Merge pull request #65 from DevKor-github/develop

Apple 로그인 시 Apple로부터 받은 리프레시 토큰을 안전하게 저장

Author: soonduck-dreams

.github/workflows/deploy-to-dev-ec2.yml

@@ -76,6 +76,7 @@ jobs:
             KAKAO_CLIENT_ID="${{ secrets.KAKAO_CLIENT_ID }}" \
             KAKAO_REDIRECT_URI="${{ secrets.KAKAO_REDIRECT_URI }}" \
             KAKAO_CLIENT_SECRET="${{ secrets.KAKAO_CLIENT_SECRET }}" \
+            KMS_KEY_ID="${{ secrets.KMS_KEY_ID }}" \
             nohup java -Duser.timezone=Asia/Seoul -jar $JAR_NAME --spring.profiles.active=dev > app.log 2>&1 &
             
             echo "✅ 배포 완료"

.github/workflows/deploy-to-prod-ec2.yml

@@ -76,6 +76,7 @@ jobs:
             KAKAO_CLIENT_ID="${{ secrets.KAKAO_CLIENT_ID }}" \
             KAKAO_REDIRECT_URI="${{ secrets.KAKAO_REDIRECT_URI }}" \
             KAKAO_CLIENT_SECRET="${{ secrets.KAKAO_CLIENT_SECRET }}" \
+            KMS_KEY_ID="${{ secrets.KMS_KEY_ID }}" \
             nohup java -Duser.timezone=Asia/Seoul -jar $JAR_NAME --spring.profiles.active=prod > app.log 2>&1 &
             
             echo "✅ 배포 완료"

build.gradle

@@ -62,6 +62,9 @@ dependencies {
 	implementation platform('software.amazon.awssdk:bom:2.27.21')
 	implementation 'software.amazon.awssdk:s3'
 
+	// AWS KMS
+	implementation 'software.amazon.awssdk:kms'
+
 	// JWT 발급 및 검증
 	implementation 'com.auth0:java-jwt:4.5.0'
 

commitlint.config.js

@@ -23,16 +23,7 @@ module.exports = {
             "db"
         ]],
         "footer-empty": [2, "always"],
-        "subject-case": [2, "always", [
-            "lower-case", // lower case
-            "upper-case", // UPPERCASE
-            "camel-case", // camelCase
-            "kebab-case", // kebab-case
-            "pascal-case", // PascalCase
-            "sentence-case", // Sentence case
-            "snake-case", // snake_case
-            "start-case", // Start Case
-        ]]
+        "subject-case": [0]
     },
     prompt: {
         settings: {},

src/main/java/org/devkor/apu/saerok_server/domain/auth/application/AbstractSocialAuthService.java

@@ -12,10 +12,14 @@
 import org.devkor.apu.saerok_server.domain.auth.core.service.UserProvisioningService;
 import org.devkor.apu.saerok_server.domain.auth.infra.SocialAuthClient;
 import org.devkor.apu.saerok_server.domain.auth.core.dto.SocialUserInfo;
+import org.devkor.apu.saerok_server.global.security.crypto.DataCryptoService;
+import org.devkor.apu.saerok_server.global.security.crypto.EncryptedPayload;
 import org.devkor.apu.saerok_server.global.util.dto.ClientInfo;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.ResponseEntity;
 
+import java.nio.charset.StandardCharsets;
+
 @Slf4j
 @RequiredArgsConstructor
 @Transactional
@@ -24,6 +28,7 @@ public abstract class AbstractSocialAuthService {
     private final SocialAuthRepository socialAuthRepository;
     private final AuthTokenFacade authTokenFacade;
     private final UserProvisioningService userProvisioningService;
+    private final DataCryptoService dataCryptoService;
 
     protected abstract SocialAuthClient client();
 
@@ -37,6 +42,12 @@ public ResponseEntity<AccessTokenResponse> authenticate(String authorizationCode
                 .findByProviderAndProviderUserId(provider, userInfo.sub())
                 .orElseGet(() -> userProvisioningService.provisionNewUser(provider, userInfo));
 
+        if (userInfo.refreshToken() != null) {
+            log.info("소셜 공급자로부터 받은 리프레시 토큰: {}", userInfo.refreshToken());
+            EncryptedPayload payload = dataCryptoService.encrypt(userInfo.refreshToken().getBytes(StandardCharsets.UTF_8));
+            socialAuth.setRefreshToken(payload);
+        }
+
         AuthBundle bundle = authTokenFacade.issueTokens(
                 socialAuth.getUser(),
                 ci

src/main/java/org/devkor/apu/saerok_server/domain/auth/application/AppleAuthService.java

@@ -5,6 +5,7 @@
 import org.devkor.apu.saerok_server.domain.auth.core.service.UserProvisioningService;
 import org.devkor.apu.saerok_server.domain.auth.infra.AppleAuthClient;
 import org.devkor.apu.saerok_server.domain.auth.infra.SocialAuthClient;
+import org.devkor.apu.saerok_server.global.security.crypto.DataCryptoService;
 import org.springframework.stereotype.Service;
 
 @Service
@@ -16,9 +17,10 @@ public AppleAuthService(
             SocialAuthRepository socialAuthRepository,
             AuthTokenFacade authTokenFacade,
             UserProvisioningService userProvisioningService,
+            DataCryptoService dataCryptoService,
             AppleAuthClient appleAuthClient
     ) {
-        super(socialAuthRepository, authTokenFacade, userProvisioningService);
+        super(socialAuthRepository, authTokenFacade, userProvisioningService, dataCryptoService);
         this.appleAuthClient = appleAuthClient;
     }
 

src/main/java/org/devkor/apu/saerok_server/domain/auth/application/KakaoAuthService.java

@@ -5,6 +5,7 @@
 import org.devkor.apu.saerok_server.domain.auth.core.service.UserProvisioningService;
 import org.devkor.apu.saerok_server.domain.auth.infra.KakaoAuthClient;
 import org.devkor.apu.saerok_server.domain.auth.infra.SocialAuthClient;
+import org.devkor.apu.saerok_server.global.security.crypto.DataCryptoService;
 import org.springframework.stereotype.Service;
 
 @Service
@@ -16,9 +17,10 @@ public KakaoAuthService(
             SocialAuthRepository socialAuthRepository,
             AuthTokenFacade authTokenFacade,
             UserProvisioningService userProvisioningService,
+            DataCryptoService dataCryptoService,
             KakaoAuthClient kakaoAuthClient
     ) {
-        super(socialAuthRepository, authTokenFacade, userProvisioningService);
+        super(socialAuthRepository, authTokenFacade, userProvisioningService, dataCryptoService);
         this.kakaoAuthClient = kakaoAuthClient;
     }
 

src/main/java/org/devkor/apu/saerok_server/domain/auth/core/dto/SocialUserInfo.java

@@ -2,6 +2,7 @@
 
 public record SocialUserInfo(
         String sub,
-        String email
+        String email,
+        String refreshToken
 ) {
 }

src/main/java/org/devkor/apu/saerok_server/domain/auth/core/entity/SocialAuth.java

@@ -4,11 +4,9 @@
 import lombok.AccessLevel;
 import lombok.Getter;
 import lombok.NoArgsConstructor;
-import lombok.Setter;
 import org.devkor.apu.saerok_server.domain.user.core.entity.User;
 import org.devkor.apu.saerok_server.global.entity.CreatedAtOnly;
-
-import java.time.OffsetDateTime;
+import org.devkor.apu.saerok_server.global.security.crypto.EncryptedPayload;
 
 @Entity
 @Table(
@@ -33,11 +31,24 @@ public class SocialAuth extends CreatedAtOnly {
     @Column(name = "provider_user_id", nullable = false)
     private String providerUserId;
 
+    @Embedded
+    private SocialAuthRefreshToken refreshToken;
+
     public static SocialAuth createSocialAuth(User user, SocialProviderType provider, String providerUserId) {
         SocialAuth socialAuth = new SocialAuth();
         socialAuth.user = user;
         socialAuth.provider = provider;
         socialAuth.providerUserId = providerUserId;
         return socialAuth;
     }
+
+    public void setRefreshToken(EncryptedPayload p) {
+
+        if (refreshToken == null) refreshToken = new SocialAuthRefreshToken();
+
+        refreshToken.setCiphertext(p.ciphertext());
+        refreshToken.setKey(p.encryptedDataKey());
+        refreshToken.setIv(p.iv());
+        refreshToken.setTag(p.authTag());
+    }
 }

src/main/java/org/devkor/apu/saerok_server/domain/auth/core/entity/SocialAuthRefreshToken.java

@@ -0,0 +1,30 @@
+package org.devkor.apu.saerok_server.domain.auth.core.entity;
+
+import jakarta.persistence.*;
+import lombok.Data;
+
+/**
+ * 소셜 공급자로부터 받은 리프레시 토큰을 AES-256-GCM 방식으로 양방향 암호화해서 관리
+ */
+@Embeddable
+@Data
+public class SocialAuthRefreshToken {
+
+    @Basic(fetch = FetchType.LAZY)
+    @Column(name = "refresh_token_ciphertext", columnDefinition = "BYTEA")
+    private byte[] ciphertext;
+
+    @Basic(fetch = FetchType.LAZY)
+    @Column(name = "refresh_token_key", columnDefinition = "BYTEA")
+    private byte[] key;
+
+    @Basic(fetch = FetchType.LAZY)
+    @Column(name = "refresh_token_iv", columnDefinition = "BYTEA")
+    private byte[] iv;
+
+    @Basic(fetch = FetchType.LAZY)
+    @Column(name = "refresh_token_tag", columnDefinition = "BYTEA")
+    private byte[] tag;
+
+
+}