Spring 10: JWT 인증

/**
 * JWT 토큰을 기반으로 사용자 인증 처리
 */
private void authenticateUser(String token) {
    try {
        // 1. 토큰에서 사용자 정보 추출
        Claims claims = tokenProvider.parseToken(token);
        String userId = claims.getSubject();
        
        // 2. 사용자 상세 정보 로드
        UserDetails userDetails = userDetailsService.loadUserByUsername(userId);
        
        // 3. 인증 토큰 생성
        UsernamePasswordAuthenticationToken authentication = 
            new UsernamePasswordAuthenticationToken(
                userDetails,
                null, // credentials (JWT에서는 null)
                userDetails.getAuthorities()
            );
        
        // 4. 인증 세부 정보 설정
        authentication.setDetails(new WebAuthenticationDetailsSource()
                .buildDetails((HttpServletRequest) request));
        
        // 5. SecurityContext에 인증 정보 설정
        SecurityContextHolder.getContext().setAuthentication(authentication);
        
        log.debug("JWT authentication successful for user: {}", userId);
        
    } catch (Exception e) {
        log.error("Failed to authenticate user from JWT: {}", e.getMessage());
        SecurityContextHolder.clearContext();
    }
}

/**
 * 토큰 기반 커스텀 인증 객체 생성
 */
private void authenticateUserWithCustomToken(String token) {
    try {
        Claims claims = tokenProvider.parseToken(token);
        String userId = claims.getSubject();
        
        // 커스텀 인증 토큰 생성
        JwtAuthenticationToken authentication = new JwtAuthenticationToken(
            userId,
            token,
            extractAuthoritiesFromClaims(claims)
        );
        
        // 추가 정보 설정
        authentication.setUserDetails(userDetailsService.loadUserByUsername(userId));
        authentication.setClaims(claims);
        
        SecurityContextHolder.getContext().setAuthentication(authentication);
        
    } catch (Exception e) {
        log.error("JWT authentication failed: {}", e.getMessage());
        SecurityContextHolder.clearContext();
    }
}

/**
 * JWT 전용 커스텀 인증 토큰
 */
public class JwtAuthenticationToken extends AbstractAuthenticationToken {
    
    private final String principal;
    private final String token;
    private UserDetails userDetails;
    private Claims claims;
    
    public JwtAuthenticationToken(String principal, String token, 
                                 Collection<? extends GrantedAuthority> authorities) {
        super(authorities);
        this.principal = principal;
        this.token = token;
        setAuthenticated(true);
    }
    
    @Override
    public Object getCredentials() {
        return token;
    }
    
    @Override
    public Object getPrincipal() {
        return userDetails != null ? userDetails : principal;
    }
    
    // JWT 특화 메서드들
    public String getToken() {
        return token;
    }
    
    public Claims getClaims() {
        return claims;
    }
    
    public void setClaims(Claims claims) {
        this.claims = claims;
    }
    
    public void setUserDetails(UserDetails userDetails) {
        this.userDetails = userDetails;
    }
    
    /**
     * 토큰에서 특정 클레임 값 추출
     */
    public <T> T getClaim(String claimName, Class<T> clazz) {
        return claims != null ? claims.get(claimName, clazz) : null;
    }
    
    /**
     * 사용자 역할 확인
     */
    public boolean hasRole(String role) {
        return getAuthorities().stream()
                .anyMatch(auth -> auth.getAuthority().equals("ROLE_" + role));
    }
}

/**
 * Claims에서 권한 정보 추출
 */
@SuppressWarnings("unchecked")
private Collection<? extends GrantedAuthority> extractAuthoritiesFromClaims(Claims claims) {
    List<String> authorities = claims.get("authorities", List.class);
    
    if (authorities == null || authorities.isEmpty()) {
        // authorities가 없으면 role에서 추출
        String role = claims.get("role", String.class);
        if (role != null) {
            return Collections.singletonList(new SimpleGrantedAuthority("ROLE_" + role));
        }
        return Collections.emptyList();
    }
    
    return authorities.stream()
            .map(SimpleGrantedAuthority::new)
            .collect(Collectors.toList());
}

@Service
@RequiredArgsConstructor
@Transactional
@Slf4j
public class AuthService {
    
    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder;
    private final JwtTokenProvider tokenProvider;
    private final LoginAttemptService loginAttemptService;
    private final RedisTemplate<String, Object> redisTemplate;
    
    public LoginResponse authenticate(LoginRequest request) {
        // 1. 로그인 시도 횟수 확인
        validateLoginAttempts(request.getUsername());
        
        // 2. 사용자 조회 및 검증
        User user = findAndValidateUser(request.getUsername(), request.getPassword());
        
        // 3. 토큰 생성
        String accessToken = tokenProvider.createAccessToken(
            user.getId().toString(), 
            user.getRole().name()
        );
        
        String refreshToken = tokenProvider.createRefreshToken(
            user.getId().toString()
        );
        
        // 4. Refresh Token 저장
        saveRefreshToken(user.getId(), refreshToken);
        
        // 5. 로그인 성공 처리
        handleSuccessfulLogin(user, request);
        
        // 6. 응답 생성
        return createLoginResponse(user, accessToken, refreshToken);
    }
    
    private void validateLoginAttempts(String username) {
        if (loginAttemptService.isBlocked(username)) {
            throw new AccountLockedException("Account temporarily locked due to too many failed attempts");
        }
    }
    
    private User findAndValidateUser(String username, String password) {
        User user = userRepository.findByUsernameOrEmail(username, username)
                .orElseThrow(() -> new BadCredentialsException("Invalid credentials"));
        
        if (!user.isEnabled()) {
            throw new DisabledException("Account is disabled");
        }
        
        if (!user.isAccountNonLocked()) {
            throw new AccountLockedException("Account is locked");
        }
        
        if (!passwordEncoder.matches(password, user.getPassword())) {
            loginAttemptService.recordFailedAttempt(username);
            throw new BadCredentialsException("Invalid credentials");
        }
        
        return user;
    }
}

private void handleSuccessfulLogin(User user, LoginRequest request) {
    // 1. 로그인 시도 횟수 초기화
    loginAttemptService.clearFailedAttempts(request.getUsername());
    
    // 2. 마지막 로그인 시간 업데이트
    user.setLastLoginTime(Instant.now());
    user.setLoginCount(user.getLoginCount() + 1);
    
    // 3. 로그인 히스토리 저장
    saveLoginHistory(user, request);
    
    // 4. 활성 세션 관리 (동시 로그인 제한)
    manageActiveSessions(user);
    
    userRepository.save(user);
}

private void saveLoginHistory(User user, LoginRequest request) {
    LoginHistory history = LoginHistory.builder()
            .userId(user.getId())
            .loginTime(Instant.now())
            .ipAddress(getCurrentIpAddress())
            .userAgent(request.getUserAgent())
            .deviceId(request.getDeviceId())
            .success(true)
            .build();
    
    loginHistoryRepository.save(history);
}

private void manageActiveSessions(User user) {
    String sessionKey = "active_sessions:" + user.getId();
    
    // 현재 활성 세션 수 확인
    Set<String> activeSessions = redisTemplate.opsForSet().members(sessionKey);
    
    // 최대 동시 로그인 수 제한 (예: 3개)
    if (activeSessions != null && activeSessions.size() >= 3) {
        // 가장 오래된 세션 제거
        String oldestSession = activeSessions.iterator().next();
        redisTemplate.opsForSet().remove(sessionKey, oldestSession);
        
        // 해당 토큰을 블랙리스트에 추가
        tokenProvider.blacklistToken(oldestSession);
    }
    
    // 새 세션 추가
    String newSessionId = UUID.randomUUID().toString();
    redisTemplate.opsForSet().add(sessionKey, newSessionId);
    redisTemplate.expire(sessionKey, Duration.ofDays(30));
}

@Service
@RequiredArgsConstructor
public class RefreshTokenService {
    
    private final RedisTemplate<String, Object> redisTemplate;
    private final JwtTokenProvider tokenProvider;
    
    private static final Duration REFRESH_TOKEN_VALIDITY = Duration.ofDays(7);
    
    /**
     * Refresh Token 생성 및 저장
     */
    public String createAndStoreRefreshToken(Long userId) {
        // 1. Refresh Token 생성
        String refreshToken = tokenProvider.createRefreshToken(userId.toString());
        
        // 2. Redis에 저장 (사용자별로 하나의 Refresh Token만 유지)
        String key = "refresh_token:" + userId;
        
        RefreshTokenInfo tokenInfo = RefreshTokenInfo.builder()
                .token(refreshToken)
                .userId(userId)
                .createdAt(Instant.now())
                .expiresAt(Instant.now().plus(REFRESH_TOKEN_VALIDITY))
                .used(false)
                .build();
        
        redisTemplate.opsForValue().set(key, tokenInfo, REFRESH_TOKEN_VALIDITY);
        
        return refreshToken;
    }
    
    /**
     * Refresh Token 검증
     */
    public boolean isValidRefreshToken(String token, Long userId) {
        try {
            // 1. JWT 토큰 자체 검증
            Claims claims = tokenProvider.parseToken(token);
            
            // 2. 토큰 타입 확인
            if (!"refresh".equals(claims.get("type"))) {
                return false;
            }
            
            // 3. Redis에서 저장된 토큰 정보 확인
            String key = "refresh_token:" + userId;
            RefreshTokenInfo tokenInfo = (RefreshTokenInfo) redisTemplate.opsForValue().get(key);
            
            if (tokenInfo == null || tokenInfo.isUsed()) {
                return false;
            }
            
            // 4. 토큰 일치 여부 확인
            return token.equals(tokenInfo.getToken());
            
        } catch (Exception e) {
            log.error("Refresh token validation failed: {}", e.getMessage());
            return false;
        }
    }
}

@RestController
@RequestMapping("/api/auth")
@RequiredArgsConstructor
public class TokenController {
    
    private final RefreshTokenService refreshTokenService;
    private final JwtTokenProvider tokenProvider;
    private final UserService userService;
    
    @PostMapping("/refresh")
    public ResponseEntity<TokenRefreshResponse> refreshToken(
            @Valid @RequestBody TokenRefreshRequest request) {
        
        try {
            // 1. Refresh Token에서 사용자 ID 추출
            Claims claims = tokenProvider.parseToken(request.getRefreshToken());
            Long userId = Long.valueOf(claims.getSubject());
            
            // 2. Refresh Token 유효성 검증
            if (!refreshTokenService.isValidRefreshToken(request.getRefreshToken(), userId)) {
                throw new InvalidTokenException("Invalid refresh token");
            }
            
            // 3. 사용자 정보 조회
            User user = userService.findById(userId)
                    .orElseThrow(() -> new UserNotFoundException("User not found"));
            
            // 4. 새로운 Access Token 생성
            String newAccessToken = tokenProvider.createAccessToken(
                userId.toString(), 
                user.getRole().name()
            );
            
            // 5. RTR(Refresh Token Rotation) 적용 - 새로운 Refresh Token 생성
            String newRefreshToken = refreshTokenService.rotateRefreshToken(
                request.getRefreshToken(), userId
            );
            
            // 6. 응답 생성
            TokenRefreshResponse response = TokenRefreshResponse.builder()
                    .accessToken(newAccessToken)
                    .refreshToken(newRefreshToken)
                    .tokenType("Bearer")
                    .expiresIn(900) // 15분
                    .build();
            
            return ResponseEntity.ok(response);
            
        } catch (JwtException e) {
            throw new InvalidTokenException("Invalid refresh token format");
        }
    }
}