[refactor] 소셜 로그인 동적 리다이렉트되도록 변경

src/main/java/konkuk/thip/common/exception/code/ErrorCode.java

@@ -24,9 +24,11 @@ public enum ErrorCode implements ResponseCode {
     AUTH_UNSUPPORTED_SOCIAL_LOGIN(HttpStatus.UNAUTHORIZED, 40105, "지원하지 않는 소셜 로그인입니다."),
     AUTH_INVALID_LOGIN_TOKEN_KEY(HttpStatus.UNAUTHORIZED, 40106, "유효하지 않은 로그인 토큰 키입니다."),
     AUTH_BLACKLIST_TOKEN(HttpStatus.UNAUTHORIZED, 40107, "블랙리스트에 등록된 토큰입니다."),
+    AUTH_INTERNAL_SERVER_ERROR(HttpStatus.INTERNAL_SERVER_ERROR, 40108, "인증 처리 중 서버 오류가 발생했습니다."),
 
     JSON_PROCESSING_ERROR(HttpStatus.INTERNAL_SERVER_ERROR, 50100, "JSON 직렬화/역직렬화에 실패했습니다."),
     AWS_BUCKET_BASE_URL_NOT_CONFIGURED(HttpStatus.INTERNAL_SERVER_ERROR, 50101, "aws s3 bucket base url 설정이 누락되었습니다."),
+    WEB_DOMAIN_ORIGIN_EMPTY(HttpStatus.INTERNAL_SERVER_ERROR, 50102, "허용된 웹 도메인 설정이 비어있습니다."),
 
     PERSISTENCE_TRANSACTION_REQUIRED(HttpStatus.INTERNAL_SERVER_ERROR, 50110, "@Transactional 컨텍스트가 필요합니다. 트랜잭션 범위 내에서만 사용할 수 있습니다."),
 

src/main/java/konkuk/thip/common/security/constant/AuthParameters.java

@@ -19,6 +19,9 @@ public enum AuthParameters {
     COOKIE_ACCESS_TOKEN("access_token"),
     COOKIE_TEMP_TOKEN("temp_token"),
 
+    REDIRECT_URL_KEY("redirect_url"),
+    REDIRECT_SESSION_KEY("oauth2_return_to"),
+
     ;
 
     private final String value;

src/main/java/konkuk/thip/common/security/filter/JwtAuthenticationEntryPoint.java

@@ -3,6 +3,8 @@
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import konkuk.thip.common.exception.AuthException;
+import konkuk.thip.common.exception.code.ErrorCode;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.AuthenticationEntryPoint;
@@ -15,16 +17,32 @@
 public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint {
     private final HandlerExceptionResolver resolver;
 
-    public JwtAuthenticationEntryPoint(@Qualifier("handlerExceptionResolver") HandlerExceptionResolver resolver){
+    public JwtAuthenticationEntryPoint(@Qualifier("handlerExceptionResolver")
+                                       HandlerExceptionResolver resolver) {
         this.resolver = resolver;
     }
 
     @Override
-    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
-        Exception e = (Exception) request.getAttribute("exception");
-        if(e == null){
-            e = authException;
+    public void commence(HttpServletRequest request,
+                         HttpServletResponse response,
+                         AuthenticationException authException) throws IOException, ServletException {
+
+        // 필터에서 set한 예외 우선
+        Exception original = (Exception) request.getAttribute("exception");
+        if (original == null) {
+            original = authException;
+        }
+
+        Exception mapped = wrapAsAuthException(original);
+
+        resolver.resolveException(request, response, null, mapped);
+    }
+
+    // 모든 예외를 AuthException(401)으로 감싸는 메서드
+    private Exception wrapAsAuthException(Exception e) {
+        if (e instanceof AuthException) {
+            return e;
         }
-        resolver.resolveException(request, response, null, e);
+        return new AuthException(ErrorCode.AUTH_INTERNAL_SERVER_ERROR, e);
     }
-}
+}

src/main/java/konkuk/thip/common/security/oauth2/CustomSuccessHandler.java

@@ -3,31 +3,33 @@
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import konkuk.thip.common.exception.AuthException;
+import konkuk.thip.common.exception.code.ErrorCode;
+import konkuk.thip.common.security.oauth2.tokenstorage.LoginTokenStorage;
 import konkuk.thip.common.security.util.JwtUtil;
+import konkuk.thip.config.properties.WebDomainProperties;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
 import org.springframework.stereotype.Component;
 
 import java.io.IOException;
 import java.time.Duration;
+import java.util.List;
+import java.util.Objects;
 import java.util.UUID;
 
-import static konkuk.thip.common.security.constant.AuthParameters.REDIRECT_HOME_URL;
-import static konkuk.thip.common.security.constant.AuthParameters.REDIRECT_SIGNUP_URL;
+import static konkuk.thip.common.security.constant.AuthParameters.*;
 
 @Slf4j
 @Component
 @RequiredArgsConstructor
 public class CustomSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
 
-    private static final int COOKIE_MAX_AGE = 60 * 60 * 24; // 1일
     private final LoginTokenStorage loginTokenStorage;
 
-    @Value("${server.web-redirect-url}")
-    private String webRedirectUrl;
+    private final WebDomainProperties webDomainProperties;
 
     private final JwtUtil jwtUtil;
 
@@ -38,6 +40,22 @@ public void onAuthenticationSuccess(
             Authentication authentication
     ) throws IOException, ServletException {
 
+        // Resolver에서 세션에 저장한 origin을 복원
+        String webRedirectDomain = null;
+        if (request.getSession(false) != null) {
+            webRedirectDomain = (String) request.getSession(false).getAttribute(REDIRECT_SESSION_KEY.getValue());
+            request.getSession(false).removeAttribute(REDIRECT_SESSION_KEY.getValue()); // 사용했으면 제거(일회성)
+        }
+
+        // 허용 오리진 검증 및 폴백
+        if (!webDomainProperties.isAllowed(Objects.toString(webRedirectDomain, ""))) {
+            List<String> origins = webDomainProperties.getWebDomainUrls();
+            if (origins == null || origins.isEmpty()) {
+                throw new AuthException(ErrorCode.WEB_DOMAIN_ORIGIN_EMPTY);
+            }
+            webRedirectDomain = origins.get(0);
+        }
+
         CustomOAuth2User oAuth2User = (CustomOAuth2User) authentication.getPrincipal();
         LoginUser loginUser = oAuth2User.getLoginUser();
 
@@ -48,15 +66,15 @@ public void onAuthenticationSuccess(
             String loginTokenKey = UUID.randomUUID().toString();
             loginTokenStorage.put(loginTokenKey, TokenType.TEMP, tempToken, Duration.ofMinutes(5));      // ttl 5분
 
-            getRedirectStrategy().sendRedirect(request, response, webRedirectUrl + REDIRECT_SIGNUP_URL.getValue() + "?loginTokenKey=" + loginTokenKey);
+            getRedirectStrategy().sendRedirect(request, response, webRedirectDomain + REDIRECT_SIGNUP_URL.getValue() + "?loginTokenKey=" + loginTokenKey);
         } else {
             // 기존 유저 - 로그인용 액세스 토큰
             String accessToken = jwtUtil.createAccessToken(loginUser.userId());
 
             String loginTokenKey = UUID.randomUUID().toString();
             loginTokenStorage.put(loginTokenKey, TokenType.ACCESS, accessToken, Duration.ofMinutes(5));      // ttl 5분
 
-            getRedirectStrategy().sendRedirect(request, response, webRedirectUrl + REDIRECT_HOME_URL.getValue() + "?loginTokenKey=" + loginTokenKey);
+            getRedirectStrategy().sendRedirect(request, response, webRedirectDomain + REDIRECT_HOME_URL.getValue() + "?loginTokenKey=" + loginTokenKey);
         }
     }
 }

src/main/java/konkuk/thip/common/security/oauth2/auth/AuthController.java

@@ -10,7 +10,7 @@
 import konkuk.thip.common.exception.BusinessException;
 import konkuk.thip.common.exception.code.ErrorCode;
 import konkuk.thip.common.security.annotation.Oauth2Id;
-import konkuk.thip.common.security.oauth2.LoginTokenStorage;
+import konkuk.thip.common.security.oauth2.tokenstorage.LoginTokenStorage;
 import konkuk.thip.common.security.oauth2.auth.dto.AuthSetCookieRequest;
 import konkuk.thip.common.security.oauth2.auth.dto.AuthSetCookieResponse;
 import konkuk.thip.common.security.oauth2.auth.dto.AuthTokenRequest;
@@ -92,11 +92,11 @@ public BaseResponse<AuthTokenResponse> getToken(
         String token;
         boolean isNewUser;
 
-        if (entry.getType() == ACCESS) {
-            token = entry.getToken();
+        if (entry.type() == ACCESS) {
+            token = entry.token();
             isNewUser = false;
         } else {
-            token = entry.getToken();
+            token = entry.token();
             isNewUser = true;
         }
 
@@ -127,8 +127,8 @@ public BaseResponse<AuthSetCookieResponse> setCookie(
         ResponseCookie cookie;
         String type;
 
-        if (entry.getType() == ACCESS) {
-            cookie = ResponseCookie.from(COOKIE_ACCESS_TOKEN.getValue(), entry.getToken())
+        if (entry.type() == ACCESS) {
+            cookie = ResponseCookie.from(COOKIE_ACCESS_TOKEN.getValue(), entry.token())
                     .httpOnly(true)
                     .secure(true)
                     .sameSite("None")
@@ -137,7 +137,7 @@ public BaseResponse<AuthSetCookieResponse> setCookie(
                     .build();
             type = ACCESS.getValue();
         } else {
-            cookie = ResponseCookie.from(COOKIE_TEMP_TOKEN.getValue(), entry.getToken())
+            cookie = ResponseCookie.from(COOKIE_TEMP_TOKEN.getValue(), entry.token())
                     .httpOnly(true)
                     .secure(true)
                     .sameSite("None")

src/main/java/konkuk/thip/common/security/oauth2/tokenstorage/LoginTokenStorage.java

@@ -0,0 +1,19 @@
+package konkuk.thip.common.security.oauth2.tokenstorage;
+
+import konkuk.thip.common.security.oauth2.TokenType;
+
+import java.time.Duration;
+
+public interface LoginTokenStorage {
+
+    void put(String key, TokenType type, String token, Duration ttl);
+
+    /**
+     * 저장된 토큰을 1회용으로 소비 후 삭제한다.
+     * 존재하지 않으면 null 반환.
+     */
+    Entry consume(String key);
+
+    record Entry(TokenType type, String token) {
+    }
+}

src/main/java/konkuk/thip/common/security/oauth2/tokenstorage/MemoryLoginTokenStorage.java

@@ -0,0 +1,44 @@
+package konkuk.thip.common.security.oauth2.tokenstorage;
+
+import konkuk.thip.common.security.oauth2.TokenType;
+import lombok.RequiredArgsConstructor;
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Component;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.util.concurrent.ConcurrentHashMap;
+
+@Profile("test")
+@Component
+@RequiredArgsConstructor
+public class MemoryLoginTokenStorage implements LoginTokenStorage{
+    private record InternalEntry(TokenType type, String token, long expireAtEpochMillis) { }
+
+    private final ConcurrentHashMap<String, InternalEntry> store = new ConcurrentHashMap<>();
+
+    /**
+     * 토큰을 메모리에 저장 (TTL 적용)
+     */
+    @Override
+    public void put(String key, TokenType type, String token, Duration ttl) {
+        long expiredAt = Instant.now().plus(ttl).toEpochMilli();
+        store.put(key, new InternalEntry(type, token, expiredAt));
+    }
+
+    /**
+     * 토큰을 일회성으로 조회 후 제거 (만료 시 null 반환)
+     */
+    @Override
+    public Entry consume(String key) {
+        InternalEntry entry = store.remove(key);
+        if (entry == null) return null;
+
+        if (entry.expireAtEpochMillis() < Instant.now().toEpochMilli()) {
+            return null; // 만료
+        }
+
+        // 외부에는 최소 DTO만 반환 (내부 정보 캡슐화)
+        return new Entry(entry.type(), entry.token());
+    }
+}

src/main/java/konkuk/thip/common/security/oauth2/tokenstorage/RedisLoginTokenStorage.java

@@ -0,0 +1,48 @@
+package konkuk.thip.common.security.oauth2.tokenstorage;
+
+import konkuk.thip.common.exception.AuthException;
+import konkuk.thip.common.exception.code.ErrorCode;
+import konkuk.thip.common.security.oauth2.TokenType;
+import lombok.RequiredArgsConstructor;
+import org.springframework.context.annotation.Profile;
+import org.springframework.data.redis.core.RedisTemplate;
+import org.springframework.stereotype.Component;
+
+import java.time.Duration;
+
+@Profile({"!test"})
+@Component
+@RequiredArgsConstructor
+public class RedisLoginTokenStorage implements LoginTokenStorage {
+
+    private final RedisTemplate<String, Object> redisTemplate;
+
+    private static final String PREFIX = "auth:login-token:";
+
+    @Override
+    public void put(String key, TokenType type, String token, Duration ttl) {
+        String redisKey = toRedisKey(key);
+        Entry entry = new Entry(type, token);
+
+        redisTemplate.opsForValue().set(redisKey, entry, ttl);
+    }
+
+    @Override
+    public Entry consume(String key) {
+        String redisKey = toRedisKey(key);
+        Object value = redisTemplate.opsForValue().getAndDelete(redisKey);
+        if (value == null) {
+            return null;
+        }
+
+        if (value instanceof Entry entry) {
+            return entry;
+        }
+
+        throw new AuthException(ErrorCode.JSON_PROCESSING_ERROR);
+    }
+
+    private String toRedisKey(String key) {
+        return PREFIX + key;
+    }
+}

src/main/java/konkuk/thip/common/security/argument_resolver/AuthTokenArgumentResolver.java → src/main/java/konkuk/thip/common/security/resolver/AuthTokenArgumentResolver.java

@@ -1,4 +1,4 @@
-package konkuk.thip.common.security.argument_resolver;
+package konkuk.thip.common.security.resolver;
 
 import jakarta.servlet.http.HttpServletRequest;
 import konkuk.thip.common.exception.AuthException;