[FLYW-210] 번호인증 구현

src/main/java/com/flyway/auth/service/SignUpServiceImpl.java

@@ -5,6 +5,7 @@
 import com.flyway.auth.domain.KakaoUserInfo;
 import com.flyway.auth.dto.EmailSignUpRequest;
 import com.flyway.auth.repository.SignUpAttemptRepository;
+import com.flyway.sender.service.SmsVerificationService;
 import com.flyway.template.exception.BusinessException;
 import com.flyway.template.exception.ErrorCode;
 import com.flyway.user.domain.User;
@@ -30,13 +31,19 @@ public class SignUpServiceImpl implements SignUpService {
     private final UserProfileRepository userProfileRepository;
     private final SignUpAttemptRepository signUpAttemptRepository;
     private final PasswordEncoder passwordEncoder;
+    private final SmsVerificationService smsVerificationService;
 
     @Override
     @Transactional
     public void signUp(EmailSignUpRequest request) {
         validateRequest(request);
         LocalDateTime now = LocalDateTime.now();
 
+        // SMS 인증 확인
+        if (!smsVerificationService.isVerified(request.getPhoneNumber())) {
+            throw new BusinessException(ErrorCode.USER_PHONE_NOT_VERIFIED);
+        }
+
         int validAttempt = signUpAttemptRepository.consumeIfVerified(request.getAttemptId(), request.getEmail(), now);
         if (validAttempt != 1) {
             throw new BusinessException(ErrorCode.USER_INVALID_SIGN_UP_ATTEMPT);
@@ -70,6 +77,7 @@ public void signUp(EmailSignUpRequest request) {
 
         userRepository.save(user);
 
+
         // UserIdentity 생성
         UserIdentity identity = UserIdentity.builder()
                 .userIdentityId(UUID.randomUUID().toString())
@@ -124,14 +132,12 @@ public User signUpKakaoUser(KakaoUserInfo userInfo) {
                 .build();
 
         userIdentityRepository.save(identity);
-
         UserProfile profile = UserProfile.builder()
                 .userId(userId)
                 .name(nickname)
+                .phoneNumber("")
                 .build();
-
         userProfileRepository.createProfile(profile);
-
         return user;
     }
 
@@ -155,6 +161,10 @@ public void completeOauthSignUp(String userId, EmailSignUpRequest request) {
 
         userRepository.updateStatus(userId, AuthStatus.ACTIVE);
 
+        if (!smsVerificationService.isVerified(request.getPhoneNumber())) {
+            throw new BusinessException(ErrorCode.USER_PHONE_NOT_VERIFIED);
+        }
+
         UserProfile profile = UserProfile.builder()
                 .userId(userId)
                 .name(request.getName())

src/main/java/com/flyway/security/config/SecurityConfigApi.java

@@ -72,7 +72,8 @@ protected void configure(HttpSecurity http) throws Exception {
                 // 비회원 허용 API
                 .antMatchers(
                         "/api/auth/**",
-                        "/api/public/**"
+                        "/api/public/**",
+                        "/api/sms/**"
                 ).permitAll()
 
                 .anyRequest().authenticated()

src/main/java/com/flyway/security/config/SecurityConfigWeb.java

@@ -32,7 +32,7 @@ public class SecurityConfigWeb extends WebSecurityConfigurerAdapter {
 
     private static final String[] PUBLIC_ENDPOINTS = {
             "/", "/login", "/loginProc", "/signup", "/auth/**", "/search/**",
-            "/payments/success", "/payments/fail", "/payments/complete" //결제 콜백
+            "/payments/success", "/payments/fail", "/payments/complete", "/api/sms/**"
     };
 
     private final JwtProvider jwtProvider;

src/main/java/com/flyway/security/filter/OnboardingAccessFilter.java

@@ -24,7 +24,8 @@ public class OnboardingAccessFilter extends OncePerRequestFilter {
             "/favicon.ico",
             "/error",
             "/api/auth/",
-            "/api/public/"
+            "/api/public/",
+            "/api/sms/"
     };
 
     @Override

src/main/java/com/flyway/security/jwt/JwtApiAuthFilter.java

@@ -42,7 +42,8 @@ protected boolean shouldNotFilter(@NonNull HttpServletRequest request) {
         }
 
         return path.startsWith("/api/public/")
-                || path.startsWith("/api/auth/");
+                || path.startsWith("/api/auth/")
+                || path.startsWith("/api/sms/");
     }
 
     @Override

src/main/java/com/flyway/security/jwt/JwtWebAuthFilter.java

@@ -35,7 +35,9 @@ public class JwtWebAuthFilter extends OncePerRequestFilter {
 
     @Override
     protected boolean shouldNotFilter(HttpServletRequest request) {
-        return resolvePath(request).startsWith(ADMIN_PREFIX);
+        String path = resolvePath(request);
+        return path.startsWith(ADMIN_PREFIX)
+                || path.startsWith("/api/");
     }
 
     @Override

src/main/java/com/flyway/sender/controller/SmsVerificationApiController.java

@@ -0,0 +1,35 @@
+package com.flyway.sender.controller;
+
+import com.flyway.sender.service.SmsVerificationService;
+import com.flyway.template.common.ApiResponse;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+@RestController
+@RequestMapping("/api/sms")
+@RequiredArgsConstructor
+public class SmsVerificationApiController {
+
+    private final SmsVerificationService service;
+
+    @PostMapping("/send")
+    public ResponseEntity<ApiResponse<Void>> send(@RequestParam String phoneNumber) {
+        try {
+            service.sendCode(phoneNumber);
+            return ResponseEntity.ok(ApiResponse.success(null, "인증번호가 발송되었습니다."));
+        } catch (Exception e) {
+            return ResponseEntity.badRequest()
+                    .body(ApiResponse.error("FAIL", e.getMessage()));
+        }
+    }
+
+    @PostMapping("/verify")
+    public ResponseEntity<ApiResponse<Boolean>> verify(
+            @RequestParam String phoneNumber,
+            @RequestParam String code) {
+        boolean ok = service.verify(phoneNumber, code);
+        String msg = ok ? "인증되었습니다." : "인증번호가 일치하지 않습니다.";
+        return ResponseEntity.ok(ApiResponse.success(ok, msg));
+    }
+}

src/main/java/com/flyway/sender/domain/SmsVerification.java

@@ -0,0 +1,19 @@
+package com.flyway.sender.domain;
+
+import lombok.*;
+import java.time.LocalDateTime;
+
+@Getter
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class SmsVerification {
+
+    private String smsVerificationId;
+    private String phoneNumber;
+    private String code;
+    private LocalDateTime expiresAt;
+    private LocalDateTime verifiedAt;
+    private LocalDateTime createdAt;
+
+}

src/main/java/com/flyway/sender/dto/PassengerTicketInfo.java

@@ -12,7 +12,6 @@ public class PassengerTicketInfo {
     private String passengerId;
     private String firstName;
     private String lastName;
-    private String phoneNumber;
 
     // 구간 정보
     private String reservationSegmentId;

src/main/java/com/flyway/sender/mapper/SmsVerificationMapper.java

@@ -0,0 +1,23 @@
+package com.flyway.sender.mapper;
+
+import com.flyway.sender.domain.SmsVerification;
+import org.apache.ibatis.annotations.Mapper;
+import org.apache.ibatis.annotations.Param;
+import java.time.LocalDateTime;
+
+@Mapper
+public interface SmsVerificationMapper {
+    void insert(SmsVerification verification);
+
+    SmsVerification findLatestByPhone(@Param("phoneNumber") String phoneNumber);
+
+    int markVerified(@Param("smsVerificationId") String id,
+                     @Param("verifiedAt") LocalDateTime verifiedAt);
+
+    int countRecentByPhone(@Param("phoneNumber") String phoneNumber,
+                           @Param("since") LocalDateTime since);
+
+    // 인증 완료 여부 확인 (5분 내)
+    int existsVerifiedPhone(@Param("phoneNumber") String phoneNumber,
+                            @Param("since") LocalDateTime since);
+}

src/main/java/com/flyway/sender/service/SmsService.java

@@ -79,14 +79,21 @@ public void sendRefundComplete(String to, String reservationId, Long amount) {
         sendSms(to, content);
     }
 
-    // 탑승객에게 티켓 정보 SMS 발송 (reservationId만 받음)
+    // 탑승객 티켓 정보를 예약자(회원) 번호로 SMS 발송
     public void sendTicketInfoToPassengers(String reservationId) {
 
-        // 항공편 정보 조회
+        // 1. 예약자(회원)의 전화번호 조회
+        String userPhone = smsMapper.selectPhoneByReservationId(reservationId);
+        if (userPhone == null || userPhone.isEmpty()) {
+            log.info("[SMS] 티켓 발송 실패 - 회원 전화번호 없음, reservationId: {}", reservationId);
+            return;
+        }
+
+        // 2. 항공편 정보 조회
         List<ReservationSegmentView> segments =
                 reservationBookingRepository.findSegments(reservationId);
 
-        // 탑승객별 티켓 정보 조회 (좌석/기내식/수하물 포함)
+        // 3. 탑승객별 티켓 정보 조회 (좌석/기내식/수하물 포함)
         List<PassengerTicketInfo> ticketInfoList =
                 smsMapper.selectPassengerTicketInfo(reservationId);
 
@@ -95,19 +102,20 @@ public void sendTicketInfoToPassengers(String reservationId) {
             return;
         }
 
-        // passengerId별로 그룹핑
+        // 4. passengerId별로 그룹핑
         Map<String, List<PassengerTicketInfo>> passengerMap = ticketInfoList.stream()
                 .collect(Collectors.groupingBy(PassengerTicketInfo::getPassengerId));
 
+        // 5. 각 탑승객 정보를 회원 번호로 발송
         for (Map.Entry<String, List<PassengerTicketInfo>> entry : passengerMap.entrySet()) {
             List<PassengerTicketInfo> paxInfoList = entry.getValue();
             PassengerTicketInfo firstInfo = paxInfoList.get(0);
 
             try {
                 String content = buildTicketSmsContent(firstInfo, segments, paxInfoList);
-                sendSms(firstInfo.getPhoneNumber(), content);
-                log.info("[SMS] 티켓 발송 - passenger: {} {}, phone: {}",
-                        firstInfo.getFirstName(), firstInfo.getLastName(), firstInfo.getPhoneNumber());
+                sendSms(userPhone, content);  // 회원 번호로 발송
+                log.info("[SMS] 티켓 발송 - passenger: {} {}, to userPhone: {}",
+                        firstInfo.getFirstName(), firstInfo.getLastName(), userPhone);
             } catch (Exception e) {
                 log.error("[SMS] 티켓 발송 실패 - passengerId: {}, error: {}",
                         firstInfo.getPassengerId(), e.getMessage());

src/main/java/com/flyway/sender/service/SmsVerificationService.java

@@ -0,0 +1,59 @@
+package com.flyway.sender.service;
+
+import com.flyway.sender.domain.SmsVerification;
+import com.flyway.sender.mapper.SmsVerificationMapper;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.time.LocalDateTime;
+import java.util.Random;
+import java.util.UUID;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class SmsVerificationService {
+
+    private final SmsVerificationMapper mapper;
+    private final SmsService smsService;
+
+    @Transactional
+    public void sendCode(String phoneNumber) {
+        // 5분 내 3회 제한
+        int count = mapper.countRecentByPhone(phoneNumber, LocalDateTime.now().minusMinutes(5));
+        if (count >= 3) {
+            throw new RuntimeException("잠시 후 다시 시도해주세요.");
+        }
+
+        String code = String.format("%06d", new Random().nextInt(1000000));
+
+        SmsVerification v = SmsVerification.builder()
+                .smsVerificationId(UUID.randomUUID().toString())
+                .phoneNumber(phoneNumber)
+                .code(code)
+                .expiresAt(LocalDateTime.now().plusMinutes(3))
+                .build();
+        mapper.insert(v);
+
+        smsService.sendSms(phoneNumber, "[Flyway] 인증번호 [" + code + "]");
+        log.info("[SMS] 인증코드 발송 - {}", phoneNumber.substring(0, 3) + "****");
+    }
+
+    @Transactional
+    public boolean verify(String phoneNumber, String code) {
+        SmsVerification v = mapper.findLatestByPhone(phoneNumber);
+        if (v == null) return false;
+        if (v.getExpiresAt().isBefore(LocalDateTime.now())) return false;
+        if (!v.getCode().equals(code)) return false;
+
+        mapper.markVerified(v.getSmsVerificationId(), LocalDateTime.now());
+        return true;
+    }
+
+    // 회원가입 시 인증 완료 여부 확인 (10분 내 인증 완료된 번호인지)
+    public boolean isVerified(String phoneNumber) {
+        return mapper.existsVerifiedPhone(phoneNumber, LocalDateTime.now().minusMinutes(10)) > 0;
+    }
+}

src/main/java/com/flyway/template/exception/ErrorCode.java

@@ -29,6 +29,7 @@ public enum ErrorCode {
 	USER_PASSWORD_ENCODE_ERROR(500, "U006", "비밀번호 처리 중 오류가 발생했습니다."),
 	USER_DB_ERROR(500, "U007", "회원 정보 저장 중 오류가 발생했습니다."),
 	USER_INVALID_SIGN_UP_ATTEMPT(400, "U008", "유효하지 않은 회원가입 요청입니다."),
+    USER_PHONE_NOT_VERIFIED(400, "U012", "전화번호 인증이 필요합니다."),
 	USER_ALREADY_WITHDRAWN(409, "U009", "이미 탈퇴 처리된 사용자입니다."),
 	USER_NOT_WITHDRAWN(409, "U010", "탈퇴 처리된 사용자만 익명화할 수 있습니다."),
 	USER_NOT_FOUND(404, "U011", "사용자를 찾을 수 없습니다."),

src/main/resources/db/migration/V21__create_sms_verification_table.sql

@@ -0,0 +1,10 @@
+CREATE TABLE sms_verification (
+                                  sms_verification_id CHAR(36) NOT NULL,
+                                  phone_number VARCHAR(20) NOT NULL,
+                                  code VARCHAR(6) NOT NULL,
+                                  expires_at DATETIME NOT NULL,
+                                  verified_at DATETIME NULL,
+                                  created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+                                  PRIMARY KEY (sms_verification_id),
+                                  INDEX idx_sms_phone (phone_number, created_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

src/main/resources/mapper/sender/SmsMapper.xml

@@ -31,13 +31,13 @@
           AND phone_number != ''
     </select>
     <!-- 탑승객별 티켓 정보 (좌석/기내식/수하물 ) -->
+    <!-- 탑승객별 티켓 정보 (좌석/기내식/수하물 ) -->
     <select id="selectPassengerTicketInfo"
             resultType="com.flyway.sender.dto.PassengerTicketInfo">
         SELECT
             p.passenger_id              AS passengerId,
             p.first_name                AS firstName,
             p.last_name                 AS lastName,
-            p.phone_number              AS phoneNumber,
             rs.reservation_segment_id   AS reservationSegmentId,
             rs.segment_order            AS segmentOrder,
             acs.seat_no                 AS seatNo,
@@ -60,8 +60,6 @@
                  LEFT JOIN meal_option mo
                            ON mo.meal_id = ps.meal_id
         WHERE p.reservation_id = #{reservationId}
-          AND p.phone_number IS NOT NULL
-          AND p.phone_number != ''
         ORDER BY p.passenger_id, rs.segment_order, ps.added_at
     </select>
 

src/main/resources/mapper/sender/SmsVerificationMapper.xml

@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8"?>
+  <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
+          "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
+
+  <mapper namespace="com.flyway.sender.mapper.SmsVerificationMapper">
+
+      <insert id="insert">
+          INSERT INTO sms_verification
+          (sms_verification_id, phone_number, code, expires_at, created_at)
+          VALUES (#{smsVerificationId}, #{phoneNumber}, #{code}, #{expiresAt}, NOW())
+      </insert>
+
+      <select id="findLatestByPhone" resultType="com.flyway.sender.domain.SmsVerification">
+          SELECT sms_verification_id AS smsVerificationId,
+                 phone_number AS phoneNumber, code,
+                 expires_at AS expiresAt, verified_at AS verifiedAt
+          FROM sms_verification
+          WHERE phone_number = #{phoneNumber} AND verified_at IS NULL
+          ORDER BY created_at DESC LIMIT 1
+      </select>
+
+      <update id="markVerified">
+          UPDATE sms_verification SET verified_at = #{verifiedAt}
+          WHERE sms_verification_id = #{smsVerificationId} AND verified_at IS NULL
+      </update>
+
+      <select id="countRecentByPhone" resultType="int">
+          SELECT COUNT(*) FROM sms_verification
+          WHERE phone_number = #{phoneNumber} AND created_at >= #{since}
+      </select>
+
+      <select id="existsVerifiedPhone" resultType="int">
+          SELECT COUNT(*) FROM sms_verification
+          WHERE phone_number = #{phoneNumber}
+            AND verified_at IS NOT NULL
+            AND verified_at >= #{since}
+      </select>
+
+  </mapper>