[feat] 애플 소셜로그인(IOS) 추가

src/main/java/konkuk/thip/common/exception/code/ErrorCode.java

@@ -25,6 +25,7 @@ public enum ErrorCode implements ResponseCode {
     AUTH_INVALID_LOGIN_TOKEN_KEY(HttpStatus.UNAUTHORIZED, 40106, "유효하지 않은 로그인 토큰 키입니다."),
     AUTH_BLACKLIST_TOKEN(HttpStatus.UNAUTHORIZED, 40107, "블랙리스트에 등록된 토큰입니다."),
     AUTH_INTERNAL_SERVER_ERROR(HttpStatus.INTERNAL_SERVER_ERROR, 40108, "인증 처리 중 서버 오류가 발생했습니다."),
+    AUTH_APPLE_IDENTITY_TOKEN_INVALID(HttpStatus.UNAUTHORIZED, 40109, "유효하지 않은 Apple identity token입니다."),
 
     JSON_PROCESSING_ERROR(HttpStatus.INTERNAL_SERVER_ERROR, 50100, "JSON 직렬화/역직렬화에 실패했습니다."),
     AWS_BUCKET_BASE_URL_NOT_CONFIGURED(HttpStatus.INTERNAL_SERVER_ERROR, 50101, "aws s3 bucket base url 설정이 누락되었습니다."),

src/main/java/konkuk/thip/common/security/constant/AuthParameters.java

@@ -8,6 +8,7 @@ public enum AuthParameters {
     JWT_PREFIX("Bearer "),
     KAKAO("kakao"),
     GOOGLE("google"),
+    APPLE("apple"),
     KAKAO_PROVIDER_ID_KEY("id"),
     GOOGLE_PROVIDER_ID_KEY("sub"),
     JWT_ACCESS_TOKEN_KEY("userId"),

src/main/java/konkuk/thip/common/security/constant/SecurityWhitelist.java

@@ -20,6 +20,7 @@ public enum SecurityWhitelist {
     ACTUATOR_PROMETHEUS("/actuator/prometheus"),
     AUTH_USERS("/auth/users"),
     AUTH_TOKEN("/auth/token"),
+    AUTH_APPLE("/auth/apple"),
     API_TEST("/api/test/**"),
     AUTH_EXCHANGE_TEMP_TOKEN("/auth/exchange-temp-token"),
     AUTH_SET_COOKIE("/auth/set-cookie");

src/main/java/konkuk/thip/common/security/oauth2/apple/AppleClientSecretGenerator.java

@@ -0,0 +1,49 @@
+package konkuk.thip.common.security.oauth2.apple;
+
+import io.jsonwebtoken.Jwts;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+
+import java.security.KeyFactory;
+import java.security.interfaces.ECPrivateKey;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.util.Base64;
+import java.util.Date;
+
+@Component
+@RequiredArgsConstructor
+public class AppleClientSecretGenerator {
+
+    private static final String APPLE_AUDIENCE = "https://appleid.apple.com";
+    private static final long EXPIRATION_MS = 1000L * 60 * 60 * 24 * 180; // 180일
+
+    private final AppleProperties appleProperties;
+
+    public String generate() {
+        try {
+            ECPrivateKey privateKey = loadPrivateKey(appleProperties.getPrivateKey());
+
+            return Jwts.builder()
+                    .header().add("kid", appleProperties.getKeyId()).and()
+                    .issuer(appleProperties.getTeamId())
+                    .issuedAt(new Date())
+                    .expiration(new Date(System.currentTimeMillis() + EXPIRATION_MS))
+                    .audience().add(APPLE_AUDIENCE).and()
+                    .subject(appleProperties.getClientId())
+                    .signWith(privateKey, Jwts.SIG.ES256)
+                    .compact();
+        } catch (Exception e) {
+            throw new IllegalStateException("Apple client_secret 생성 실패", e);
+        }
+    }
+
+    private ECPrivateKey loadPrivateKey(String privateKeyStr) throws Exception {
+        String stripped = privateKeyStr
+                .replace("-----BEGIN PRIVATE KEY-----", "")
+                .replace("-----END PRIVATE KEY-----", "")
+                .replaceAll("\\s", "");
+        byte[] keyBytes = Base64.getDecoder().decode(stripped);
+        PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(keyBytes);
+        return (ECPrivateKey) KeyFactory.getInstance("EC").generatePrivate(spec);
+    }
+}

src/main/java/konkuk/thip/common/security/oauth2/apple/AppleIdentityTokenVerifier.java

@@ -0,0 +1,48 @@
+package konkuk.thip.common.security.oauth2.apple;
+
+import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jose.jwk.source.JWKSource;
+import com.nimbusds.jose.jwk.source.RemoteJWKSet;
+import com.nimbusds.jose.proc.JWSVerificationKeySelector;
+import com.nimbusds.jose.proc.SecurityContext;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.proc.ConfigurableJWTProcessor;
+import com.nimbusds.jwt.proc.DefaultJWTProcessor;
+import konkuk.thip.common.exception.AuthException;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Component;
+
+import java.net.URL;
+
+import static konkuk.thip.common.exception.code.ErrorCode.AUTH_APPLE_IDENTITY_TOKEN_INVALID;
+
+@Slf4j
+@Component
+public class AppleIdentityTokenVerifier {
+
+    private static final String APPLE_JWK_SET_URI = "https://appleid.apple.com/auth/keys";
+
+    private final ConfigurableJWTProcessor<SecurityContext> jwtProcessor;
+
+    public AppleIdentityTokenVerifier() {
+        try {
+            JWKSource<SecurityContext> keySource = new RemoteJWKSet<>(new URL(APPLE_JWK_SET_URI));
+            jwtProcessor = new DefaultJWTProcessor<>();
+            jwtProcessor.setJWSKeySelector(new JWSVerificationKeySelector<>(JWSAlgorithm.RS256, keySource));
+        } catch (Exception e) {
+            throw new IllegalStateException("Apple JWK 초기화 실패", e);
+        }
+    }
+
+    public String verify(String identityToken) {
+        try {
+            JWTClaimsSet claims = jwtProcessor.process(identityToken, null);
+            String sub = claims.getSubject();
+            log.info("[Apple Login] verified sub={}", sub);
+            return sub;
+        } catch (Exception e) {
+            log.warn("[Apple Login] identity token verification failed: {}", e.getMessage());
+            throw new AuthException(AUTH_APPLE_IDENTITY_TOKEN_INVALID);
+        }
+    }
+}

src/main/java/konkuk/thip/common/security/oauth2/apple/AppleLoginRequest.java

@@ -0,0 +1,9 @@
+package konkuk.thip.common.security.oauth2.apple;
+
+import jakarta.validation.constraints.NotBlank;
+
+public record AppleLoginRequest(
+        @NotBlank String identityToken,
+        String authorizationCode
+) {
+}

src/main/java/konkuk/thip/common/security/oauth2/apple/AppleProperties.java

@@ -0,0 +1,17 @@
+package konkuk.thip.common.security.oauth2.apple;
+
+import lombok.Getter;
+import lombok.Setter;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.stereotype.Component;
+
+@Getter
+@Setter
+@Component
+@ConfigurationProperties(prefix = "apple")
+public class AppleProperties {
+    private String clientId;
+    private String teamId;
+    private String keyId;
+    private String privateKey;
+}

src/main/java/konkuk/thip/common/security/oauth2/apple/AppleRefreshTokenStore.java

@@ -0,0 +1,30 @@
+package konkuk.thip.common.security.oauth2.apple;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.data.redis.core.RedisTemplate;
+import org.springframework.stereotype.Component;
+
+import java.time.Duration;
+
+@Component
+@RequiredArgsConstructor
+public class AppleRefreshTokenStore {
+
+    private static final String PREFIX = "apple:refresh:";
+    private static final Duration TTL = Duration.ofMinutes(30);
+
+    private final RedisTemplate<String, String> redisTemplate;
+
+    public void save(String oauth2Id, String refreshToken) {
+        redisTemplate.opsForValue().set(PREFIX + oauth2Id, refreshToken, TTL);
+    }
+
+    public String pop(String oauth2Id) {
+        String key = PREFIX + oauth2Id;
+        String token = redisTemplate.opsForValue().get(key);
+        if (token != null) {
+            redisTemplate.delete(key);
+        }
+        return token;
+    }
+}

src/main/java/konkuk/thip/common/security/oauth2/apple/AppleTokenClient.java

@@ -0,0 +1,75 @@
+package konkuk.thip.common.security.oauth2.apple;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpEntity;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.stereotype.Component;
+import org.springframework.util.LinkedMultiValueMap;
+import org.springframework.util.MultiValueMap;
+import org.springframework.web.client.RestTemplate;
+
+import java.util.Map;
+
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class AppleTokenClient {
+
+    private static final String APPLE_TOKEN_URL = "https://appleid.apple.com/auth/token";
+    private static final String APPLE_REVOKE_URL = "https://appleid.apple.com/auth/revoke";
+
+    private final RestTemplate restTemplate;
+    private final AppleProperties appleProperties;
+    private final AppleClientSecretGenerator clientSecretGenerator;
+
+    public String exchangeAuthorizationCode(String authorizationCode) {
+        String clientSecret = clientSecretGenerator.generate();
+
+        MultiValueMap<String, String> params = new LinkedMultiValueMap<>();
+        params.add("client_id", appleProperties.getClientId());
+        params.add("client_secret", clientSecret);
+        params.add("code", authorizationCode);
+        params.add("grant_type", "authorization_code");
+
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
+
+        try {
+            Map<?, ?> response = restTemplate.postForObject(
+                    APPLE_TOKEN_URL,
+                    new HttpEntity<>(params, headers),
+                    Map.class
+            );
+            if (response == null || !response.containsKey("refresh_token")) {
+                log.warn("[Apple] authorizationCode 교환 실패: refresh_token 없음");
+                return null;
+            }
+            return (String) response.get("refresh_token");
+        } catch (Exception e) {
+            log.warn("[Apple] authorizationCode 교환 중 오류: {}", e.getMessage());
+            return null;
+        }
+    }
+
+    public void revokeToken(String refreshToken) {
+        String clientSecret = clientSecretGenerator.generate();
+
+        MultiValueMap<String, String> params = new LinkedMultiValueMap<>();
+        params.add("client_id", appleProperties.getClientId());
+        params.add("client_secret", clientSecret);
+        params.add("token", refreshToken);
+        params.add("token_type_hint", "refresh_token");
+
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
+
+        try {
+            restTemplate.postForObject(APPLE_REVOKE_URL, new HttpEntity<>(params, headers), Void.class);
+            log.info("[Apple] 토큰 철회 완료");
+        } catch (Exception e) {
+            log.warn("[Apple] 토큰 철회 중 오류: {}", e.getMessage());
+        }
+    }
+}

src/main/java/konkuk/thip/common/security/oauth2/auth/AuthController.java

@@ -5,17 +5,23 @@
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import jakarta.validation.Valid;
 import konkuk.thip.common.dto.BaseResponse;
 import konkuk.thip.common.exception.AuthException;
 import konkuk.thip.common.exception.BusinessException;
 import konkuk.thip.common.exception.code.ErrorCode;
 import konkuk.thip.common.security.annotation.Oauth2Id;
+import konkuk.thip.common.security.oauth2.apple.AppleIdentityTokenVerifier;
+import konkuk.thip.common.security.oauth2.apple.AppleLoginRequest;
+import konkuk.thip.common.security.oauth2.apple.AppleRefreshTokenStore;
+import konkuk.thip.common.security.oauth2.apple.AppleTokenClient;
 import konkuk.thip.common.security.oauth2.tokenstorage.LoginTokenStorage;
 import konkuk.thip.common.security.oauth2.auth.dto.AuthSetCookieRequest;
 import konkuk.thip.common.security.oauth2.auth.dto.AuthSetCookieResponse;
 import konkuk.thip.common.security.oauth2.auth.dto.AuthTokenRequest;
 import konkuk.thip.common.security.oauth2.auth.dto.AuthTokenResponse;
 import konkuk.thip.common.security.util.JwtUtil;
+import konkuk.thip.user.adapter.out.jpa.UserJpaEntity;
 import konkuk.thip.user.adapter.out.persistence.repository.UserJpaRepository;
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.HttpStatus;
@@ -29,6 +35,7 @@
 import java.io.IOException;
 import java.time.Duration;
 import java.util.Map;
+import java.util.Optional;
 
 import static konkuk.thip.common.exception.code.ErrorCode.API_INVALID_PARAM;
 import static konkuk.thip.common.exception.code.ErrorCode.AUTH_INVALID_LOGIN_TOKEN_KEY;
@@ -45,8 +52,10 @@ public class AuthController {
 
     private final UserJpaRepository userJpaRepository;
     private final JwtUtil jwtUtil;
-
     private final LoginTokenStorage loginTokenStorage;
+    private final AppleIdentityTokenVerifier appleIdentityTokenVerifier;
+    private final AppleTokenClient appleTokenClient;
+    private final AppleRefreshTokenStore appleRefreshTokenStore;
 
     @Operation(
             summary = "소셜 로그인 유저 확인",
@@ -70,6 +79,44 @@ public BaseResponse<AuthTokenResponse> checkUserExists(
                 });
     }
 
+    @Operation(
+            summary = "Apple 소셜 로그인 (iOS 네이티브)",
+            description = "iOS에서 Apple Sign In SDK로 받은 identityToken을 검증하여 AccessToken 또는 SignupToken을 발급합니다."
+    )
+    @PostMapping("/apple")
+    public BaseResponse<AuthTokenResponse> appleLogin(
+            @Valid @RequestBody AppleLoginRequest request
+    ) {
+        String appleUserId = appleIdentityTokenVerifier.verify(request.identityToken());
+        String oauth2Id = "apple_" + appleUserId;
+
+        Optional<UserJpaEntity> existingUser = userJpaRepository.findByOauth2Id(oauth2Id);
+
+        if (request.authorizationCode() != null) {
+            String refreshToken = appleTokenClient.exchangeAuthorizationCode(request.authorizationCode());
+            if (refreshToken != null) {
+                if (existingUser.isPresent()) {
+                    // 기존 유저: DB에 바로 저장
+                    existingUser.get().updateAppleRefreshToken(refreshToken);
+                    userJpaRepository.save(existingUser.get());
+                } else {
+                    // 신규 유저: 회원가입 완료 시 옮겨 저장하도록 Redis에 임시 보관 (TTL 30분)
+                    appleRefreshTokenStore.save(oauth2Id, refreshToken);
+                }
+            }
+        }
+
+        return existingUser
+                .map(user -> {
+                    String accessToken = jwtUtil.createAccessToken(user.getUserId());
+                    return BaseResponse.ok(AuthTokenResponse.of(accessToken, false));
+                })
+                .orElseGet(() -> {
+                    String tempToken = jwtUtil.createSignupToken(oauth2Id);
+                    return BaseResponse.ok(AuthTokenResponse.of(tempToken, true));
+                });
+    }
+
     @Operation(
             summary = "로그인 토큰 키로 토큰 발급",
             description = "로그인 토큰 키를 사용하여 AccessToken 또는 SignupToken을 발급합니다."

src/main/java/konkuk/thip/user/adapter/out/jpa/UserJpaEntity.java

@@ -39,6 +39,9 @@ public class UserJpaEntity extends BaseJpaEntity {
     @Column(name = "oauth2_id", length = 50, nullable = false)
     private String oauth2Id;
 
+    @Column(name = "apple_refresh_token", length = 1000)
+    private String appleRefreshToken;
+
     /**
      * -- SETTER --
      *  회원 탈퇴용
@@ -76,6 +79,10 @@ public void updateFrom(User user) {
         this.recordReviewCount = user.getRecordReviewCount();
     }
 
+    public void updateAppleRefreshToken(String token) {
+        this.appleRefreshToken = token;
+    }
+
     public void softDelete(User user) {
         if(this.status.equals(INACTIVE)){
             throw new InvalidStateException(USER_ALREADY_DELETED);