Spring 11: OAuth2 소셜 로그인

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-web'
    implementation 'org.springframework.boot:spring-boot-starter-security'
    implementation 'org.springframework.boot:spring-boot-starter-oauth2-client'
    implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
    implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
    
    runtimeOnly 'com.h2database:h2'
    
    testImplementation 'org.springframework.boot:spring-boot-starter-test'
    testImplementation 'org.springframework.security:spring-security-test'
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .headers(headers -> headers.frameOptions().disable()) // H2 Console용
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/", "/css/**", "/images/**", "/js/**", "/h2-console/**").permitAll()
                .requestMatchers("/login/**", "/oauth2/**").permitAll()
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard", true)
                .failureUrl("/login?error=true")
                .userInfoEndpoint(userInfo -> userInfo
                    .userService(customOAuth2UserService())
                )
            )
            .logout(logout -> logout
                .logoutSuccessUrl("/")
                .invalidateHttpSession(true)
                .clearAuthentication(true)
                .deleteCookies("JSESSIONID")
            );

        return http.build();
    }

    @Bean
    public CustomOAuth2UserService customOAuth2UserService() {
        return new CustomOAuth2UserService();
    }
}

@Entity
@Table(name = "users")
@Getter
@NoArgsConstructor(access = AccessLevel.PROTECTED)
public class User {
    
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(nullable = false)
    private String name;
    
    @Column(nullable = false, unique = true)
    private String email;
    
    @Column
    private String picture;
    
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private Role role;
    
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private SocialType socialType;
    
    @Column(nullable = false)
    private String socialId;
    
    @CreationTimestamp
    private LocalDateTime createdDate;
    
    @UpdateTimestamp
    private LocalDateTime modifiedDate;
    
    @Builder
    public User(String name, String email, String picture, Role role, 
                SocialType socialType, String socialId) {
        this.name = name;
        this.email = email;
        this.picture = picture;
        this.role = role;
        this.socialType = socialType;
        this.socialId = socialId;
    }
    
    public User update(String name, String picture) {
        this.name = name;
        this.picture = picture;
        return this;
    }
    
    public String getRoleKey() {
        return this.role.getKey();
    }
}

@Getter
@RequiredArgsConstructor
public enum Role {
    GUEST("ROLE_GUEST", "손님"),
    USER("ROLE_USER", "일반 사용자"),
    ADMIN("ROLE_ADMIN", "관리자");
    
    private final String key;
    private final String title;
}

@Getter
@RequiredArgsConstructor
public enum SocialType {
    GOOGLE("google"),
    KAKAO("kakao"),
    NAVER("naver");
    
    private final String registrationId;
}

@Repository
public interface UserRepository extends JpaRepository<User, Long> {
    
    Optional<User> findByEmail(String email);
    
    Optional<User> findBySocialTypeAndSocialId(SocialType socialType, String socialId);
    
    boolean existsByEmail(String email);
    
    @Query("SELECT u FROM User u WHERE u.socialType = :socialType AND u.socialId = :socialId")
    Optional<User> findBySocialInfo(@Param("socialType") SocialType socialType, 
                                   @Param("socialId") String socialId);
    
    @Modifying
    @Query("UPDATE User u SET u.name = :name, u.picture = :picture WHERE u.id = :id")
    void updateUserInfo(@Param("id") Long id, @Param("name") String name, 
                       @Param("picture") String picture);
}

@Service
@RequiredArgsConstructor
@Transactional
public class CustomOAuth2UserService implements OAuth2UserService<OAuth2UserRequest, OAuth2User> {
    
    private final UserRepository userRepository;
    
    @Override
    public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
        OAuth2UserService<OAuth2UserRequest, OAuth2User> delegate = new DefaultOAuth2UserService();
        OAuth2User oauth2User = delegate.loadUser(userRequest);
        
        // 현재 로그인 진행 중인 서비스를 구분하는 코드
        String registrationId = userRequest.getClientRegistration().getRegistrationId();
        
        // OAuth2 로그인 진행 시 키가 되는 필드값 (Primary Key와 같은 의미)
        String userNameAttributeName = userRequest.getClientRegistration()
                .getProviderDetails()
                .getUserInfoEndpoint()
                .getUserNameAttributeName();
        
        // OAuth2UserService를 통해 가져온 OAuth2User의 attribute를 담을 클래스
        OAuthAttributes attributes = OAuthAttributes.of(registrationId, userNameAttributeName, oauth2User.getAttributes());
        
        User user = saveOrUpdate(attributes);
        
        return new DefaultOAuth2User(
                Collections.singleton(new SimpleGrantedAuthority(user.getRoleKey())),
                attributes.getAttributes(),
                attributes.getNameAttributeKey()
        );
    }
    
    private User saveOrUpdate(OAuthAttributes attributes) {
        User user = userRepository.findBySocialTypeAndSocialId(
                        attributes.getSocialType(), 
                        attributes.getSocialId())
                .map(entity -> entity.update(attributes.getName(), attributes.getPicture()))
                .orElse(attributes.toEntity());
        
        return userRepository.save(user);
    }
}

@Getter
@Builder
public class OAuthAttributes {
    private Map<String, Object> attributes;
    private String nameAttributeKey;
    private String name;
    private String email;
    private String picture;
    private SocialType socialType;
    private String socialId;
    
    public static OAuthAttributes of(String registrationId, String userNameAttributeName, 
                                   Map<String, Object> attributes) {
        switch (registrationId) {
            case "google":
                return ofGoogle(userNameAttributeName, attributes);
            case "kakao":
                return ofKakao(userNameAttributeName, attributes);
            case "naver":
                return ofNaver(userNameAttributeName, attributes);
            default:
                throw new IllegalArgumentException("지원하지 않는 소셜 로그인입니다: " + registrationId);
        }
    }
    
    private static OAuthAttributes ofGoogle(String userNameAttributeName, 
                                          Map<String, Object> attributes) {
        return OAuthAttributes.builder()
                .name((String) attributes.get("name"))
                .email((String) attributes.get("email"))
                .picture((String) attributes.get("picture"))
                .socialType(SocialType.GOOGLE)
                .socialId((String) attributes.get("sub"))
                .attributes(attributes)
                .nameAttributeKey(userNameAttributeName)
                .build();
    }
    
    private static OAuthAttributes ofKakao(String userNameAttributeName, 
                                         Map<String, Object> attributes) {
        Map<String, Object> properties = (Map<String, Object>) attributes.get("properties");
        Map<String, Object> kakaoAccount = (Map<String, Object>) attributes.get("kakao_account");
        
        return OAuthAttributes.builder()
                .name((String) properties.get("nickname"))
                .email((String) kakaoAccount.get("email"))
                .picture((String) properties.get("profile_image"))
                .socialType(SocialType.KAKAO)
                .socialId(String.valueOf(attributes.get("id")))
                .attributes(attributes)
                .nameAttributeKey(userNameAttributeName)
                .build();
    }
    
    private static OAuthAttributes ofNaver(String userNameAttributeName, 
                                         Map<String, Object> attributes) {
        Map<String, Object> response = (Map<String, Object>) attributes.get("response");
        
        return OAuthAttributes.builder()
                .name((String) response.get("name"))
                .email((String) response.get("email"))
                .picture((String) response.get("profile_image"))
                .socialType(SocialType.NAVER)
                .socialId((String) response.get("id"))
                .attributes(attributes)
                .nameAttributeKey(userNameAttributeName)
                .build();
    }
    
    public User toEntity() {
        return User.builder()
                .name(name)
                .email(email)
                .picture(picture)
                .socialType(socialType)
                .socialId(socialId)
                .role(Role.USER)
                .build();
    }
}

jwt:
  secret: ${JWT_SECRET:mySecretKeyForJWTTokenGenerationThatShouldBeLongEnough}
  expiration: 86400000 # 24시간 (밀리초)
  refresh-expiration: 604800000 # 7일 (밀리초)
  
spring:
  security:
    oauth2:
      client:
        registration:
          google:
            # ... Google 설정 ...
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
          kakao:
            # ... Kakao 설정 ...
          naver:
            # ... Naver 설정 ...

@Component
@Slf4j
public class JwtTokenProvider {
    
    private final Key key;
    private final long tokenValidityInMilliseconds;
    private final long refreshTokenValidityInMilliseconds;
    
    public JwtTokenProvider(@Value("${jwt.secret}") String secret,
                           @Value("${jwt.expiration}") long tokenValidity,
                           @Value("${jwt.refresh-expiration}") long refreshTokenValidity) {
        byte[] keyBytes = Decoders.BASE64.decode(secret);
        this.key = Keys.hmacShaKeyFor(keyBytes);
        this.tokenValidityInMilliseconds = tokenValidity;
        this.refreshTokenValidityInMilliseconds = refreshTokenValidity;
    }
    
    // Access Token 생성
    public String createAccessToken(String email, String name, String role, String socialType) {
        Date now = new Date();
        Date validity = new Date(now.getTime() + tokenValidityInMilliseconds);
        
        return Jwts.builder()
                .setSubject(email)
                .claim("name", name)
                .claim("role", role)
                .claim("socialType", socialType)
                .claim("tokenType", "ACCESS")
                .setIssuedAt(now)
                .setExpiration(validity)
                .signWith(key, SignatureAlgorithm.HS512)
                .compact();
    }
    
    // Refresh Token 생성
    public String createRefreshToken(String email) {
        Date now = new Date();
        Date validity = new Date(now.getTime() + refreshTokenValidityInMilliseconds);
        
        return Jwts.builder()
                .setSubject(email)
                .claim("tokenType", "REFRESH")
                .setIssuedAt(now)
                .setExpiration(validity)
                .signWith(key, SignatureAlgorithm.HS512)
                .compact();
    }
    
    // 토큰에서 사용자 정보 추출
    public Authentication getAuthentication(String token) {
        Claims claims = parseClaims(token);
        
        if (claims.get("role") == null) {
            throw new RuntimeException("권한 정보가 없는 토큰입니다.");
        }
        
        Collection<? extends GrantedAuthority> authorities =
                Arrays.stream(claims.get("role").toString().split(","))
                        .map(SimpleGrantedAuthority::new)
                        .collect(Collectors.toList());
        
        UserPrincipal principal = UserPrincipal.builder()
                .email(claims.getSubject())
                .name(claims.get("name", String.class))
                .role(claims.get("role", String.class))
                .socialType(claims.get("socialType", String.class))
                .build();
        
        return new UsernamePasswordAuthenticationToken(principal, "", authorities);
    }
    
    // 토큰 유효성 검증
    public boolean validateToken(String token) {
        try {
            Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token);
            return true;
        } catch (io.jsonwebtoken.security.SecurityException | MalformedJwtException e) {
            log.info("잘못된 JWT 서명입니다.");
        } catch (ExpiredJwtException e) {
            log.info("만료된 JWT 토큰입니다.");
        } catch (UnsupportedJwtException e) {
            log.info("지원되지 않는 JWT 토큰입니다.");
        } catch (IllegalArgumentException e) {
            log.info("JWT 토큰이 잘못되었습니다.");
        }
        return false;
    }
    
    // 토큰에서 Claims 추출
    private Claims parseClaims(String token) {
        try {
            return Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token).getBody();
        } catch (ExpiredJwtException e) {
            return e.getClaims();
        }
    }
    
    // 토큰에서 이메일 추출
    public String getEmailFromToken(String token) {
        return parseClaims(token).getSubject();
    }
    
    // 토큰 만료 시간 확인
    public Long getExpiration(String token) {
        Date expiration = parseClaims(token).getExpiration();
        return expiration.getTime() - System.currentTimeMillis();
    }
}

@Getter
@Builder
public class UserPrincipal {
    private String email;
    private String name;
    private String role;
    private String socialType;
}

@RequiredArgsConstructor
@Slf4j
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    
    private final JwtTokenProvider jwtTokenProvider;
    
    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                  HttpServletResponse response, 
                                  FilterChain filterChain) throws ServletException, IOException {
        
        String token = resolveToken(request);
        
        if (token != null && jwtTokenProvider.validateToken(token)) {
            Authentication authentication = jwtTokenProvider.getAuthentication(token);
            SecurityContextHolder.getContext().setAuthentication(authentication);
            log.debug("Security Context에 '{}' 인증 정보를 저장했습니다.", authentication.getName());
        } else {
            log.debug("유효한 JWT 토큰이 없습니다.");
        }
        
        filterChain.doFilter(request, response);
    }
    
    // Request Header에서 토큰 정보 추출
    private String resolveToken(HttpServletRequest request) {
        String bearerToken = request.getHeader("Authorization");
        if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
            return bearerToken.substring(7);
        }
        return null;
    }
}

@Component
@RequiredArgsConstructor
@Slf4j
public class OAuth2AuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    
    private final JwtTokenProvider jwtTokenProvider;
    private final UserRepository userRepository;
    private final ObjectMapper objectMapper;
    
    @Value("${app.oauth2.authorized-redirect-uris}")
    private List<String> authorizedRedirectUris;
    
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, 
                                      HttpServletResponse response,
                                      Authentication authentication) throws IOException {
        
        OAuth2User oauth2User = (OAuth2User) authentication.getPrincipal();
        
        // 사용자 정보 조회
        String email = oauth2User.getAttribute("email");
        User user = userRepository.findByEmail(email)
                .orElseThrow(() -> new IllegalArgumentException("사용자를 찾을 수 없습니다: " + email));
        
        // JWT 토큰 생성
        String accessToken = jwtTokenProvider.createAccessToken(
                user.getEmail(),
                user.getName(),
                user.getRoleKey(),
                user.getSocialType().name()
        );
        
        String refreshToken = jwtTokenProvider.createRefreshToken(user.getEmail());
        
        // Refresh Token을 데이터베이스에 저장 (선택사항)
        // refreshTokenService.saveRefreshToken(user.getEmail(), refreshToken);
        
        // 응답 설정
        response.setContentType("application/json");
        response.setCharacterEncoding("UTF-8");
        
        // 프론트엔드로 리다이렉트하면서 토큰 전달
        String targetUrl = determineTargetUrl(request, response, authentication, accessToken, refreshToken);
        
        if (response.isCommitted()) {
            log.debug("Response has already been committed. Unable to redirect to " + targetUrl);
            return;
        }
        
        clearAuthenticationAttributes(request, response);
        getRedirectStrategy().sendRedirect(request, response, targetUrl);
    }
    
    protected String determineTargetUrl(HttpServletRequest request, 
                                      HttpServletResponse response,
                                      Authentication authentication,
                                      String accessToken,
                                      String refreshToken) {
        
        Optional<String> redirectUri = CookieUtils.getCookie(request, "redirect_uri")
                .map(Cookie::getValue);
        
        if (redirectUri.isPresent() && !isAuthorizedRedirectUri(redirectUri.get())) {
            throw new BadRequestException("승인되지 않은 리다이렉트 URI입니다.");
        }
        
        String targetUrl = redirectUri.orElse("http://localhost:3000/oauth2/redirect");
        
        return UriComponentsBuilder.fromUriString(targetUrl)
                .queryParam("token", accessToken)
                .queryParam("refreshToken", refreshToken)
                .build().toUriString();
    }
    
    protected void clearAuthenticationAttributes(HttpServletRequest request, 
                                               HttpServletResponse response) {
        super.clearAuthenticationAttributes(request);
        CookieUtils.deleteCookie(request, response, "redirect_uri");
    }
    
    private boolean isAuthorizedRedirectUri(String uri) {
        URI clientRedirectUri = URI.create(uri);
        return authorizedRedirectUris
                .stream()
                .anyMatch(authorizedRedirectUri -> {
                    URI authorizedURI = URI.create(authorizedRedirectUri);
                    return authorizedURI.getHost().equalsIgnoreCase(clientRedirectUri.getHost())
                            && authorizedURI.getPort() == clientRedirectUri.getPort();
                });
    }
    
    private RedirectStrategy getRedirectStrategy() {
        return new DefaultRedirectStrategy();
    }
}

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig {
    
    private final JwtTokenProvider jwtTokenProvider;
    private final CustomOAuth2UserService customOAuth2UserService;
    private final OAuth2AuthenticationSuccessHandler oAuth2AuthenticationSuccessHandler;
    private final OAuth2AuthenticationFailureHandler oAuth2AuthenticationFailureHandler;
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
            .csrf(csrf -> csrf.disable())
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .formLogin(form -> form.disable())
            .httpBasic(basic -> basic.disable())
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/", "/error", "/favicon.ico", "/**/*.png", "/**/*.gif", 
                               "/**/*.svg", "/**/*.jpg", "/**/*.html", "/**/*.css", "/**/*.js").permitAll()
                .requestMatchers("/auth/**", "/oauth2/**").permitAll()
                .requestMatchers("/api/auth/**").permitAll()
                .requestMatchers(HttpMethod.GET, "/api/posts/**", "/api/comments/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                .authorizationEndpoint(authorization -> authorization
                    .baseUri("/oauth2/authorize")
                    .authorizationRequestRepository(cookieAuthorizationRequestRepository())
                )
                .redirectionEndpoint(redirection -> redirection
                    .baseUri("/oauth2/callback/*")
                )
                .userInfoEndpoint(userInfo -> userInfo
                    .userService(customOAuth2UserService)
                )
                .successHandler(oAuth2AuthenticationSuccessHandler)
                .failureHandler(oAuth2AuthenticationFailureHandler)
            )
            .addFilterBefore(new JwtAuthenticationFilter(jwtTokenProvider), 
                           UsernamePasswordAuthenticationFilter.class);
        
        return http.build();
    }
    
    @Bean
    public HttpCookieOAuth2AuthorizationRequestRepository cookieAuthorizationRequestRepository() {
        return new HttpCookieOAuth2AuthorizationRequestRepository();
    }
    
    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOriginPatterns(Arrays.asList("*"));
        configuration.setAllowedMethods(Arrays.asList("HEAD", "POST", "GET", "DELETE", "PUT", "PATCH"));
        configuration.setAllowedHeaders(Arrays.asList("*"));
        configuration.setAllowCredentials(true);
        
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

@RestController
@RequestMapping("/api/auth")
@RequiredArgsConstructor
@Slf4j
public class AuthController {
    
    private final JwtTokenProvider jwtTokenProvider;
    private final UserRepository userRepository;
    
    @PostMapping("/refresh")
    public ResponseEntity<?> refreshToken(@RequestBody TokenRefreshRequest request) {
        String refreshToken = request.getRefreshToken();
        
        if (!jwtTokenProvider.validateToken(refreshToken)) {
            return ResponseEntity.badRequest()
                    .body(new ApiResponse(false, "Refresh Token이 유효하지 않습니다."));
        }
        
        String email = jwtTokenProvider.getEmailFromToken(refreshToken);
        User user = userRepository.findByEmail(email)
                .orElseThrow(() -> new IllegalArgumentException("사용자를 찾을 수 없습니다."));
        
        String newAccessToken = jwtTokenProvider.createAccessToken(
                user.getEmail(),
                user.getName(),
                user.getRoleKey(),
                user.getSocialType().name()
        );
        
        return ResponseEntity.ok(new JwtAuthenticationResponse(newAccessToken, refreshToken));
    }
    
    @PostMapping("/logout")
    public ResponseEntity<?> logout(@RequestBody TokenRefreshRequest request) {
        // Refresh Token을 블랙리스트에 추가하거나 데이터베이스에서 삭제
        // refreshTokenService.deleteByToken(request.getRefreshToken());
        
        return ResponseEntity.ok(new ApiResponse(true, "로그아웃되었습니다."));
    }
    
    @GetMapping("/user")
    public ResponseEntity<?> getCurrentUser(Authentication authentication) {
        if (authentication == null || !authentication.isAuthenticated()) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                    .body(new ApiResponse(false, "인증이 필요합니다."));
        }
        
        UserPrincipal userPrincipal = (UserPrincipal) authentication.getPrincipal();
        User user = userRepository.findByEmail(userPrincipal.getEmail())
                .orElseThrow(() -> new IllegalArgumentException("사용자를 찾을 수 없습니다."));
        
        return ResponseEntity.ok(new UserSummary(user));
    }
}

@Getter
@Setter
public class TokenRefreshRequest {
    private String refreshToken;
}

@Getter
@AllArgsConstructor
public class JwtAuthenticationResponse {
    private String accessToken;
    private String refreshToken;
    private String tokenType = "Bearer";
    
    public JwtAuthenticationResponse(String accessToken, String refreshToken) {
        this.accessToken = accessToken;
        this.refreshToken = refreshToken;
    }
}

@Getter
@AllArgsConstructor
public class ApiResponse {
    private Boolean success;
    private String message;
}

@Getter
public class UserSummary {
    private Long id;
    private String name;
    private String email;
    private String picture;
    private String socialType;
    
    public UserSummary(User user) {
        this.id = user.getId();
        this.name = user.getName();
        this.email = user.getEmail();
        this.picture = user.getPicture();
        this.socialType = user.getSocialType().name();
    }
}

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          # JWT 검증을 위한 설정
          issuer-uri: http://localhost:8080  # Authorization Server URI
          # 또는 직접 JWK Set URI 지정
          # jwk-set-uri: http://localhost:8080/.well-known/jwks.json
          
jwt:
  secret: ${JWT_SECRET:mySecretKeyForJWTTokenGenerationThatShouldBeLongEnough}
  
# 서버 포트 (Resource Server)
server:
  port: 8081
  
# 로깅 설정
logging:
  level:
    org.springframework.security: DEBUG
    org.springframework.security.oauth2: DEBUG

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class JwtConfig {
    
    @Value("${jwt.secret}")
    private String jwtSecret;
    
    @Bean
    public JwtDecoder jwtDecoder() {
        // HMAC 기반 JWT Decoder 설정
        byte[] keyBytes = Decoders.BASE64.decode(jwtSecret);
        SecretKeySpec secretKey = new SecretKeySpec(keyBytes, "HmacSHA512");
        
        return NimbusJwtDecoder.withSecretKey(secretKey)
                .macAlgorithm(MacAlgorithm.HS512)
                .build();
    }
    
    @Bean
    public JwtAuthenticationConverter jwtAuthenticationConverter() {
        JwtGrantedAuthoritiesConverter authoritiesConverter = new JwtGrantedAuthoritiesConverter();
        
        // JWT의 권한 클레임 설정
        authoritiesConverter.setAuthorityPrefix(""); // 기본 "SCOPE_" 접두사 제거
        authoritiesConverter.setAuthoritiesClaimName("role"); // 권한 클레임명 설정
        
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(authoritiesConverter);
        
        // Principal 이름 설정 (기본적으로 'sub' 클레임 사용)
        converter.setPrincipalClaimName("sub");
        
        return converter;
    }
    
    @Bean
    public Converter<Jwt, AbstractAuthenticationToken> jwtAuthenticationConverter() {
        return new CustomJwtAuthenticationConverter();
    }
}

@Component
public class CustomJwtAuthenticationConverter implements Converter<Jwt, AbstractAuthenticationToken> {
    
    @Override
    public AbstractAuthenticationToken convert(Jwt jwt) {
        Collection<GrantedAuthority> authorities = extractAuthorities(jwt);
        
        // 커스텀 Principal 생성
        JwtUserPrincipal principal = JwtUserPrincipal.builder()
                .email(jwt.getSubject())
                .name(jwt.getClaimAsString("name"))
                .role(jwt.getClaimAsString("role"))
                .socialType(jwt.getClaimAsString("socialType"))
                .build();
        
        return new JwtAuthenticationToken(jwt, authorities, principal);
    }
    
    private Collection<GrantedAuthority> extractAuthorities(Jwt jwt) {
        String role = jwt.getClaimAsString("role");
        if (role != null) {
            return Arrays.stream(role.split(","))
                    .map(SimpleGrantedAuthority::new)
                    .collect(Collectors.toList());
        }
        return Collections.emptyList();
    }
}

@Getter
@Builder
public class JwtUserPrincipal {
    private String email;
    private String name;
    private String role;
    private String socialType;
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true) // 메서드 레벨 보안 활성화
@RequiredArgsConstructor
public class ResourceServerConfig {
    
    private final JwtDecoder jwtDecoder;
    private final Converter<Jwt, AbstractAuthenticationToken> jwtAuthenticationConverter;
    
    @Bean
    public SecurityFilterChain resourceServerFilterChain(HttpSecurity http) throws Exception {
        http
            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
            .csrf(csrf -> csrf.disable())
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(authz -> authz
                // 공개 엔드포인트
                .requestMatchers("/", "/health", "/actuator/**").permitAll()
                .requestMatchers(HttpMethod.GET, "/api/public/**").permitAll()
                
                // 인증이 필요한 엔드포인트
                .requestMatchers("/api/user/**").hasAnyRole("USER", "ADMIN")
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                
                // 나머지 모든 요청은 인증 필요
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .decoder(jwtDecoder)
                    .jwtAuthenticationConverter(jwtAuthenticationConverter)
                )
                .authenticationEntryPoint(customAuthenticationEntryPoint())
                .accessDeniedHandler(customAccessDeniedHandler())
            );
        
        return http.build();
    }
    
    @Bean
    public AuthenticationEntryPoint customAuthenticationEntryPoint() {
        return (request, response, authException) -> {
            response.setContentType("application/json");
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            response.getOutputStream().println(
                "{ "error": "Unauthorized", "message": "" + authException.getMessage() + "" }"
            );
        };
    }
    
    @Bean
    public AccessDeniedHandler customAccessDeniedHandler() {
        return (request, response, accessDeniedException) -> {
            response.setContentType("application/json");
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.getOutputStream().println(
                "{ "error": "Access Denied", "message": "" + accessDeniedException.getMessage() + "" }"
            );
        };
    }
    
    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOriginPatterns(Arrays.asList("*"));
        configuration.setAllowedMethods(Arrays.asList("HEAD", "POST", "GET", "DELETE", "PUT", "PATCH"));
        configuration.setAllowedHeaders(Arrays.asList("*"));
        configuration.setAllowCredentials(true);
        
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

@Service
@RequiredArgsConstructor
@Transactional
public class PostService {
    
    private final PostRepository postRepository;
    private final UserRepository userRepository;
    
    @PreAuthorize("hasRole('USER')")
    public PostResponse createPost(String userEmail, PostCreateRequest request) {
        User user = userRepository.findByEmail(userEmail)
                .orElseThrow(() -> new IllegalArgumentException("사용자를 찾을 수 없습니다."));
        
        Post post = Post.builder()
                .title(request.getTitle())
                .content(request.getContent())
                .author(user)
                .build();
        
        Post savedPost = postRepository.save(post);
        return new PostResponse(savedPost);
    }
    
    @PreAuthorize("hasRole('USER') and @postService.isPostOwner(#postId, authentication.principal.email)")
    public PostResponse updatePost(Long postId, PostUpdateRequest request) {
        Post post = postRepository.findById(postId)
                .orElseThrow(() -> new IllegalArgumentException("게시글을 찾을 수 없습니다."));
        
        post.update(request.getTitle(), request.getContent());
        return new PostResponse(post);
    }
    
    @PreAuthorize("hasRole('ADMIN') or @postService.isPostOwner(#postId, authentication.principal.email)")
    public void deletePost(Long postId) {
        Post post = postRepository.findById(postId)
                .orElseThrow(() -> new IllegalArgumentException("게시글을 찾을 수 없습니다."));
        
        postRepository.delete(post);
    }
    
    // 게시글 소유자 확인 메서드
    public boolean isPostOwner(Long postId, String userEmail) {
        return postRepository.findById(postId)
                .map(post -> post.getAuthor().getEmail().equals(userEmail))
                .orElse(false);
    }
    
    @PostAuthorize("hasRole('ADMIN') or returnObject.authorEmail == authentication.principal.email")
    public PostDetailResponse getPostDetail(Long postId) {
        Post post = postRepository.findById(postId)
                .orElseThrow(() -> new IllegalArgumentException("게시글을 찾을 수 없습니다."));
        
        return new PostDetailResponse(post);
    }
}

@RestControllerAdvice
@Slf4j
public class GlobalExceptionHandler {
    
    @ExceptionHandler(JwtException.class)
    public ResponseEntity<ErrorResponse> handleJwtException(JwtException ex) {
        log.error("JWT 예외 발생: {}", ex.getMessage());
        
        ErrorResponse errorResponse = ErrorResponse.builder()
                .error("JWT_ERROR")
                .message("토큰이 유효하지 않습니다.")
                .timestamp(LocalDateTime.now())
                .build();
        
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(errorResponse);
    }
    
    @ExceptionHandler(AccessDeniedException.class)
    public ResponseEntity<ErrorResponse> handleAccessDeniedException(AccessDeniedException ex) {
        log.error("접근 권한 없음: {}", ex.getMessage());
        
        ErrorResponse errorResponse = ErrorResponse.builder()
                .error("ACCESS_DENIED")
                .message("접근 권한이 없습니다.")
                .timestamp(LocalDateTime.now())
                .build();
        
        return ResponseEntity.status(HttpStatus.FORBIDDEN).body(errorResponse);
    }
    
    @ExceptionHandler(AuthenticationException.class)
    public ResponseEntity<ErrorResponse> handleAuthenticationException(AuthenticationException ex) {
        log.error("인증 실패: {}", ex.getMessage());
        
        ErrorResponse errorResponse = ErrorResponse.builder()
                .error("AUTHENTICATION_FAILED")
                .message("인증에 실패했습니다.")
                .timestamp(LocalDateTime.now())
                .build();
        
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(errorResponse);
    }
    
    @ExceptionHandler(MethodArgumentNotValidException.class)
    public ResponseEntity<ErrorResponse> handleValidationException(MethodArgumentNotValidException ex) {
        String message = ex.getBindingResult().getFieldErrors().stream()
                .map(error -> error.getField() + ": " + error.getDefaultMessage())
                .collect(Collectors.joining(", "));
        
        ErrorResponse errorResponse = ErrorResponse.builder()
                .error("VALIDATION_ERROR")
                .message(message)
                .timestamp(LocalDateTime.now())
                .build();
        
        return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(errorResponse);
    }
}

@Getter
@Builder
public class ErrorResponse {
    private String error;
    private String message;
    private LocalDateTime timestamp;
}

src/
├── main/
│   ├── java/
│   │   └── com/example/oauth2/
│   │       ├── OAuth2Application.java
│   │       ├── config/
│   │       │   ├── SecurityConfig.java
│   │       │   ├── JwtConfig.java
│   │       │   └── CorsConfig.java
│   │       ├── controller/
│   │       │   ├── AuthController.java
│   │       │   ├── UserController.java
│   │       │   └── AdminController.java
│   │       ├── service/
│   │       │   ├── CustomOAuth2UserService.java
│   │       │   ├── UserService.java
│   │       │   └── JwtTokenService.java
│   │       ├── security/
│   │       │   ├── JwtTokenProvider.java
│   │       │   ├── JwtAuthenticationFilter.java
│   │       │   ├── OAuth2AuthenticationSuccessHandler.java
│   │       │   └── OAuth2AuthenticationFailureHandler.java
│   │       ├── domain/
│   │       │   ├── user/
│   │       │   │   ├── User.java
│   │       │   │   ├── Role.java
│   │       │   │   ├── SocialType.java
│   │       │   │   └── UserRepository.java
│   │       │   └── token/
│   │       │       ├── RefreshToken.java
│   │       │       └── RefreshTokenRepository.java
│   │       ├── dto/
│   │       │   ├── auth/
│   │       │   ├── user/
│   │       │   └── common/
│   │       ├── exception/
│   │       │   ├── GlobalExceptionHandler.java
│   │       │   ├── OAuth2AuthenticationProcessingException.java
│   │       │   └── TokenValidationException.java
│   │       └── util/
│   │           ├── CookieUtils.java
│   │           └── OAuthAttributes.java
│   └── resources/
│       ├── application.yml
│       ├── application-dev.yml
│       ├── application-prod.yml
│       └── static/
└── test/
    └── java/
        └── com/example/oauth2/
            ├── integration/
            ├── security/
            └── service/

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: ${GOOGLE_CLIENT_ID}
            client-secret: ${GOOGLE_CLIENT_SECRET}
            redirect-uri: "https://yourdomain.com/login/oauth2/code/{registrationId}"
          kakao:
            client-id: ${KAKAO_CLIENT_ID}
            client-secret: ${KAKAO_CLIENT_SECRET}
            redirect-uri: "https://yourdomain.com/login/oauth2/code/{registrationId}"
          naver:
            client-id: ${NAVER_CLIENT_ID}
            client-secret: ${NAVER_CLIENT_SECRET}
            redirect-uri: "https://yourdomain.com/login/oauth2/code/{registrationId}"

jwt:
  secret: ${JWT_SECRET} # 256비트 이상의 강력한 시크릿
  expiration: 900000 # 15분 (짧게 설정)
  refresh-expiration: 604800000 # 7일

# HTTPS 강제 설정
server:
  ssl:
    enabled: true
    key-store: ${SSL_KEYSTORE_PATH}
    key-store-password: ${SSL_KEYSTORE_PASSWORD}
    key-store-type: PKCS12
  port: 443

# 보안 헤더 설정
security:
  headers:
    frame-options: DENY
    content-type-options: nosniff
    xss-protection: "1; mode=block"
    referrer-policy: strict-origin-when-cross-origin
    
# CORS 설정 (운영 환경)
app:
  cors:
    allowed-origins: 
      - https://yourdomain.com
      - https://www.yourdomain.com
    allowed-methods: GET,POST,PUT,DELETE,OPTIONS
    allowed-headers: "*"
    allow-credentials: true
    max-age: 3600

# OAuth2 리다이렉트 URI 화이트리스트
oauth2:
  authorized-redirect-uris:
    - https://yourdomain.com/oauth2/redirect
    - https://yourdomain.com/login

# 로깅 설정 (운영 환경)
logging:
  level:
    org.springframework.security: WARN
    org.springframework.security.oauth2: INFO
    com.example.oauth2.security: INFO
  pattern:
    console: "%d{yyyy-MM-dd HH:mm:ss} - %msg%n"
  file:
    name: /var/log/oauth2-app.log

@Service
@RequiredArgsConstructor
@Slf4j
public class SecurityAuditService {
    
    private final AuditLogRepository auditLogRepository;
    private final MeterRegistry meterRegistry;
    
    @EventListener
    @Async
    public void handleAuthenticationSuccess(AuthenticationSuccessEvent event) {
        String username = event.getAuthentication().getName();
        String ipAddress = getClientIpAddress();
        
        log.info("로그인 성공 - 사용자: {}, IP: {}", username, ipAddress);
        
        // 메트릭 수집
        meterRegistry.counter("auth.login.success", 
                            "user", username, 
                            "ip", ipAddress).increment();
        
        // 감사 로그 저장
        saveAuditLog("LOGIN_SUCCESS", username, ipAddress, null);
    }
    
    @EventListener
    @Async
    public void handleAuthenticationFailure(AbstractAuthenticationFailureEvent event) {
        String username = event.getAuthentication().getName();
        String ipAddress = getClientIpAddress();
        String reason = event.getException().getMessage();
        
        log.warn("로그인 실패 - 사용자: {}, IP: {}, 이유: {}", username, ipAddress, reason);
        
        // 실패 메트릭 수집
        meterRegistry.counter("auth.login.failure", 
                            "user", username, 
                            "ip", ipAddress,
                            "reason", reason).increment();
        
        // 감사 로그 저장
        saveAuditLog("LOGIN_FAILURE", username, ipAddress, reason);
        
        // 브루트 포스 공격 감지
        checkBruteForceAttack(ipAddress);
    }
    
    @EventListener
    @Async
    public void handleTokenValidationFailure(TokenValidationFailureEvent event) {
        String token = event.getToken();
        String reason = event.getReason();
        String ipAddress = getClientIpAddress();
        
        log.warn("토큰 검증 실패 - IP: {}, 이유: {}", ipAddress, reason);
        
        meterRegistry.counter("auth.token.validation.failure",
                            "ip", ipAddress,
                            "reason", reason).increment();
        
        saveAuditLog("TOKEN_VALIDATION_FAILURE", null, ipAddress, reason);
    }
    
    private void checkBruteForceAttack(String ipAddress) {
        // Redis를 사용한 IP별 실패 횟수 추적
        String key = "failed_attempts:" + ipAddress;
        String attempts = redisTemplate.opsForValue().get(key);
        
        int failedAttempts = attempts != null ? Integer.parseInt(attempts) : 0;
        failedAttempts++;
        
        redisTemplate.opsForValue().set(key, String.valueOf(failedAttempts), 
                                      Duration.ofMinutes(15));
        
        if (failedAttempts >= 5) {
            log.error("브루트 포스 공격 감지 - IP: {}, 시도 횟수: {}", ipAddress, failedAttempts);
            
            // IP 차단 또는 알림 발송
            blockIpAddress(ipAddress);
            sendSecurityAlert("브루트 포스 공격 감지", ipAddress);
        }
    }
    
    private void saveAuditLog(String eventType, String username, String ipAddress, String details) {
        AuditLog auditLog = AuditLog.builder()
                .eventType(eventType)
                .username(username)
                .ipAddress(ipAddress)
                .details(details)
                .timestamp(LocalDateTime.now())
                .build();
        
        auditLogRepository.save(auditLog);
    }
}