Feat/token provider

[Whale0928]

This pull request introduces changes to improve the JWT authentication system by enhancing configurability, reducing hardcoded values, and improving maintainability. The most important changes include adding a JwtProperties class for externalized configuration, updating token expiration times, and introducing TODO comments for future improvements.

Improvements to JWT Configuration:

• JwtProperties class added: Introduced a new class JwtProperties to externalize JWT-related configurations, such as secretKey, accessTokenExpiration, and refreshTokenExpiration, using Spring's @ConfigurationProperties and @ConfigurationPropertiesScan. This enhances flexibility and maintainability.
• Externalized token expiration times: Updated application.yml to define access-token-expiration and refresh-token-expiration values, replacing hardcoded values in the code. This aligns with the new JwtProperties class.

Updates to JWT Token Behavior:

• Modified token expiration values: Adjusted ACCESS_TOKEN_EXPIRE_TIME to 2 days (from 24 hours) while keeping REFRESH_TOKEN_EXPIRE_TIME unchanged at 14 days. This change may impact session management and user experience.

Codebase Maintainability:

• TODO comments for future improvements: Added TODO comments in JwtAuthenticationFilter to suggest replacing the hardcoded path management system with an annotation-based approach (@AccessPolicy or @OptionalAuth) to reduce redundancy and improve scalability.

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull Request Overview

This PR externalizes JWT settings into a new JwtProperties class, updates token expiration values via YAML, and adds TODO comments for future improvements in filter path handling.

• Introduce JwtProperties with @ConfigurationProperties to manage JWT settings.
• Move token expiration values to application.yml and adjust the access token to 2 days.
• Add TODOs in JwtAuthenticationFilter for annotation-based path configuration.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/main/resources/application.yml	Added access-token-expiration and refresh-token-expiration under security.jwt
src/main/java/app/bottlenote/global/security/jwt/JwtTokenProvider.java	Updated hardcoded expiration constants to 2 days for access and kept refresh at 14 days
src/main/java/app/bottlenote/global/security/jwt/JwtProperties.java	New configuration class for externalized JWT properties
src/main/java/app/bottlenote/global/security/jwt/JwtAuthenticationFilter.java	Added TODOs for annotation-based path management

Comments suppressed due to low confidence (2)

src/main/resources/application.yml:63

• These new properties are at the same indentation level as jwt instead of nested under it. They should be indented two more spaces so they reside under security.jwt for the prefix mapping to work.

    access-token-expiration: 86400 # 하루 (24시간)

src/main/resources/application.yml:64

• The YAML values appear to be in seconds, but the code multiplies constants by 1000 (milliseconds). Clarify or convert units consistently to avoid token lifespan mismatches.

    refresh-token-expiration: 2592000 # 한 달 (30일)

[Copilot]

The class still uses static constants for expiration. Consider injecting JwtProperties and using its values here so the provider honors the externalized configuration.

Suggested change

	public static final int ACCESS_TOKEN_EXPIRE_TIME = 1000 * 60 * 60 * 24 * 2;
	public static final int REFRESH_TOKEN_EXPIRE_TIME = 1000 * 60 * 60 * 24 * 14;
	@Value("${security.jwt.access-token-expire-time}")
	private int accessTokenExpireTime;
	@Value("${security.jwt.refresh-token-expire-time}")
	private int refreshTokenExpireTime;

[Copilot]

[nitpick] You’ve placed @ConfigurationPropertiesScan on this class. It's typically applied to a configuration entry point (e.g., the main application class) instead of the properties bean itself—consider relocating the scan annotation.

Suggested change

@ConfigurationPropertiesScan