[Fix] 역할 회수 API 및 Redis 캐시 기반 권한 즉시 반영

backend/src/main/java/com/opensource/docgrid/domain/auth/jwt/JwtAuthenticationFilter.java

@@ -23,9 +23,9 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
     private final JwtProvider jwtProvider;
     private final TokenBlacklistService tokenBlacklistService;
+    private final RoleAuthorityService roleAuthorityService;
 
     @Override
-    @SuppressWarnings("unchecked")
     protected void doFilterInternal(HttpServletRequest request,
                                     HttpServletResponse response,
                                     FilterChain filterChain) throws ServletException, IOException {
@@ -36,7 +36,7 @@ protected void doFilterInternal(HttpServletRequest request,
             if (claims != null && !isBlacklisted(claims.get("jti", String.class))) {
                 Long userId = claims.get("userId", Long.class);
                 String email = claims.getSubject();
-                List<String> roles = (List<String>) claims.get("roles");
+                List<String> roles = roleAuthorityService.getRoles(userId);
 
                 List<SimpleGrantedAuthority> authorities = roles.stream()
                         .map(role -> new SimpleGrantedAuthority("ROLE_" + role))

backend/src/main/java/com/opensource/docgrid/domain/auth/jwt/JwtProvider.java

@@ -2,7 +2,6 @@
 
 import java.nio.charset.StandardCharsets;
 import java.util.Date;
-import java.util.List;
 import java.util.UUID;
 
 import javax.crypto.SecretKey;
@@ -32,14 +31,14 @@ public JwtProvider(
         this.expirationSeconds = expirationSeconds;
     }
 
-    public String generateToken(Long userId, String email, List<String> roles) {
+    public String generateToken(Long userId, String email) {
         Date now = new Date();
         Date expiry = new Date(now.getTime() + expirationSeconds * 1000);
 
+        // role은 RoleAuthorityService가 매 요청 DB(+Redis 캐시)에서 조회하므로 토큰에 담지 않는다.
         return Jwts.builder()
                 .subject(email)
                 .claim("userId", userId)
-                .claim("roles", roles)
                 .claim("jti", UUID.randomUUID().toString())
                 .issuedAt(now)
                 .expiration(expiry)

backend/src/main/java/com/opensource/docgrid/domain/auth/jwt/RoleAuthorityService.java

@@ -0,0 +1,75 @@
+package com.opensource.docgrid.domain.auth.jwt;
+
+import java.time.Duration;
+import java.util.Arrays;
+import java.util.List;
+
+import org.springframework.data.redis.core.StringRedisTemplate;
+import org.springframework.stereotype.Component;
+
+import com.opensource.docgrid.domain.user.repository.UserRoleRepository;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * 인가(hasRole) 판단에 쓰는 사용자 role을 JWT가 아니라 DB에서 매 요청 조회한다.
+ *
+ * <p>JWT에 role을 박제하면 관리자가 role을 부여/회수해도 재로그인 전까지 반영되지 않는다.
+ * DB 조회 부하를 줄이기 위해 Redis에 짧은 TTL로 캐싱하고, role 변경 시 즉시 무효화한다.
+ *
+ * <p>이 서비스는 인증 필터(모든 요청)의 critical path에 있으므로, {@code TokenBlacklistService}와
+ * 동일하게 Redis 장애 시 예외를 전파하지 않고 DB 조회로 폴백한다 — Redis가 죽었다고 전체 API가
+ * 막히면 안 된다.
+ */
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class RoleAuthorityService {
+
+    private static final String KEY_PREFIX = "auth:roles:";
+    private static final Duration TTL = Duration.ofSeconds(30);
+
+    private final StringRedisTemplate redisTemplate;
+    private final UserRoleRepository userRoleRepository;
+
+    public List<String> getRoles(Long userId) {
+        // 1. 먼저 Redis 캐시를 확인한다 — 대부분의 요청은 여기서 끝나 DB 부하를 줄인다.
+        String cached = readCache(userId);
+        if (cached != null) {
+            return cached.isBlank() ? List.of() : Arrays.asList(cached.split(","));
+        }
+
+        // 2. 캐시 미스면 DB에서 최신 role을 조회한다(source of truth).
+        List<String> roles = userRoleRepository.findRoleCodesByUserId(userId);
+
+        // 3. 다음 요청부터는 캐시로 처리되도록 짧은 TTL로 저장해둔다.
+        writeCache(userId, roles);
+        return roles;
+    }
+
+    public void invalidate(Long userId) {
+        try {
+            redisTemplate.delete(KEY_PREFIX + userId);
+        } catch (Exception e) {
+            log.error("Redis role 캐시 무효화 실패, userId={}: {}", userId, e.getMessage());
+        }
+    }
+
+    private String readCache(Long userId) {
+        try {
+            return redisTemplate.opsForValue().get(KEY_PREFIX + userId);
+        } catch (Exception e) {
+            log.error("Redis role 캐시 조회 실패, DB로 폴백합니다. userId={}: {}", userId, e.getMessage());
+            return null;
+        }
+    }
+
+    private void writeCache(Long userId, List<String> roles) {
+        try {
+            redisTemplate.opsForValue().set(KEY_PREFIX + userId, String.join(",", roles), TTL);
+        } catch (Exception e) {
+            log.error("Redis role 캐시 저장 실패, userId={}: {}", userId, e.getMessage());
+        }
+    }
+}

backend/src/main/java/com/opensource/docgrid/domain/auth/jwt/StompAuthChannelInterceptor.java

@@ -51,9 +51,9 @@ public class StompAuthChannelInterceptor implements ChannelInterceptor {
     private static final String BEARER_PREFIX = "Bearer ";
 
     private final JwtProvider jwtProvider;
+    private final RoleAuthorityService roleAuthorityService;
 
     @Override
-    @SuppressWarnings("unchecked")
     public Message<?> preSend(Message<?> message, MessageChannel channel) {
         StompHeaderAccessor accessor = MessageHeaderAccessor.getAccessor(message, StompHeaderAccessor.class);
 
@@ -68,7 +68,7 @@ public Message<?> preSend(Message<?> message, MessageChannel channel) {
 
             String email = claims.getSubject();
             Long userId = claims.get("userId", Long.class);
-            List<String> roles = (List<String>) claims.get("roles");
+            List<String> roles = roleAuthorityService.getRoles(userId);
             List<SimpleGrantedAuthority> authorities = roles.stream()
                 .map(role -> new SimpleGrantedAuthority("ROLE_" + role))
                 .toList();

backend/src/main/java/com/opensource/docgrid/domain/auth/service/command/AuthCommandService.java

@@ -98,7 +98,7 @@ public LoginResponse login(LoginRequest request) {
 
         List<String> roles = userRoleRepository.findRoleCodesByUserId(user.getId());
 
-        String token = jwtProvider.generateToken(user.getId(), user.getEmail(), roles);
+        String token = jwtProvider.generateToken(user.getId(), user.getEmail());
 
         return LoginResponse.of(token, jwtProvider.getExpirationSeconds(), user.getId(), user.getEmail(), roles);
     }

backend/src/main/java/com/opensource/docgrid/domain/user/controller/AdminUserController.java

@@ -2,6 +2,7 @@
 
 import org.springframework.http.ResponseEntity;
 import org.springframework.validation.annotation.Validated;
+import org.springframework.web.bind.annotation.DeleteMapping;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PatchMapping;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -71,6 +72,18 @@ public ResponseEntity<ApiResponse<UserRoleResponse>> assignRole(
         return ResponseUtils.ok(userRoleCommandService.assignRole(userId, adminUserId, request));
     }
 
+    @Operation(
+            summary = "역할 회수",
+            description = "특정 사용자에게 부여된 역할을 회수합니다. ADMIN 권한이 필요합니다. "
+                    + "부여되지 않은 역할이면 404를 반환합니다. 재로그인 없이 다음 요청부터 즉시 반영됩니다."
+    )
+    @DeleteMapping("/{userId}/roles/{roleCode}")
+    public ResponseEntity<ApiResponse<UserRoleResponse>> revokeRole(
+            @PathVariable Long userId,
+            @PathVariable String roleCode) {
+        return ResponseUtils.ok(userRoleCommandService.revokeRole(userId, roleCode));
+    }
+
     @Operation(
             summary = "사용자 부서 변경",
             description = "특정 사용자의 소속 부서를 변경합니다. ADMIN 권한이 필요합니다. "

backend/src/main/java/com/opensource/docgrid/domain/user/repository/UserRoleRepository.java

@@ -1,6 +1,7 @@
 package com.opensource.docgrid.domain.user.repository;
 
 import java.util.List;
+import java.util.Optional;
 
 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.data.jpa.repository.Query;
@@ -30,4 +31,6 @@ public interface UserRoleRepository extends JpaRepository<UserRole, Long> {
     List<String> findRoleCodesByUserId(@Param("userId") Long userId);
 
     boolean existsByUserIdAndRoleCode(Long userId, String roleCode);
+
+    Optional<UserRole> findByUserIdAndRoleCode(Long userId, String roleCode);
 }

backend/src/main/java/com/opensource/docgrid/domain/user/service/command/UserRoleCommandService.java

@@ -5,7 +5,10 @@
 
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
+import org.springframework.transaction.support.TransactionSynchronization;
+import org.springframework.transaction.support.TransactionSynchronizationManager;
 
+import com.opensource.docgrid.domain.auth.jwt.RoleAuthorityService;
 import com.opensource.docgrid.domain.user.dto.request.AssignRoleRequest;
 import com.opensource.docgrid.domain.user.dto.response.UserRoleResponse;
 import com.opensource.docgrid.domain.user.entity.Role;
@@ -27,6 +30,7 @@ public class UserRoleCommandService {
     private final UserRepository userRepository;
     private final RoleRepository roleRepository;
     private final UserRoleRepository userRoleRepository;
+    private final RoleAuthorityService roleAuthorityService;
 
     // 관리자가 다른 사용자에게 역할을 부여
     public UserRoleResponse assignRole(Long targetUserId, Long adminUserId, AssignRoleRequest request) {
@@ -50,11 +54,46 @@ public UserRoleResponse assignRole(Long targetUserId, Long adminUserId, AssignRo
                 .assignedAt(LocalDateTime.now())
                 .build();
         userRoleRepository.save(userRole);
+        invalidateAfterCommit(targetUserId);
 
         List<String> roles = userRoleRepository.findAllWithRoleByUserId(targetUserId).stream()
                 .map(ur -> ur.getRole().getCode())
                 .toList();
 
         return UserRoleResponse.of(targetUser, roles);
     }
+
+    // 관리자가 다른 사용자에게 부여된 역할을 회수
+    public UserRoleResponse revokeRole(Long targetUserId, String roleCode) {
+        User targetUser = userRepository.findById(targetUserId)
+                .orElseThrow(() -> new DocGridException(ErrorCode.USER_NOT_FOUND));
+
+        UserRole userRole = userRoleRepository.findByUserIdAndRoleCode(targetUserId, roleCode)
+                .orElseThrow(() -> new DocGridException(ErrorCode.ROLE_NOT_ASSIGNED));
+
+        userRoleRepository.delete(userRole);
+        invalidateAfterCommit(targetUserId);
+
+        List<String> roles = userRoleRepository.findAllWithRoleByUserId(targetUserId).stream()
+                .map(ur -> ur.getRole().getCode())
+                .toList();
+
+        return UserRoleResponse.of(targetUser, roles);
+    }
+
+    // DB 커밋 전에 캐시를 지우면, 커밋 직전 시점에 캐시 미스가 난 다른 요청이 아직 커밋 안 된(옛날) role을
+    // 다시 캐시에 채워 넣을 수 있다. 그래서 무효화는 반드시 트랜잭션 커밋 이후로 미룬다.
+    // 트랜잭션 밖에서 호출되는 경우(예: 단위 테스트)는 즉시 무효화한다.
+    private void invalidateAfterCommit(Long userId) {
+        if (TransactionSynchronizationManager.isSynchronizationActive()) {
+            TransactionSynchronizationManager.registerSynchronization(new TransactionSynchronization() {
+                @Override
+                public void afterCommit() {
+                    roleAuthorityService.invalidate(userId);
+                }
+            });
+        } else {
+            roleAuthorityService.invalidate(userId);
+        }
+    }
 }

backend/src/main/java/com/opensource/docgrid/global/config/SecurityConfig.java

@@ -14,6 +14,7 @@
 
 import com.opensource.docgrid.domain.auth.jwt.JwtAuthenticationFilter;
 import com.opensource.docgrid.domain.auth.jwt.JwtProvider;
+import com.opensource.docgrid.domain.auth.jwt.RoleAuthorityService;
 import com.opensource.docgrid.domain.auth.jwt.TokenBlacklistService;
 import com.opensource.docgrid.domain.mcp.security.McpApiKeyAuthFilter;
 import com.opensource.docgrid.domain.mcp.service.command.McpAccessTokenCommandService;
@@ -28,6 +29,7 @@ public class SecurityConfig {
     private final CorsConfigurationSource corsConfigurationSource;
     private final JwtProvider jwtProvider;
     private final TokenBlacklistService tokenBlacklistService;
+    private final RoleAuthorityService roleAuthorityService;
     private final McpAccessTokenCommandService mcpAccessTokenCommandService;
 
     @Bean
@@ -57,7 +59,7 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
              *   - JwtAuthenticationFilter  → 웹 로그인(JWT), /mcp/tokens 등 일반 API 담당
              *   - McpApiKeyAuthFilter      → Claude Desktop API 키, /mcp 경로만 담당
              */
-            .addFilterBefore(new JwtAuthenticationFilter(jwtProvider, tokenBlacklistService), UsernamePasswordAuthenticationFilter.class)
+            .addFilterBefore(new JwtAuthenticationFilter(jwtProvider, tokenBlacklistService, roleAuthorityService), UsernamePasswordAuthenticationFilter.class)
             .addFilterBefore(new McpApiKeyAuthFilter(mcpAccessTokenCommandService), UsernamePasswordAuthenticationFilter.class);
         return http.build();
     }

backend/src/main/java/com/opensource/docgrid/global/exception/ErrorCode.java

@@ -38,6 +38,7 @@ public enum ErrorCode {
     ROLE_NOT_FOUND(HttpStatus.BAD_REQUEST, "ROLE-001", "존재하지 않는 역할입니다."),
     PERMISSION_DENIED(HttpStatus.FORBIDDEN, "ROLE-002", "접근 권한이 없습니다."),
     ROLE_ALREADY_ASSIGNED(HttpStatus.CONFLICT, "ROLE-003", "이미 부여된 역할입니다."),
+    ROLE_NOT_ASSIGNED(HttpStatus.NOT_FOUND, "ROLE-004", "부여되지 않은 역할입니다."),
 
     // COLLECTION
     COLLECTION_NOT_FOUND(HttpStatus.NOT_FOUND, "COLLECTION-001", "컬렉션을 찾을 수 없습니다."),

backend/src/test/java/com/opensource/docgrid/domain/auth/jwt/JwtAuthenticationFilterTest.java

@@ -27,13 +27,16 @@ class JwtAuthenticationFilterTest {
     @Mock
     private TokenBlacklistService tokenBlacklistService;
 
+    @Mock
+    private RoleAuthorityService roleAuthorityService;
+
     private JwtProvider jwtProvider;
     private JwtAuthenticationFilter filter;
 
     @BeforeEach
     void setUp() {
         jwtProvider = new JwtProvider(TEST_SECRET, 3600L);
-        filter = new JwtAuthenticationFilter(jwtProvider, tokenBlacklistService);
+        filter = new JwtAuthenticationFilter(jwtProvider, tokenBlacklistService, roleAuthorityService);
         SecurityContextHolder.clearContext();
     }
 
@@ -45,8 +48,9 @@ void tearDown() {
     @Test
     @DisplayName("유효하고 블랙리스트에 없는 토큰이면 인증에 성공한다")
     void doFilter_authenticates_whenTokenValidAndNotBlacklisted() throws Exception {
-        String token = jwtProvider.generateToken(1L, "user@test.com", List.of("USER"));
+        String token = jwtProvider.generateToken(1L, "user@test.com");
         given(tokenBlacklistService.isBlacklisted(anyString())).willReturn(false);
+        given(roleAuthorityService.getRoles(1L)).willReturn(List.of("USER"));
 
         filter.doFilter(requestWithToken(token), new MockHttpServletResponse(), new MockFilterChain());
 
@@ -56,7 +60,7 @@ void doFilter_authenticates_whenTokenValidAndNotBlacklisted() throws Exception {
     @Test
     @DisplayName("블랙리스트에 등록된 토큰이면 인증하지 않는다")
     void doFilter_doesNotAuthenticate_whenTokenBlacklisted() throws Exception {
-        String token = jwtProvider.generateToken(1L, "user@test.com", List.of("USER"));
+        String token = jwtProvider.generateToken(1L, "user@test.com");
         given(tokenBlacklistService.isBlacklisted(anyString())).willReturn(true);
 
         filter.doFilter(requestWithToken(token), new MockHttpServletResponse(), new MockFilterChain());
@@ -67,8 +71,9 @@ void doFilter_doesNotAuthenticate_whenTokenBlacklisted() throws Exception {
     @Test
     @DisplayName("블랙리스트 조회가 실패해도(Redis 장애) 인증은 계속 진행된다")
     void doFilter_authenticates_whenBlacklistCheckFails() throws Exception {
-        String token = jwtProvider.generateToken(1L, "user@test.com", List.of("USER"));
+        String token = jwtProvider.generateToken(1L, "user@test.com");
         given(tokenBlacklistService.isBlacklisted(anyString())).willThrow(new RuntimeException("redis down"));
+        given(roleAuthorityService.getRoles(1L)).willReturn(List.of("USER"));
 
         filter.doFilter(requestWithToken(token), new MockHttpServletResponse(), new MockFilterChain());
 

backend/src/test/java/com/opensource/docgrid/domain/auth/jwt/JwtProviderTest.java

@@ -0,0 +1,33 @@
+package com.opensource.docgrid.domain.auth.jwt;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import io.jsonwebtoken.Claims;
+
+/**
+ * JWT 발급·검증 계약을 검증한다. 특히 role은 더 이상 토큰에 담기지 않는다는 계약을 고정한다.
+ */
+class JwtProviderTest {
+
+    private static final String TEST_SECRET = "test-secret-key-for-jwt-provider-unit-test";
+
+    private final JwtProvider jwtProvider = new JwtProvider(TEST_SECRET, 3600L);
+
+    @Test
+    @DisplayName("토큰에는 roles claim이 없고, userId/sub/jti/expiration만 담긴다")
+    void generateToken_omitsRolesClaim() {
+        String token = jwtProvider.generateToken(1L, "user@test.com");
+
+        Claims claims = jwtProvider.getClaimsIfValid(token);
+
+        assertThat(claims).isNotNull();
+        assertThat(claims.get("roles")).isNull();
+        assertThat(claims.get("userId", Long.class)).isEqualTo(1L);
+        assertThat(claims.getSubject()).isEqualTo("user@test.com");
+        assertThat(claims.get("jti", String.class)).isNotBlank();
+        assertThat(claims.getExpiration()).isAfter(claims.getIssuedAt());
+    }
+}