[Refactor/signup token version] - Signup Token Version사용

build.gradle

@@ -4,6 +4,8 @@ plugins {
     id 'io.spring.dependency-management' version '1.1.7'
     id "org.sonarqube" version "6.2.0.5505"
     id 'jacoco'
+    id 'org.flywaydb.flyway' version '11.10.0'
+
 }
 
 group = 'org.Runimo'
@@ -44,6 +46,8 @@ dependencies {
 
     runtimeOnly 'com.h2database:h2'
     runtimeOnly 'com.mysql:mysql-connector-j'
+    implementation 'org.flywaydb:flyway-core'
+    implementation 'org.flywaydb:flyway-mysql'
 
 
     testImplementation 'io.rest-assured:rest-assured:5.4.0'

src/main/java/org/runimo/runimo/auth/domain/SignupToken.java

@@ -6,11 +6,14 @@
 import jakarta.persistence.Enumerated;
 import jakarta.persistence.Id;
 import jakarta.persistence.Table;
+import jakarta.persistence.Version;
 import lombok.Builder;
 import lombok.Getter;
 import lombok.NoArgsConstructor;
+import org.runimo.runimo.auth.exceptions.SignUpException;
 import org.runimo.runimo.common.CreatedAuditEntity;
 import org.runimo.runimo.user.domain.SocialProvider;
+import org.runimo.runimo.user.enums.UserHttpResponseCode;
 
 @Table(name = "signup_token")
 @Entity
@@ -32,6 +35,13 @@ public class SignupToken extends CreatedAuditEntity {
     @Enumerated(EnumType.STRING)
     private SocialProvider socialProvider;
 
+    @Version
+    @Column(name = "version")
+    private Long version;
+
+    @Column(name = "used", nullable = false)
+    private Boolean used = false;
+
     @Builder
     public SignupToken(String token, String providerId, String refreshToken,
         SocialProvider socialProvider) {
@@ -40,4 +50,11 @@ public SignupToken(String token, String providerId, String refreshToken,
         this.refreshToken = refreshToken;
         this.socialProvider = socialProvider;
     }
+
+    public void markAsUsed() {
+        if (this.used) {
+            throw new SignUpException(UserHttpResponseCode.SIGNIN_FAIL_ALREADY_EXIST);
+        }
+        this.used = true;
+    }
 }

src/main/java/org/runimo/runimo/auth/repository/SignupTokenRepository.java

@@ -9,7 +9,9 @@
 public interface SignupTokenRepository extends JpaRepository<SignupToken, String> {
 
     @Query(
-        "SELECT st FROM SignupToken st WHERE st.token = :token AND st.createdAt > :createdAtAfter"
+        "SELECT st FROM SignupToken st WHERE st.token = :token "
+            + "AND st.createdAt > :createdAtAfter "
+            + "AND st.used = false"
     )
     Optional<SignupToken> findByIdAndCreatedAtAfter(String token, LocalDateTime createdAtAfter);
 

src/main/java/org/runimo/runimo/auth/service/SignUpUsecaseImpl.java

@@ -57,15 +57,11 @@ public SignupUserResponse register(UserSignupCommand command) {
         Egg grantedEgg = eggGrantService.grantGreetingEggToUser(savedUser);
         EggType eggType = grantedEgg.getEggType();
 
-        removeSignupToken(payload.token());
+        signupToken.markAsUsed();
         return new SignupUserResponse(savedUser, jwtTokenFactory.generateTokenPair(savedUser),
             grantedEgg, eggType.getCode());
     }
 
-    private void removeSignupToken(String token) {
-        signupTokenRepository.deleteByToken(token);
-    }
-
     private SignupToken findUnExpiredSignupToken(String token) {
         LocalDateTime cutOffTime = LocalDateTime.now().minusMinutes(REGISTER_CUTOFF_MIN);
         return signupTokenRepository.

src/main/resources/db/migration/V1__Create_baseline.sql

@@ -0,0 +1,27 @@
+-- V1__Create_baseline.sql
+-- Production baseline - existing schema as of 2025-06-24
+-- This migration represents the current state of the production database
+-- All existing tables are already present, this is just a baseline marker
+
+-- Flyway baseline marker for existing production database
+-- No actual schema changes in this file as tables already exist
+
+-- Existing tables:
+-- - users
+-- - user_token
+-- - user_love_point
+-- - oauth_account
+-- - apple_user_token
+-- - signup_token
+-- - running_record
+-- - item
+-- - egg_type
+-- - item_activity
+-- - user_item
+-- - incubating_egg
+-- - runimo_definition
+-- - runimo
+-- - user_refresh_token
+
+-- This baseline allows us to start versioned migrations from V2 onwards
+SELECT 'Baseline migration - existing schema marked as V1' as message;

src/main/resources/db/migration/V20250702__add_version_column_signup_token.sql

@@ -0,0 +1,10 @@
+ALTER TABLE `signup_token`
+    ADD COLUMN `version` BIGINT NOT NULL DEFAULT 0;
+
+ALTER TABLE `signup_token`
+    ADD COLUMN `used` BOOLEAN NOT NULL DEFAULT FALSE;
+
+-- 기존 토큰들은 사용되지 않은 것으로 처리
+UPDATE `signup_token`
+SET `used`    = FALSE,
+    `version` = 0;

src/test/java/org/runimo/runimo/auth/controller/AuthAcceptanceTest.java

@@ -153,7 +153,8 @@ void tearDown() {
     }
 
     @Test
-    void 중복_유저_회원가입_409응답() throws JsonProcessingException {
+    @DisplayName("중복된 유저를 회원가입 시도하면 401응답 - 동일한 토큰")
+    void 중복_유저_회원가입_401응답() throws JsonProcessingException {
         AuthSignupRequest request = new AuthSignupRequest(token, "username", Gender.UNKNOWN);
 
         given()
@@ -176,6 +177,44 @@ void tearDown() {
         );
         token = jwtTokenFactory.generateSignupTemporalToken("provider-id", SocialProvider.KAKAO,
             "valid-token");
+        request = new AuthSignupRequest(token, "username", Gender.UNKNOWN);
+
+        given()
+            .contentType(ContentType.MULTIPART)
+            .multiPart("request", objectMapper.writeValueAsString(request))
+            .when()
+            .post("/api/v1/auth/signup")
+            .then()
+            .statusCode(HttpStatus.UNAUTHORIZED.value());
+
+        signupTokenRepository.delete(signupToken);
+    }
+
+    @Test
+    @DisplayName("중복된 유저를 회원가입 시도하면 409응답 - 동일한 토큰")
+    void 중복_유저_회원가입_409응답_다른토큰() throws JsonProcessingException {
+        AuthSignupRequest request = new AuthSignupRequest(token, "username", Gender.UNKNOWN);
+
+        given()
+            .contentType(ContentType.MULTIPART)
+            .multiPart("request", objectMapper.writeValueAsString(request))
+            .when()
+            .post("/api/v1/auth/signup")
+            .then()
+            .statusCode(HttpStatus.CREATED.value())
+            .log().all()
+            .body("payload.nickname", equalTo("username"))
+            .body("payload.token_pair.access_token", notNullValue())
+            .body("payload.token_pair.refresh_token", notNullValue());
+
+        SignupToken signupToken = new SignupToken(
+            "valid-token-2",
+            "provider-id",
+            "refresh-token",
+            SocialProvider.KAKAO
+        );
+        token = jwtTokenFactory.generateSignupTemporalToken("provider-id", SocialProvider.KAKAO,
+            "valid-token-2");
         signupTokenRepository.save(signupToken);
         request = new AuthSignupRequest(token, "username", Gender.UNKNOWN);
 

src/test/resources/application.yml

@@ -25,18 +25,26 @@ spring:
     url: jdbc:h2:mem:testdb;MODE=MYSQL;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE
     username: ${DB_USERNAME}
     password: ${DB_PASSWORD}
+
+  flyway:
+    enabled: true
+    locations: classpath:db/migration/h2
+    baseline-on-migrate: true
+    clean-disabled: false
+
   jpa:
     hibernate:
       ddl-auto: none
     open-in-view: false
     show-sql: true
-    defer-datasource-initialization: true
+    defer-datasource-initialization: false
+
   jackson:
     property-naming-strategy: SNAKE_CASE
 
   sql:
     init:
-      mode: always
+      mode: never
       schema-locations: classpath*:sql/schema.sql
       data-locations: