Merge remote-tracking branch 'origin/main' into dev

# Conflicts:
#	ontime-back/src/main/java/devkor/ontime_back/global/oauth/google/GoogleLoginService.java

Author: jjoonleo

.github/workflows/deploy.yml

@@ -239,7 +239,7 @@ jobs:
               timeout 5 bash -c "</dev/tcp/$DB_HOST/$DB_PORT"
             fi
 
-            echo "${{ secrets.GHCR_READ_TOKEN }}" | sudo docker login ghcr.io -u "${{ secrets.GHCR_USERNAME }}" --password-stdin
+            echo "${{ secrets.GITHUB_TOKEN }}" | sudo docker login ghcr.io -u "${{ github.actor }}" --password-stdin
 
             if sudo docker compose version >/dev/null 2>&1; then
               sudo docker compose pull

.github/workflows/ops-tail-production-logs.yml

@@ -0,0 +1,24 @@
+name: Ops Tail Production Logs
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  tail-logs:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Tail production backend logs
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.EC2_HOST }}
+          username: ${{ secrets.EC2_USER }}
+          key: ${{ secrets.EC2_SSH_KEY }}
+          script: |
+            set -eu
+            sudo docker logs --since 30m --tail=500 ontime-container \
+              | grep -E -A40 -B10 'Apple login failed|InvalidTokenException|invalid_client|invalid_grant|audience|issuer|Exchange Apple credential|Verify Apple identity credential|/users/me/onboarding|onboarding|Onboarding|DataIntegrityViolation|MethodArgumentNotValidException|HttpMessageNotReadableException|GeneralException|Exception|ERROR|WARN' \
+              || true

.github/workflows/test.yml

@@ -61,13 +61,21 @@ jobs:
 
 
 
-      # 4. Gradle 빌드 & JUnit 테스트 실행
+      # 4. Gradle 검증 및 커버리지 검사 실행
       - name: Run Tests with Gradle
         env:
           SPRING_PROFILES_ACTIVE: test
         run: |
           cd ontime-back
-          ./gradlew test
+          ./gradlew check
+
+      - name: Upload JaCoCo Coverage Report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: jacoco-coverage-report
+          path: ontime-back/build/reports/jacoco/test/
+          if-no-files-found: warn
 
       - name: Verify Flyway Migrations
         run: |

ontime-back/build.gradle

@@ -1,5 +1,6 @@
 plugins {
 	id 'java'
+	id 'jacoco'
 	id 'org.springframework.boot' version '3.3.4'
 	id 'io.spring.dependency-management' version '1.1.6'
 	id 'org.flywaydb.flyway' version '9.22.1'
@@ -70,4 +71,30 @@ dependencies {
 
 tasks.named('test') {
 	useJUnitPlatform()
+	finalizedBy tasks.named('jacocoTestReport')
+}
+
+tasks.named('jacocoTestReport') {
+	dependsOn tasks.named('test')
+
+	reports {
+		xml.required = true
+		html.required = true
+	}
+}
+
+tasks.named('jacocoTestCoverageVerification') {
+	dependsOn tasks.named('jacocoTestReport')
+
+	violationRules {
+		rule {
+			limit {
+				minimum = 0.95
+			}
+		}
+	}
+}
+
+tasks.named('check') {
+	dependsOn tasks.named('jacocoTestCoverageVerification')
 }

ontime-back/src/main/java/devkor/ontime_back/entity/PreparationSchedule.java

@@ -24,7 +24,7 @@ public class PreparationSchedule {
     @OnDelete(action = OnDeleteAction.CASCADE)
     private Schedule schedule;
 
-    @Column(nullable = false, length = 30)
+    @Column(nullable = false, length = 50)
     private String preparationName;
 
     private Integer preparationTime;

ontime-back/src/main/java/devkor/ontime_back/entity/PreparationUser.java

@@ -24,7 +24,7 @@ public class PreparationUser {
     @OnDelete(action = OnDeleteAction.CASCADE)
     private User user;
 
-    @Column(nullable = false, length = 30)
+    @Column(nullable = false, length = 50)
     private String preparationName;
 
     private Integer preparationTime;

ontime-back/src/main/java/devkor/ontime_back/global/jwt/JwtAuthenticationFilter.java

@@ -125,7 +125,7 @@ public void saveAuthentication(User myUser) {
         }
 
         UserDetails userDetailsUser = org.springframework.security.core.userdetails.User.builder()
-                .username(myUser.getEmail())
+                .username(authenticationName(myUser))
                 .password(password)
                 .roles(myUser.getRole().name())
                 .build();
@@ -137,6 +137,14 @@ public void saveAuthentication(User myUser) {
         SecurityContextHolder.getContext().setAuthentication(authentication);
     }
 
+    private String authenticationName(User user) {
+        String email = user.getEmail();
+        if (email != null && !email.isBlank()) {
+            return email;
+        }
+        return "user:" + user.getId();
+    }
+
     // 비밀번호 랜덤 생성
     private String generateRandomPassword(int length) {
         final String CHAR_SET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz!@#$%^&*()-_=+[]{}|;:,.<>?";

ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginFilter.java

@@ -81,12 +81,13 @@ public Authentication attemptAuthentication(HttpServletRequest request, HttpServ
             }
 
             String appleUserId = tokenClaims.getSubject();
-            String email = tokenClaims.get("email", String.class);
+            String email = firstNonBlank(
+                    oAuthAppleRequestDto.getEmail(),
+                    tokenClaims.get("email", String.class)
+            );
+            String appleRefreshToken = exchangeAppleRefreshToken(oAuthAppleRequestDto);
 
-            // socialRefreshtoken에 저장
-            String appleRefreshToken = appleLoginService.getAppleAccessTokenAndRefreshToken(oAuthAppleRequestDto.getAuthCode()).getRefreshToken();
-
-            OAuthAppleUserDto oAuthAppleUserDto = new OAuthAppleUserDto(appleUserId, oAuthAppleRequestDto.getEmail(), oAuthAppleRequestDto.getFullName());
+            OAuthAppleUserDto oAuthAppleUserDto = new OAuthAppleUserDto(appleUserId, email, oAuthAppleRequestDto.getFullName());
 
             Optional<User> existingUser = userRepository.findBySocialTypeAndSocialId(SocialType.APPLE, appleUserId);
 
@@ -97,19 +98,43 @@ public Authentication attemptAuthentication(HttpServletRequest request, HttpServ
             }
 
         } catch (Exception e) {
-            log.error("Apple login failed: {}", e.getClass().getSimpleName());
-            throw new AuthenticationException("Apple 로그인 실패") {};
+            log.error("Apple login failed", e);
+            throw new AppleLoginException();
         }
     }
 
+    private String exchangeAppleRefreshToken(OAuthAppleRequestDto oAuthAppleRequestDto) {
+        try {
+            AppleTokenResponseDto tokenResponse = appleLoginService.getAppleAccessTokenAndRefreshToken(
+                    oAuthAppleRequestDto.getAuthCode()
+            );
+            return tokenResponse.getRefreshToken();
+        } catch (Exception e) {
+            log.warn("Apple credential exchange failed; continuing with verified identity credential", e);
+            return null;
+        }
+    }
+
+    private String firstNonBlank(String first, String second) {
+        if (first != null && !first.isBlank()) {
+            return first;
+        }
+        if (second != null && !second.isBlank()) {
+            return second;
+        }
+        return null;
+    }
+
     @Override
     protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,
                                               AuthenticationException failed) throws IOException {
         if (failed instanceof RequestValidationException) {
             return;
         }
         response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
-        response.getWriter().write("{\"status\":\"error\", \"message\":\"Authentication failed\"}");
+        response.setContentType("application/json");
+        response.setCharacterEncoding("UTF-8");
+        response.getWriter().write("{\"status\":\"error\", \"message\":\"Apple 로그인 실패\"}");
     }
 
     private static class RequestValidationException extends AuthenticationException {
@@ -118,4 +143,10 @@ private RequestValidationException() {
         }
     }
 
+    private static class AppleLoginException extends AuthenticationException {
+        private AppleLoginException() {
+            super("Apple login failed");
+        }
+    }
+
 }

ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginService.java

@@ -52,7 +52,6 @@ public class AppleLoginService {
 
     private static final String APPLE_KEYS_URL = "https://appleid.apple.com/auth/keys";
     private static final String APPLE_TOKEN_URL = "https://appleid.apple.com/auth/token";
-    private static final String REDIRECT_URI = "https://ontime-back.duckdns.org/oauth2/apple/callback";
     private String issuer = "https://appleid.apple.com";
     @Value("${apple.client.id}")
     private String clientId;
@@ -77,7 +76,9 @@ public class AppleLoginService {
     private final RestTemplate restTemplate = new RestTemplate();
     public Authentication handleLogin(String appleRefreshToken, User user, HttpServletResponse response) throws IOException {
         log.info("handleLogin");
-        user.updateSocialLoginToken(appleRefreshToken);
+        if (appleRefreshToken != null && !appleRefreshToken.isBlank()) {
+            user.updateSocialLoginToken(appleRefreshToken);
+        }
 
         String accessToken = jwtTokenProvider.createAccessToken(user.getEmail(), user.getId());
         String refreshToken = jwtTokenProvider.createRefreshToken();
@@ -134,7 +135,7 @@ public Authentication handleRegister(String appleRefreshToken, OAuthAppleUserDto
 
         User savedUser = userRepository.save(newUser);
 
-        String accessToken = jwtTokenProvider.createAccessToken(newUser.getEmail(), newUser.getId());
+        String accessToken = jwtTokenProvider.createAccessToken(savedUser.getEmail(), savedUser.getId());
         String refreshToken = jwtTokenProvider.createRefreshToken();
 
         jwtTokenProvider.sendAccessAndRefreshToken(response, accessToken, refreshToken);
@@ -201,12 +202,7 @@ public AppleTokenResponseDto getAppleAccessTokenAndRefreshToken(String authCode)
         // clientSecret
         String clientSecret = generateClientSecret();
         log.info("Exchange Apple credential");
-        MultiValueMap<String, String> requestBody = new LinkedMultiValueMap<>();
-        requestBody.add("grant_type", "authorization_code");
-        requestBody.add("code", authCode);
-        requestBody.add("client_id", clientId);
-        requestBody.add("client_secret", clientSecret);
-        requestBody.add("redirect_uri", REDIRECT_URI);
+        MultiValueMap<String, String> requestBody = buildAppleTokenRequestBody(authCode, clientSecret);
 
         HttpHeaders headers = new HttpHeaders();
         headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
@@ -222,6 +218,15 @@ public AppleTokenResponseDto getAppleAccessTokenAndRefreshToken(String authCode)
         return objectMapper.treeToValue(response, AppleTokenResponseDto.class);
     }
 
+    MultiValueMap<String, String> buildAppleTokenRequestBody(String authCode, String clientSecret) {
+        MultiValueMap<String, String> requestBody = new LinkedMultiValueMap<>();
+        requestBody.add("grant_type", "authorization_code");
+        requestBody.add("code", authCode);
+        requestBody.add("client_id", clientId);
+        requestBody.add("client_secret", clientSecret);
+        return requestBody;
+    }
+
     // clientsecret 생성
     private String generateClientSecret() throws Exception {
         log.info("Generate Apple client credential");

ontime-back/src/main/java/devkor/ontime_back/global/oauth/google/GoogleLoginService.java

@@ -18,6 +18,7 @@
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpEntity;
 import org.springframework.http.HttpHeaders;
@@ -50,19 +51,35 @@ public class GoogleLoginService {
     private static final String GOOGLE_REVOKE_URL = "https://oauth2.googleapis.com/revoke?token=";
 
     private final List<String> validClientIds;
+    private final RestTemplate revokeRestTemplate;
 
+    @Autowired
     public GoogleLoginService(
             JwtTokenProvider jwtTokenProvider,
             UserRepository userRepository,
             UserAlarmSettingRepository userAlarmSettingRepository,
             AnalyticsPreferenceService analyticsPreferenceService,
             @Value("${google.web.client-id}") String webClientId,
             @Value("${google.app.client-id}") String appClientId
+    ) {
+        this(jwtTokenProvider, userRepository, userAlarmSettingRepository, analyticsPreferenceService,
+                webClientId, appClientId, createRevokeRestTemplate());
+    }
+
+    GoogleLoginService(
+            JwtTokenProvider jwtTokenProvider,
+            UserRepository userRepository,
+            UserAlarmSettingRepository userAlarmSettingRepository,
+            AnalyticsPreferenceService analyticsPreferenceService,
+            String webClientId,
+            String appClientId,
+            RestTemplate revokeRestTemplate
     ) {
         this.jwtTokenProvider = jwtTokenProvider;
         this.userRepository = userRepository;
         this.userAlarmSettingRepository = userAlarmSettingRepository;
         this.analyticsPreferenceService = analyticsPreferenceService;
+        this.revokeRestTemplate = revokeRestTemplate;
         this.validClientIds = Stream.concat(
                         Stream.of(webClientId),
                         Stream.of(appClientId.split(","))
@@ -75,6 +92,13 @@ public GoogleLoginService(
                 .toList());
     }
 
+    private static RestTemplate createRevokeRestTemplate() {
+        SimpleClientHttpRequestFactory requestFactory = new SimpleClientHttpRequestFactory();
+        requestFactory.setConnectTimeout(3000);
+        requestFactory.setReadTimeout(3000);
+        return new RestTemplate(requestFactory);
+    }
+
 
     public Authentication handleLogin(OAuthGoogleRequestDto oAuthGoogleRequestDto, User user, HttpServletResponse response) throws IOException {
         user.updateSocialLoginToken(oAuthGoogleRequestDto.getRefreshToken());
@@ -133,7 +157,7 @@ public Authentication handleRegister(OAuthGoogleRequestDto oAuthGoogleRequestDto
 
         User savedUser = userRepository.save(newUser);
 
-        String accessToken = jwtTokenProvider.createAccessToken(newUser.getEmail(), newUser.getId());
+        String accessToken = jwtTokenProvider.createAccessToken(savedUser.getEmail(), savedUser.getId());
         String refreshToken = jwtTokenProvider.createRefreshToken();
 
         jwtTokenProvider.sendAccessAndRefreshToken(response, accessToken, refreshToken);
@@ -233,18 +257,14 @@ public boolean revokeToken(Long userId) {
 
         String googleRefreshToken = user.getSocialLoginToken();
 
-        SimpleClientHttpRequestFactory requestFactory = new SimpleClientHttpRequestFactory();
-        requestFactory.setConnectTimeout(3000);
-        requestFactory.setReadTimeout(3000);
-        RestTemplate restTemplate = new RestTemplate(requestFactory);
         String revokeUrl = GOOGLE_REVOKE_URL + googleRefreshToken;
 
         HttpHeaders headers = new HttpHeaders();
         headers.set("Content-Type", "application/x-www-form-urlencoded");
 
         HttpEntity<String> request = new HttpEntity<>(headers);
 
-        ResponseEntity<String> response = restTemplate.exchange(
+        ResponseEntity<String> response = revokeRestTemplate.exchange(
                 revokeUrl, HttpMethod.POST, request, String.class);
 
         return response.getStatusCode().is2xxSuccessful();