refactor(auth, character): 사용자 인증 및 캐릭터 관리 개선

- 캐릭터 삭제 엔드포인트에 소유권 검증 추가
- OAuth2 인증 과정의 토큰 처리 안정성 개선
- 사용자 인증 로직 리팩토링 및 불필요한 로깅 제거
- 요청별 HTTP 헤더 관리로 동시성 문제 해결
- 사용자 인증 및 캐릭터 관리의 보안성 강화

Author: ImGdevel

.gitignore

@@ -114,6 +114,12 @@ Thumbs.db
 .DS_Store
 Desktop.ini
 
+# Shell configuration files
+.zshrc
+.bashrc
+.bash_profile
+.profile
+
 # Crash dumps
 *.dmp
 

ProjectVG.Api/Controllers/CharacterController.cs

@@ -88,9 +88,16 @@ public async Task<ActionResult<CharacterResponse>> UpdateCharacterToSystemPrompt
         }
 
         [HttpDelete("{id}")]
+        [JwtAuthentication]
         public async Task<ActionResult> DeleteCharacter(Guid id)
         {
-            await _characterService.DeleteCharacterAsync(id);
+            var userId = GetCurrentUserId();
+            if (!userId.HasValue)
+            {
+                return Unauthorized();
+            }
+
+            await _characterService.DeleteCharacterAsync(id, userId.Value);
             return NoContent();
         }
 

ProjectVG.Api/Controllers/ChatController.cs

@@ -1,6 +1,6 @@
 using Microsoft.AspNetCore.Mvc;
 using ProjectVG.Application.Models.Chat;
-using ProjectVG.Application.Models.API.Request;
+using ProjectVG.Api.Models.Chat.Request;
 using ProjectVG.Application.Services.Chat;
 using System.Security.Claims;
 

ProjectVG.Api/Controllers/ConversationController.cs

@@ -2,6 +2,9 @@
 using ProjectVG.Api.Models.Conversation.Request;
 using ProjectVG.Api.Models.Conversation.Response;
 using ProjectVG.Application.Services.Conversation;
+using ProjectVG.Api.Filters;
+using ProjectVG.Common.Exceptions;
+using ProjectVG.Common.Constants;
 using System.Security.Claims;
 
 namespace ProjectVG.Api.Controllers
@@ -137,14 +140,8 @@ public async Task<IActionResult> GetConversationBySessionId(string conversationI
                     throw new ValidationException(ErrorCode.AUTHENTICATION_FAILED);
                 }
 
-                // 대화 세션 조회
-                var messages = await _conversationService.GetByConversationIdAsync(conversationId);
-                
-                // 사용자 권한 확인 (첫 번째 메시지의 사용자 ID 확인)
-                if (messages.Any() && !messages.Any(m => m.UserId == userGuid))
-                {
-                    return Forbid();
-                }
+                // 대화 세션 조회 (DB 레벨에서 userId로 필터링)
+                var messages = await _conversationService.GetByConversationIdAsync(conversationId, userGuid);
 
                 // 응답 매핑
                 var response = messages.Select(m => new ConversationHistoryResponse

ProjectVG.Api/Controllers/OAuthController.cs

@@ -96,14 +96,12 @@ public async Task<IActionResult> GetOAuth2Token([FromQuery] string state)
                 throw new ValidationException(ErrorCode.REQUIRED_PARAMETER_MISSING);
             }
 
-            var tokenData = await _oauth2Service.GetTokenDataAsync(state);
+            var tokenData = await _oauth2Service.ConsumeTokenDataAsync(state);
             if (tokenData == null)
             {
                 throw new ValidationException(ErrorCode.OAUTH2_REQUEST_NOT_FOUND);
             }
 
-            await _oauth2Service.DeleteTokenDataAsync(state);
-
             Response.Headers.Append("X-Access-Credit", tokenData.AccessToken);
             Response.Headers.Append("X-Refresh-Credit", tokenData.RefreshToken);
             Response.Headers.Append("X-Expires-In", tokenData.ExpiresIn.ToString());

ProjectVG.Api/Models/Character/Request/CreateCharacterWithFieldsRequest.cs

@@ -24,7 +24,8 @@ public record CreateCharacterWithFieldsRequest
         public string ImageUrl { get; init; } = string.Empty;
 
         [JsonPropertyName("voice_id")]
-        [StringLength(100, ErrorMessage = "음성 ID는 최대 100자까지 입력 가능합니다.")]
+        [Required(ErrorMessage = "음성 ID는 필수입니다.")]
+        [StringLength(100, MinimumLength = 1, ErrorMessage = "음성 ID는 1-100자 사이여야 합니다.")]
         public string VoiceId { get; init; } = string.Empty;
 
         [JsonPropertyName("individual_config")]

ProjectVG.Api/Models/Chat/Request/ChatRequest.cs

@@ -1,7 +1,6 @@
 using System.Text.Json.Serialization;
-using ProjectVG.Application.Models.Chat;
 
-namespace ProjectVG.Application.Models.API.Request
+namespace ProjectVG.Api.Models.Chat.Request
 {
     public record ChatRequest
     {

ProjectVG.Application/Models/Auth/OAuth2Models.cs

@@ -1,4 +1,3 @@
-using System.Text.Json.Serialization;
 
 namespace ProjectVG.Application.Models.Auth
 {

ProjectVG.Application/Models/Chat/ChatProcessContext.cs

@@ -1,4 +1,3 @@
-using Azure.Core;
 using ProjectVG.Application.Models.Character;
 using ProjectVG.Domain.Entities.ConversationHistorys;
 
@@ -39,11 +38,13 @@ public ChatProcessContext(
             IEnumerable<ConversationHistory> conversationHistory,
             IEnumerable<string> memoryContext)
         {
+            RequestId = command.Id;
             UserId = command.UserId;
             CharacterId = command.CharacterId;
             UserMessage = command.UserPrompt;
             MemoryStore = command.UserId.ToString();
             UseTTS = command.UseTTS;
+            UserRequestAt = command.UserRequestAt;
 
             Character = character;
             ConversationHistory = conversationHistory;

ProjectVG.Application/Services/Auth/AuthService.cs

@@ -1,13 +1,7 @@
-using Microsoft.Extensions.Logging;
-using ProjectVG.Application.Models.Auth;
 using ProjectVG.Application.Models.User;
 using ProjectVG.Application.Services.Credit;
 using ProjectVG.Application.Services.Users;
-using ProjectVG.Common.Constants;
-using ProjectVG.Common.Exceptions;
-using ProjectVG.Domain.Entities.Users;
 using ProjectVG.Infrastructure.Auth;
-using System;
 
 namespace ProjectVG.Application.Services.Auth
 {
@@ -50,9 +44,6 @@ public async Task<AuthResult> GuestLoginAsync(string guestId)
                 user = await _userService.CreateUserAsync(createCommand);
                 _logger.LogInformation("새 게스트 사용자 생성됨: UserId={UserId}, GuestId={GuestId}", user.Id, guestId);
             }
-            else {
-                _logger.LogDebug("기존 게스트 사용자 로그인: UserId={UserId}, GuestId={GuestId}", user.Id, guestId);
-            }
 
             return await FinalizeLoginAsync(user, "guest");
         }
@@ -64,15 +55,10 @@ private async Task<AuthResult> FinalizeLoginAsync(UserDto user, string provider)
             if (tokenGranted) {
                 _logger.LogInformation("사용자 {UserId}에게 최초 크레딧 지급 완료", user.Id);
             }
-            else {
-                _logger.LogDebug("사용자 {UserId}는 이미 크레딧이 지급되었거나 지급 실패", user.Id);
-            }
 
             // 최종 JWT 토큰 발급
             var tokens = await _tokenService.GenerateTokensAsync(user.Id);
 
-            _logger.LogDebug("사용자 {UserId} 로그인 완료 (Provider={Provider})", user.Id, provider);
-
             return new AuthResult {
                 Tokens = tokens,
                 User = user
@@ -82,12 +68,12 @@ private async Task<AuthResult> FinalizeLoginAsync(UserDto user, string provider)
         public async Task<AuthResult> RefreshAccessTokenAsync(string? refreshToken)
         {
             if (string.IsNullOrEmpty(refreshToken)) {
-                throw new ValidationException(ErrorCode.TOKEN_MISSING, "리프레시 토큰이 필요합니다");
+                throw new ValidationException(ErrorCode.TOKEN_MISSING);
             }
 
             var tokens = await _tokenService.RefreshAccessTokenAsync(refreshToken);
             if (tokens == null) {
-                throw new ValidationException(ErrorCode.TOKEN_REFRESH_FAILED, "유효하지 않거나 만료된 리프레시 토큰입니다");
+                throw new ValidationException(ErrorCode.TOKEN_REFRESH_FAILED);
             }
 
             var userId = await _tokenService.GetUserIdFromTokenAsync(refreshToken);
@@ -102,16 +88,12 @@ public async Task<AuthResult> RefreshAccessTokenAsync(string? refreshToken)
         public async Task<bool> LogoutAsync(string? refreshToken)
         {
             if (string.IsNullOrEmpty(refreshToken)) {
-                throw new ValidationException(ErrorCode.TOKEN_MISSING, "리프레시 토큰이 필요합니다");
+                throw new ValidationException(ErrorCode.TOKEN_MISSING);
             }
 
             var revoked = await _tokenService.RevokeRefreshTokenAsync(refreshToken);
             if (revoked) {
                 var userId = await _tokenService.GetUserIdFromTokenAsync(refreshToken);
-                _logger.LogInformation("사용자 {UserId} 로그아웃 성공", userId);
-            }
-            else {
-                _logger.LogWarning("리프레시 토큰 만료 또는 무효화 실패: {RefreshToken}", refreshToken);
             }
             return revoked;
         }