feat: Implement JWT-based logout with Spring Security

- Add CustomLogoutHandler for cleanup operations
  - Delete Redis userCache on logout
  - Publish UserLogoutEvent for analytics
- Configure Spring Security logout
  - Delete JWT cookies (accessToken, refreshToken)
  - Logout URL: /logout
  - Redirect to homepage after logout
- Add logout() function to common.js
- Add UserLogoutEvent domain event

Author: NileTheKing

core-service/src/main/java/com/axon/core_service/config/auth/CustomLogoutHandler.java

@@ -0,0 +1,68 @@
+package com.axon.core_service.config.auth;
+
+import com.axon.core_service.domain.user.CustomOAuth2User;
+import com.axon.core_service.event.UserLogoutEvent;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.context.ApplicationEventPublisher;
+import org.springframework.data.redis.core.RedisTemplate;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.authentication.logout.LogoutHandler;
+import org.springframework.stereotype.Component;
+
+import java.time.Instant;
+
+/**
+ * Custom logout handler for JWT-based authentication.
+ * Handles cleanup tasks during logout:
+ * - Deletes user cache from Redis
+ * - Publishes logout event for analytics
+ */
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class CustomLogoutHandler implements LogoutHandler {
+
+    private final RedisTemplate<String, Object> redisTemplate;
+    private final ApplicationEventPublisher eventPublisher;
+
+    /**
+     * Performs logout cleanup operations when a user logs out.
+     *
+     * @param request        the HTTP request
+     * @param response       the HTTP response
+     * @param authentication the current authentication object (may be null if not authenticated)
+     */
+    @Override
+    public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
+        if (authentication == null) {
+            log.debug("Logout called with null authentication, skipping cleanup");
+            return;
+        }
+
+        if (!(authentication.getPrincipal() instanceof CustomOAuth2User)) {
+            log.debug("Logout called with non-CustomOAuth2User principal, skipping cleanup");
+            return;
+        }
+
+        CustomOAuth2User customUser = (CustomOAuth2User) authentication.getPrincipal();
+        Long userId = customUser.getUserId();
+
+        try {
+            // Delete user cache from Redis
+            String cacheKey = "userCache:" + userId;
+            Boolean deleted = redisTemplate.delete(cacheKey);
+            log.info("Logout: userId={}, userCache deleted={}", userId, deleted);
+
+            // Publish logout event for analytics
+            eventPublisher.publishEvent(new UserLogoutEvent(userId, Instant.now()));
+            log.info("Logout: userId={}, logout event published", userId);
+
+        } catch (Exception e) {
+            log.error("Error during logout cleanup for userId={}", userId, e);
+            // Don't throw exception - allow logout to proceed even if cleanup fails
+        }
+    }
+}

core-service/src/main/java/com/axon/core_service/config/auth/SecurityConfig.java

@@ -26,6 +26,7 @@ public class SecurityConfig {
         private final CustomOAuth2UserService customOAuth2UserService;
         private final OAuth2AuthenticationSuccessHandler oAuth2AuthenticationSuccessHandler;
         private final HttpCookieOAuth2AuthorizationRequestRepository httpCookieOAuth2AuthorizationRequestRepository;
+        private final CustomLogoutHandler customLogoutHandler;
 
         /**
          * Creates a JwtAuthenticationFilter initialized with the configured
@@ -78,7 +79,12 @@ public SecurityFilterChain filterChain(HttpSecurity http, JwtAuthenticationFilte
                                                                 new HttpStatusEntryPoint(HttpStatus.OK), // 200 OK 반환 (리다이렉트 방지)
                                                                 antMatcher("/test/**"))
                                                 .authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/oauth2/authorization/naver")))
-                                .logout(logout -> logout.logoutSuccessUrl("/"))
+                                .logout(logout -> logout
+                                                .logoutUrl("/logout")
+                                                .logoutSuccessUrl("/")
+                                                .deleteCookies("accessToken", "refreshToken")  // Delete JWT cookies
+                                                .addLogoutHandler(customLogoutHandler)  // Custom cleanup (Redis, events)
+                                                .permitAll())
                                 .oauth2Login(oauth2 -> oauth2
                                                 .loginPage("/oauth2/authorization/naver")
                                                 .userInfoEndpoint(userInfo -> userInfo

core-service/src/main/java/com/axon/core_service/event/UserLogoutEvent.java

@@ -0,0 +1,22 @@
+package com.axon.core_service.event;
+
+import lombok.Getter;
+import org.springframework.context.ApplicationEvent;
+
+import java.time.Instant;
+
+/**
+ * Domain event published when a user logs out.
+ * Used for analytics and auditing purposes.
+ */
+@Getter
+public class UserLogoutEvent extends ApplicationEvent {
+    private final Long userId;
+    private final Instant logoutAt;
+
+    public UserLogoutEvent(Long userId, Instant logoutAt) {
+        super(userId);
+        this.userId = userId;
+        this.logoutAt = logoutAt;
+    }
+}

core-service/src/main/resources/static/js/common.js

@@ -15,6 +15,17 @@ const common = (() => {
     return {
         getCookie,
 
+        /**
+         * Logout the current user by redirecting to Spring Security logout endpoint.
+         * This will trigger CustomLogoutHandler which:
+         * - Deletes user cache from Redis
+         * - Publishes logout event
+         * - Clears JWT cookies
+         */
+        logout: function() {
+            window.location.href = '/logout';
+        },
+
         /**
          * Format filter condition to human-readable string.
          * @param {Object} filter - Filter object {type, operator, values}