[FEAT/#359] 백오피스 권한 처리 및 Security 세팅

build.gradle

@@ -33,6 +33,7 @@ dependencies {
 
 	// spring security
 	implementation 'org.springframework.boot:spring-boot-starter-security'
+	implementation 'org.springframework.boot:spring-boot-starter-aop'
 	testImplementation 'org.springframework.security:spring-security-test'
 
 	// redis

src/main/java/com/assu/server/domain/admin/controller/AdminController.java

@@ -8,6 +8,7 @@
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -17,6 +18,7 @@
 @RestController
 @RequiredArgsConstructor
 @RequestMapping("/admin")
+@PreAuthorize("hasRole('ADMIN')")
 public class AdminController {
 
     private final AdminService adminService;

src/main/java/com/assu/server/domain/admin/controller/StudentAdminController.java

@@ -8,6 +8,7 @@
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -17,6 +18,7 @@
 @RequiredArgsConstructor
 @RequestMapping("/admin/dashBoard")
 @Tag(name = "Admin Dashboard", description = "관리자 대시보드 및 통계 API")
+@PreAuthorize("hasRole('ADMIN')")
 public class StudentAdminController {
 
     private final StudentAdminService studentAdminService;

src/main/java/com/assu/server/domain/appreview/controller/AppReviewController.java

@@ -12,13 +12,15 @@
 import jakarta.validation.Valid;
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.MediaType;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 
 @Tag(name = "App Review", description = "앱 리뷰 API")
 @RestController
 @RequiredArgsConstructor
 @RequestMapping("/app-reviews")
+@PreAuthorize("hasRole('STUDENT')")
 public class AppReviewController {
 
     private final AppReviewService appReviewService;

src/main/java/com/assu/server/domain/auth/controller/BackofficeAuthController.java

@@ -0,0 +1,102 @@
+package com.assu.server.domain.auth.controller;
+
+import com.assu.server.domain.auth.dto.backoffice.BackofficeLoginResponseDTO;
+import com.assu.server.domain.auth.dto.login.CommonLoginRequestDTO;
+import com.assu.server.domain.auth.dto.login.RefreshResponseDTO;
+import com.assu.server.domain.auth.service.BackofficeAuthService;
+import com.assu.server.global.apiPayload.BaseResponse;
+import com.assu.server.global.apiPayload.code.status.SuccessStatus;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.enums.ParameterIn;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.MediaType;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@Tag(name = "Backoffice Auth", description = "백오피스 전용 인증 API")
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/auth/backoffice")
+public class BackofficeAuthController {
+
+    private final BackofficeAuthService backofficeAuthService;
+
+    @Operation(
+            summary = "백오피스 로그인 API",
+            description = "# [v1.0 (2026-06-23)]\n" +
+                    "- `application/json`으로 호출합니다.\n" +
+                    "- 바디: `CommonLoginRequestDTO(email, password)`.\n" +
+                    "- `BACKOFFICE` 역할 계정만 로그인할 수 있습니다.\n" +
+                    "- 처리: 자격 증명 검증 후 `aud=backoffice` Access/Refresh 토큰 발급 및 저장.\n" +
+                    "- 성공 시 200(OK)과 토큰(accessToken/refreshToken), 기본 정보 반환.\n" +
+                    "\n**Request Body:**\n" +
+                    "  - `CommonLoginRequestDTO` 객체 (JSON, required): 로그인 정보\n" +
+                    "  - `email` (String, required): 이메일 주소\n" +
+                    "  - `password` (String, required): 비밀번호\n" +
+                    "\n**Response:**\n" +
+                    "  - 성공 시 200(OK)과 `BackofficeLoginResponseDTO` 객체 반환\n" +
+                    "  - `memberId` (Long): 회원 ID\n" +
+                    "  - `role` (UserRole): BACKOFFICE\n" +
+                    "  - `status` (ActivationStatus): 회원 상태\n" +
+                    "  - `tokens` (Object): JWT 토큰 정보 (accessToken, refreshToken)\n" +
+                    "  - `basicInfo` (UserBasicInfo): 운영자 이름 등 기본 정보\n" +
+                    "  - 403(FORBIDDEN): BACKOFFICE 역할이 아닌 계정\n" +
+                    "  - 401(UNAUTHORIZED): 이메일 또는 비밀번호 불일치"
+    )
+    @PostMapping(value = "/login", consumes = MediaType.APPLICATION_JSON_VALUE)
+    public BaseResponse<BackofficeLoginResponseDTO> login(
+            @io.swagger.v3.oas.annotations.parameters.RequestBody(
+                    required = true,
+                    description = "백오피스 로그인 요청",
+                    content = @Content(
+                            mediaType = MediaType.APPLICATION_JSON_VALUE,
+                            schema = @Schema(implementation = CommonLoginRequestDTO.class)
+                    )
+            )
+            @RequestBody
+            @Valid
+            CommonLoginRequestDTO request
+    ) {
+        return BaseResponse.onSuccess(SuccessStatus._OK, backofficeAuthService.login(request));
+    }
+
+    @Operation(
+            summary = "백오피스 Access Token 갱신 API",
+            description = "# [v1.0 (2026-06-23)]\n" +
+                    "- 헤더로 호출합니다.\n" +
+                    "- 헤더: `RefreshToken: <refreshToken>`.\n" +
+                    "- `aud=backoffice` Refresh Token만 갱신할 수 있습니다.\n" +
+                    "- 처리: Refresh 검증/회전 후 신규 Access/Refresh 발급 및 저장.\n" +
+                    "- 성공 시 200(OK)과 신규 토큰 반환.\n" +
+                    "\n**Headers:**\n" +
+                    "  - `RefreshToken` (String, required): 백오피스 리프레시 토큰\n" +
+                    "\n**Response:**\n" +
+                    "  - 성공 시 200(OK)과 `RefreshResponseDTO` 객체 반환\n" +
+                    "  - `memberId` (Long): 회원 ID\n" +
+                    "  - `newAccess` (String): 새로운 액세스 토큰\n" +
+                    "  - `newRefresh` (String): 새로운 리프레시 토큰\n" +
+                    "  - 401(UNAUTHORIZED): audience 불일치 또는 유효하지 않은 Refresh Token"
+    )
+    @PostMapping("/tokens/refresh")
+    public BaseResponse<RefreshResponseDTO> refresh(
+            @Parameter(
+                    name = "RefreshToken",
+                    description = "Backoffice Refresh Token",
+                    required = true,
+                    in = ParameterIn.HEADER,
+                    schema = @Schema(type = "string")
+            )
+            @RequestHeader("RefreshToken")
+            String refreshToken
+    ) {
+        return BaseResponse.onSuccess(SuccessStatus._OK, backofficeAuthService.refresh(refreshToken));
+    }
+}

src/main/java/com/assu/server/domain/auth/dto/backoffice/BackofficeLoginResponseDTO.java

@@ -0,0 +1,36 @@
+package com.assu.server.domain.auth.dto.backoffice;
+
+import com.assu.server.domain.auth.dto.common.TokensDTO;
+import com.assu.server.domain.auth.dto.common.UserBasicInfoDTO;
+import com.assu.server.domain.common.enums.ActivationStatus;
+import com.assu.server.domain.common.enums.UserRole;
+import com.assu.server.domain.member.entity.Member;
+import io.swagger.v3.oas.annotations.media.Schema;
+
+@Schema(description = "백오피스 로그인 성공 응답")
+public record BackofficeLoginResponseDTO(
+        @Schema(description = "회원 ID", example = "1")
+        Long memberId,
+
+        @Schema(description = "회원 역할", example = "BACKOFFICE")
+        UserRole role,
+
+        @Schema(description = "회원 상태", example = "ACTIVE")
+        ActivationStatus status,
+
+        @Schema(description = "액세스/리프레시 토큰")
+        TokensDTO tokens,
+
+        @Schema(description = "운영자 기본 정보")
+        UserBasicInfoDTO basicInfo
+) {
+    public static BackofficeLoginResponseDTO from(Member member, TokensDTO tokens) {
+        return new BackofficeLoginResponseDTO(
+                member.getId(),
+                member.getRole(),
+                member.getIsActivated(),
+                tokens,
+                UserBasicInfoDTO.from(member)
+        );
+    }
+}

src/main/java/com/assu/server/domain/auth/dto/common/UserBasicInfoDTO.java

@@ -51,6 +51,12 @@ public static UserBasicInfoDTO from(Member member) {
                     name = partner.getName();
                 }
             }
+            case BACKOFFICE -> {
+                var backofficeUser = member.getBackofficeProfile();
+                if (backofficeUser != null) {
+                    name = backofficeUser.getName();
+                }
+            }
         }
 
         return new UserBasicInfoDTO(name, university, department, major);

src/main/java/com/assu/server/domain/auth/security/adapter/CommonAuthAdapter.java

@@ -69,14 +69,14 @@ public void registerCredentials(Member member, String email, String rawPassword)
             throw new CustomAuthException(ErrorStatus.EXISTED_EMAIL);
         }
         String hash = passwordEncoder.encode(rawPassword);
-        commonAuthRepository.save(
-                CommonAuth.builder()
-                        .member(member)
-                        .email(email)
-                        .hashedPassword(hash)
-                        .lastLoginAt(LocalDateTime.now())
-                        .build()
-        );
+        CommonAuth commonAuth = CommonAuth.builder()
+                .member(member)
+                .email(email)
+                .hashedPassword(hash)
+                .lastLoginAt(LocalDateTime.now())
+                .build();
+        commonAuthRepository.save(commonAuth);
+        member.setCommonAuth(commonAuth);
     }
 
     @Override