[Feat] #10 카카오 및 구글 소셜 로그인 구현

- 카카오 및 구글 OAuth 로그인 구현
- Redis 기반 일회용 loginCode 발급 및 교환 API 구현
- 로그인 코드를 URL fragment로 프론트 콜백에 전달
- Access Token 응답 및 Refresh Token HttpOnly 쿠키 발급
- 토큰 재발급·로그아웃과 선택적 CSRF 보호 적용
- OAuth 사용자 정보와 카카오 이메일 인증 여부 검증
- OAuth 외부 요청 timeout 및 인증 테스트 추가
- SecurityConfig 문서와 설정 경로 오타 수정
- 잘못된 base로 머지된 PR #11을 develop 대상으로 다시 반영

Author: yeonjuncho

.gitignore

@@ -45,5 +45,5 @@ application-prod.yml
 .env.*
 !.env.example
 
-## Cluade ##
-.cluade/
+## Claude ##
+.claude/

CLAUDE.md

@@ -33,7 +33,7 @@ Package root: `com.leets7th.job_is_be`. The project is early-stage — most doma
   - `status` — `ErrorStatus` / `SuccessStatus` enums implement `BaseStatus`. Add new API result codes here rather than constructing ad-hoc messages.
   - `exception` — `GeneralException(BaseStatus)` is the standard exception to throw from application code. `GeneralExceptionAdvice` (`@RestControllerAdvice`) converts it — plus `IllegalArgumentException`, `NullPointerException`, and validation errors — into `ApiResponse` error bodies.
   - `response` — `ApiResponse<T>` is the single response envelope (`isSuccess`, `code`, `message`, `data`), built via `ApiResponse.success(...)`/`ApiResponse.error(...)`. `PageResponse<T>` wraps Spring `Page<T>` for paginated endpoints.
-  - `config` — `SecurityConfig` (stateless, CSRF disabled; all requests currently `permitAll()` since auth isn't wired up yet), `WebConfig` (CORS from `app.cors.allowed-origins`), `SwaggerConfig` (OpenAPI at `/swagger-ui.html`, JWT bearer scheme pre-registered), `JpaConfig` (`@EnableJpaAuditing`, required for `BaseEntity` timestamps to populate).
+  - `config` — `SecurityConfig` (stateless JWT authentication; OAuth, Swagger, health, and selected auth endpoints are public, while all other requests require an access token; CSRF protection applies to refresh-cookie endpoints such as token reissue and logout), `WebConfig` (CORS from `app.cors.allowed-origins`), `SwaggerConfig` (OpenAPI at `/swagger-ui.html`, JWT bearer scheme pre-registered), `JpaConfig` (`@EnableJpaAuditing`, required for `BaseEntity` timestamps to populate).
 - Entity conventions: extend `BaseEntity`, use `@NoArgsConstructor(access = AccessLevel.PROTECTED)` with a Lombok `@Builder` all-args constructor, and expose state transitions as instance methods (e.g. `Job.expire()`, `Job.markRemoved()`) instead of public setters.
 
 ### Configuration

src/main/java/com/leets7th/job_is_be/domain/auth/controller/OAuthController.java

@@ -0,0 +1,123 @@
+package com.leets7th.job_is_be.domain.auth.controller;
+
+import com.leets7th.job_is_be.domain.auth.dto.OAuthExchangeRequest;
+import com.leets7th.job_is_be.domain.auth.dto.OAuthExchangeResponse;
+import com.leets7th.job_is_be.domain.auth.service.OAuthLoginService;
+import com.leets7th.job_is_be.domain.auth.service.RefreshTokenCookieManager;
+import com.leets7th.job_is_be.domain.auth.oauth.OAuthStateCookieManager;
+import com.leets7th.job_is_be.global.base.BaseStatus;
+import com.leets7th.job_is_be.global.exception.GeneralException;
+import com.leets7th.job_is_be.global.properties.OAuthProperties;
+import com.leets7th.job_is_be.global.response.ApiResponse;
+import com.leets7th.job_is_be.global.status.ErrorStatus;
+import com.leets7th.job_is_be.global.status.SuccessStatus;
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.util.UriComponentsBuilder;
+
+import java.net.URI;
+
+@RestController
+@RequestMapping("/api/auth/oauth")
+public class OAuthController {
+
+    private final OAuthLoginService oauthLoginService;
+    private final RefreshTokenCookieManager cookieManager;
+    private final OAuthStateCookieManager stateCookieManager;
+    private final OAuthProperties properties;
+
+    public OAuthController(
+            OAuthLoginService oauthLoginService,
+            RefreshTokenCookieManager cookieManager,
+            OAuthStateCookieManager stateCookieManager,
+            OAuthProperties properties
+    ) {
+        this.oauthLoginService = oauthLoginService;
+        this.cookieManager = cookieManager;
+        this.stateCookieManager = stateCookieManager;
+        this.properties = properties;
+    }
+
+    @GetMapping("/{provider}")
+    public ResponseEntity<Void> authorize(@PathVariable String provider) {
+        OAuthLoginService.AuthorizationRequest authorization =
+                oauthLoginService.createAuthorizationRequest(provider);
+        return ResponseEntity.status(HttpStatus.FOUND)
+                .header(HttpHeaders.LOCATION, authorization.uri().toString())
+                .header(HttpHeaders.SET_COOKIE, stateCookieManager.create(authorization.state()).toString())
+                .build();
+    }
+
+    @GetMapping("/{provider}/callback")
+    public ResponseEntity<Void> callback(
+            @PathVariable String provider,
+            @RequestParam(required = false) String code,
+            @RequestParam(required = false) String state,
+            @RequestParam(required = false) String error,
+            HttpServletRequest request
+    ) {
+        if (error != null && !error.isBlank()) {
+            return redirectFailure(ErrorStatus.OAUTH_PROVIDER_ERROR);
+        }
+
+        try {
+            OAuthLoginService.OAuthLoginResult result = oauthLoginService.login(
+                    provider,
+                    code,
+                    state,
+                    stateCookieManager.extract(request)
+            );
+            URI location = UriComponentsBuilder.fromUri(properties.frontendSuccessUri())
+                    .fragment("code=" + result.loginCode())
+                    .build()
+                    .encode()
+                    .toUri();
+
+            return ResponseEntity.status(HttpStatus.FOUND)
+                    .header(HttpHeaders.LOCATION, location.toString())
+                    .header(HttpHeaders.SET_COOKIE, stateCookieManager.clear().toString())
+                    .build();
+        } catch (GeneralException e) {
+            return redirectFailure(e.getErrorStatus());
+        }
+    }
+
+    @PostMapping(value = "/exchange", consumes = MediaType.APPLICATION_JSON_VALUE)
+    public ResponseEntity<ApiResponse<OAuthExchangeResponse>> exchange(
+            @RequestBody OAuthExchangeRequest request
+    ) {
+        OAuthLoginService.ExchangeResult result = oauthLoginService.exchange(request.loginCode());
+
+        return ResponseEntity
+                .status(SuccessStatus.OAUTH_EXCHANGE_SUCCESS.getHttpStatus())
+                .header(HttpHeaders.SET_COOKIE, cookieManager.create(result.refreshToken()).toString())
+                .body(new ApiResponse<>(
+                        true,
+                        SuccessStatus.OAUTH_EXCHANGE_SUCCESS.getCode(),
+                        SuccessStatus.OAUTH_EXCHANGE_SUCCESS.getMessage(),
+                        result.response()
+                ));
+    }
+
+    private ResponseEntity<Void> redirectFailure(BaseStatus errorStatus) {
+        URI location = UriComponentsBuilder.fromUri(properties.frontendFailureUri())
+                .queryParam("error", errorStatus.getCode())
+                .build()
+                .encode()
+                .toUri();
+        return ResponseEntity.status(HttpStatus.FOUND)
+                .header(HttpHeaders.LOCATION, location.toString())
+                .header(HttpHeaders.SET_COOKIE, stateCookieManager.clear().toString())
+                .build();
+    }
+}

src/main/java/com/leets7th/job_is_be/domain/auth/dto/OAuthExchangeRequest.java

@@ -0,0 +1,4 @@
+package com.leets7th.job_is_be.domain.auth.dto;
+
+public record OAuthExchangeRequest(String loginCode) {
+}

src/main/java/com/leets7th/job_is_be/domain/auth/dto/OAuthExchangeResponse.java

@@ -0,0 +1,9 @@
+package com.leets7th.job_is_be.domain.auth.dto;
+
+public record OAuthExchangeResponse(
+        String accessToken,
+        Long userId,
+        boolean isNewUser,
+        boolean onboardingCompleted
+) {
+}

src/main/java/com/leets7th/job_is_be/domain/auth/oauth/GoogleOAuthClient.java

@@ -0,0 +1,114 @@
+package com.leets7th.job_is_be.domain.auth.oauth;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.leets7th.job_is_be.domain.user.enums.SocialType;
+import com.leets7th.job_is_be.global.exception.GeneralException;
+import com.leets7th.job_is_be.global.properties.OAuthProperties;
+import com.leets7th.job_is_be.global.status.ErrorStatus;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.http.MediaType;
+import org.springframework.stereotype.Component;
+import org.springframework.util.LinkedMultiValueMap;
+import org.springframework.util.MultiValueMap;
+import org.springframework.web.client.RestClient;
+import org.springframework.web.client.RestClientException;
+import org.springframework.web.util.UriComponentsBuilder;
+
+import java.net.URI;
+
+@Component
+public class GoogleOAuthClient implements SocialOAuthClient {
+
+    private final OAuthProperties.Provider properties;
+    private final RestClient restClient;
+
+    public GoogleOAuthClient(
+            OAuthProperties oauthProperties,
+            @Qualifier("oauthRestClient") RestClient restClient
+    ) {
+        this.properties = oauthProperties.google();
+        this.restClient = restClient;
+    }
+
+    @Override
+    public SocialType supports() {
+        return SocialType.GOOGLE;
+    }
+
+    @Override
+    public URI buildAuthorizationUri(String state) {
+        validateConfigured();
+        return UriComponentsBuilder.fromUri(properties.authorizationUri())
+                .queryParam("response_type", "code")
+                .queryParam("client_id", properties.clientId())
+                .queryParam("redirect_uri", properties.redirectUri())
+                .queryParam("scope", String.join(" ", properties.scopes()))
+                .queryParam("state", state)
+                .build()
+                .encode()
+                .toUri();
+    }
+
+    @Override
+    public OAuthUserInfo getUserInfo(String authorizationCode) {
+        validateConfigured();
+        try {
+            GoogleTokenResponse token = requestToken(authorizationCode);
+            GoogleUserResponse user = restClient.get()
+                    .uri(properties.userInfoUri())
+                    .headers(headers -> headers.setBearerAuth(token.accessToken()))
+                    .retrieve()
+                    .body(GoogleUserResponse.class);
+
+            if (user == null || user.sub() == null || user.sub().isBlank()) {
+                throw new GeneralException(ErrorStatus.OAUTH_PROVIDER_ERROR);
+            }
+            if (user.email() == null || user.email().isBlank() || !Boolean.TRUE.equals(user.emailVerified())) {
+                throw new GeneralException(ErrorStatus.OAUTH_EMAIL_REQUIRED);
+            }
+            return new OAuthUserInfo(user.sub(), SocialType.GOOGLE, user.email());
+        } catch (GeneralException e) {
+            throw e;
+        } catch (RestClientException e) {
+            throw new GeneralException(ErrorStatus.OAUTH_PROVIDER_ERROR);
+        }
+    }
+
+    private GoogleTokenResponse requestToken(String authorizationCode) {
+        MultiValueMap<String, String> form = new LinkedMultiValueMap<>();
+        form.add("grant_type", "authorization_code");
+        form.add("client_id", properties.clientId());
+        form.add("client_secret", properties.clientSecret());
+        form.add("redirect_uri", properties.redirectUri().toString());
+        form.add("code", authorizationCode);
+
+        GoogleTokenResponse token = restClient.post()
+                .uri(properties.tokenUri())
+                .contentType(MediaType.APPLICATION_FORM_URLENCODED)
+                .body(form)
+                .retrieve()
+                .body(GoogleTokenResponse.class);
+        if (token == null || token.accessToken() == null || token.accessToken().isBlank()) {
+            throw new GeneralException(ErrorStatus.OAUTH_PROVIDER_ERROR);
+        }
+        return token;
+    }
+
+    private void validateConfigured() {
+        if (!properties.isConfigured()) {
+            throw new GeneralException(ErrorStatus.OAUTH_NOT_CONFIGURED);
+        }
+    }
+
+    private record GoogleTokenResponse(
+            @JsonProperty("access_token") String accessToken
+    ) {
+    }
+
+    private record GoogleUserResponse(
+            String sub,
+            String email,
+            @JsonProperty("email_verified") Boolean emailVerified
+    ) {
+    }
+}

src/main/java/com/leets7th/job_is_be/domain/auth/oauth/KakaoOAuthClient.java

@@ -0,0 +1,125 @@
+package com.leets7th.job_is_be.domain.auth.oauth;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.leets7th.job_is_be.domain.user.enums.SocialType;
+import com.leets7th.job_is_be.global.exception.GeneralException;
+import com.leets7th.job_is_be.global.properties.OAuthProperties;
+import com.leets7th.job_is_be.global.status.ErrorStatus;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.http.MediaType;
+import org.springframework.stereotype.Component;
+import org.springframework.util.LinkedMultiValueMap;
+import org.springframework.util.MultiValueMap;
+import org.springframework.web.client.RestClient;
+import org.springframework.web.client.RestClientException;
+import org.springframework.web.util.UriComponentsBuilder;
+
+import java.net.URI;
+
+@Component
+public class KakaoOAuthClient implements SocialOAuthClient {
+
+    private final OAuthProperties.Provider properties;
+    private final RestClient restClient;
+
+    public KakaoOAuthClient(
+            OAuthProperties oauthProperties,
+            @Qualifier("oauthRestClient") RestClient restClient
+    ) {
+        this.properties = oauthProperties.kakao();
+        this.restClient = restClient;
+    }
+
+    @Override
+    public SocialType supports() {
+        return SocialType.KAKAO;
+    }
+
+    @Override
+    public URI buildAuthorizationUri(String state) {
+        validateConfigured();
+        return UriComponentsBuilder.fromUri(properties.authorizationUri())
+                .queryParam("response_type", "code")
+                .queryParam("client_id", properties.clientId())
+                .queryParam("redirect_uri", properties.redirectUri())
+                .queryParam("scope", String.join(",", properties.scopes()))
+                .queryParam("state", state)
+                .build()
+                .encode()
+                .toUri();
+    }
+
+    @Override
+    public OAuthUserInfo getUserInfo(String authorizationCode) {
+        validateConfigured();
+        try {
+            KakaoTokenResponse token = requestToken(authorizationCode);
+            KakaoUserResponse user = restClient.get()
+                    .uri(properties.userInfoUri())
+                    .headers(headers -> headers.setBearerAuth(token.accessToken()))
+                    .retrieve()
+                    .body(KakaoUserResponse.class);
+
+            if (user == null || user.id() == null) {
+                throw new GeneralException(ErrorStatus.OAUTH_PROVIDER_ERROR);
+            }
+            KakaoAccount account = user.kakaoAccount();
+            String email = account == null ? null : account.email();
+            validateEmail(email, account == null ? null : account.emailVerified());
+            return new OAuthUserInfo(user.id().toString(), SocialType.KAKAO, email);
+        } catch (GeneralException e) {
+            throw e;
+        } catch (RestClientException e) {
+            throw new GeneralException(ErrorStatus.OAUTH_PROVIDER_ERROR);
+        }
+    }
+
+    private KakaoTokenResponse requestToken(String authorizationCode) {
+        MultiValueMap<String, String> form = new LinkedMultiValueMap<>();
+        form.add("grant_type", "authorization_code");
+        form.add("client_id", properties.clientId());
+        form.add("client_secret", properties.clientSecret());
+        form.add("redirect_uri", properties.redirectUri().toString());
+        form.add("code", authorizationCode);
+
+        KakaoTokenResponse token = restClient.post()
+                .uri(properties.tokenUri())
+                .contentType(MediaType.APPLICATION_FORM_URLENCODED)
+                .body(form)
+                .retrieve()
+                .body(KakaoTokenResponse.class);
+        if (token == null || token.accessToken() == null || token.accessToken().isBlank()) {
+            throw new GeneralException(ErrorStatus.OAUTH_PROVIDER_ERROR);
+        }
+        return token;
+    }
+
+    private void validateConfigured() {
+        if (!properties.isConfigured()) {
+            throw new GeneralException(ErrorStatus.OAUTH_NOT_CONFIGURED);
+        }
+    }
+
+    private void validateEmail(String email, Boolean emailVerified) {
+        if (email == null || email.isBlank() || !Boolean.TRUE.equals(emailVerified)) {
+            throw new GeneralException(ErrorStatus.OAUTH_EMAIL_REQUIRED);
+        }
+    }
+
+    private record KakaoTokenResponse(
+            @JsonProperty("access_token") String accessToken
+    ) {
+    }
+
+    private record KakaoUserResponse(
+            Long id,
+            @JsonProperty("kakao_account") KakaoAccount kakaoAccount
+    ) {
+    }
+
+    private record KakaoAccount(
+            String email,
+            @JsonProperty("is_email_verified") Boolean emailVerified
+    ) {
+    }
+}