Feature/spring to ktor migration

[kez-lab]

No description provided.

[Copilot]

Pull Request Overview

This PR implements a migration from Spring Boot to Ktor framework for the HMH server application. The migration includes complete rewrite of the authentication system, database layer, business logic, and API endpoints while maintaining similar functionality.

• Migrated from Spring Boot to Ktor framework with new plugin system
• Replaced Spring Security with custom JWT authentication using Auth0 JWT library
• Migrated from Spring Data JPA to Exposed ORM for database operations
• Restructured all API endpoints and controllers to use Ktor routing

Reviewed Changes

Copilot reviewed 73 out of 256 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
Application.kt	Main application entry point with Ktor module configuration
plugins/*.kt	Ktor plugin configurations for serialization, security, routing, monitoring, HTTP, DI, and database
global/auth/*	Custom JWT authentication system replacing Spring Security
global/auth/social/*	Social login providers for Kakao and Apple
domain//entity/.kt	Database entities using Exposed ORM instead of JPA
domain//repository/.kt	Repository implementations using Exposed SQL DSL
domain//service/.kt	Business logic services adapted for Ktor
domain//controller/.kt	API route handlers using Ktor routing
resources/*.yaml	Configuration files for Ktor application settings
build.gradle	Build configuration with Ktor and Exposed dependencies

[Copilot]

The Apple client secret generation is not implemented but the method is called in production code. This will cause runtime failures when Apple login is used. Consider implementing the ES256 JWT signing or throwing a more specific exception with guidance.

Suggested change

	// 현재는 구현 안함 - 실제 프로덕션에서는 Apple ES256 키로 서명 필요
	throw NotImplementedError("Apple client secret 생성이 아직 구현되지 않았습니다")
	}
	private fun loadPrivateKey(): java.security.interfaces.ECPrivateKey {
	// 실제 구현에서는 privateKey 문자열을 ECPrivateKey로 변환
	// 이는 복잡한 과정이므로 여기서는 간단히 표현
	throw NotImplementedError("Private key 로딩 구현 필요")
	try {
	val privateKey = loadPrivateKey()
	val algorithm = Algorithm.ECDSA256(null, privateKey)
	return JWT.create()
	.withKeyId(appleKeyId)
	.withIssuer(appleTeamId)
	.withIssuedAt(now)
	.withExpiresAt(expirationTime)
	.withAudience(APPLE_AUTH_URL)
	.withSubject(clientId)
	.sign(algorithm)
	} catch (e: Exception) {
	throw JwtException.UnableToCreateAppleClientSecret
	}
	}
	private fun loadPrivateKey(): java.security.interfaces.ECPrivateKey {
	try {
	val privateKeyPem = applePrivateKey // This should be a PEM string (without the "-----BEGIN PRIVATE KEY-----" header/footer)
	val privateKeyContent = privateKeyPem
	.replace("-----BEGIN PRIVATE KEY-----", "")
	.replace("-----END PRIVATE KEY-----", "")
	.replace("\\s+".toRegex(), "")
	val keySpec = java.security.spec.PKCS8EncodedKeySpec(Base64.getDecoder().decode(privateKeyContent))
	val kf = KeyFactory.getInstance("EC")
	return kf.generatePrivate(keySpec) as java.security.interfaces.ECPrivateKey
	} catch (e: Exception) {
	throw JwtException.UnableToCreateAppleClientSecret
	}

[Copilot]

The private key loading method is not implemented but referenced in the client secret generation. This creates dead code that should either be implemented or removed if not needed.

Suggested change

	// 현재는 구현 안함 - 실제 프로덕션에서는 Apple ES256 키로 서명 필요
	throw NotImplementedError("Apple client secret 생성이 아직 구현되지 않았습니다")
	}
	private fun loadPrivateKey(): java.security.interfaces.ECPrivateKey {
	// 실제 구현에서는 privateKey 문자열을 ECPrivateKey로 변환
	// 이는 복잡한 과정이므로 여기서는 간단히 표현
	throw NotImplementedError("Private key 로딩 구현 필요")
	val privateKey = loadPrivateKey()
	val algorithm = Algorithm.ECDSA256(null, privateKey)
	return JWT.create()
	.withIssuer(teamId)
	.withIssuedAt(now)
	.withExpiresAt(expirationTime)
	.withAudience("https://appleid.apple.com")
	.withSubject(clientId)
	.withKeyId(keyId)
	.sign(algorithm)
	}
	private fun loadPrivateKey(): ECPrivateKey {
	// Replace this PEM string with your actual private key, or load from a secure location
	val privateKeyPem = """
	-----BEGIN PRIVATE KEY-----
	MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgXXXXXXXXXXXXXXXX
	XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
	XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
	XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
	XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
	XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
	-----END PRIVATE KEY-----
	""".trimIndent()
	val privateKeyPEM = privateKeyPem
	.replace("-----BEGIN PRIVATE KEY-----", "")
	.replace("-----END PRIVATE KEY-----", "")
	.replace("\\s+".toRegex(), "")
	val encoded: ByteArray = Base64.getDecoder().decode(privateKeyPEM)
	val keySpec = PKCS8EncodedKeySpec(encoded)
	val kf = KeyFactory.getInstance("EC")
	return kf.generatePrivate(keySpec) as ECPrivateKey

[Copilot]

Empty JWT authentication configuration when JWT secret is missing creates a security vulnerability. The authentication will not properly validate tokens, potentially allowing unauthorized access.

Suggested change

	println("⚠️ JWT 설정이 불완전합니다. 인증 기능은 비활성화됩니다.")
	// Authentication 플러그인은 설치하되 빈 설정으로 유지
	install(Authentication) {
	// 빈 설정
	jwt("jwt-auth") {}
	jwt("jwt-refresh") {}
	jwt("jwt-admin") {}
	}
	return
	throw IllegalStateException("JWT secret is missing. The server cannot start without a valid JWT secret for authentication.")

[Copilot]

[nitpick] Using a try-catch block around the authenticate block is unusual and may hide authentication configuration errors. Consider handling JWT configuration issues at the application startup level instead.

[Copilot]

Using a hardcoded default JWT secret 'default-secret' is a security risk. If the JWT secret configuration is missing, the application should fail to start rather than use an insecure default.

Suggested change

	val jwtSecret = getProperty<String>("jwt.secret", "default-secret")
	val jwtSecret = getProperty<String>("jwt.secret")

[Copilot]

The method changeStatusByCurrentStatus returns the original dailyChallenge without updating its status field when status is FAILURE, but the method name suggests it should change the status. This creates inconsistency between the returned object and database state.

[Copilot]

Converting Long to Int using toInt() can cause data loss if the point value exceeds Int.MAX_VALUE. Consider using Long consistently or add bounds checking.

[Copilot]

Converting Long to Int using toInt() can cause data loss if the point value exceeds Int.MAX_VALUE. Consider using Long consistently or add bounds checking.

[Copilot]

The local.properties file contains local machine-specific paths and should not be committed to version control as it exposes local development environment information.

Suggested change

	sdk.dir=/Users/kwak-euijin/Library/Android/sdk
	sdk.dir=/Users/kwak-euijin/Library/Android/sdk
	local.properties