세션 종료 시 Hydra 토큰 세션도 함께 무효화

backend/internal/handler/auth_handler_sessions_test.go

@@ -3,7 +3,9 @@ package handler
 import (
 	"baron-sso-backend/internal/domain"
 	"baron-sso-backend/internal/service"
+	"context"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -102,23 +104,40 @@ func TestListMySessions_Success(t *testing.T) {
 }
 
 func TestDeleteMySession_Success(t *testing.T) {
-	setDefaultHTTPClientForTest(t, roundTripFunc(func(r *http.Request) (*http.Response, error) {
-		if r.URL.Path == "/sessions/whoami" {
-			return httpJSONAny(r, http.StatusOK, map[string]any{
-				"id":               "current-sid",
-				"authenticated_at": time.Now().UTC().Format(time.RFC3339),
-				"identity": map[string]any{
-					"id": "user-123",
-					"traits": map[string]any{
-						"email": "user@example.com",
-						"name":  "User",
-						"role":  "user",
+	t.Setenv("KRATOS_PUBLIC_URL", "http://kratos.test")
+	var hydraRevokeCalls int
+	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		switch r.URL.Host {
+		case "kratos.test":
+			if r.URL.Path == "/sessions/whoami" {
+				return httpJSONAny(r, http.StatusOK, map[string]any{
+					"id":               "current-sid",
+					"authenticated_at": time.Now().UTC().Format(time.RFC3339),
+					"identity": map[string]any{
+						"id": "user-123",
+						"traits": map[string]any{
+							"email": "user@example.com",
+							"name":  "User",
+							"role":  "user",
+						},
 					},
-				},
-			}), nil
+				}), nil
+			}
+		case "hydra.test":
+			if r.Method == http.MethodDelete && r.URL.Path == "/oauth2/auth/sessions/consent" {
+				if r.URL.Query().Get("subject") != "user-123" {
+					t.Fatalf("unexpected revoke subject: %s", r.URL.Query().Get("subject"))
+				}
+				if r.URL.Query().Get("client") != "devfront" {
+					t.Fatalf("unexpected revoke client: %s", r.URL.Query().Get("client"))
+				}
+				hydraRevokeCalls++
+				return httpResponse(r, http.StatusNoContent, ""), nil
+			}
 		}
 		return httpResponse(r, http.StatusNotFound, "not found"), nil
-	}))
+	})}
+	setDefaultHTTPClientForTest(t, client.Transport)
 
 	mockKratos := new(MockKratosAdminService)
 	mockKratos.On("ListIdentitySessions", mock.Anything, "user-123").Return([]service.KratosSession{
@@ -134,7 +153,17 @@ func TestDeleteMySession_Success(t *testing.T) {
 	h := &AuthHandler{
 		KratosAdmin: mockKratos,
 		AuditRepo:   auditRepo,
+		Hydra: &service.HydraAdminService{
+			AdminURL:   "http://hydra.test",
+			HTTPClient: client,
+		},
 	}
+	auditRepo.logs = append(auditRepo.logs, domain.AuditLog{
+		UserID:    "user-123",
+		EventType: "POST /api/v1/auth/oidc/login/accept",
+		SessionID: "target-sid",
+		Details:   `{"client_id":"devfront","client_name":"Devfront"}`,
+	})
 
 	app := fiber.New()
 	app.Delete("/api/v1/user/sessions/:id", h.DeleteMySession)
@@ -146,12 +175,56 @@ func TestDeleteMySession_Success(t *testing.T) {
 	resp, err := app.Test(req, -1)
 	assert.NoError(t, err)
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
-	if assert.Len(t, auditRepo.logs, 1) {
-		assert.Equal(t, "session.revoked", auditRepo.logs[0].EventType)
-		assert.Equal(t, "user-123", auditRepo.logs[0].UserID)
-		assert.Equal(t, "current-sid", auditRepo.logs[0].SessionID)
-		assert.Contains(t, auditRepo.logs[0].Details, "target-sid")
+	if assert.Len(t, auditRepo.logs, 2) {
+		assert.Equal(t, "session.revoked", auditRepo.logs[len(auditRepo.logs)-1].EventType)
+		assert.Equal(t, "user-123", auditRepo.logs[len(auditRepo.logs)-1].UserID)
+		assert.Equal(t, "current-sid", auditRepo.logs[len(auditRepo.logs)-1].SessionID)
+		assert.Contains(t, auditRepo.logs[len(auditRepo.logs)-1].Details, "target-sid")
 	}
+	assert.Equal(t, 1, hydraRevokeCalls)
 
 	mockKratos.AssertExpectations(t)
 }
+
+func TestGetHydraProfile_RejectsInactiveLinkedSession(t *testing.T) {
+	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		if r.URL.Host == "hydra.test" && r.URL.Path == "/oauth2/introspect" {
+			body, _ := io.ReadAll(r.Body)
+			if string(body) != "token=opaque-token" {
+				t.Fatalf("unexpected introspect body: %s", string(body))
+			}
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"active":    true,
+				"sub":       "user-123",
+				"client_id": "devfront",
+				"ext": map[string]any{
+					"session_id": "target-sid",
+				},
+			}), nil
+		}
+		return httpResponse(r, http.StatusNotFound, "not found"), nil
+	})}
+
+	mockKratos := new(MockKratosAdminService)
+	mockKratos.On("GetSession", mock.Anything, "target-sid").Return(&service.KratosSession{
+		ID:     "target-sid",
+		Active: false,
+		Identity: &service.KratosIdentity{
+			ID: "user-123",
+		},
+	}, nil).Once()
+
+	h := &AuthHandler{
+		KratosAdmin: mockKratos,
+		Hydra: &service.HydraAdminService{
+			AdminURL:   "http://hydra.test",
+			HTTPClient: client,
+		},
+	}
+
+	profile, err := h.getHydraProfile(context.Background(), "opaque-token")
+	assert.Nil(t, profile)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "inactive")
+	mockKratos.AssertExpectations(t)
+}