Merge pull request #162 from SookmyungTackit/dev

[Release] v5 배포 (dev → main 병합)

Author: yeongsinkeem

src/main/java/org/example/tackit/config/Redis/RedisUtil.java

@@ -16,6 +16,9 @@ public void save(String key, String value) {
         redisTemplate.opsForValue().set(key, value);
     }
 
+    // 저장 2 : 비밀번호 재설정 토큰의 만료 시간 지정을 위해
+    public void save(String key, String value, long timeoutSeconds) { redisTemplate.opsForValue().set(key, value, timeoutSeconds, TimeUnit.SECONDS); }
+
     // 조회 (refreshToken 비교용)
     public String getData(String key) {
         return redisTemplate.opsForValue().get(key);

src/main/java/org/example/tackit/config/SecurityConfig.java

@@ -70,7 +70,7 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
 
                 .authorizeHttpRequests(authorizeHttpRequests -> authorizeHttpRequests
                         .requestMatchers("/api/admin/**").hasAuthority("ADMIN") // 관리자 페이지 role 추가
-                        .requestMatchers("/auth/**") // 로그인, 회원가입은 열어주기
+                        .requestMatchers("/auth/**") // 로그인, 회원가입, 이메일 및 비밀번호 찾기는 열어주기
                         .permitAll()
                         .requestMatchers("/api/s3/**").permitAll()
                         .requestMatchers("/api/actuator/**").permitAll() // actuator 경로 열기

src/main/java/org/example/tackit/config/jwt/JwtFilter.java

@@ -38,6 +38,13 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
         filterChain.doFilter(request, response);
     }
 
+    // 필터를 적용하지 않을 경로 지정
+    // auth/reset-password 요청은 토큰 인증 건너뛰도록
+    @Override
+    protected boolean shouldNotFilter(HttpServletRequest request) {
+        return request.getRequestURI().equals("/auth/reset-password") && request.getMethod().equals("PATCH");
+    }
+
     private String resolveToken(HttpServletRequest request) {
         String bearerToken = request.getHeader(AUTHORIZATION_HEADER);
         if (StringUtils.hasText(bearerToken) && bearerToken.startsWith(BEARER_PREFIX)) {

src/main/java/org/example/tackit/config/jwt/TokenProvider.java

@@ -11,14 +11,12 @@
 import org.example.tackit.domain.entity.Member;
 import org.example.tackit.domain.entity.Status;
 import org.springframework.security.authentication.BadCredentialsException;
-import org.springframework.security.core.userdetails.User;
 import org.example.tackit.domain.auth.login.dto.TokenDto;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.stereotype.Component;
 
 import java.security.Key;
@@ -35,6 +33,9 @@ public class TokenProvider {
     private static final String BEARER_TYPE = "Bearer";
     private static final long ACCESS_TOKEN_EXPIRE_TIME = 1000 * 60 * 60 * 24;            // 1일
     private static final long REFRESH_TOKEN_EXPIRE_TIME = 1000 * 60 * 60 * 24 * 7;  // 7일
+
+    //  비밀번호 재설정 토큰 (5분)
+    private static final long RESET_TOKEN_EXPIRE_TIME = 1000 * 60 * 5;
     private final Key key;
     private final RedisUtil redisUtil;
     private final MemberRepository memberRepository;
@@ -68,6 +69,24 @@ public TokenDto generateTokenDto(Authentication authentication) {
                 .build();
     }
 
+    // 비밀번호 재설정 전용 일회성 토큰
+    // 보안 원칙 : 최소 권한 부여
+    // authorities 클레임을 포함시키지 않게 하여, 다른 API 호출하지 않도록
+    public String generateResetToken(String email) {
+        long now = (new Date()).getTime();
+
+        return Jwts.builder()
+                .setSubject(email)
+                .setExpiration(new Date(now + RESET_TOKEN_EXPIRE_TIME))
+                .claim("isResetToken", true)
+                .signWith(key, SignatureAlgorithm.HS512)
+                .compact();
+    }
+
+    // 비밀번호 재설정 토큰의 만료 시간 반환
+    public long getResetTokenExpiresIn() {
+        return RESET_TOKEN_EXPIRE_TIME;
+    }
 
 
     public TokenDto reissueAccessToken(String refreshToken) {
@@ -195,6 +214,17 @@ public boolean validateToken(String token) {
         return false;
     }
 
+    // 비밀번호 재설정 토큰인지 확인
+    public boolean isResetToken(String token) {
+        try {
+            Claims claims = parseClaims(token);
+            Object resetClaim = claims.get("isResetToken");
+            return resetClaim instanceof Boolean && (Boolean) resetClaim;
+        } catch (Exception e) {
+            return false;
+        }
+    }
+
 
     private Claims parseClaims(String accessToken) {
         try {

src/main/java/org/example/tackit/domain/admin/repository/MemberRepository.java

@@ -1,8 +1,10 @@
 package org.example.tackit.domain.admin.repository;
 
 import org.example.tackit.domain.entity.Member;
+import org.example.tackit.domain.entity.Role;
 import org.example.tackit.domain.entity.Status;
 import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Modifying;
 import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.query.Param;
 
@@ -27,6 +29,17 @@ public interface MemberRepository extends JpaRepository<Member, Long> {
 
     // 탈퇴 회원 통계
     List<Member> findByStatus(Status status);
-    Long countByStatus(Status status);
+
+    // 1년마다 뉴비 -> 시니어 자동 갱신
+    @Modifying(clearAutomatically = true, flushAutomatically = true)
+    @Query("UPDATE Member m " +
+            "SET m.role = :newRole " +
+            "WHERE m.role = :oldRole " +
+            "AND m.joinedYear <= :thresholdYear")
+    int bulkUpdateRole(@Param("oldRole") Role oldRole,
+                       @Param("newRole") Role newRole,
+                       @Param("thresholdYear") int thresholdYear);
+    // 닉네임 중복확인
+    boolean existsByNickname(String nickname);
 
 }

src/main/java/org/example/tackit/domain/auth/login/controller/AuthController.java

@@ -54,5 +54,30 @@ public ResponseEntity<FindEmailRespDto> findEmail(
 
         return ResponseEntity.ok(resp);
     }
+
+    // 비밀번호 찾기
+    @PostMapping("/find-password")
+    public ResponseEntity<ResetTokenDto> findPassword(
+            @RequestBody FindPwReqDto findPwReqDto
+    ) {
+        ResetTokenDto tokenDto = authService.findPwByIdentity(
+                findPwReqDto.getName(),
+                findPwReqDto.getOrganization(),
+                findPwReqDto.getEmail()
+        );
+
+        return ResponseEntity.ok(tokenDto);
+    }
+
+    // 비밀번호 재설정
+    @PatchMapping("/reset-password")
+    public ResponseEntity<?> resetPassword(
+            @RequestHeader("Authorization") String authorizationHeader,
+            @RequestBody ResetPwReqDto resetPwReqDto
+    ) {
+        authService.resetPassword(authorizationHeader, resetPwReqDto.getNewPassword());
+
+        return ResponseEntity.ok().body(Map.of("status", "OK", "message", "비밀번호가 성공적으로 변경되었습니다."));
+    }
 }
 

src/main/java/org/example/tackit/domain/auth/login/dto/FindPwReqDto.java

@@ -0,0 +1,10 @@
+package org.example.tackit.domain.auth.login.dto;
+
+import lombok.Data;
+
+@Data
+public class FindPwReqDto {
+    private String organization;
+    private String name;
+    private String email;
+}

src/main/java/org/example/tackit/domain/auth/login/dto/ResetPwReqDto.java

@@ -0,0 +1,8 @@
+package org.example.tackit.domain.auth.login.dto;
+
+import lombok.Data;
+
+@Data
+public class ResetPwReqDto {
+    private String newPassword;
+}

src/main/java/org/example/tackit/domain/auth/login/dto/ResetTokenDto.java

@@ -0,0 +1,12 @@
+package org.example.tackit.domain.auth.login.dto;
+
+import lombok.Builder;
+import lombok.Data;
+
+@Builder
+@Data
+public class ResetTokenDto {
+    private String grantType;
+    private String resetToken;
+    private Long expiresIn;
+}

src/main/java/org/example/tackit/domain/auth/login/repository/UserRepository.java

@@ -18,5 +18,7 @@ public interface UserRepository extends JpaRepository<Member, Long> {
     Optional<Member> findByOrganizationAndName(String organization, String name);
 
     Optional<Member> findByEmailAndOrganization(String email, String organization);
+
+    Optional<Member> findByNameAndOrganizationAndEmail(String name, String organization, String email);
 }