Fix: DB/JWT 시간 통일 및 Access/Refresh Token 타입 Claim 분리

Author: joonhyong

src/main/java/com/ureca/unity/domain/auth/model/RefreshToken.java

@@ -5,7 +5,7 @@
 import lombok.Getter;
 import lombok.NoArgsConstructor;
 
-import java.time.LocalDateTime;
+import java.time.Instant;
 
 @Getter
 @Builder
@@ -16,5 +16,5 @@ public class RefreshToken {
     private Long id;
     private Long userId;
     private String token;
-    private LocalDateTime expiresAt;
+    private Instant expiresAt;
 }

src/main/java/com/ureca/unity/domain/auth/service/RefreshTokenServiceImpl.java

@@ -18,7 +18,7 @@
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
-import java.time.LocalDateTime;
+import java.time.Instant;
 
 @Service
 @RequiredArgsConstructor
@@ -42,7 +42,7 @@ public void saveRefreshToken(Long userId, String refreshToken) {
                         .userId(userId)
                         .token(refreshToken)
                         .expiresAt(
-                                LocalDateTime.now()
+                                Instant.now()
                                         .plusSeconds(jwtProperties.refreshExpirationSeconds())
                         )
                         .build()
@@ -60,7 +60,7 @@ public TokenResponse refreshAccessToken(HttpServletRequest request,
         // 1-1. JWT 서명 검증 (DB 조회 전)
         Long jwtUserId;
         try {
-            jwtUserId = jwtProvider.getUserId(refreshToken);
+            jwtUserId = jwtProvider.getUserId(refreshToken, "refresh");
         } catch (JwtException | IllegalArgumentException e) {
             throw new CustomException(ErrorCode.REFRESH_TOKEN_INVALID);
         }
@@ -76,7 +76,7 @@ public TokenResponse refreshAccessToken(HttpServletRequest request,
         }
 
         // 3. 만료 체크
-        if (savedToken.getExpiresAt().isBefore(LocalDateTime.now())) {
+        if (savedToken.getExpiresAt().isBefore(Instant.now())) {
             // 만료된 토큰은 즉시 삭제 후 예외 반환 (rotation 로직 미진입)
             refreshTokenMapper.deleteByToken(refreshToken); // 만료 토큰 정리
             throw new CustomException(ErrorCode.REFRESH_TOKEN_EXPIRED);

src/main/java/com/ureca/unity/global/security/JwtIssuer.java

@@ -32,7 +32,7 @@ public JwtIssuer(JwtProperties props) {
     public TokenResponse issueAccessToken(Long userId) {
 
         long accessExp = props.accessExpirationSeconds();
-        String accessToken = createToken(userId, accessExp);
+        String accessToken = createToken(userId, accessExp, "access");
 
         return TokenResponse.builder()
                 .accessToken(accessToken)
@@ -41,10 +41,10 @@ public TokenResponse issueAccessToken(Long userId) {
     }
 
     public String issueRefreshToken(Long userId) {
-        return createToken(userId, props.refreshExpirationSeconds());
+        return createToken(userId, props.refreshExpirationSeconds(), "refresh");
     }
 
-    private String createToken(Long userId, long expSeconds) {
+    private String createToken(Long userId, long expSeconds, String type) {
         if (userId == null) {
             throw new IllegalArgumentException("userId must not be null");
         }
@@ -54,6 +54,7 @@ private String createToken(Long userId, long expSeconds) {
         return Jwts.builder()
                 .issuer(props.issuer())
                 .subject(String.valueOf(userId))
+                .claim("type", type)
                 .issuedAt(Date.from(now))
                 .expiration(Date.from(now.plusSeconds(expSeconds)))
                 .signWith(key, Jwts.SIG.HS256)

src/main/java/com/ureca/unity/global/security/JwtProvider.java

@@ -1,6 +1,8 @@
 package com.ureca.unity.global.security;
 
 import com.ureca.unity.domain.auth.constant.JwtProperties;
+import com.ureca.unity.global.exception.CustomException;
+import com.ureca.unity.global.exception.ErrorCode;
 import io.jsonwebtoken.Claims;
 import io.jsonwebtoken.Jwts;
 import io.jsonwebtoken.security.Keys;
@@ -24,18 +26,24 @@ public JwtProvider(JwtProperties props) {
     }
 
     /* JWT 검증 + userId(subject) 추출 */
-    public Long getUserId(String token) {
+    public Long getUserId(String token, String expectedType) {
         Claims claims = Jwts.parser()
                 .verifyWith(key)
                 .build()
                 .parseSignedClaims(token)
                 .getPayload();
 
+        String tokenType = claims.get("type", String.class);
+
+        if (!expectedType.equals(tokenType)) {
+            throw new CustomException(ErrorCode.REFRESH_TOKEN_INVALID);
+        }
+
         return Long.valueOf(claims.getSubject());
     }
 
     public Authentication getAuthentication(String token) {
-        Long userId = getUserId(token);
+        Long userId = getUserId(token, "access");
 
         return new UsernamePasswordAuthenticationToken(
                 userId,