[FEAT/#113] 회원탈퇴 시 OAuth revoke 연결

.env.example

@@ -11,6 +11,12 @@ JWT_SECRET=
 # OIDC
 APPLE_CLIENT_ID=com.Routee-iOS
 
+# OAuth revoke
+APPLE_TEAM_ID=
+APPLE_KEY_ID=
+APPLE_PRIVATE_KEY=
+GOOGLE_CLIENT_ID=
+
 # Redis
 REDIS_HOST=
 REDIS_PORT=

.github/workflows/deploy-common.yml

@@ -79,6 +79,9 @@ jobs:
             export S3_BUCKET="${{ secrets[format('{0}S3_BUCKET', inputs.secret_prefix)] }}"
             export S3_ENDPOINT="${{ secrets[format('{0}S3_ENDPOINT', inputs.secret_prefix)] }}"
             export APPLE_CLIENT_ID="${{ secrets[format('{0}APPLE_CLIENT_ID', inputs.secret_prefix)] }}"
+            export APPLE_TEAM_ID="${{ secrets[format('{0}APPLE_TEAM_ID', inputs.secret_prefix)] }}"
+            export APPLE_KEY_ID="${{ secrets[format('{0}APPLE_KEY_ID', inputs.secret_prefix)] }}"
+            export APPLE_PRIVATE_KEY="${{ secrets[format('{0}APPLE_PRIVATE_KEY', inputs.secret_prefix)] }}"
             export GOOGLE_CLIENT_ID="${{ secrets.GOOGLE_CLIENT_ID }}"
 
             cd ~/app && bash scripts/deploy.sh ${{ secrets.DOCKER_USERNAME }}/routee-api:${{ inputs.environment }}-${{ github.sha }}

docker-compose.yml

@@ -28,6 +28,9 @@ services:
       S3_BUCKET: ${S3_BUCKET}
       S3_ENDPOINT: ${S3_ENDPOINT}
       APPLE_CLIENT_ID: ${APPLE_CLIENT_ID}
+      APPLE_TEAM_ID: ${APPLE_TEAM_ID}
+      APPLE_KEY_ID: ${APPLE_KEY_ID}
+      APPLE_PRIVATE_KEY: ${APPLE_PRIVATE_KEY}
       GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
     depends_on:
       redis:
@@ -60,6 +63,9 @@ services:
       S3_BUCKET: ${S3_BUCKET}
       S3_ENDPOINT: ${S3_ENDPOINT}
       APPLE_CLIENT_ID: ${APPLE_CLIENT_ID}
+      APPLE_TEAM_ID: ${APPLE_TEAM_ID}
+      APPLE_KEY_ID: ${APPLE_KEY_ID}
+      APPLE_PRIVATE_KEY: ${APPLE_PRIVATE_KEY}
       GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
     depends_on:
       redis:

routee-app/src/main/resources/application.yml

@@ -39,6 +39,17 @@ oidc:
       issuer: https://accounts.google.com
       client-id: ${GOOGLE_CLIENT_ID}
 
+oauth:
+  providers:
+    apple:
+      token-uri: https://appleid.apple.com/auth/token
+      revoke-uri: https://appleid.apple.com/auth/revoke
+      audience: https://appleid.apple.com
+      client-id: ${APPLE_CLIENT_ID}
+      team-id: ${APPLE_TEAM_ID}
+      key-id: ${APPLE_KEY_ID}
+      private-key: ${APPLE_PRIVATE_KEY}
+
 jwt:
   secret: ${JWT_SECRET}
   issuer: org.routee

routee-external/build.gradle

@@ -6,6 +6,9 @@ dependencies {
     // OAuth
     implementation 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'
 
+    // Apple client secret nimbus
+    implementation 'com.nimbusds:nimbus-jose-jwt'
+
     // AWS
     implementation platform("software.amazon.awssdk:bom:${rootProject.ext['awsSdkVersion']}")
     implementation 'software.amazon.awssdk:s3'

routee-external/src/main/java/org/sopt/routee/external/api/port/OAuthRevokePort.java

@@ -0,0 +1,6 @@
+package org.sopt.routee.external.api.port;
+
+public interface OAuthRevokePort {
+
+	void revoke(String authorizationCode);
+}

routee-external/src/main/java/org/sopt/routee/external/internal/oauth/adapter/AppleClientSecretGenerator.java

@@ -0,0 +1,76 @@
+package org.sopt.routee.external.internal.oauth.adapter;
+
+import java.security.GeneralSecurityException;
+import java.security.KeyFactory;
+import java.security.interfaces.ECPrivateKey;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Base64;
+import java.util.Date;
+import java.util.concurrent.atomic.AtomicReference;
+
+import org.sopt.routee.external.internal.oauth.config.OAuthRevokeProperty;
+import org.sopt.routee.external.internal.oauth.exception.AppleClientSecretException;
+import org.springframework.stereotype.Component;
+
+import com.nimbusds.jose.JOSEException;
+import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jose.JWSHeader;
+import com.nimbusds.jose.crypto.ECDSASigner;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.SignedJWT;
+
+@Component
+class AppleClientSecretGenerator {
+
+	private static final Duration TOKEN_EXPIRY = Duration.ofMinutes(30);
+	private static final Duration CACHE_TTL = Duration.ofMinutes(25);
+
+	private final OAuthRevokeProperty property;
+	private final AtomicReference<CachedSecret> cache = new AtomicReference<>();
+
+	AppleClientSecretGenerator(OAuthRevokeProperty property) {
+		this.property = property;
+	}
+
+	String generate() {
+		CachedSecret cached = cache.get();
+		if (cached != null && cached.expiresAt().isAfter(Instant.now())) {
+			return cached.value();
+		}
+
+		String secret = sign();
+		cache.set(new CachedSecret(secret, Instant.now().plus(CACHE_TTL)));
+		return secret;
+	}
+
+	private String sign() {
+		try {
+			Instant now = Instant.now();
+			SignedJWT jwt = new SignedJWT(
+				new JWSHeader.Builder(JWSAlgorithm.ES256).keyID(property.keyId()).build(),
+				new JWTClaimsSet.Builder()
+					.issuer(property.teamId())
+					.issueTime(Date.from(now))
+					.expirationTime(Date.from(now.plus(TOKEN_EXPIRY)))
+					.audience(property.audience())
+					.subject(property.clientId())
+					.build()
+			);
+			jwt.sign(new ECDSASigner(parsePrivateKey(property.privateKey())));
+			return jwt.serialize();
+		} catch (JOSEException | GeneralSecurityException | IllegalArgumentException e) {
+			throw new AppleClientSecretException(e);
+		}
+	}
+
+	private ECPrivateKey parsePrivateKey(String privateKey) throws GeneralSecurityException {
+		byte[] der = Base64.getDecoder().decode(privateKey);
+		KeyFactory keyFactory = KeyFactory.getInstance("EC");
+		return (ECPrivateKey)keyFactory.generatePrivate(new PKCS8EncodedKeySpec(der));
+	}
+
+	private record CachedSecret(String value, Instant expiresAt) {
+	}
+}

routee-external/src/main/java/org/sopt/routee/external/internal/oauth/adapter/AppleOAuthRevokeAdapter.java

@@ -0,0 +1,81 @@
+package org.sopt.routee.external.internal.oauth.adapter;
+
+import org.sopt.routee.external.api.port.OAuthRevokePort;
+import org.sopt.routee.external.internal.oauth.config.OAuthRevokeProperty;
+import org.sopt.routee.external.internal.oauth.exception.OAuthRevokeException;
+import org.springframework.http.MediaType;
+import org.springframework.stereotype.Component;
+import org.springframework.util.LinkedMultiValueMap;
+import org.springframework.util.MultiValueMap;
+import org.springframework.util.StringUtils;
+import org.springframework.web.client.RestClient;
+import org.springframework.web.client.RestClientException;
+
+import lombok.RequiredArgsConstructor;
+
+@Component
+@RequiredArgsConstructor
+class AppleOAuthRevokeAdapter implements OAuthRevokePort {
+
+	private static final String REFRESH_TOKEN_HINT = "refresh_token";
+
+	private final RestClient restClient;
+	private final OAuthRevokeProperty property;
+	private final AppleClientSecretGenerator clientSecretGenerator;
+
+	@Override
+	public void revoke(String authorizationCode) {
+		OAuthTokenResponse token = exchangeAuthorizationCode(authorizationCode);
+
+		if (!StringUtils.hasText(token.refreshToken())) {
+			throw new OAuthRevokeException();
+		}
+
+		requestRevoke(token.refreshToken(), REFRESH_TOKEN_HINT);
+	}
+
+	private OAuthTokenResponse exchangeAuthorizationCode(String authorizationCode) {
+		MultiValueMap<String, String> form = credentialForm();
+
+		form.add("grant_type", "authorization_code");
+		form.add("code", authorizationCode);
+
+		OAuthTokenResponse response = post(property.tokenUri(), form, OAuthTokenResponse.class);
+
+		if (response == null) {
+			throw new OAuthRevokeException();
+		}
+
+		return response;
+	}
+
+	private void requestRevoke(String token, String tokenTypeHint) {
+		MultiValueMap<String, String> form = credentialForm();
+		form.add("token", token);
+		form.add("token_type_hint", tokenTypeHint);
+
+		post(property.revokeUri(), form, Void.class);
+	}
+
+	private <T> T post(String uri, MultiValueMap<String, String> form, Class<T> responseType) {
+		try {
+			return restClient.post()
+				.uri(uri)
+				.contentType(MediaType.APPLICATION_FORM_URLENCODED)
+				.body(form)
+				.retrieve()
+				.body(responseType);
+		} catch (RestClientException e) {
+			throw new OAuthRevokeException(e);
+		}
+	}
+
+	private MultiValueMap<String, String> credentialForm() {
+		MultiValueMap<String, String> form = new LinkedMultiValueMap<>();
+
+		form.add("client_id", property.clientId());
+		form.add("client_secret", clientSecretGenerator.generate());
+
+		return form;
+	}
+}

routee-external/src/main/java/org/sopt/routee/external/internal/oauth/adapter/OAuthTokenResponse.java

@@ -0,0 +1,8 @@
+package org.sopt.routee.external.internal.oauth.adapter;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+record OAuthTokenResponse(
+	@JsonProperty("refresh_token") String refreshToken
+) {
+}

routee-external/src/main/java/org/sopt/routee/external/internal/oauth/code/ErrorCode.java

@@ -0,0 +1,18 @@
+package org.sopt.routee.external.internal.oauth.code;
+
+import org.sopt.routee.code.ErrorResultCode;
+import org.springframework.http.HttpStatus;
+
+import lombok.Getter;
+import lombok.RequiredArgsConstructor;
+
+@Getter
+@RequiredArgsConstructor
+public enum ErrorCode implements ErrorResultCode {
+
+	OAUTH_REVOKE_FAILED(HttpStatus.BAD_GATEWAY, "소셜 로그인 연동 해제에 실패했습니다."),
+	APPLE_CLIENT_SECRET_GENERATION_FAILED(HttpStatus.INTERNAL_SERVER_ERROR, "Apple client secret 생성에 실패했습니다.");
+
+	private final HttpStatus status;
+	private final String message;
+}

routee-external/src/main/java/org/sopt/routee/external/internal/oauth/config/OAuthRevokeClientConfig.java

@@ -0,0 +1,30 @@
+package org.sopt.routee.external.internal.oauth.config;
+
+import java.net.http.HttpClient;
+import java.time.Duration;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.client.JdkClientHttpRequestFactory;
+import org.springframework.web.client.RestClient;
+
+@Configuration
+class OAuthRevokeClientConfig {
+
+	private static final Duration CONNECT_TIMEOUT = Duration.ofSeconds(5);
+	private static final Duration READ_TIMEOUT = Duration.ofSeconds(10);
+
+	@Bean
+	RestClient oauthRevokeRestClient() {
+		HttpClient httpClient = HttpClient.newBuilder()
+			.connectTimeout(CONNECT_TIMEOUT)
+			.build();
+
+		JdkClientHttpRequestFactory requestFactory = new JdkClientHttpRequestFactory(httpClient);
+		requestFactory.setReadTimeout(READ_TIMEOUT);
+
+		return RestClient.builder()
+			.requestFactory(requestFactory)
+			.build();
+	}
+}

routee-external/src/main/java/org/sopt/routee/external/internal/oauth/config/OAuthRevokeProperty.java

@@ -0,0 +1,15 @@
+package org.sopt.routee.external.internal.oauth.config;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+
+@ConfigurationProperties(prefix = "oauth.providers.apple")
+public record OAuthRevokeProperty(
+	String tokenUri,
+	String revokeUri,
+	String audience,
+	String clientId,
+	String teamId,
+	String keyId,
+	String privateKey
+) {
+}

routee-external/src/main/java/org/sopt/routee/external/internal/oauth/exception/AppleClientSecretException.java

@@ -0,0 +1,11 @@
+package org.sopt.routee.external.internal.oauth.exception;
+
+import org.sopt.routee.exception.BaseException;
+import org.sopt.routee.external.internal.oauth.code.ErrorCode;
+
+public final class AppleClientSecretException extends BaseException {
+
+	public AppleClientSecretException(Throwable cause) {
+		super(ErrorCode.APPLE_CLIENT_SECRET_GENERATION_FAILED, cause);
+	}
+}

routee-external/src/main/java/org/sopt/routee/external/internal/oauth/exception/OAuthRevokeException.java

@@ -0,0 +1,15 @@
+package org.sopt.routee.external.internal.oauth.exception;
+
+import org.sopt.routee.exception.BaseException;
+import org.sopt.routee.external.internal.oauth.code.ErrorCode;
+
+public final class OAuthRevokeException extends BaseException {
+
+	public OAuthRevokeException() {
+		super(ErrorCode.OAUTH_REVOKE_FAILED);
+	}
+
+	public OAuthRevokeException(Throwable cause) {
+		super(ErrorCode.OAUTH_REVOKE_FAILED, cause);
+	}
+}

routee-member/src/main/java/org/sopt/routee/member/internal/controller/MemberController.java

@@ -71,7 +71,7 @@ public ResponseEntity<SuccessResponse<Void>> withdraw(
 		String accessTokenHash = TokenHasher.hash(TokenExtractor.extract(accessTokenWithBearer));
 		String refreshTokenHash = TokenHasher.hash(request.refreshToken());
 
-		memberService.withdraw(memberId, accessTokenHash, refreshTokenHash);
+		memberService.withdraw(request.toCommand(memberId, accessTokenHash, refreshTokenHash));
 
 		return ResponseEntity.status(HttpStatus.OK)
 			.body(ApiResponse.success(SuccessCode.MEMBER_WITHDRAW));

routee-member/src/main/java/org/sopt/routee/member/internal/controller/MemberControllerDocs.java

@@ -84,7 +84,11 @@ ResponseEntity<SuccessResponse<Void>> register(
 		@RequestHeader("Time-Zone") ZoneId timeZone
 	);
 
-	@Operation(summary = "회원 탈퇴", description = "인증된 회원의 정보를 삭제하고, 보유한 액세스/리프레시 토큰을 무효화합니다.")
+	@Operation(summary = "회원 탈퇴",
+		description = "인증된 회원의 정보를 삭제하고, 보유한 액세스/리프레시 토큰을 무효화합니다. refresh_token은 모든 탈퇴 요청에 필수입니다. "
+			+ "Apple 로그인 회원은 authorization_code를 함께 전달해야 소셜 로그인 연동도 해제됩니다. "
+			+ "authorization_code는 탈퇴 직전 재인증하여 발급받은 값이어야 하며, Apple 외 소셜 로그인 회원은 전달하지 않아도 됩니다. "
+			+ "연동 해제에 실패하더라도 탈퇴 자체는 완료됩니다.")
 	@SecurityRequirement(name = "bearerAuth")
 	@ApiResponses({
 		@ApiResponse(responseCode = "200", description = "탈퇴 성공"),
@@ -108,6 +112,14 @@ ResponseEntity<SuccessResponse<Void>> register(
 	ResponseEntity<SuccessResponse<Void>> withdraw(
 		Long memberId,
 		@RequestHeader(name = "Authorization") String accessTokenWithBearer,
+		@io.swagger.v3.oas.annotations.parameters.RequestBody(required = true,
+			content = @Content(schema = @Schema(implementation = WithdrawRequest.class),
+				examples = {
+					@ExampleObject(name = "APPLE_MEMBER", summary = "Apple 로그인 회원",
+						value = "{\"refreshToken\":\"eyJ...\",\"authorizationCode\":\"c1234...\"}"),
+					@ExampleObject(name = "OTHER_MEMBER", summary = "그 외 소셜 로그인 회원",
+						value = "{\"refreshToken\":\"eyJ...\"}")
+				}))
 		@Valid @RequestBody WithdrawRequest request
 	);
 

routee-member/src/main/java/org/sopt/routee/member/internal/controller/dto/request/WithdrawRequest.java

@@ -1,9 +1,20 @@
 package org.sopt.routee.member.internal.controller.dto.request;
 
+import org.sopt.routee.member.internal.service.dto.command.WithdrawCommand;
+
+import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.validation.constraints.NotBlank;
 
 public record WithdrawRequest(
+	@Schema(description = "탈퇴를 요청하는 회원의 리프레시 토큰. 모든 탈퇴 요청에 필수입니다.")
 	@NotBlank(message = "refresh_token은 필수입니다.")
-	String refreshToken
+	String refreshToken,
+
+	@Schema(description = "탈퇴 시점에 재인증하여 발급받은 Apple 인가 코드. Apple 계정 연동 해제에 사용되며, Apple 로그인 회원만 필요합니다. "
+		+ "그 외 소셜 로그인 회원은 전달하지 않아도 됩니다.")
+	String authorizationCode
 ) {
+	public WithdrawCommand toCommand(Long memberId, String accessTokenHash, String refreshTokenHash) {
+		return new WithdrawCommand(memberId, accessTokenHash, refreshTokenHash, authorizationCode);
+	}
 }