[Feat] 메일 인증 구현

.gitignore

@@ -35,3 +35,7 @@ out/
 
 ### VS Code ###
 .vscode/
+
+### .env file ###
+*.env
+

src/main/java/com/WhoIsRoom/WhoIs_Server/domain/auth/controller/AuthController.java

@@ -1,15 +1,19 @@
 package com.WhoIsRoom.WhoIs_Server.domain.auth.controller;
 
+import com.WhoIsRoom.WhoIs_Server.domain.auth.dto.request.CodeCheckRequest;
+import com.WhoIsRoom.WhoIs_Server.domain.auth.dto.request.MailRequest;
+import com.WhoIsRoom.WhoIs_Server.domain.auth.dto.request.PasswordRequest;
+import com.WhoIsRoom.WhoIs_Server.domain.auth.dto.request.RefreshTokenRequest;
+import com.WhoIsRoom.WhoIs_Server.domain.auth.dto.response.ReissueResponse;
 import com.WhoIsRoom.WhoIs_Server.domain.auth.service.JwtService;
+import com.WhoIsRoom.WhoIs_Server.domain.auth.service.MailService;
+import com.WhoIsRoom.WhoIs_Server.domain.user.service.UserService;
+import com.WhoIsRoom.WhoIs_Server.global.common.resolver.CurrentUserId;
 import com.WhoIsRoom.WhoIs_Server.global.common.response.BaseResponse;
 import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.bind.annotation.*;
 
 @Slf4j
 @RestController
@@ -18,16 +22,44 @@
 public class AuthController {
 
     private final JwtService jwtService;
+    private final MailService mailService;
+    private final UserService userService;
 
     @PostMapping("/logout")
-    public BaseResponse<Void> logout(HttpServletRequest request){
-        jwtService.logout(request);
+    public BaseResponse<Void> logout(HttpServletRequest request,
+                                     @RequestBody RefreshTokenRequest tokenRequest){
+        jwtService.logout(request, tokenRequest);
         return BaseResponse.ok(null);
     }
 
     @PostMapping("/reissue")
-    public BaseResponse<Void> reissueTokens(HttpServletRequest request, HttpServletResponse response) {
-        jwtService.reissueTokens(request, response);
+    public BaseResponse<ReissueResponse> reissueTokens(@RequestBody RefreshTokenRequest tokenRequest) {
+        ReissueResponse response = jwtService.reissueTokens(tokenRequest);
+        return BaseResponse.ok(response);
+    }
+
+    @PostMapping("/email/send")
+    public BaseResponse<Void> sendAuthCodeMail(@RequestBody MailRequest request) {
+        mailService.sendMail(request);
+        return BaseResponse.ok(null);
+    }
+
+    @PostMapping("/email/validation")
+    public BaseResponse<Void> checkAuthCode(@RequestBody CodeCheckRequest request) {
+        mailService.checkAuthCode(request);
+        return BaseResponse.ok(null);
+    }
+
+    @PostMapping("/email/find-password")
+    public BaseResponse<Void> findPassword(@RequestBody MailRequest request) {
+        userService.sendNewPassword(request);
+        return BaseResponse.ok(null);
+    }
+
+    @PatchMapping("/password")
+    public BaseResponse<Void> updatePassword(@CurrentUserId Long userId,
+                                             @RequestBody PasswordRequest request) {
+        userService.updateMyPassword(userId, request);
         return BaseResponse.ok(null);
     }
 }

src/main/java/com/WhoIsRoom/WhoIs_Server/domain/auth/dto/request/CodeCheckRequest.java

@@ -0,0 +1,15 @@
+package com.WhoIsRoom.WhoIs_Server.domain.auth.dto.request;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.NotNull;
+import lombok.AccessLevel;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+
+@NoArgsConstructor(access = AccessLevel.PROTECTED)
+@Getter
+public class CodeCheckRequest {
+    private String email;
+    private String authCode;
+}
+

src/main/java/com/WhoIsRoom/WhoIs_Server/domain/auth/dto/request/MailRequest.java

@@ -0,0 +1,13 @@
+package com.WhoIsRoom.WhoIs_Server.domain.auth.dto.request;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.NotNull;
+import lombok.AccessLevel;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+
+@Getter
+@NoArgsConstructor(access = AccessLevel.PROTECTED)
+public class MailRequest {
+    private String email;
+}

src/main/java/com/WhoIsRoom/WhoIs_Server/domain/auth/dto/request/PasswordRequest.java

@@ -0,0 +1,12 @@
+package com.WhoIsRoom.WhoIs_Server.domain.auth.dto.request;
+
+import lombok.AccessLevel;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+
+@Getter
+@NoArgsConstructor(access = AccessLevel.PROTECTED)
+public class PasswordRequest {
+    private String prePassword;
+    private String newPassword;
+}

src/main/java/com/WhoIsRoom/WhoIs_Server/domain/auth/dto/request/RefreshTokenRequest.java

@@ -0,0 +1,11 @@
+package com.WhoIsRoom.WhoIs_Server.domain.auth.dto.request;
+
+import lombok.AccessLevel;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+
+@Getter
+@NoArgsConstructor(access = AccessLevel.PROTECTED)
+public class RefreshTokenRequest {
+    private String refreshToken;
+}

src/main/java/com/WhoIsRoom/WhoIs_Server/domain/auth/dto/response/ReissueResponse.java

@@ -0,0 +1,11 @@
+package com.WhoIsRoom.WhoIs_Server.domain.auth.dto.response;
+
+import lombok.Builder;
+import lombok.Getter;
+
+@Getter
+@Builder
+public class ReissueResponse {
+    private String accessToken;
+    private String refreshToken;
+}

src/main/java/com/WhoIsRoom/WhoIs_Server/domain/auth/handler/success/CustomAuthenticationSuccessHandler.java

@@ -47,8 +47,6 @@ public void onAuthenticationSuccess(HttpServletRequest request, HttpServletRespo
         jwtService.storeRefreshToken(refreshToken);
         log.info("[CustomAuthenticationSuccessHandler], refreshToken={}", refreshToken);
 
-        jwtService.sendTokens(response, accessToken, refreshToken);
-
         LoginResponse data = LoginResponse.builder()
                 .accessToken(accessToken)
                 .refreshToken(refreshToken)

src/main/java/com/WhoIsRoom/WhoIs_Server/domain/auth/service/JwtService.java

@@ -1,17 +1,24 @@
 package com.WhoIsRoom.WhoIs_Server.domain.auth.service;
 
+import com.WhoIsRoom.WhoIs_Server.domain.auth.dto.request.RefreshTokenRequest;
+import com.WhoIsRoom.WhoIs_Server.domain.auth.dto.response.LoginResponse;
+import com.WhoIsRoom.WhoIs_Server.domain.auth.dto.response.ReissueResponse;
 import com.WhoIsRoom.WhoIs_Server.domain.auth.exception.CustomAuthenticationException;
 import com.WhoIsRoom.WhoIs_Server.domain.auth.exception.CustomJwtException;
 import com.WhoIsRoom.WhoIs_Server.domain.auth.util.JwtUtil;
 import com.WhoIsRoom.WhoIs_Server.global.common.redis.RedisService;
+import com.WhoIsRoom.WhoIs_Server.global.common.response.BaseResponse;
 import com.WhoIsRoom.WhoIs_Server.global.common.response.ErrorCode;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.MediaType;
 import org.springframework.stereotype.Service;
 
+import java.io.IOException;
 import java.time.Duration;
 
 @Slf4j
@@ -37,27 +44,30 @@ public class JwtService {
 
     private final RedisService redisService;
     private final JwtUtil jwtUtil;
+    private final ObjectMapper objectMapper;
 
-    public void logout(HttpServletRequest request) {
+    public void logout(HttpServletRequest request, RefreshTokenRequest tokenRequest) {
         String accessToken = jwtUtil.extractAccessToken(request)
                 .orElseThrow(() -> new CustomAuthenticationException(ErrorCode.SECURITY_INVALID_ACCESS_TOKEN));
-        String refreshToken = jwtUtil.extractRefreshToken(request)
-                .orElseThrow(() -> new CustomAuthenticationException(ErrorCode.SECURITY_INVALID_REFRESH_TOKEN));
+
+        String refreshToken = tokenRequest.getRefreshToken();
+        jwtUtil.validateToken(refreshToken);
+        if (!"refresh".equals(jwtUtil.getTokenType(refreshToken))) {
+            throw new CustomJwtException(ErrorCode.INVALID_TOKEN_TYPE);
+        }
 
         deleteRefreshToken(refreshToken);
         //access token blacklist 처리 -> 로그아웃한 사용자가 요청 시 access token이 redis에 존재하면 jwtAuthenticationFilter에서 인증처리 거부
         invalidAccessToken(accessToken);
     }
 
-    public void reissueTokens(HttpServletRequest request, HttpServletResponse response) {
-        String refreshToken = jwtUtil.extractRefreshToken(request)
-                .orElseThrow(() -> new CustomAuthenticationException(ErrorCode.SECURITY_INVALID_REFRESH_TOKEN));
-
+    public ReissueResponse reissueTokens(RefreshTokenRequest tokenRequest) {
+        String refreshToken = tokenRequest.getRefreshToken();
         jwtUtil.validateToken(refreshToken);
         if (!"refresh".equals(jwtUtil.getTokenType(refreshToken))) {
             throw new CustomJwtException(ErrorCode.INVALID_TOKEN_TYPE);
         }
-        reissueAndSendTokens(response, refreshToken);
+        return reissueAndSendTokens(refreshToken);
     }
 
     public void checkLogout(String accessToken) {
@@ -83,7 +93,7 @@ private void invalidAccessToken(String accessToken) {
                 Duration.ofMillis(ACCESS_TOKEN_EXPIRED_IN));
     }
 
-    private void reissueAndSendTokens(HttpServletResponse response, String refreshToken) {
+    private ReissueResponse reissueAndSendTokens(String refreshToken) {
 
         // 새로운 Refresh Token 발급
         String reissuedAccessToken = jwtUtil.createAccessToken(jwtUtil.getUserId(refreshToken), jwtUtil.getProviderId(refreshToken), jwtUtil.getRole(refreshToken), jwtUtil.getName(refreshToken));
@@ -95,12 +105,9 @@ private void reissueAndSendTokens(HttpServletResponse response, String refreshTo
         // 기존 Refresh Token 폐기 (DB나 Redis에서 삭제)
         deleteRefreshToken(refreshToken);
 
-        sendTokens(response, reissuedAccessToken, reissuedRefreshToken);
-    }
-
-    public void sendTokens(HttpServletResponse response, String accessToken,
-                            String refreshToken) {
-        response.setHeader(ACCESS_HEADER, BEARER_PREFIX + accessToken);
-        response.setHeader(REFRESH_HEADER, BEARER_PREFIX + refreshToken);
+        return ReissueResponse.builder()
+                .accessToken(reissuedAccessToken)
+                .refreshToken(reissuedRefreshToken)
+                .build();
     }
 }