken(EncodedToken accessToken) {
+    public RefreshToken findRefreshTokenByAccessToken(EncodedToken accessToken) {
         return refreshTokenRepository.findByAccessToken(accessToken.value())
                 .orElseThrow(() -> new JwtException(JwtErrorType.EXPIRED_TOKEN));
     }
 
+    @Override
+    public RefreshToken findRefreshTokenByUserId(UUID userId) {
+        return refreshTokenRepository.findByUserId(userId.toString())
+                .orElseThrow(() -> new JwtException(JwtErrorType.EXPIRED_TOKEN));
+    }
+
     @Override
     public void save(RefreshToken refreshToken) {
         refreshTokenRepository.save(refreshToken);