fix: authenticate Apple users without email

Author: jjoonleo

ontime-back/src/main/java/devkor/ontime_back/global/jwt/JwtAuthenticationFilter.java

@@ -125,7 +125,7 @@ public void saveAuthentication(User myUser) {
         }
 
         UserDetails userDetailsUser = org.springframework.security.core.userdetails.User.builder()
-                .username(myUser.getEmail())
+                .username(authenticationName(myUser))
                 .password(password)
                 .roles(myUser.getRole().name())
                 .build();
@@ -137,6 +137,14 @@ public void saveAuthentication(User myUser) {
         SecurityContextHolder.getContext().setAuthentication(authentication);
     }
 
+    private String authenticationName(User user) {
+        String email = user.getEmail();
+        if (email != null && !email.isBlank()) {
+            return email;
+        }
+        return "user:" + user.getId();
+    }
+
     // 비밀번호 랜덤 생성
     private String generateRandomPassword(int length) {
         final String CHAR_SET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz!@#$%^&*()-_=+[]{}|;:,.<>?";

ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginFilter.java

@@ -81,9 +81,13 @@ public Authentication attemptAuthentication(HttpServletRequest request, HttpServ
             }
 
             String appleUserId = tokenClaims.getSubject();
+            String email = firstNonBlank(
+                    oAuthAppleRequestDto.getEmail(),
+                    tokenClaims.get("email", String.class)
+            );
             String appleRefreshToken = exchangeAppleRefreshToken(oAuthAppleRequestDto);
 
-            OAuthAppleUserDto oAuthAppleUserDto = new OAuthAppleUserDto(appleUserId, oAuthAppleRequestDto.getEmail(), oAuthAppleRequestDto.getFullName());
+            OAuthAppleUserDto oAuthAppleUserDto = new OAuthAppleUserDto(appleUserId, email, oAuthAppleRequestDto.getFullName());
 
             Optional<User> existingUser = userRepository.findBySocialTypeAndSocialId(SocialType.APPLE, appleUserId);
 
@@ -111,6 +115,16 @@ private String exchangeAppleRefreshToken(OAuthAppleRequestDto oAuthAppleRequestD
         }
     }
 
+    private String firstNonBlank(String first, String second) {
+        if (first != null && !first.isBlank()) {
+            return first;
+        }
+        if (second != null && !second.isBlank()) {
+            return second;
+        }
+        return null;
+    }
+
     @Override
     protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,
                                               AuthenticationException failed) throws IOException {

ontime-back/src/test/java/devkor/ontime_back/global/jwt/JwtAuthenticationFilterTest.java

@@ -168,6 +168,19 @@ void socialLoginUserWithoutPasswordReceivesGeneratedAuthenticationPassword() {
                 .containsExactly("ROLE_USER");
     }
 
+    @Test
+    void socialLoginUserWithoutEmailUsesUserIdAuthenticationName() {
+        JwtAuthenticationFilter filter = new JwtAuthenticationFilter(mock(JwtTokenProvider.class), mock(UserRepository.class));
+        User user = user(null, null);
+
+        filter.saveAuthentication(user);
+
+        assertThat(SecurityContextHolder.getContext().getAuthentication().getName()).isEqualTo("user:1");
+        assertThat(SecurityContextHolder.getContext().getAuthentication().getAuthorities())
+                .extracting("authority")
+                .containsExactly("ROLE_USER");
+    }
+
     private User user(String email, String password) {
         return User.builder()
                 .id(1L)

ontime-back/src/test/java/devkor/ontime_back/global/oauth/OAuthLoginFilterValidationTest.java

@@ -3,6 +3,7 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.api.client.googleapis.auth.oauth2.GoogleIdToken;
 import devkor.ontime_back.dto.AppleTokenResponseDto;
+import devkor.ontime_back.dto.OAuthAppleUserDto;
 import devkor.ontime_back.global.jwt.JwtTokenProvider;
 import devkor.ontime_back.global.oauth.apple.AppleLoginFilter;
 import devkor.ontime_back.global.oauth.apple.AppleLoginService;
@@ -400,6 +401,38 @@ void appleLoginFilterRegistersNewUser() throws Exception {
         verify(appleLoginService).handleRegister(any(), any(), any());
     }
 
+    @Test
+    @DisplayName("애플 로그인 필터가 요청 email이 비어 있으면 identity token email로 신규 유저를 생성한다")
+    void appleLoginFilterUsesIdentityTokenEmailWhenRequestEmailIsMissing() throws Exception {
+        AppleLoginFilter filter = new AppleLoginFilter(
+                "/oauth2/apple/login",
+                objectMapper,
+                validator,
+                appleLoginService,
+                userRepository);
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        Claims claims = Jwts.claims().setSubject("apple-id");
+        claims.put("email", "token@example.com");
+        AppleTokenResponseDto tokenResponse = appleTokenResponse("apple-refresh-token");
+        User newUser = user(2L, "token@example.com", Role.GUEST);
+
+        when(appleLoginService.verifyIdentityToken("apple-id-token")).thenReturn(claims);
+        when(appleLoginService.getAppleAccessTokenAndRefreshToken("auth-code")).thenReturn(tokenResponse);
+        when(userRepository.findBySocialTypeAndSocialId(SocialType.APPLE, "apple-id"))
+                .thenReturn(Optional.empty());
+        when(appleLoginService.handleRegister(eq("apple-refresh-token"), any(), any())).thenReturn(
+                new org.springframework.security.authentication.UsernamePasswordAuthenticationToken(newUser, null)
+        );
+
+        assertThat(filter.attemptAuthentication(
+                request("/oauth2/apple/login", appleBodyWithoutEmail()),
+                response).getPrincipal()).isSameAs(newUser);
+
+        verify(appleLoginService).handleRegister(eq("apple-refresh-token"), org.mockito.ArgumentMatchers.argThat(
+                (OAuthAppleUserDto userDto) -> "token@example.com".equals(userDto.getEmail())
+        ), eq(response));
+    }
+
     @Test
     @DisplayName("애플 로그인 필터가 Apple refresh token 교환 실패 시 identity token 검증만으로 신규 유저를 회원가입 처리한다")
     void appleLoginFilterRegistersNewUserWhenTokenExchangeFails() throws Exception {
@@ -478,6 +511,16 @@ private String validAppleBody() {
                 """;
     }
 
+    private String appleBodyWithoutEmail() {
+        return """
+                {
+                  "idToken": "apple-id-token",
+                  "authCode": "auth-code",
+                  "fullName": "Apple User"
+                }
+                """;
+    }
+
     private AppleTokenResponseDto appleTokenResponse(String refreshToken) {
         AppleTokenResponseDto response = new AppleTokenResponseDto();
         ReflectionTestUtils.setField(response, "refreshToken", refreshToken);