diff --git a/src/main/java/com/devpick/domain/user/service/TokenService.java b/src/main/java/com/devpick/domain/user/service/TokenService.java index b2788c21..11b0d6e6 100644 --- a/src/main/java/com/devpick/domain/user/service/TokenService.java +++ b/src/main/java/com/devpick/domain/user/service/TokenService.java @@ -91,19 +91,10 @@ public String[] reissueTokens(String refreshToken) { User user = stored.getUser(); - // 4. 기존 토큰 삭제 + 신규 토큰 발급 (Token Rotation) - refreshTokenRepository.deleteByUser(user); - + // 4. Access Token만 새로 발급, Refresh Token은 유지 (레이스 컨디션 방지) String newAccessToken = jwtTokenProvider.generateAccessToken(user.getId()); - String newRefreshToken = jwtTokenProvider.generateRefreshToken(); - - refreshTokenRepository.save(RefreshToken.builder() - .user(user) - .token(newRefreshToken) - .expiresAt(jwtTokenProvider.getRefreshTokenExpiresAt()) - .build()); - return new String[]{newAccessToken, newRefreshToken}; + return new String[]{newAccessToken, refreshToken}; } /** diff --git a/src/test/java/com/devpick/domain/user/service/TokenServiceTest.java b/src/test/java/com/devpick/domain/user/service/TokenServiceTest.java index e659acc7..25624bf3 100644 --- a/src/test/java/com/devpick/domain/user/service/TokenServiceTest.java +++ b/src/test/java/com/devpick/domain/user/service/TokenServiceTest.java @@ -24,6 +24,7 @@ import static org.assertj.core.api.Assertions.assertThatThrownBy; import static org.mockito.ArgumentMatchers.any; import static org.mockito.BDDMockito.given; +import static org.mockito.Mockito.never; import static org.mockito.Mockito.verify; @ExtendWith(MockitoExtension.class) @@ -84,18 +85,13 @@ void reissueTokens_success() throws Exception { .willReturn(Optional.of(stored)); given(jwtTokenProvider.generateAccessToken(user.getId())) .willReturn("new-access-token"); - given(jwtTokenProvider.generateRefreshToken()) - .willReturn("new-refresh-token"); - given(jwtTokenProvider.getRefreshTokenExpiresAt()) - .willReturn(LocalDateTime.now().plusDays(7)); - given(refreshTokenRepository.save(any(RefreshToken.class))) - .willAnswer(invocation -> invocation.getArgument(0)); String[] tokens = tokenService.reissueTokens("old-refresh-token"); assertThat(tokens[0]).isEqualTo("new-access-token"); - assertThat(tokens[1]).isEqualTo("new-refresh-token"); - verify(refreshTokenRepository).deleteByUser(user); + assertThat(tokens[1]).isEqualTo("old-refresh-token"); + verify(refreshTokenRepository, never()).deleteByUser(any()); + verify(refreshTokenRepository, never()).save(any()); } @Test