feat: TypeHandler를 통해 OAuthToken 암호화

Author: joonhyong

src/main/java/com/ureca/unity/global/config/EncryptedStringTypeHandler.java

@@ -0,0 +1,48 @@
+package com.ureca.unity.global.config;
+
+import org.apache.ibatis.type.BaseTypeHandler;
+import org.apache.ibatis.type.JdbcType;
+
+import java.sql.*;
+
+public class EncryptedStringTypeHandler extends BaseTypeHandler<String> {
+
+    private static OAuthTokenCrypto crypto;
+
+    public static void setCrypto(OAuthTokenCrypto c) {
+        crypto = c;
+    }
+
+    public EncryptedStringTypeHandler() {}
+
+    private OAuthTokenCrypto crypto() {
+        if (crypto == null) {
+            throw new IllegalStateException("EncryptedStringTypeHandler crypto not initialized");
+        }
+        return crypto;
+    }
+
+    @Override
+    public void setNonNullParameter(PreparedStatement ps, int i, String parameter, JdbcType jdbcType)
+            throws SQLException {
+        ps.setString(i, crypto().encrypt(parameter));
+    }
+
+    @Override
+    public String getNullableResult(ResultSet rs, String columnName) throws SQLException {
+        String v = rs.getString(columnName);
+        return v == null ? null : crypto().decrypt(v);
+    }
+
+    @Override
+    public String getNullableResult(ResultSet rs, int columnIndex) throws SQLException {
+        String v = rs.getString(columnIndex);
+        return v == null ? null : crypto().decrypt(v);
+    }
+
+    @Override
+    public String getNullableResult(CallableStatement cs, int columnIndex) throws SQLException {
+        String v = cs.getString(columnIndex);
+        return v == null ? null : crypto().decrypt(v);
+    }
+}

src/main/java/com/ureca/unity/global/config/MyBatisTypeHandlerConfig.java

@@ -0,0 +1,17 @@
+package com.ureca.unity.global.config;
+
+import jakarta.annotation.PostConstruct;
+import lombok.RequiredArgsConstructor;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+@RequiredArgsConstructor
+public class MyBatisTypeHandlerConfig {
+
+    private final OAuthTokenCrypto crypto;
+
+    @PostConstruct
+    public void init() {
+        EncryptedStringTypeHandler.setCrypto(crypto);
+    }
+}

src/main/java/com/ureca/unity/global/config/OAuthTokenCrypto.java

@@ -0,0 +1,80 @@
+package com.ureca.unity.global.config;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.GCMParameterSpec;
+import javax.crypto.spec.SecretKeySpec;
+import java.nio.charset.StandardCharsets;
+import java.security.SecureRandom;
+import java.util.Base64;
+
+@Component
+public class OAuthTokenCrypto {
+
+    private static final String ALG = "AES";
+    private static final String TRANSFORM = "AES/GCM/NoPadding";
+    private static final int IV_LEN = 12;          // GCM 권장 12 bytes
+    private static final int TAG_BITS = 128;
+
+    private final byte[] keyBytes;
+    private final SecureRandom random = new SecureRandom();
+
+    public OAuthTokenCrypto(@Value("${security.oauth-token.secret}") String secret) {
+        // 최소 수정 버전: secret을 16/24/32 bytes로 맞춰 쓰는 걸 권장
+        // 여기서는 "UTF-8 바이트" 기준으로 32바이트로 잘라/패딩 처리
+        byte[] raw = secret.getBytes(StandardCharsets.UTF_8);
+        this.keyBytes = new byte[32];
+        for (int i = 0; i < this.keyBytes.length; i++) {
+            this.keyBytes[i] = i < raw.length ? raw[i] : 0;
+        }
+    }
+
+    public String encrypt(String plain) {
+        if (plain == null) return null;
+        try {
+            byte[] iv = new byte[IV_LEN];
+            random.nextBytes(iv);
+
+            Cipher cipher = Cipher.getInstance(TRANSFORM);
+            SecretKeySpec key = new SecretKeySpec(keyBytes, ALG);
+            cipher.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(TAG_BITS, iv));
+
+            byte[] ct = cipher.doFinal(plain.getBytes(StandardCharsets.UTF_8));
+
+            // 저장 포맷: base64( iv + ciphertext )
+            byte[] out = new byte[iv.length + ct.length];
+            System.arraycopy(iv, 0, out, 0, iv.length);
+            System.arraycopy(ct, 0, out, iv.length, ct.length);
+
+            return Base64.getEncoder().encodeToString(out);
+        } catch (Exception e) {
+            throw new IllegalStateException("OAuth token encrypt failed", e);
+        }
+    }
+
+    public String decrypt(String enc) {
+        if (enc == null) return null;
+        try {
+            byte[] in = Base64.getDecoder().decode(enc);
+            if (in.length < IV_LEN + 1) return enc; // 방어: 평문이 들어온 경우 그냥 반환
+
+            byte[] iv = new byte[IV_LEN];
+            byte[] ct = new byte[in.length - IV_LEN];
+
+            System.arraycopy(in, 0, iv, 0, IV_LEN);
+            System.arraycopy(in, IV_LEN, ct, 0, ct.length);
+
+            Cipher cipher = Cipher.getInstance(TRANSFORM);
+            SecretKeySpec key = new SecretKeySpec(keyBytes, ALG);
+            cipher.init(Cipher.DECRYPT_MODE, key, new GCMParameterSpec(TAG_BITS, iv));
+
+            byte[] pt = cipher.doFinal(ct);
+            return new String(pt, StandardCharsets.UTF_8);
+        } catch (Exception e) {
+            // 방어: 기존 데이터가 평문/다른 포맷이면 그냥 원문 반환(마이그레이션 단계에서 유용)
+            return enc;
+        }
+    }
+}

src/main/resources/application.yml

@@ -44,3 +44,7 @@ cors:
 
 cookie:
   secure: ${COOKIE_SECURE:true}
+
+security:
+  oauth-token:
+    secret: ${OAUTH_TOKEN_SECRET}

src/main/resources/mapper/oauth/OAuthTokenMapper.xml

@@ -9,14 +9,20 @@
         <id property="id" column="oauth_token_id"/>
         <result property="userId" column="user_id"/>
         <result property="provider" column="provider"/>
-        <result property="accessToken" column="access_token"/>
-        <result property="refreshToken" column="refresh_token"/>
+        <result property="accessToken" column="access_token" typeHandler="com.ureca.unity.global.config.EncryptedStringTypeHandler"/>
+        <result property="refreshToken" column="refresh_token" typeHandler="com.ureca.unity.global.config.EncryptedStringTypeHandler"/>
         <result property="expiresAt" column="expires_at"/>
     </resultMap>
 
     <insert id="insert" useGeneratedKeys="true" keyProperty="id" keyColumn="oauth_token_id">
         INSERT INTO oauth_tokens (user_id, provider, access_token, refresh_token, expires_at)
-        VALUES (#{userId}, #{provider}, #{accessToken}, #{refreshToken}, #{expiresAt})
+        VALUES (
+                #{userId},
+                #{provider},
+                #{accessToken, typeHandler=com.ureca.unity.global.config.EncryptedStringTypeHandler},
+                #{refreshToken, typeHandler=com.ureca.unity.global.config.EncryptedStringTypeHandler},
+                #{expiresAt}
+               )
     </insert>
 
     <select id="findByUserIdAndProvider" resultMap="oauthTokenMap">