Auth API를 만들어요: domain과 application

dependencies {
	testImplementation 'org.springframework.boot:spring-boot-starter-actuator-test'
}

plugins {
	id 'java'
	id 'org.springframework.boot' version '4.0.7'
	id 'io.spring.dependency-management' version '1.1.7'
}

group = 'me.nvim.blog'
version = '0.0.1-SNAPSHOT'

java {
	toolchain {
		languageVersion = JavaLanguageVersion.of(21)
	}
}

repositories {
	mavenCentral()
}

dependencies {
	implementation 'org.springframework.boot:spring-boot-h2console'
	implementation 'org.springframework.boot:spring-boot-starter-actuator'
	implementation 'org.springframework.boot:spring-boot-starter-jdbc'
	implementation 'org.springframework.boot:spring-boot-starter-security'
	implementation 'org.springframework.boot:spring-boot-starter-security-oauth2-resource-server'
	implementation 'org.springframework.boot:spring-boot-starter-validation'
	implementation 'org.springframework.boot:spring-boot-starter-webmvc'
	runtimeOnly 'com.h2database:h2'
	testImplementation 'org.springframework.boot:spring-boot-starter-jdbc-test'
	testImplementation 'org.springframework.boot:spring-boot-starter-security-oauth2-resource-server-test'
	testImplementation 'org.springframework.boot:spring-boot-starter-security-test'
	testImplementation 'org.springframework.boot:spring-boot-starter-validation-test'
	testImplementation 'org.springframework.boot:spring-boot-starter-webmvc-test'
	testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
}

tasks.named('test') {
	useJUnitPlatform()
}

package me.nvim.blog.auth;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.context.properties.ConfigurationPropertiesScan; 

@SpringBootApplication
@ConfigurationPropertiesScan
public class AuthApiApplication {

    public static void main(String[] args) {
        SpringApplication.run(AuthApiApplication.class, args);
    }

}

spring:
  application:
    name: auth-api
  datasource:
    url: jdbc:h2:mem:auth_api;MODE=PostgreSQL;DATABASE_TO_LOWER=TRUE;DEFAULT_NULL_ORDERING=HIGH
    username: sa
    password: ""
  sql:
    init:
      mode: always
  h2:
    console:
      enabled: true
      path: /h2-console

management:
  endpoints:
    web:
      exposure:
        include: health,info
  endpoint:
    health:
      probes:
        enabled: true

auth:
  token:
    issuer: ${AUTH_TOKEN_ISSUER:http://localhost:8080}
    audience: ${AUTH_TOKEN_AUDIENCE:auth-api}
    key-id: ${AUTH_TOKEN_KEY_ID:auth-api-local}
    private-key-pem: ${AUTH_TOKEN_PRIVATE_KEY_PEM:}
    public-key-pem: ${AUTH_TOKEN_PUBLIC_KEY_PEM:}
    access-token-ttl: 15m
    refresh-token-ttl: 7d
    refresh-token-hmac-secret: ${AUTH_REFRESH_TOKEN_HMAC_SECRET:blog-study-only-refresh-token-hmac-secret}

create table app_user (
    id uuid primary key,
    email varchar(320) not null unique,
    password_hash varchar(255) not null,
    display_name varchar(80) not null,
    enabled boolean not null default true,
    created_at timestamp with time zone not null
);

create table app_role (
    name varchar(40) primary key
);

create table app_user_role (
    user_id uuid not null,
    role_name varchar(40) not null,
    primary key (user_id, role_name),
    constraint fk_app_user_role_user foreign key (user_id) references app_user(id),
    constraint fk_app_user_role_role foreign key (role_name) references app_role(name)
);

create table refresh_token (
    id uuid primary key,
    user_id uuid not null,
    token_hash char(64) not null unique,
    created_at timestamp with time zone not null,
    expires_at timestamp with time zone not null,
    revoked_at timestamp with time zone,
    constraint fk_refresh_token_user foreign key (user_id) references app_user(id)
);

create index idx_refresh_token_user on refresh_token(user_id);
create index idx_refresh_token_active on refresh_token(token_hash, expires_at, revoked_at);

insert into app_role (name) values ('ROLE_USER');
insert into app_role (name) values ('ROLE_ADMIN');

package me.nvim.blog.auth.identity.domain;

import java.time.Instant;
import java.util.List;
import java.util.Locale;
import java.util.Objects;
import java.util.UUID;

public record UserAccount(
        UUID id,
        String email,
        String passwordHash,
        String displayName,
        boolean enabled,
        Instant createdAt,
        List<String> roles) {

    public UserAccount {
        Objects.requireNonNull(id, "id");
        Objects.requireNonNull(email, "email");
        Objects.requireNonNull(passwordHash, "passwordHash");
        Objects.requireNonNull(displayName, "displayName");
        Objects.requireNonNull(createdAt, "createdAt");
        roles = List.copyOf(roles);
    }

    public static UserAccount register(String email, String passwordHash, String displayName) {
        return new UserAccount(
                UUID.randomUUID(),
                email.toLowerCase(Locale.ROOT),
                passwordHash,
                displayName,
                true,
                Instant.now(),
                List.of("ROLE_USER"));
    }
}

package me.nvim.blog.auth.identity.domain;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;

import java.time.Instant;
import java.util.ArrayList;
import java.util.List;
import java.util.UUID;

import org.junit.jupiter.api.Test;

class UserAccountTests {

    @Test
    void registrationNormalizesEmailAndAssignsUserRole() {
        UserAccount userAccount = UserAccount.register("User@Example.COM", "password-hash", "User");

        assertEquals("user@example.com", userAccount.email());
        assertEquals(List.of("ROLE_USER"), userAccount.roles());
    }

    @Test
    void rolesAreDefensivelyCopied() {
        List<String> roles = new ArrayList<>(List.of("ROLE_USER"));
        UserAccount userAccount = new UserAccount(
                UUID.randomUUID(),
                "user@example.com",
                "password-hash",
                "User",
                true,
                Instant.now(),
                roles);

        roles.add("ROLE_ADMIN");

        assertEquals(List.of("ROLE_USER"), userAccount.roles());
        assertThrows(UnsupportedOperationException.class, () -> userAccount.roles().add("ROLE_ADMIN"));
    }
}

package me.nvim.blog.auth.common.exception;

public enum ErrorCode {

    EMAIL_ALREADY_USED(
            409,
            "https://blog.nvim.me/problems/email-already-used",
            "Email already used",
            "Email is already registered"),
    INVALID_REFRESH_TOKEN(
            401,
            "https://blog.nvim.me/problems/invalid-refresh-token",
            "Invalid refresh token",
            "Refresh token is invalid, expired, or already used"),
    UNAUTHORIZED(
            401,
            "https://blog.nvim.me/problems/unauthorized",
            "Unauthorized",
            "Authentication is required");

    private final int status;
    private final String type;
    private final String title;
    private final String detail;

    ErrorCode(int status, String type, String title, String detail) {
        this.status = status;
        this.type = type;
        this.title = title;
        this.detail = detail;
    }

    public int status() {
        return this.status;
    }

    public String type() {
        return this.type;
    }

    public String title() {
        return this.title;
    }

    public String detail() {
        return this.detail;
    }
}

package me.nvim.blog.auth.common.exception;

public class BusinessException extends RuntimeException {

    private final ErrorCode errorCode;

    public BusinessException(ErrorCode errorCode) {
        this(errorCode, errorCode.detail(), null);
    }

    public BusinessException(ErrorCode errorCode, String detail, Throwable cause) {
        super(detail, cause);
        this.errorCode = errorCode;
    }

    public ErrorCode errorCode() {
        return this.errorCode;
    }
}

package me.nvim.blog.auth.common.exception;

import java.net.URI;
import java.util.LinkedHashMap;
import java.util.Map;

import org.springframework.http.HttpStatus;
import org.springframework.http.HttpStatusCode;
import org.springframework.http.ProblemDetail;
import org.springframework.validation.FieldError;
import org.springframework.web.bind.MethodArgumentNotValidException;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RestControllerAdvice;

@RestControllerAdvice
public class GlobalExceptionHandler {

    @ExceptionHandler(BusinessException.class)
    ProblemDetail handleBusinessException(BusinessException ex) {
        ErrorCode errorCode = ex.errorCode();
        ProblemDetail problem = ProblemDetail.forStatusAndDetail(
                HttpStatusCode.valueOf(errorCode.status()),
                ex.getMessage());
        problem.setType(URI.create(errorCode.type()));
        problem.setTitle(errorCode.title());
        return problem;
    }

    @ExceptionHandler(MethodArgumentNotValidException.class)
    ProblemDetail handleValidationFailure(MethodArgumentNotValidException ex) {
        ProblemDetail problem = ProblemDetail.forStatusAndDetail(HttpStatus.BAD_REQUEST, "Request validation failed");
        problem.setType(URI.create("https://blog.nvim.me/problems/validation-failed"));
        problem.setTitle("Validation failed");
        problem.setProperty("errors", fieldErrors(ex));
        return problem;
    }

    private static Map<String, String> fieldErrors(MethodArgumentNotValidException ex) {
        Map<String, String> errors = new LinkedHashMap<>();
        for (FieldError fieldError : ex.getBindingResult().getFieldErrors()) {
            errors.putIfAbsent(fieldError.getField(), fieldError.getDefaultMessage());
        }
        return errors;
    }
}

package me.nvim.blog.auth.identity.application;

import java.time.Instant;
import java.util.List;

import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import me.nvim.blog.auth.common.exception.BusinessException;
import me.nvim.blog.auth.common.exception.ErrorCode;
import me.nvim.blog.auth.identity.domain.IssuedToken;
import me.nvim.blog.auth.identity.domain.PasswordHasher;
import me.nvim.blog.auth.identity.domain.RefreshToken;
import me.nvim.blog.auth.identity.domain.RefreshTokenRepository;
import me.nvim.blog.auth.identity.domain.TokenIssuer;
import me.nvim.blog.auth.identity.domain.UserAccount;
import me.nvim.blog.auth.identity.domain.UserAccountRepository;

@Service
public class IdentityFacade {

    private final UserAccountRepository userAccountRepository;
    private final RefreshTokenRepository refreshTokenRepository;
    private final PasswordHasher passwordHasher;
    private final TokenIssuer tokenIssuer;

    public IdentityFacade(
            UserAccountRepository userAccountRepository,
            RefreshTokenRepository refreshTokenRepository,
            PasswordHasher passwordHasher,
            TokenIssuer tokenIssuer) {
        this.userAccountRepository = userAccountRepository;
        this.refreshTokenRepository = refreshTokenRepository;
        this.passwordHasher = passwordHasher;
        this.tokenIssuer = tokenIssuer;
    }

    @Transactional
    public AccountResult register(RegisterAccountCommand command) {
        UserAccount userAccount = UserAccount.register(
                command.email(),
                this.passwordHasher.hash(command.password()),
                command.displayName());
        return AccountResult.from(this.userAccountRepository.save(userAccount));
    }

    @Transactional(readOnly = true)
    public AccountResult findByEmail(String email) {
        return this.userAccountRepository.findByEmail(email)
                .map(AccountResult::from)
                .orElseThrow(() -> new BusinessException(ErrorCode.UNAUTHORIZED));
    }

    @Transactional(readOnly = true)
    public List<AccountResult> findAll() {
        return this.userAccountRepository.findAll().stream()
                .map(AccountResult::from)
                .toList();
    }

    @Transactional
    public TokenResult issueToken(IssueTokenCommand command) {
        UserAccount userAccount = this.userAccountRepository.findByEmail(command.email())
                .orElseThrow(() -> new BusinessException(ErrorCode.UNAUTHORIZED));
        return issueToken(userAccount, Instant.now());
    }

    @Transactional
    public TokenResult refreshToken(RefreshTokenCommand command) {
        Instant now = Instant.now();
        RefreshToken refreshToken = this.refreshTokenRepository
                .findActive(command.refreshToken(), now)
                .orElseThrow(() -> new BusinessException(ErrorCode.INVALID_REFRESH_TOKEN));
        UserAccount userAccount = this.userAccountRepository.findById(refreshToken.userId())
                .orElseThrow(() -> new BusinessException(ErrorCode.INVALID_REFRESH_TOKEN));

        if (!this.refreshTokenRepository.revokeIfActive(refreshToken.id(), now)) {
            throw new BusinessException(ErrorCode.INVALID_REFRESH_TOKEN);
        }
        return issueToken(userAccount, now);
    }

    private TokenResult issueToken(UserAccount userAccount, Instant issuedAt) {
        IssuedToken issuedToken = this.tokenIssuer.issue(userAccount, issuedAt);
        this.refreshTokenRepository.save(
                userAccount.id(),
                issuedToken.refreshToken(),
                issuedToken.refreshTokenExpiresAt());
        return TokenResult.from(issuedToken);
    }
}

package me.nvim.blog.auth.identity.infrastructure.config;

import java.time.Duration;

import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.validation.annotation.Validated;

import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.NotNull;

@Validated
@ConfigurationProperties("auth.token")
public record TokenProperties(
        @NotBlank String issuer,
        @NotBlank String audience,
        @NotBlank String keyId,
        String privateKeyPem,
        String publicKeyPem,
        @NotNull Duration accessTokenTtl,
        @NotNull Duration refreshTokenTtl,
        @NotBlank String refreshTokenHmacSecret) {

    public TokenProperties {
        if (accessTokenTtl != null && (accessTokenTtl.isZero() || accessTokenTtl.isNegative())) {
            throw new IllegalArgumentException("accessTokenTtl must be positive");
        }
        if (refreshTokenTtl != null && (refreshTokenTtl.isZero() || refreshTokenTtl.isNegative())) {
            throw new IllegalArgumentException("refreshTokenTtl must be positive");
        }
        if (hasText(privateKeyPem) != hasText(publicKeyPem)) {
            throw new IllegalArgumentException("privateKeyPem and publicKeyPem must be configured together");
        }
    }

    public boolean hasConfiguredSigningKey() {
        return hasText(this.privateKeyPem) && hasText(this.publicKeyPem);
    }

    private static boolean hasText(String value) {
        return value != null && !value.isBlank();
    }
}

package me.nvim.blog.auth.identity.infrastructure.config;

import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.JwtEncoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;

import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jose.jwk.RSAKey;
import com.nimbusds.jose.jwk.source.ImmutableJWKSet;

@Configuration
public class RsaKeyConfig {

    @Bean
    KeyPair tokenSigningKeyPair(TokenProperties tokenProperties) {
        if (tokenProperties.hasConfiguredSigningKey()) {
            return parseConfiguredKeyPair(tokenProperties);
        }
        try {
            KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
            generator.initialize(2048);
            return generator.generateKeyPair();
        } catch (NoSuchAlgorithmException ex) {
            throw new IllegalStateException("RSA key generation is not available", ex);
        }
    }

    @Bean
    JwtEncoder jwtEncoder(KeyPair tokenSigningKeyPair, TokenProperties tokenProperties) {
        RSAPublicKey publicKey = (RSAPublicKey) tokenSigningKeyPair.getPublic();
        RSAPrivateKey privateKey = (RSAPrivateKey) tokenSigningKeyPair.getPrivate();
        RSAKey rsaKey = new RSAKey.Builder(publicKey)
                .privateKey(privateKey)
                .keyID(tokenProperties.keyId())
                .build();
        return new NimbusJwtEncoder(new ImmutableJWKSet<>(new JWKSet(rsaKey)));
    }

    @Bean
    JwtDecoder jwtDecoder(KeyPair tokenSigningKeyPair) {
        RSAPublicKey publicKey = (RSAPublicKey) tokenSigningKeyPair.getPublic();
        return NimbusJwtDecoder.withPublicKey(publicKey).build();
    }

    private static KeyPair parseConfiguredKeyPair(TokenProperties tokenProperties) {
        try {
            KeyFactory keyFactory = KeyFactory.getInstance("RSA");
            RSAPrivateKey privateKey = (RSAPrivateKey) keyFactory.generatePrivate(
                    new PKCS8EncodedKeySpec(parsePem(tokenProperties.privateKeyPem())));
            RSAPublicKey publicKey = (RSAPublicKey) keyFactory.generatePublic(
                    new X509EncodedKeySpec(parsePem(tokenProperties.publicKeyPem())));
            return new KeyPair(publicKey, privateKey);
        } catch (Exception ex) {
            throw new IllegalStateException("Configured RSA signing key is invalid", ex);
        }
    }

    private static byte[] parsePem(String pem) {
        String base64 = pem
                .replaceAll("-----BEGIN [^-]+-----", "")
                .replaceAll("-----END [^-]+-----", "")
                .replaceAll("\\s", "");
        return Base64.getDecoder().decode(base64);
    }
}

package me.nvim.blog.auth.identity.infrastructure.config;

import static org.junit.jupiter.api.Assertions.assertArrayEquals;

import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.time.Duration;
import java.util.Base64;

import org.junit.jupiter.api.Test;

class RsaKeyConfigTests {

    @Test
    void loadsConfiguredPemKeyPair() throws Exception {
        KeyPair expected = generateKeyPair();
        TokenProperties properties = new TokenProperties(
                "http://localhost:8080",
                "auth-api",
                "auth-api-local",
                toPem("PRIVATE KEY", expected.getPrivate().getEncoded()),
                toPem("PUBLIC KEY", expected.getPublic().getEncoded()),
                Duration.ofMinutes(15),
                Duration.ofDays(7),
                "local-dev-refresh-token-hmac-secret-change-me");

        KeyPair actual = new RsaKeyConfig().tokenSigningKeyPair(properties);

        assertArrayEquals(
                ((RSAPrivateKey) expected.getPrivate()).getEncoded(),
                ((RSAPrivateKey) actual.getPrivate()).getEncoded());
        assertArrayEquals(
                ((RSAPublicKey) expected.getPublic()).getEncoded(),
                ((RSAPublicKey) actual.getPublic()).getEncoded());
    }

    private static KeyPair generateKeyPair() throws Exception {
        KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
        generator.initialize(2048);
        return generator.generateKeyPair();
    }

    private static String toPem(String label, byte[] encoded) {
        return "-----BEGIN " + label + "-----\n"
                + Base64.getMimeEncoder(64, "\n".getBytes()).encodeToString(encoded)
                + "\n-----END " + label + "-----";
    }
}