[#718] GitHub 인증을 서버 callback과 공통 OAuth 모델 기반으로 전환한다

Application/App/Sources/Resource/Info.plist

@@ -4,8 +4,6 @@
 <dict>
 	<key>TESTFLIGHT_URL</key>
 	<string>$(TESTFLIGHT_URL)</string>
-	<key>APP_REDIRECT_URL</key>
-	<string>$(APP_REDIRECT_URL)</string>
 	<key>CFBundleDevelopmentRegion</key>
 	<string>$(DEVELOPMENT_LANGUAGE)</string>
 	<key>CFBundleExecutable</key>
@@ -46,8 +44,6 @@
 	<string>$(FUNCTION_API_BASE_URL)</string>
 	<key>GIDClientID</key>
 	<string>$(CLIENT_ID)</string>
-	<key>GITHUB_CLIENT_ID</key>
-	<string>$(GITHUB_CLIENT_ID)</string>
 	<key>ITSAppUsesNonExemptEncryption</key>
 	<false/>
 	<key>LSApplicationCategoryType</key>

Application/Data/Sources/DTO/AuthDataResponse.swift

@@ -15,23 +15,20 @@ public struct AuthDataResponse {
     public let providers: [String]
     public let providerID: String
     public let fcmToken: String?
-    public let accessToken: String?
 
     public init(
         uid: String,
         displayName: String?,
         email: String?,
         providers: [String],
         providerID: String,
-        fcmToken: String? = nil,
-        accessToken: String? = nil
+        fcmToken: String? = nil
     ) {
         self.uid = uid
         self.displayName = displayName
         self.email = email
         self.providers = providers
         self.providerID = providerID
         self.fcmToken = fcmToken
-        self.accessToken = accessToken
     }
 }

Application/Infra/Sources/Common/InfraLayerError.swift

@@ -30,6 +30,7 @@ enum TokenError: Error {
 
 enum SocialLoginError: Error {
     case invalidOAuthState
+    case invalidOAuthCallback
     case failedToStartWebAuthenticationSession
     case authenticationAlreadyInProgress
 }

Application/Infra/Sources/Extension/FirebaseAuthUser+.swift

@@ -10,17 +10,13 @@ import FirebaseAuth
 import Data
 
 extension FirebaseAuth.User {
-    func makeResponse(
-        providerID: AuthProviderID,
-        accessToken: String? = nil
-    ) -> AuthDataResponse {
+    func makeResponse(providerID: AuthProviderID) -> AuthDataResponse {
         return AuthDataResponse(
             uid: self.uid,
             displayName: self.displayName,
             email: self.email,
             providers: self.providerData.map { $0.providerID },
-            providerID: providerID.rawValue,
-            accessToken: accessToken
+            providerID: providerID.rawValue
         )
     }
 }

Application/Infra/Sources/Service/FunctionAPIClient.swift

@@ -99,24 +99,28 @@ struct FunctionAPIEndpoint<Response: Decodable>: NXEndpoint {
     let path: String
 }
 
-struct GithubAuthenticationResponse: Decodable {
-    let accessToken: String?
-    let customToken: String?
+struct OAuthAuthenticationSessionRequest: Encodable {
+    let appChallenge: String
+}
+
+struct OAuthAuthenticationSessionResponse: Decodable {
+    let authorizationURL: URL
+}
+
+struct OAuthAuthenticationTicketRequest: Encodable {
+    let ticket: String
+    let appVerifier: String
 }
 
 struct AppleChallengeResponse: Decodable {
     let challengeId: String
     let hashedNonce: String
 }
 
-struct AppleCustomTokenResponse: Decodable {
+struct FirebaseCustomTokenResponse: Decodable {
     let customToken: String
 }
 
-struct AppleOperationResponse: Decodable {
-    let success: Bool
-}
-
 struct AppleCustomTokenRequest: Encodable {
     let challengeId: String
     let authorizationCode: String
@@ -145,6 +149,9 @@ private enum FunctionAPIErrorCode: String {
 
 enum AppleAuthenticationAPIError: Error, Equatable {
     case providerLinkConflict
+}
+
+enum AuthenticationAPIError: Error, Equatable {
     case lastProvider
 }
 
@@ -169,7 +176,7 @@ struct FunctionAPIServerErrorDecoder: NXServerErrorDecoder {
         case .appleProviderLinkConflict:
             return AppleAuthenticationAPIError.providerLinkConflict
         case .lastProvider:
-            return AppleAuthenticationAPIError.lastProvider
+            return AuthenticationAPIError.lastProvider
         }
     }
 }
@@ -193,6 +200,10 @@ extension Error {
         functionAPIUnderlyingError as? AppleAuthenticationAPIError
     }
 
+    var apiAuthenticationError: AuthenticationAPIError? {
+        functionAPIUnderlyingError as? AuthenticationAPIError
+    }
+
     private var functionAPIUnderlyingError: (any Error)? {
         guard let error = self as? NXError,
               case let .server(statusCode: _, data: _, underlying: underlying) = error else {

Application/Infra/Sources/Service/FunctionAPIEndpoint.swift

@@ -35,25 +35,31 @@ extension FunctionAPIEndpoint where Response == EmptyAPIResponse {
     }
 
     static let revokeGithubAccessToken = Self(method: .delete, path: "/auth/github/access-token")
+    static let linkGithubAccount = Self(method: .put, path: "/auth/github/account-link")
+    static let unlinkGithubAccount = Self(method: .delete, path: "/auth/github/account-link")
+    static let linkAppleAccount = Self(method: .put, path: "/auth/apple/account-link")
+    static let unlinkAppleAccount = Self(method: .delete, path: "/auth/apple/account-link")
+    static let revokeAppleAccessToken = Self(method: .delete, path: "/auth/apple/access-token")
 }
 
 extension FunctionAPIEndpoint where Response == AppleChallengeResponse {
     static let requestAppleChallenge = Self(method: .post, path: "/auth/apple/challenges")
 }
 
-extension FunctionAPIEndpoint where Response == AppleCustomTokenResponse {
+extension FunctionAPIEndpoint where Response == FirebaseCustomTokenResponse {
     static let requestAppleCustomToken = Self(method: .post, path: "/auth/apple/custom-token")
+    static let requestGithubCustomToken = Self(method: .post, path: "/auth/github/custom-token")
 }
 
-extension FunctionAPIEndpoint where Response == AppleOperationResponse {
-    static let linkAppleAccount = Self(method: .put, path: "/auth/apple/account-link")
-    static let unlinkAppleAccount = Self(method: .delete, path: "/auth/apple/account-link")
-    static let revokeAppleAccessToken = Self(method: .delete, path: "/auth/apple/access-token")
-}
-
-extension FunctionAPIEndpoint where Response == GithubAuthenticationResponse {
-    static let linkGithubProvider = Self(method: .post, path: "/auth/github/link")
-    static let requestGithubTokens = Self(method: .post, path: "/auth/github/tokens")
+extension FunctionAPIEndpoint where Response == OAuthAuthenticationSessionResponse {
+    static let requestGithubSignInSession = Self(
+        method: .post,
+        path: "/auth/github/sign-in-sessions"
+    )
+    static let requestGithubAccountLinkSession = Self(
+        method: .post,
+        path: "/auth/github/account-link-sessions"
+    )
 }
 
 private func functionAPIPathSegment(_ value: String) -> String {

Application/Infra/Sources/Service/SocialLogin/AppleAuthenticationServiceImpl.swift

@@ -110,8 +110,7 @@ final class AppleAuthenticationServiceImpl: AuthenticationService {
     func deleteAuth(_ uid: String) async throws {
         do {
             logger.info("Deleting Apple grant for user: \(uid)")
-            let response = try await FunctionAPIClient.shared.send(.revokeAppleAccessToken)
-            try validate(response)
+            try await FunctionAPIClient.shared.send(.revokeAppleAccessToken)
         } catch {
             logger.error("Failed to delete Apple auth", error: error)
             record(error, code: .deleteAuth)
@@ -125,15 +124,14 @@ final class AppleAuthenticationServiceImpl: AuthenticationService {
             let challenge = try await requestAppleChallenge()
             let response = try await authenticateWithAppleAsync(hashedNonce: challenge.hashedNonce)
 
-            let operation = try await FunctionAPIClient.shared.send(
+            try await FunctionAPIClient.shared.send(
                 .linkAppleAccount,
                 payload: AppleAccountLinkRequest(
                     challengeId: challenge.challengeId,
                     authorizationCode: response.authorizationCode,
                     credentialEmail: response.email
                 )
             )
-            try validate(operation)
             try await user?.reload()
             return true
         } catch {
@@ -149,8 +147,7 @@ final class AppleAuthenticationServiceImpl: AuthenticationService {
     func unlink(_ uid: String) async throws {
         do {
             logger.info("Unlinking Apple account for user: \(uid)")
-            let response = try await FunctionAPIClient.shared.send(.unlinkAppleAccount)
-            try validate(response)
+            try await FunctionAPIClient.shared.send(.unlinkAppleAccount)
             try await user?.reload()
         } catch {
             let mappedError = mapAppleAPIError(error)
@@ -243,22 +240,18 @@ final class AppleAuthenticationServiceImpl: AuthenticationService {
 }
 
 private extension AppleAuthenticationServiceImpl {
-    func validate(_ response: AppleOperationResponse) throws {
-        guard response.success else {
-            throw TokenError.invalidResponse
-        }
-    }
-
     func mapAppleAPIError(_ error: Error) -> Error {
         if let emailError = error.apiEmailError {
             return emailError
         }
 
+        if error.apiAuthenticationError == .lastProvider {
+            return DataLayerError.failedToUnlinkLastProvider
+        }
+
         switch error.apiAppleAuthenticationError {
         case .providerLinkConflict:
             return DataLayerError.linkCredentialAlreadyInUse
-        case .lastProvider:
-            return DataLayerError.failedToUnlinkLastProvider
         case .none:
             return error
         }