refactor: sprint1 hardening

.env.example

@@ -53,3 +53,5 @@ OAUTH_KAKAO_CLIENT_ID=
 OAUTH_KAKAO_CLIENT_SECRET=
 OAUTH_NAVER_CLIENT_ID=
 OAUTH_NAVER_CLIENT_SECRET=
+
+EMAIL_ENCRYPTION_KEY_BASE64=MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=

src/main/kotlin/com/unit/member/config/EmailEncryptionConfig.kt

@@ -0,0 +1,8 @@
+package com.unit.member.config
+
+import org.springframework.boot.context.properties.EnableConfigurationProperties
+import org.springframework.context.annotation.Configuration
+
+@Configuration
+@EnableConfigurationProperties(EmailEncryptionProperties::class)
+class EmailEncryptionConfig

src/main/kotlin/com/unit/member/config/EmailEncryptionProperties.kt

@@ -0,0 +1,8 @@
+package com.unit.member.config
+
+import org.springframework.boot.context.properties.ConfigurationProperties
+
+@ConfigurationProperties(prefix = "unit.security.email-encryption")
+data class EmailEncryptionProperties(
+    val keyBase64: String,
+)

src/main/kotlin/com/unit/member/dto/MemberResponse.kt

@@ -5,6 +5,7 @@ import com.unit.member.enums.UserSchoolVerificationStatus
 
 data class MemberMeResponse(
     val memberId: Long,
+    val email: String?,
     val nickname: String,
     val profileImageUrl: String?,
     val status: MemberStatus,
@@ -16,4 +17,5 @@ data class MemberSchoolResponse(
     val schoolId: Long,
     val name: String,
     val verificationStatus: UserSchoolVerificationStatus,
+    val verifiedEmail: String?,
 )

src/main/kotlin/com/unit/member/entity/MemberConsent.kt

@@ -50,4 +50,8 @@ class MemberConsent(
     @Column(name = "updated_at", nullable = false)
     var updatedAt: LocalDateTime? = null
         protected set
-}
+
+    fun withdraw(now: LocalDateTime) {
+        this.withdrawnAt = now
+    }
+}

src/main/kotlin/com/unit/member/entity/UserSchoolVerification.kt

@@ -33,10 +33,10 @@ class UserSchoolVerification(
     val method: UserSchoolVerificationMethod,
 
     @Column(name = "verified_email_hash", columnDefinition = "BINARY(32)")
-    val verifiedEmailHash: ByteArray? = null,
+    var verifiedEmailHash: ByteArray? = null,
 
     @Column(name = "verified_email_encrypted", columnDefinition = "VARBINARY(512)")
-    val verifiedEmailEncrypted: ByteArray? = null,
+    var verifiedEmailEncrypted: ByteArray? = null,
 
     @Column(name = "student_number_hash", columnDefinition = "BINARY(32)")
     val studentNumberHash: ByteArray? = null,
@@ -74,4 +74,15 @@ class UserSchoolVerification(
     fun expire() {
         this.status = UserSchoolVerificationStatus.EXPIRED
     }
+
+    fun verifyByEmail(
+        now: LocalDateTime,
+        emailHash: ByteArray,
+        emailEncrypted: ByteArray? = null,
+    ) {
+        this.status = UserSchoolVerificationStatus.VERIFIED
+        this.verifiedAt = now
+        this.verifiedEmailHash = emailHash
+        this.verifiedEmailEncrypted = emailEncrypted
+    }
 }

src/main/kotlin/com/unit/member/repository/MemberConsentRepository.kt

@@ -3,4 +3,7 @@ package com.unit.member.repository
 import com.unit.member.entity.MemberConsent
 import org.springframework.data.jpa.repository.JpaRepository
 
-interface MemberConsentRepository : JpaRepository<MemberConsent, Long>
+interface MemberConsentRepository : JpaRepository<MemberConsent, Long> {
+
+    fun findAllByMemberId(memberId: Long): List<MemberConsent>
+}

src/main/kotlin/com/unit/member/repository/RefreshTokenRepository.kt

@@ -2,9 +2,13 @@ package com.unit.member.repository
 
 import com.unit.member.entity.RefreshToken
 import com.unit.member.enums.RefreshTokenStatus
+import jakarta.persistence.LockModeType
 import org.springframework.data.jpa.repository.JpaRepository
+import org.springframework.data.jpa.repository.Lock
 
 interface RefreshTokenRepository : JpaRepository<RefreshToken, Long> {
+
+    @Lock(LockModeType.PESSIMISTIC_WRITE)
     fun findByTokenHashAndStatus(
         tokenHash: ByteArray,
         status: RefreshTokenStatus = RefreshTokenStatus.ACTIVE,

src/main/kotlin/com/unit/member/service/AuthLoginService.kt

@@ -25,7 +25,8 @@ class AuthLoginService(
 
     override fun login(request: AuthLoginRequest): AuthLoginResponse {
 
-        val emailHash = emailHasher.hash(request.email)
+        val email = request.email.trim().lowercase()
+        val emailHash = emailHasher.hash(email)
 
         val member = memberRepository.findByEmailHashAndDeletedAtIsNull(emailHash)
             ?: memberRepository.findTopByEmailHashAndDeletedAtIsNotNullOrderByDeletedAtDescIdDesc(emailHash)

src/main/kotlin/com/unit/member/service/MemberQueryService.kt

@@ -7,6 +7,7 @@ import com.unit.member.exception.MemberErrorCode
 import com.unit.member.repository.MemberRepository
 import com.unit.member.repository.SchoolRepository
 import com.unit.member.repository.UserSchoolVerificationRepository
+import com.unit.member.util.EmailEncryptor
 import com.unit.platform.error.BusinessException
 import org.springframework.data.repository.findByIdOrNull
 import org.springframework.stereotype.Service
@@ -18,6 +19,7 @@ class MemberQueryService(
     private val memberRepository: MemberRepository,
     private val userSchoolVerificationRepository: UserSchoolVerificationRepository,
     private val schoolRepository: SchoolRepository,
+    private val emailEncryptor: EmailEncryptor
 ) : MemberQueryUseCase {
 
     override fun getMe(memberId: Long): MemberMeResponse {
@@ -35,11 +37,13 @@ class MemberQueryService(
                 schoolId = requireNotNull(school.id),
                 name = school.name,
                 verificationStatus = it.status,
+                verifiedEmail = it.verifiedEmailEncrypted?.let(emailEncryptor::decrypt),
             )
         }
 
         return MemberMeResponse(
             memberId = requireNotNull(member.id),
+            email = member.emailEncrypted?.let(emailEncryptor::decrypt),
             nickname = member.nickname,
             profileImageUrl = member.profileImageUrl,
             status = member.status,

src/main/kotlin/com/unit/member/service/MemberSignupService.kt

@@ -15,6 +15,7 @@ import com.unit.member.repository.MemberConsentRepository
 import com.unit.member.repository.MemberRepository
 import com.unit.member.repository.SchoolRepository
 import com.unit.member.repository.UserSchoolVerificationRepository
+import com.unit.member.util.EmailEncryptor
 import com.unit.member.util.EmailHasher
 import com.unit.platform.error.BusinessException
 import org.springframework.security.crypto.password.PasswordEncoder
@@ -32,10 +33,12 @@ class MemberSignupService(
     private val emailHasher: EmailHasher,
     private val memberConsentRepository: MemberConsentRepository,
     private val memberConsentProperties: MemberConsentProperties,
+    private val emailEncryptor: EmailEncryptor,
 ) : MemberSignupUseCase {
 
     override fun signup(request: MemberSignupRequest): MemberSignupResponse {
-        val emailHash = emailHasher.hash(request.email)
+        val email = request.email.trim().lowercase()
+        val emailHash = emailHasher.hash(email)
         val nickname = request.nickname.trim()
         val schoolId = request.schoolId!!
 
@@ -54,6 +57,7 @@ class MemberSignupService(
         val member = memberRepository.save(
             Member(
                 emailHash = emailHash,
+                emailEncrypted = emailEncryptor.encrypt(email),
                 passwordHash = passwordEncoder.encode(request.password),
                 nickname = nickname,
                 status = MemberStatus.PENDING,

src/main/kotlin/com/unit/member/service/MemberWithdrawalService.kt

@@ -2,18 +2,23 @@ package com.unit.member.service
 
 import com.unit.member.enums.MemberStatus
 import com.unit.member.exception.MemberErrorCode
+import com.unit.member.repository.MemberConsentRepository
 import com.unit.member.repository.MemberRepository
 import com.unit.member.withdrawal.MemberWithdrawalContext
 import com.unit.member.withdrawal.MemberWithdrawalPolicy
 import com.unit.platform.error.BusinessException
+import org.slf4j.LoggerFactory
 import org.springframework.stereotype.Service
 import org.springframework.transaction.annotation.Transactional
+import org.springframework.transaction.support.TransactionSynchronization
+import org.springframework.transaction.support.TransactionSynchronizationManager
 import java.time.LocalDateTime
 
 @Service
 @Transactional
 class MemberWithdrawalService(
     private val memberRepository: MemberRepository,
+    private val memberConsentRepository: MemberConsentRepository,
     private val refreshTokenUseCase: RefreshTokenUseCase,
     private val withdrawalPolicies: List<MemberWithdrawalPolicy>,
 ) : MemberWithdrawalUseCase {
@@ -33,8 +38,45 @@ class MemberWithdrawalService(
         withdrawalPolicies.forEach { it.validate(context) }
 
         member.withdraw(now)
+        memberConsentRepository.findAllByMemberId(context.memberId)
+            .forEach { it.withdraw(now) }
         refreshTokenUseCase.revokeAll(context.memberId)
 
-        withdrawalPolicies.forEach { it.apply(context) }
+        registerAfterCommit {
+            applyWithdrawalPoliciesAfterCommit(context)
+        }
     }
-}
+
+    private fun registerAfterCommit(action: () -> Unit) {
+        if (!TransactionSynchronizationManager.isSynchronizationActive()) {
+            action()
+            return
+        }
+
+        TransactionSynchronizationManager.registerSynchronization(
+            object : TransactionSynchronization {
+                override fun afterCommit() {
+                    action()
+                }
+            },
+        )
+    }
+
+    private fun applyWithdrawalPoliciesAfterCommit(context: MemberWithdrawalContext) {
+        withdrawalPolicies.forEach { policy ->
+            try {
+                policy.apply(context)
+            } catch (e: Exception) {
+                log.error(
+                    "Member withdrawal post-processing failed. memberId=${context.memberId}, policy=${policy.javaClass.name}",
+                    e,
+                )
+            }
+        }
+    }
+
+    companion object {
+        private val log = LoggerFactory.getLogger(MemberWithdrawalService::class.java)
+    }
+
+}

src/main/kotlin/com/unit/member/service/SchoolEmailVerificationService.kt

@@ -12,6 +12,7 @@ import com.unit.member.repository.SchoolEmailDomainRepository
 import com.unit.member.repository.SchoolEmailVerificationCodeRepository
 import com.unit.member.repository.SchoolRepository
 import com.unit.member.repository.UserSchoolVerificationRepository
+import com.unit.member.util.EmailEncryptor
 import com.unit.member.util.EmailHasher
 import com.unit.member.util.SchoolEmailVerificationCodeGenerator
 import com.unit.member.util.SchoolEmailVerificationFailureRecorder
@@ -22,6 +23,8 @@ import com.unit.platform.mail.EmailSender
 import com.unit.platform.mail.EmailTemplateRenderer
 import org.springframework.stereotype.Service
 import org.springframework.transaction.annotation.Transactional
+import org.springframework.transaction.support.TransactionSynchronization
+import org.springframework.transaction.support.TransactionSynchronizationManager
 import java.time.LocalDateTime
 
 @Service
@@ -38,7 +41,7 @@ class SchoolEmailVerificationService(
     private val failureRecorder: SchoolEmailVerificationFailureRecorder,
     private val emailSender: EmailSender,
     private val emailTemplateRenderer: EmailTemplateRenderer,
-
+    private val emailEncryptor: EmailEncryptor,
     ) : SchoolEmailVerificationUseCase {
 
     private val verificationExpiresInSeconds = 300L
@@ -51,6 +54,18 @@ class SchoolEmailVerificationService(
         schoolRepository.findByIdAndStatus(schoolId)
             ?: throw BusinessException(MemberErrorCode.SCHOOL_NOT_FOUND)
 
+        val hasPendingSchoolVerification =
+            userSchoolVerificationRepository.existsByMemberIdAndSchoolIdAndStatus(
+                memberId = memberId,
+                schoolId = schoolId,
+                status = UserSchoolVerificationStatus.PENDING,
+            )
+
+        if (!hasPendingSchoolVerification) {
+            throw BusinessException(MemberErrorCode.SCHOOL_VERIFICATION_NOT_FOUND)
+        }
+
+
         val email = request.email.trim().lowercase()
         val domain = extractDomain(email)
 
@@ -91,15 +106,17 @@ class SchoolEmailVerificationService(
             ),
         )
 
-        emailSender.send(
-            EmailMessage(
-                to = email,
-                subject = "[UniT] 학교 이메일 인증 코드",
-                body = html,
-                html = true,
-            ),
+        val message = EmailMessage(
+            to = email,
+            subject = "[UniT] 학교 이메일 인증 코드",
+            body = html,
+            html = true,
         )
 
+        registerAfterCommit {
+            emailSender.send(message)
+        }
+
         return SchoolEmailVerificationResponse(
             schoolId = schoolId,
             email = email,
@@ -134,27 +151,27 @@ class SchoolEmailVerificationService(
             throw BusinessException(MemberErrorCode.SCHOOL_EMAIL_VERIFICATION_CODE_EXPIRED)
         }
 
-        failureRecorder.increaseAttempt(requireNotNull(verificationCode.id))
-
         if (!tokenHasher.matches(code, verificationCode.codeHash)) {
+            failureRecorder.increaseAttempt(requireNotNull(verificationCode.id))
             throw BusinessException(MemberErrorCode.SCHOOL_EMAIL_VERIFICATION_CODE_MISMATCHED)
         }
 
-        verificationCode.verify(now)
-
         val schoolVerification = userSchoolVerificationRepository.findByMemberIdAndSchoolId(
             memberId = memberId,
             schoolId = schoolId,
         ) ?: throw BusinessException(MemberErrorCode.SCHOOL_VERIFICATION_NOT_FOUND)
 
-        schoolVerification.status = UserSchoolVerificationStatus.VERIFIED
-        schoolVerification.verifiedAt = now
-
         val member = memberRepository.findByIdAndStatusAndDeletedAtIsNull(
             id = memberId,
             status = MemberStatus.PENDING,
         ) ?: throw BusinessException(MemberErrorCode.MEMBER_LOGIN_FORBIDDEN)
 
+        verificationCode.verify(now)
+        schoolVerification.verifyByEmail(
+            now = now,
+            emailHash = emailHash,
+            emailEncrypted = emailEncryptor.encrypt(email),
+        )
         member.activate()
 
         return SchoolEmailVerificationConfirmResponse(
@@ -170,4 +187,20 @@ class SchoolEmailVerificationService(
     private fun SchoolEmailVerificationCode.memberIdEquals(memberId: Long): Boolean {
         return this.memberId == memberId
     }
-}
+
+    private fun registerAfterCommit(action: () -> Unit) {
+        if (!TransactionSynchronizationManager.isSynchronizationActive()) {
+            action()
+            return
+        }
+
+        TransactionSynchronizationManager.registerSynchronization(
+            object : TransactionSynchronization {
+                override fun afterCommit() {
+                    action()
+                }
+            },
+        )
+    }
+
+}