Fix duplicate Google relogin handling

Author: jjoonleo

ontime-back/src/main/java/devkor/ontime_back/global/jwt/JwtAuthenticationFilter.java

@@ -107,15 +107,12 @@ public void checkAccessTokenAndAuthentication(HttpServletRequest request, HttpSe
                                                   FilterChain filterChain) throws ServletException, IOException {
         log.info("checkAccessTokenAndAuthentication() 호출");
         jwtTokenProvider.extractAccessToken(request)
-                .ifPresent(accessToken -> {
-                    jwtTokenProvider.extractEmail(accessToken)
-                            .ifPresent(email -> userRepository.findByEmail(email)
-                                    .ifPresent(this::saveAuthentication)
-                            );
-
-                    jwtTokenProvider.extractUserId(accessToken)
-                            .ifPresent(userId -> log.info("추출된 userId: {}", userId));
-                });
+                .ifPresent(accessToken -> jwtTokenProvider.extractUserId(accessToken)
+                        .ifPresent(userId -> {
+                            log.info("추출된 userId: {}", userId);
+                            userRepository.findById(userId)
+                                    .ifPresent(this::saveAuthentication);
+                        }));
 
         filterChain.doFilter(request, response);
     }
@@ -192,4 +189,4 @@ private void handleInvalidTokenException(HttpServletResponse response, InvalidTo
             response.getWriter().write(objectMapper.writeValueAsString(errorResponse));
         }
     }
-}
+}

ontime-back/src/main/java/devkor/ontime_back/global/jwt/JwtTokenProvider.java

@@ -71,6 +71,7 @@ public String createRefreshToken() {
         return JWT.create()
                 .withSubject(REFRESH_TOKEN_SUBJECT)
                 .withExpiresAt(new Date(now.getTime() + refreshTokenExpirationPeriod))
+                .withJWTId(UUID.randomUUID().toString())
                 .sign(Algorithm.HMAC512(secretKey));
     }
 
@@ -199,4 +200,4 @@ public String createExpiredAccessToken(String email) {
                 .sign(Algorithm.HMAC512(secretKey));
     }
 
-}
+}

ontime-back/src/main/java/devkor/ontime_back/global/oauth/google/GoogleLoginFilter.java

@@ -18,10 +18,14 @@
 import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
 
 import java.io.IOException;
+import java.util.Map;
 import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
 
 @Slf4j
 public class GoogleLoginFilter extends AbstractAuthenticationProcessingFilter {
+    private static final Map<String, Object> LOGIN_LOCKS = new ConcurrentHashMap<>();
+
     private final UserRepository userRepository;
     private final GoogleLoginService googleLoginService;
 
@@ -42,13 +46,16 @@ public Authentication attemptAuthentication(HttpServletRequest request, HttpServ
             GoogleIdToken.Payload googlePayload = googleLoginService.verifyIdentityToken(oAuthGoogleRequestDto.getIdToken());
             String googleUserId = googlePayload.getSubject();
 
-            Optional<User> existingUser = userRepository.findBySocialTypeAndSocialId(SocialType.GOOGLE, googleUserId);
+            Object loginLock = LOGIN_LOCKS.computeIfAbsent(googleUserId, key -> new Object());
+            synchronized (loginLock) {
+                Optional<User> existingUser = userRepository.findBySocialTypeAndSocialId(SocialType.GOOGLE, googleUserId);
 
-            if (existingUser.isPresent()) {
-                return googleLoginService.handleLogin(oAuthGoogleRequestDto, existingUser.get(), response);
-            } else {
-                OAuthGoogleUserDto oAuthGoogleUserDto = new OAuthGoogleUserDto(googleUserId, (String) googlePayload.get("name"), (String) googlePayload.get("picture"), googlePayload.getEmail());
-                return googleLoginService.handleRegister(oAuthGoogleRequestDto, oAuthGoogleUserDto, response);
+                if (existingUser.isPresent()) {
+                    return googleLoginService.handleLogin(oAuthGoogleRequestDto, existingUser.get(), response);
+                } else {
+                    OAuthGoogleUserDto oAuthGoogleUserDto = new OAuthGoogleUserDto(googleUserId, (String) googlePayload.get("name"), (String) googlePayload.get("picture"), googlePayload.getEmail());
+                    return googleLoginService.handleRegister(oAuthGoogleRequestDto, oAuthGoogleUserDto, response);
+                }
             }
 
         } catch (Exception e) {

ontime-back/src/test/java/devkor/ontime_back/global/jwt/JwtTokenProviderTest.java

@@ -0,0 +1,28 @@
+package devkor.ontime_back.global.jwt;
+
+import devkor.ontime_back.repository.UserRepository;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+
+class JwtTokenProviderTest {
+
+    @DisplayName("동일한 시각에 발급한 리프레시 토큰도 서로 다르다")
+    @Test
+    void createRefreshTokenGeneratesUniqueTokens() {
+        // given
+        JwtTokenProvider jwtTokenProvider = new JwtTokenProvider(mock(UserRepository.class));
+        ReflectionTestUtils.setField(jwtTokenProvider, "secretKey", "test-secret-key-that-is-long-enough");
+        ReflectionTestUtils.setField(jwtTokenProvider, "refreshTokenExpirationPeriod", 3600000L);
+
+        // when
+        String refreshToken1 = jwtTokenProvider.createRefreshToken();
+        String refreshToken2 = jwtTokenProvider.createRefreshToken();
+
+        // then
+        assertThat(refreshToken1).isNotEqualTo(refreshToken2);
+    }
+}