사용자 인증 토큰 스키마 안정화

[Seongwonp]

No description provided.

[Copilot]

Pull request overview

This PR stabilizes the authentication token schema by aligning Flyway-managed database tables with the current JPA token entities, and hardens password-reset behavior to avoid leaking account existence.

Changes:

• Add Flyway migrations (V3/V4) to reconcile legacy token columns (token, expires_at, used) with current entity columns (token_value, expiry_date, is_*), preserving data where possible.
• Update PasswordResetService behavior for unknown emails and wrap password reset operations in transactions; add unit tests for reset flows.
• Add stabilization documentation and link it from the README.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/main/java/com/honeyrest/honeyrest_user/service/PasswordResetService.java	Makes password-reset requests non-enumerable and adds transactional boundaries around reset flows.
src/test/java/com/honeyrest/honeyrest_user/service/PasswordResetServiceTest.java	Adds unit coverage for reset request, token expiry handling, and password update/token consumption.
src/main/resources/db/migration/V3__align_email_verification_token.sql	Introduces schema alignment migration for email verification tokens.
src/main/resources/db/migration/V4__align_auth_token_tables.sql	Introduces schema alignment migration for refresh/password-reset token tables.
README.md	Adds a link to the stabilization notes.
docs/STABILIZATION.md	Documents stabilization steps and verification results for the token schema changes.

Suppressed comments (3)

src/main/resources/db/migration/V3__align_email_verification_token.sql:33

• When expiry_date already exists, the migration drops legacy expires_at without backfilling. If existing rows only have expires_at populated (common when Hibernate added new columns), dropping it can wipe token expiry data and later cause NPEs in token validation. Backfill expiry_date from expires_at before dropping, and then enforce NOT NULL.

SET @sql = IF(
    @has_expiry_date = 0,
    'ALTER TABLE `email_verification_token` CHANGE COLUMN `expires_at` `expiry_date` DATETIME(6) NOT NULL',
    'ALTER TABLE `email_verification_token` DROP COLUMN `expires_at`'
);

src/main/resources/db/migration/V3__align_email_verification_token.sql:48

• When is_verified already exists, the migration drops legacy used without backfilling. If existing rows still only have data in used, dropping it can lose verification state. Backfill is_verified from used first, then drop, and ensure the column is NOT NULL with a default.

SET @sql = IF(
    @has_is_verified = 0,
    'ALTER TABLE `email_verification_token` CHANGE COLUMN `used` `is_verified` BIT(1) NOT NULL DEFAULT 0',
    'ALTER TABLE `email_verification_token` DROP COLUMN `used`'
);

src/main/resources/db/migration/V4__align_auth_token_tables.sql:102

• password_reset_token.expiry_date and is_used are left nullable. PasswordResetService.resetPassword() calls token.getExpiryDate().isBefore(...), so a NULL expiry_date will throw at runtime. After backfilling from legacy columns, enforce expiry_date as NOT NULL and make is_used NOT NULL DEFAULT 0 (and normalize any remaining NULLs).

ALTER TABLE `password_reset_token`
    MODIFY COLUMN `expires_at` DATETIME(6) NULL,
    MODIFY COLUMN `used` BIT(1) NULL;

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.