feat: harden auth ops and deployment baseline

TaxBaik.Web/Services/AuthService.cs

@@ -13,6 +13,7 @@ public class AuthService
     private readonly IAdminUserRepository _adminUserRepository;
     private readonly ILogger<AuthService> _logger;
     private readonly string _jwtSecretKey;
+    private readonly string? _passwordResetToken;
     private readonly int _tokenExpirationMinutes = 480; // 8시간
 
     public AuthService(IAdminUserRepository adminUserRepository, ILogger<AuthService> logger, IConfiguration configuration)
@@ -20,6 +21,7 @@ public class AuthService
         _adminUserRepository = adminUserRepository;
         _logger = logger;
         _jwtSecretKey = configuration["Jwt:SecretKey"] ?? throw new InvalidOperationException("Missing 'Jwt:SecretKey' configuration.");
+        _passwordResetToken = configuration["Admin:PasswordResetToken"];
     }
 
     public async Task<string?> AuthenticateAndGenerateTokenAsync(string username, string password)
@@ -49,9 +51,47 @@ public class AuthService
         }
 
         _logger.LogInformation("로그인 성공: {Username}", username);
+        await _adminUserRepository.UpdateLastLoginAtAsync(user.Id);
         return GenerateJwtToken(user);
     }
 
+    public async Task<bool> ChangePasswordAsync(string username, string currentPassword, string newPassword)
+    {
+        if (!IsValidPassword(newPassword))
+            throw new ArgumentException("새 비밀번호는 12자 이상이어야 합니다.", nameof(newPassword));
+
+        var user = await _adminUserRepository.GetByUsernameAsync(username);
+        if (user == null || string.IsNullOrWhiteSpace(user.PasswordHash))
+            return false;
+
+        if (!BCrypt.Net.BCrypt.Verify(currentPassword, user.PasswordHash))
+            return false;
+
+        await _adminUserRepository.UpdatePasswordHashAsync(user.Id, BCrypt.Net.BCrypt.HashPassword(newPassword));
+        _logger.LogInformation("관리자 비밀번호 변경: {Username}", username);
+        return true;
+    }
+
+    public async Task<bool> ResetPasswordAsync(string username, string newPassword, string resetToken)
+    {
+        if (string.IsNullOrWhiteSpace(_passwordResetToken))
+            throw new InvalidOperationException("Admin:PasswordResetToken is not configured.");
+
+        if (!TimeConstantEquals(resetToken, _passwordResetToken))
+            return false;
+
+        if (!IsValidPassword(newPassword))
+            throw new ArgumentException("새 비밀번호는 12자 이상이어야 합니다.", nameof(newPassword));
+
+        var user = await _adminUserRepository.GetByUsernameAsync(username);
+        if (user == null)
+            return false;
+
+        await _adminUserRepository.UpdatePasswordHashAsync(user.Id, BCrypt.Net.BCrypt.HashPassword(newPassword));
+        _logger.LogWarning("관리자 비밀번호 재설정 API 사용: {Username}", username);
+        return true;
+    }
+
     private string GenerateJwtToken(AdminUser user)
     {
         var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_jwtSecretKey));
@@ -99,4 +139,14 @@ public class AuthService
             return null;
         }
     }
+
+    private static bool IsValidPassword(string password) => !string.IsNullOrWhiteSpace(password) && password.Length >= 12;
+
+    private static bool TimeConstantEquals(string value, string expected)
+    {
+        var valueBytes = Encoding.UTF8.GetBytes(value);
+        var expectedBytes = Encoding.UTF8.GetBytes(expected);
+        return valueBytes.Length == expectedBytes.Length
+            && System.Security.Cryptography.CryptographicOperations.FixedTimeEquals(valueBytes, expectedBytes);
+    }
 }