AuthControllerTest.java

package com.devpick.domain.user.controller;

import com.devpick.domain.user.dto.LoginRequest;
import com.devpick.domain.user.dto.LoginResponse;
import com.devpick.domain.user.dto.OAuthAuthorizationResponse;
import com.devpick.domain.user.dto.SocialLoginResponse;
import com.devpick.domain.user.dto.SignupRequest;
import com.devpick.domain.user.dto.SignupResponse;
import com.devpick.domain.user.dto.TokenResponse;
import com.devpick.domain.user.service.AuthService;
import com.devpick.domain.user.service.EmailVerificationService;
import com.devpick.domain.user.service.SocialAuthService;
import com.devpick.domain.user.service.TokenService;
import com.devpick.global.common.exception.DevpickException;
import com.devpick.global.common.exception.ErrorCode;
import com.devpick.global.common.exception.GlobalExceptionHandler;
import jakarta.servlet.http.Cookie;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.DisplayName;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;
import org.mockito.InjectMocks;
import org.mockito.Mock;
import org.mockito.junit.jupiter.MockitoExtension;
import org.springframework.http.MediaType;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.setup.MockMvcBuilders;
import com.fasterxml.jackson.databind.ObjectMapper;

import java.util.List;
import java.util.UUID;

import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.allOf;
import static org.hamcrest.Matchers.containsString;
import static org.hamcrest.Matchers.hasItem;
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.ArgumentMatchers.anyString;
import static org.mockito.BDDMockito.given;
import static org.mockito.Mockito.doNothing;
import static org.mockito.Mockito.doThrow;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;

// Spring Boot 3.x: standaloneSetup 사용
// Jackson 2.x: com.fasterxml.jackson.databind.ObjectMapper 사용
@ExtendWith(MockitoExtension.class)
class AuthControllerTest {

    private MockMvc mockMvc;

    private final ObjectMapper objectMapper = new ObjectMapper();

    @Mock
    private AuthService authService;

    @Mock
    private EmailVerificationService emailVerificationService;

    @Mock
    private TokenService tokenService;

    @Mock
    private SocialAuthService socialAuthService;

    @InjectMocks
    private AuthController authController;

    private final UUID testUserId = UUID.randomUUID();

    @BeforeEach
    void setUp() {
        mockMvc = MockMvcBuilders
                .standaloneSetup(authController)
                .setControllerAdvice(new GlobalExceptionHandler())
                .build();
    }

    // ── signup ──────────────────────────────────────────────

    @Test
    @DisplayName("POST /auth/signup - 정상 회원가입 시 201과 userId, email, nickname을 반환한다")
    void signup_success() throws Exception {
        SignupRequest request = new SignupRequest("test@devpick.kr", "password123!", "하영", true, true);
        SignupResponse response = new SignupResponse(UUID.randomUUID(), "test@devpick.kr", "하영");
        given(authService.signup(any(SignupRequest.class))).willReturn(response);

        mockMvc.perform(post("/auth/signup")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(objectMapper.writeValueAsString(request)))
                .andExpect(status().isCreated())
                .andExpect(jsonPath("$.success").value(true))
                .andExpect(jsonPath("$.data.email").value("test@devpick.kr"))
                .andExpect(jsonPath("$.data.nickname").value("하영"));
    }

    @Test
    @DisplayName("POST /auth/signup - 필수 필드 누락 시 400을 반환한다")
    void signup_missingField_returns400() throws Exception {
        String request = "{\"email\":\"test@devpick.kr\",\"password\":\"password123!\"}";

        mockMvc.perform(post("/auth/signup")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(request))
                .andExpect(status().isBadRequest())
                .andExpect(jsonPath("$.success").value(false));
    }

    @Test
    @DisplayName("POST /auth/signup - 이용약관 미동의 시 400을 반환한다")
    void signup_termsNotAgreed_returns400() throws Exception {
        given(authService.signup(any(SignupRequest.class)))
                .willThrow(new DevpickException(ErrorCode.AUTH_CONSENT_REQUIRED));

        SignupRequest request = new SignupRequest("test@devpick.kr", "password123!", "하영", false, true);

        mockMvc.perform(post("/auth/signup")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(objectMapper.writeValueAsString(request)))
                .andExpect(status().isBadRequest())
                .andExpect(jsonPath("$.success").value(false))
                .andExpect(jsonPath("$.error.code").value("AUTH_026"));
    }

    @Test
    @DisplayName("POST /auth/signup - 개인정보처리방침 미동의 시 400을 반환한다")
    void signup_privacyNotAgreed_returns400() throws Exception {
        given(authService.signup(any(SignupRequest.class)))
                .willThrow(new DevpickException(ErrorCode.AUTH_CONSENT_REQUIRED));

        SignupRequest request = new SignupRequest("test@devpick.kr", "password123!", "하영", true, false);

        mockMvc.perform(post("/auth/signup")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(objectMapper.writeValueAsString(request)))
                .andExpect(status().isBadRequest())
                .andExpect(jsonPath("$.success").value(false))
                .andExpect(jsonPath("$.error.code").value("AUTH_026"));
    }

    // ── login ──────────────────────────────────────────────

    @Test
    @DisplayName("POST /auth/login - 정상 로그인 시 200, accessToken(바디), refreshToken(HttpOnly Cookie)을 반환한다")
    void login_success() throws Exception {
        LoginRequest request = new LoginRequest("test@devpick.kr", "password123!");
        LoginResponse response = new LoginResponse(
                "access-token", UUID.randomUUID(), "test@devpick.kr", "하영", "refresh-token");
        given(authService.login(any(LoginRequest.class))).willReturn(response);

        mockMvc.perform(post("/auth/login")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(objectMapper.writeValueAsString(request)))
                .andExpect(status().isOk())
                .andExpect(jsonPath("$.success").value(true))
                .andExpect(jsonPath("$.data.accessToken").value("access-token"))
                .andExpect(jsonPath("$.data.refreshTokenValue").doesNotExist())
                .andExpect(jsonPath("$.data.email").value("test@devpick.kr"))
                .andExpect(header().string("Set-Cookie", containsString("HttpOnly")))
                .andExpect(header().string("Set-Cookie", containsString("SameSite=None")))
                .andExpect(header().string("Set-Cookie", containsString("refreshToken=refresh-token")))
                .andExpect(result -> assertThat(
                        result.getResponse().getHeaders("Set-Cookie"),
                        hasItem(allOf(containsString("hasSession=true"), containsString("SameSite=Lax")))));
    }

    @Test
    @DisplayName("POST /auth/login - 이메일 미인증 시 403을 반환한다")
    void login_emailNotVerified_returns403() throws Exception {
        LoginRequest request = new LoginRequest("test@devpick.kr", "password123!");
        given(authService.login(any(LoginRequest.class)))
                .willThrow(new DevpickException(ErrorCode.AUTH_EMAIL_NOT_VERIFIED));

        mockMvc.perform(post("/auth/login")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(objectMapper.writeValueAsString(request)))
                .andExpect(status().isForbidden())
                .andExpect(jsonPath("$.success").value(false));
    }

    @Test
    @DisplayName("POST /auth/login - 잘못된 비밀번호면 401을 반환한다")
    void login_invalidPassword_returns401() throws Exception {
        LoginRequest request = new LoginRequest("test@devpick.kr", "wrongPassword");
        given(authService.login(any(LoginRequest.class)))
                .willThrow(new DevpickException(ErrorCode.AUTH_INVALID_PASSWORD));

        mockMvc.perform(post("/auth/login")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(objectMapper.writeValueAsString(request)))
                .andExpect(status().isUnauthorized())
                .andExpect(jsonPath("$.success").value(false));
    }

    @Test
    @DisplayName("POST /auth/login - 존재하지 않는 이메일이면 404를 반환한다")
    void login_userNotFound_returns404() throws Exception {
        LoginRequest request = new LoginRequest("unknown@devpick.kr", "password123!");
        given(authService.login(any(LoginRequest.class)))
                .willThrow(new DevpickException(ErrorCode.AUTH_USER_NOT_FOUND));

        mockMvc.perform(post("/auth/login")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(objectMapper.writeValueAsString(request)))
                .andExpect(status().isNotFound())
                .andExpect(jsonPath("$.success").value(false));
    }

    // ── logout (DP-185) ──────────────────────────────────────────────

    @Test
    @DisplayName("POST /auth/logout - 인증된 사용자가 로그아웃하면 200과 Cookie 만료(maxAge=0)를 반환한다")
    void logout_success() throws Exception {
        doNothing().when(tokenService).logout(any(UUID.class));

        mockMvc.perform(post("/auth/logout")
                        .principal(new UsernamePasswordAuthenticationToken(
                                testUserId, null, List.of())))
                .andExpect(status().isOk())
                .andExpect(jsonPath("$.success").value(true))
                .andExpect(result -> assertThat(
                        result.getResponse().getHeaders("Set-Cookie"),
                        hasItem(allOf(containsString("refreshToken="), containsString("Max-Age=0")))))
                .andExpect(result -> assertThat(
                        result.getResponse().getHeaders("Set-Cookie"),
                        hasItem(allOf(containsString("hasSession="), containsString("Max-Age=0")))));
    }

    @Test
    @DisplayName("POST /auth/logout - 존재하지 않는 사용자이면 404를 반환한다")
    void logout_userNotFound_returns404() throws Exception {
        doThrow(new DevpickException(ErrorCode.AUTH_USER_NOT_FOUND))
                .when(tokenService).logout(any(UUID.class));

        mockMvc.perform(post("/auth/logout")
                        .principal(new UsernamePasswordAuthenticationToken(
                                testUserId, null, List.of())))
                .andExpect(status().isNotFound())
                .andExpect(jsonPath("$.success").value(false));
    }

    // ── refresh ──────────────────────────────────────────────

    @Test
    @DisplayName("POST /auth/refresh - Cookie의 Refresh Token으로 새 accessToken(바디)과 refreshToken(Cookie)을 반환한다")
    void refresh_success() throws Exception {
        given(tokenService.reissueTokens("valid-refresh-token"))
                .willReturn(new String[]{"new-access-token", "new-refresh-token"});

        mockMvc.perform(post("/auth/refresh")
                        .cookie(new Cookie(AuthController.REFRESH_TOKEN_COOKIE, "valid-refresh-token")))
                .andExpect(status().isOk())
                .andExpect(jsonPath("$.success").value(true))
                .andExpect(jsonPath("$.data.accessToken").value("new-access-token"))
                .andExpect(header().string("Set-Cookie", containsString("HttpOnly")))
                .andExpect(header().string("Set-Cookie", containsString("SameSite=None")))
                .andExpect(header().string("Set-Cookie", containsString("refreshToken=new-refresh-token")));
    }

    @Test
    @DisplayName("POST /auth/refresh - 유효하지 않은 Refresh Token이면 401을 반환한다")
    void refresh_invalidToken_returns401() throws Exception {
        given(tokenService.reissueTokens("invalid-refresh-token"))
                .willThrow(new DevpickException(ErrorCode.AUTH_INVALID_REFRESH_TOKEN));

        mockMvc.perform(post("/auth/refresh")
                        .cookie(new Cookie(AuthController.REFRESH_TOKEN_COOKIE, "invalid-refresh-token")))
                .andExpect(status().isUnauthorized())
                .andExpect(jsonPath("$.success").value(false));
    }

    // ── email/send & email/verify ──────────────────────────────────────────────

    @Test
    @DisplayName("POST /auth/email/send - 정상 요청 시 200을 반환한다")
    void sendVerificationCode_success() throws Exception {
        mockMvc.perform(post("/auth/email/send")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content("{\"email\":\"test@devpick.kr\"}"))
                .andExpect(status().isOk())
                .andExpect(jsonPath("$.success").value(true));
    }

    @Test
    @DisplayName("POST /auth/email/send - 너무 잦은 요청 시 429를 반환한다")
    void sendVerificationCode_tooOften_returns429() throws Exception {
        doThrow(new DevpickException(ErrorCode.AUTH_EMAIL_SEND_TOO_OFTEN))
                .when(emailVerificationService).sendVerificationCode(anyString());

        mockMvc.perform(post("/auth/email/send")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content("{\"email\":\"test@devpick.kr\"}"))
                .andExpect(status().isTooManyRequests())
                .andExpect(jsonPath("$.success").value(false));
    }

    @Test
    @DisplayName("POST /auth/email/verify - 정상 요청 시 200을 반환한다")
    void verifyCode_success() throws Exception {
        mockMvc.perform(post("/auth/email/verify")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content("{\"email\":\"test@devpick.kr\",\"code\":\"123456\"}"))
                .andExpect(status().isOk())
                .andExpect(jsonPath("$.success").value(true));
    }

    @Test
    @DisplayName("POST /auth/email/verify - 잘못된 코드이면 400을 반환한다")
    void verifyCode_invalidCode_returns400() throws Exception {
        doThrow(new DevpickException(ErrorCode.AUTH_EMAIL_CODE_INVALID))
                .when(emailVerificationService).verifyCode(anyString(), anyString());

        mockMvc.perform(post("/auth/email/verify")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content("{\"email\":\"test@devpick.kr\",\"code\":\"000000\"}"))
                .andExpect(status().isBadRequest())
                .andExpect(jsonPath("$.success").value(false));
    }

    // ── GitHub 소셜 로그인 시작 (DP-284) ──────────────────────────────────────────────

    @Test
    @DisplayName("GET /auth/github - 200과 authorizationUrl을 반환한다")
    void githubAuthorize_success() throws Exception {
        given(socialAuthService.generateAuthorizationUrl("github")).willReturn(
                new OAuthAuthorizationResponse(
                        "https://github.com/login/oauth/authorize?client_id=xxx&state=test-state"));

        mockMvc.perform(get("/auth/github"))
                .andExpect(status().isOk())
                .andExpect(jsonPath("$.success").value(true))
                .andExpect(jsonPath("$.data.authorizationUrl").value(
                        "https://github.com/login/oauth/authorize?client_id=xxx&state=test-state"));
    }

    // ── Google 소셜 로그인 시작 (DP-284) ──────────────────────────────────────────────

    @Test
    @DisplayName("GET /auth/google - 200과 authorizationUrl을 반환한다")
    void googleAuthorize_success() throws Exception {
        given(socialAuthService.generateAuthorizationUrl("google")).willReturn(
                new OAuthAuthorizationResponse(
                        "https://accounts.google.com/o/oauth2/v2/auth?client_id=xxx&state=test-state"));

        mockMvc.perform(get("/auth/google"))
                .andExpect(status().isOk())
                .andExpect(jsonPath("$.success").value(true))
                .andExpect(jsonPath("$.data.authorizationUrl").value(
                        "https://accounts.google.com/o/oauth2/v2/auth?client_id=xxx&state=test-state"));
    }

    // ── GitHub 소셜 로그인 콜백 (DP-183, DP-284) ──────────────────────────────────────────────

    @Test
    @DisplayName("GET /auth/github/callback - 유효한 인가 코드와 state로 200, accessToken(바디), refreshToken(Cookie)을 반환한다")
    void githubCallback_success() throws Exception {
        SocialLoginResponse response = new SocialLoginResponse(
                "access-token", UUID.randomUUID(), "hayoung@test.com", "하영", false, "refresh-token");
        given(socialAuthService.login(anyString(), anyString(), anyString())).willReturn(response);

        mockMvc.perform(get("/auth/github/callback")
                        .param("code", "valid-github-code")
                        .param("state", "valid-state"))
                .andExpect(status().isOk())
                .andExpect(jsonPath("$.success").value(true))
                .andExpect(jsonPath("$.data.accessToken").value("access-token"))
                .andExpect(jsonPath("$.data.email").value("hayoung@test.com"))
                .andExpect(header().string("Set-Cookie", containsString("HttpOnly")))
                .andExpect(header().string("Set-Cookie", containsString("SameSite=None")))
                .andExpect(header().string("Set-Cookie", containsString("refreshToken=refresh-token")))
                .andExpect(result -> assertThat(
                        result.getResponse().getHeaders("Set-Cookie"),
                        hasItem(allOf(containsString("hasSession=true"), containsString("SameSite=Lax")))));
    }

    @Test
    @DisplayName("GET /auth/github/callback - 유효하지 않은 state이면 400을 반환한다")
    void githubCallback_invalidState_returns400() throws Exception {
        given(socialAuthService.login(anyString(), anyString(), anyString()))
                .willThrow(new DevpickException(ErrorCode.AUTH_INVALID_STATE));

        mockMvc.perform(get("/auth/github/callback")
                        .param("code", "some-code")
                        .param("state", "invalid-state"))
                .andExpect(status().isBadRequest())
                .andExpect(jsonPath("$.success").value(false));
    }

    @Test
    @DisplayName("GET /auth/github/callback - GitHub API 실패 시 502를 반환한다")
    void githubCallback_githubApiFailed_returns502() throws Exception {
        given(socialAuthService.login(anyString(), anyString(), anyString()))
                .willThrow(new DevpickException(ErrorCode.AUTH_SOCIAL_GITHUB_FAILED));

        mockMvc.perform(get("/auth/github/callback")
                        .param("code", "bad-code")
                        .param("state", "valid-state"))
                .andExpect(status().isBadGateway())
                .andExpect(jsonPath("$.success").value(false));
    }

    @Test
    @DisplayName("GET /auth/github/callback - GitHub 이메일 미공개 시 400을 반환한다")
    void githubCallback_emailNotPublic_returns400() throws Exception {
        given(socialAuthService.login(anyString(), anyString(), anyString()))
                .willThrow(new DevpickException(ErrorCode.AUTH_SOCIAL_EMAIL_REQUIRED));

        mockMvc.perform(get("/auth/github/callback")
                        .param("code", "no-email-code")
                        .param("state", "valid-state"))
                .andExpect(status().isBadRequest())
                .andExpect(jsonPath("$.success").value(false));
    }

    // ── Google 소셜 로그인 콜백 (DP-184, DP-284) ──────────────────────────────────────────────

    @Test
    @DisplayName("GET /auth/google/callback - 유효한 인가 코드와 state로 200, accessToken(바디), refreshToken(Cookie)을 반환한다")
    void googleCallback_success() throws Exception {
        SocialLoginResponse response = new SocialLoginResponse(
                "access-token", UUID.randomUUID(), "hayoung@gmail.com", "하영", false, "refresh-token");
        given(socialAuthService.login(anyString(), anyString(), anyString())).willReturn(response);

        mockMvc.perform(get("/auth/google/callback")
                        .param("code", "valid-google-code")
                        .param("state", "valid-state"))
                .andExpect(status().isOk())
                .andExpect(jsonPath("$.success").value(true))
                .andExpect(jsonPath("$.data.accessToken").value("access-token"))
                .andExpect(jsonPath("$.data.email").value("hayoung@gmail.com"))
                .andExpect(header().string("Set-Cookie", containsString("HttpOnly")))
                .andExpect(header().string("Set-Cookie", containsString("SameSite=None")))
                .andExpect(header().string("Set-Cookie", containsString("refreshToken=refresh-token")))
                .andExpect(result -> assertThat(
                        result.getResponse().getHeaders("Set-Cookie"),
                        hasItem(allOf(containsString("hasSession=true"), containsString("SameSite=Lax")))));
    }

    @Test
    @DisplayName("GET /auth/google/callback - 유효하지 않은 state이면 400을 반환한다")
    void googleCallback_invalidState_returns400() throws Exception {
        given(socialAuthService.login(anyString(), anyString(), anyString()))
                .willThrow(new DevpickException(ErrorCode.AUTH_INVALID_STATE));

        mockMvc.perform(get("/auth/google/callback")
                        .param("code", "some-code")
                        .param("state", "invalid-state"))
                .andExpect(status().isBadRequest())
                .andExpect(jsonPath("$.success").value(false));
    }

    @Test
    @DisplayName("POST /auth/recover - 이메일 탈퇴 계정 복구 성공 시 200과 토큰을 반환한다")
    void recover_success() throws Exception {
        com.devpick.domain.user.dto.RecoverRequest request =
                new com.devpick.domain.user.dto.RecoverRequest("test@devpick.kr", "Pass1234!");
        LoginResponse response = new LoginResponse(
                "access-token", UUID.randomUUID(), "test@devpick.kr", "하영", "refresh-token");
        given(authService.recover(any())).willReturn(response);

        mockMvc.perform(post("/auth/recover")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(objectMapper.writeValueAsString(request)))
                .andExpect(status().isOk())
                .andExpect(jsonPath("$.success").value(true))
                .andExpect(jsonPath("$.data.accessToken").value("access-token"))
                .andExpect(result -> assertThat(
                        result.getResponse().getHeaders("Set-Cookie"),
                        hasItem(allOf(containsString("hasSession=true"), containsString("SameSite=Lax")))));
    }

    @Test
    @DisplayName("POST /auth/recover - 복구 기간 만료 시 410을 반환한다")
    void recover_expired_returns410() throws Exception {
        com.devpick.domain.user.dto.RecoverRequest request =
                new com.devpick.domain.user.dto.RecoverRequest("test@devpick.kr", "Pass1234!");
        given(authService.recover(any()))
                .willThrow(new DevpickException(ErrorCode.AUTH_ACCOUNT_DELETED));

        mockMvc.perform(post("/auth/recover")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(objectMapper.writeValueAsString(request)))
                .andExpect(status().isGone())
                .andExpect(jsonPath("$.success").value(false));
    }

    @Test
    @DisplayName("POST /auth/social/recover - 소셜 탈퇴 계정 복구 성공 시 200과 토큰을 반환한다")
    void socialRecover_success() throws Exception {
        com.devpick.domain.user.dto.SocialRecoverRequest request =
                new com.devpick.domain.user.dto.SocialRecoverRequest("valid-recovery-token");
        SocialLoginResponse response = new SocialLoginResponse(
                "access-token", UUID.randomUUID(), "test@devpick.kr", "하영", false, "refresh-token");
        given(socialAuthService.recoverWithToken("valid-recovery-token")).willReturn(response);

        mockMvc.perform(post("/auth/social/recover")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(objectMapper.writeValueAsString(request)))
                .andExpect(status().isOk())
                .andExpect(jsonPath("$.success").value(true))
                .andExpect(jsonPath("$.data.accessToken").value("access-token"))
                .andExpect(header().string("Set-Cookie", containsString("HttpOnly")))
                .andExpect(header().string("Set-Cookie", containsString("SameSite=None")))
                .andExpect(result -> assertThat(
                        result.getResponse().getHeaders("Set-Cookie"),
                        hasItem(allOf(containsString("hasSession=true"), containsString("SameSite=Lax")))));
    }

    @Test
    @DisplayName("POST /auth/social/recover - 토큰 만료 또는 복구 기간 초과 시 410을 반환한다")
    void socialRecover_expired_returns410() throws Exception {
        com.devpick.domain.user.dto.SocialRecoverRequest request =
                new com.devpick.domain.user.dto.SocialRecoverRequest("expired-token");
        given(socialAuthService.recoverWithToken("expired-token"))
                .willThrow(new DevpickException(ErrorCode.AUTH_ACCOUNT_DELETED));

        mockMvc.perform(post("/auth/social/recover")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(objectMapper.writeValueAsString(request)))
                .andExpect(status().isGone())
                .andExpect(jsonPath("$.success").value(false));
    }

    @Test
    @DisplayName("GET /auth/google/callback - Google API 실패 시 502를 반환한다")
    void googleCallback_googleApiFailed_returns502() throws Exception {
        given(socialAuthService.login(anyString(), anyString(), anyString()))
                .willThrow(new DevpickException(ErrorCode.AUTH_SOCIAL_GOOGLE_FAILED));

        mockMvc.perform(get("/auth/google/callback")
                        .param("code", "bad-code")
                        .param("state", "valid-state"))
                .andExpect(status().isBadGateway())
                .andExpect(jsonPath("$.success").value(false));
    }

    @Test
    @DisplayName("GET /auth/google/callback - Google 이메일 없는 경우 400을 반환한다")
    void googleCallback_emailRequired_returns400() throws Exception {
        given(socialAuthService.login(anyString(), anyString(), anyString()))
                .willThrow(new DevpickException(ErrorCode.AUTH_SOCIAL_GOOGLE_EMAIL_REQUIRED));

        mockMvc.perform(get("/auth/google/callback")
                        .param("code", "no-email-code")
                        .param("state", "valid-state"))
                .andExpect(status().isBadRequest())
                .andExpect(jsonPath("$.success").value(false));
    }
}