fix: allow Apple login without token exchange

Author: jjoonleo

ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginFilter.java

@@ -81,10 +81,7 @@ public Authentication attemptAuthentication(HttpServletRequest request, HttpServ
             }
 
             String appleUserId = tokenClaims.getSubject();
-            String email = tokenClaims.get("email", String.class);
-
-            // socialRefreshtoken에 저장
-            String appleRefreshToken = appleLoginService.getAppleAccessTokenAndRefreshToken(oAuthAppleRequestDto.getAuthCode()).getRefreshToken();
+            String appleRefreshToken = exchangeAppleRefreshToken(oAuthAppleRequestDto);
 
             OAuthAppleUserDto oAuthAppleUserDto = new OAuthAppleUserDto(appleUserId, oAuthAppleRequestDto.getEmail(), oAuthAppleRequestDto.getFullName());
 
@@ -102,6 +99,18 @@ public Authentication attemptAuthentication(HttpServletRequest request, HttpServ
         }
     }
 
+    private String exchangeAppleRefreshToken(OAuthAppleRequestDto oAuthAppleRequestDto) {
+        try {
+            AppleTokenResponseDto tokenResponse = appleLoginService.getAppleAccessTokenAndRefreshToken(
+                    oAuthAppleRequestDto.getAuthCode()
+            );
+            return tokenResponse.getRefreshToken();
+        } catch (Exception e) {
+            log.warn("Apple token exchange failed; continuing with verified identity token", e);
+            return null;
+        }
+    }
+
     @Override
     protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,
                                               AuthenticationException failed) throws IOException {

ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginService.java

@@ -74,7 +74,9 @@ public class AppleLoginService {
     private final RestTemplate restTemplate = new RestTemplate();
     public Authentication handleLogin(String appleRefreshToken, User user, HttpServletResponse response) throws IOException {
         log.info("handleLogin");
-        user.updateSocialLoginToken(appleRefreshToken);
+        if (appleRefreshToken != null && !appleRefreshToken.isBlank()) {
+            user.updateSocialLoginToken(appleRefreshToken);
+        }
 
         String accessToken = jwtTokenProvider.createAccessToken(user.getEmail(), user.getId());
         String refreshToken = jwtTokenProvider.createRefreshToken();

ontime-back/src/test/java/devkor/ontime_back/global/oauth/OAuthLoginFilterValidationTest.java

@@ -34,6 +34,7 @@
 import java.util.Optional;
 
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.Mockito.times;
@@ -341,6 +342,35 @@ void appleLoginFilterLogsInExistingUser() throws Exception {
         verify(appleLoginService).handleLogin("apple-refresh-token", existingUser, response);
     }
 
+    @Test
+    @DisplayName("애플 로그인 필터가 Apple refresh token 교환 실패 시 identity token 검증만으로 기존 유저를 로그인 처리한다")
+    void appleLoginFilterLogsInExistingUserWhenTokenExchangeFails() throws Exception {
+        AppleLoginFilter filter = new AppleLoginFilter(
+                "/oauth2/apple/login",
+                objectMapper,
+                validator,
+                appleLoginService,
+                userRepository);
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        Claims claims = Jwts.claims().setSubject("apple-id");
+        User existingUser = user(1L, "user@example.com", Role.USER);
+
+        when(appleLoginService.verifyIdentityToken("apple-id-token")).thenReturn(claims);
+        when(appleLoginService.getAppleAccessTokenAndRefreshToken("auth-code"))
+                .thenThrow(new RuntimeException("invalid_client"));
+        when(userRepository.findBySocialTypeAndSocialId(SocialType.APPLE, "apple-id"))
+                .thenReturn(Optional.of(existingUser));
+        when(appleLoginService.handleLogin(null, existingUser, response)).thenReturn(
+                new org.springframework.security.authentication.UsernamePasswordAuthenticationToken(existingUser, null)
+        );
+
+        assertThat(filter.attemptAuthentication(
+                request("/oauth2/apple/login", validAppleBody()),
+                response).getPrincipal()).isSameAs(existingUser);
+
+        verify(appleLoginService).handleLogin(null, existingUser, response);
+    }
+
     @Test
     @DisplayName("애플 로그인 필터가 신규 유저를 Apple identity token과 auth code로 회원가입 처리한다")
     void appleLoginFilterRegistersNewUser() throws Exception {
@@ -370,6 +400,35 @@ void appleLoginFilterRegistersNewUser() throws Exception {
         verify(appleLoginService).handleRegister(any(), any(), any());
     }
 
+    @Test
+    @DisplayName("애플 로그인 필터가 Apple refresh token 교환 실패 시 identity token 검증만으로 신규 유저를 회원가입 처리한다")
+    void appleLoginFilterRegistersNewUserWhenTokenExchangeFails() throws Exception {
+        AppleLoginFilter filter = new AppleLoginFilter(
+                "/oauth2/apple/login",
+                objectMapper,
+                validator,
+                appleLoginService,
+                userRepository);
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        Claims claims = Jwts.claims().setSubject("apple-id");
+        User newUser = user(2L, "new@example.com", Role.GUEST);
+
+        when(appleLoginService.verifyIdentityToken("apple-id-token")).thenReturn(claims);
+        when(appleLoginService.getAppleAccessTokenAndRefreshToken("auth-code"))
+                .thenThrow(new RuntimeException("invalid_client"));
+        when(userRepository.findBySocialTypeAndSocialId(SocialType.APPLE, "apple-id"))
+                .thenReturn(Optional.empty());
+        when(appleLoginService.handleRegister(eq(null), any(), any())).thenReturn(
+                new org.springframework.security.authentication.UsernamePasswordAuthenticationToken(newUser, null)
+        );
+
+        assertThat(filter.attemptAuthentication(
+                request("/oauth2/apple/login", validAppleBody()),
+                response).getPrincipal()).isSameAs(newUser);
+
+        verify(appleLoginService).handleRegister(eq(null), any(), any());
+    }
+
     private KakaoLoginFilter kakaoLoginFilter() {
         return new KakaoLoginFilter(
                 "/oauth2/kakao/login",

ontime-back/src/test/java/devkor/ontime_back/global/oauth/apple/AppleLoginFilterAuthenticationResultTest.java

@@ -29,7 +29,7 @@ void unsuccessfulAuthenticationWritesUnauthorizedEnvelope() throws Exception {
         filter.callUnsuccessfulAuthentication(new MockHttpServletRequest(), response, new BadCredentialsException("bad"));
 
         assertThat(response.getStatus()).isEqualTo(401);
-        assertThat(response.getContentAsString()).contains("Authentication failed");
+        assertThat(response.getContentAsString()).contains("Apple 로그인 실패");
     }
 
     private static class TestableAppleLoginFilter extends AppleLoginFilter {