11장: 실전 프로젝트 -- Rust 백엔드 API 구축

POST   /auth/register     — 회원가입
POST   /auth/login         — 로그인
 
GET    /bookmarks          — 북마크 목록 (페이지네이션, 검색)
POST   /bookmarks          — 북마크 생성
GET    /bookmarks/{id}     — 북마크 상세
PUT    /bookmarks/{id}     — 북마크 수정
DELETE /bookmarks/{id}     — 북마크 삭제
 
GET    /tags               — 태그 목록
GET    /health             — 헬스 체크

bookmark-api/
  Cargo.toml
  .env
  migrations/
    20260405_001_create_users.sql
    20260405_002_create_bookmarks.sql
  src/
    main.rs
    lib.rs
    config.rs
    error.rs
    state.rs
    routes/
      mod.rs
      auth.rs
      bookmarks.rs
      health.rs
    handlers/
      mod.rs
      auth.rs
      bookmarks.rs
    models/
      mod.rs
      user.rs
      bookmark.rs
    middleware/
      mod.rs
      auth.rs
    services/
      mod.rs
      auth.rs
      bookmark.rs
  tests/
    common/mod.rs
    auth_test.rs
    bookmarks_test.rs
  Dockerfile
  docker-compose.yml

CREATE TABLE IF NOT EXISTS users (
    id          BIGSERIAL PRIMARY KEY,
    email       VARCHAR(255) NOT NULL UNIQUE,
    password    VARCHAR(255) NOT NULL,
    name        VARCHAR(100) NOT NULL,
    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE TABLE IF NOT EXISTS bookmarks (
    id          BIGSERIAL PRIMARY KEY,
    user_id     BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    url         VARCHAR(2048) NOT NULL,
    title       VARCHAR(500) NOT NULL,
    description TEXT,
    tags        TEXT[] NOT NULL DEFAULT '{}',
    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
);
 
CREATE INDEX idx_bookmarks_user_id ON bookmarks(user_id);
CREATE INDEX idx_bookmarks_tags ON bookmarks USING GIN(tags);
CREATE INDEX idx_bookmarks_title_search ON bookmarks USING GIN(to_tsvector('simple', title));

use axum::{
    http::StatusCode,
    response::{IntoResponse, Response},
    Json,
};
use thiserror::Error;
 
#[derive(Debug, Error)]
pub enum AppError {
    #[error("인증 실패: {0}")]
    Unauthorized(String),
 
    #[error("권한 없음: {0}")]
    Forbidden(String),
 
    #[error("리소스를 찾을 수 없습니다: {0}")]
    NotFound(String),
 
    #[error("요청이 잘못되었습니다: {0}")]
    BadRequest(String),
 
    #[error("충돌: {0}")]
    Conflict(String),
 
    #[error("내부 서버 오류")]
    Internal(#[from] anyhow::Error),
 
    #[error("데이터베이스 오류")]
    Database(#[from] sqlx::Error),
}
 
impl IntoResponse for AppError {
    fn into_response(self) -> Response {
        let (status, message) = match &self {
            AppError::Unauthorized(msg) => (StatusCode::UNAUTHORIZED, msg.clone()),
            AppError::Forbidden(msg) => (StatusCode::FORBIDDEN, msg.clone()),
            AppError::NotFound(msg) => (StatusCode::NOT_FOUND, msg.clone()),
            AppError::BadRequest(msg) => (StatusCode::BAD_REQUEST, msg.clone()),
            AppError::Conflict(msg) => (StatusCode::CONFLICT, msg.clone()),
            AppError::Internal(_) => (
                StatusCode::INTERNAL_SERVER_ERROR,
                "내부 서버 오류가 발생했습니다".to_string(),
            ),
            AppError::Database(_) => (
                StatusCode::INTERNAL_SERVER_ERROR,
                "데이터베이스 오류가 발생했습니다".to_string(),
            ),
        };
 
        // 내부 에러는 로깅하고 클라이언트에게는 일반 메시지만 반환
        if matches!(&self, AppError::Internal(_) | AppError::Database(_)) {
            tracing::error!(error = ?self, "내부 오류 발생");
        }
 
        let body = Json(serde_json::json!({
            "error": {
                "message": message,
                "code": status.as_u16(),
            }
        }));
 
        (status, body).into_response()
    }
}

use sqlx::PgPool;
use crate::config::AppConfig;
 
#[derive(Clone)]
pub struct AppState {
    pub db: PgPool,
    pub config: AppConfig,
}

use argon2::{
    password_hash::{rand_core::OsRng, SaltString, PasswordHash, PasswordHasher, PasswordVerifier},
    Argon2,
};
use jsonwebtoken::{encode, decode, Header, EncodingKey, DecodingKey, Validation};
use serde::{Deserialize, Serialize};
use crate::error::AppError;
 
#[derive(Debug, Serialize, Deserialize, Clone)]
pub struct Claims {
    pub sub: i64,       // 사용자 ID
    pub email: String,
    pub exp: usize,     // 만료 시간 (Unix timestamp)
    pub iat: usize,     // 발행 시간
}
 
pub fn hash_password(password: &str) -> Result<String, AppError> {
    let salt = SaltString::generate(&mut OsRng);
    let argon2 = Argon2::default();
 
    argon2
        .hash_password(password.as_bytes(), &salt)
        .map(|h| h.to_string())
        .map_err(|e| AppError::Internal(anyhow::anyhow!("비밀번호 해싱 실패: {}", e)))
}
 
pub fn verify_password(password: &str, hash: &str) -> Result<bool, AppError> {
    let parsed_hash = PasswordHash::new(hash)
        .map_err(|e| AppError::Internal(anyhow::anyhow!("해시 파싱 실패: {}", e)))?;
 
    Ok(Argon2::default()
        .verify_password(password.as_bytes(), &parsed_hash)
        .is_ok())
}
 
pub fn create_token(user_id: i64, email: &str, secret: &str, expiry_hours: u64) -> Result<String, AppError> {
    let now = chrono::Utc::now();
    let claims = Claims {
        sub: user_id,
        email: email.to_string(),
        exp: (now + chrono::Duration::hours(expiry_hours as i64)).timestamp() as usize,
        iat: now.timestamp() as usize,
    };
 
    encode(
        &Header::default(),
        &claims,
        &EncodingKey::from_secret(secret.as_bytes()),
    )
    .map_err(|e| AppError::Internal(anyhow::anyhow!("토큰 생성 실패: {}", e)))
}
 
pub fn verify_token(token: &str, secret: &str) -> Result<Claims, AppError> {
    decode::<Claims>(
        token,
        &DecodingKey::from_secret(secret.as_bytes()),
        &Validation::default(),
    )
    .map(|data| data.claims)
    .map_err(|_| AppError::Unauthorized("유효하지 않은 토큰입니다".to_string()))
}

use axum::{Json, extract::State, http::StatusCode};
use serde::{Deserialize, Serialize};
use std::sync::Arc;
use crate::{error::AppError, state::AppState, services::auth};
 
#[derive(Deserialize)]
pub struct RegisterRequest {
    pub name: String,
    pub email: String,
    pub password: String,
}
 
#[derive(Deserialize)]
pub struct LoginRequest {
    pub email: String,
    pub password: String,
}
 
#[derive(Serialize)]
pub struct AuthResponse {
    pub token: String,
    pub user: UserInfo,
}
 
#[derive(Serialize)]
pub struct UserInfo {
    pub id: i64,
    pub name: String,
    pub email: String,
}
 
pub async fn register(
    State(state): State<Arc<AppState>>,
    Json(req): Json<RegisterRequest>,
) -> Result<(StatusCode, Json<AuthResponse>), AppError> {
    // 입력 검증
    if req.name.is_empty() || req.name.len() > 100 {
        return Err(AppError::BadRequest("이름은 1-100자여야 합니다".to_string()));
    }
    if req.password.len() < 8 {
        return Err(AppError::BadRequest("비밀번호는 8자 이상이어야 합니다".to_string()));
    }
 
    // 비밀번호 해싱 (CPU 집약적이므로 spawn_blocking)
    let password = req.password.clone();
    let hashed = tokio::task::spawn_blocking(move || {
        auth::hash_password(&password)
    })
    .await
    .map_err(|e| AppError::Internal(anyhow::anyhow!("{}", e)))??;
 
    // 사용자 생성
    let user = sqlx::query_as::<_, (i64, String, String)>(
        "INSERT INTO users (name, email, password) VALUES ($1, $2, $3) RETURNING id, name, email",
    )
    .bind(&req.name)
    .bind(&req.email)
    .bind(&hashed)
    .fetch_one(&state.db)
    .await
    .map_err(|e| match e {
        sqlx::Error::Database(ref db_err) if db_err.is_unique_violation() => {
            AppError::Conflict("이미 등록된 이메일입니다".to_string())
        }
        _ => AppError::Database(e),
    })?;
 
    // JWT 토큰 생성
    let token = auth::create_token(
        user.0,
        &user.2,
        &state.config.auth.jwt_secret,
        state.config.auth.token_expiry_hours,
    )?;
 
    Ok((
        StatusCode::CREATED,
        Json(AuthResponse {
            token,
            user: UserInfo {
                id: user.0,
                name: user.1,
                email: user.2,
            },
        }),
    ))
}
 
pub async fn login(
    State(state): State<Arc<AppState>>,
    Json(req): Json<LoginRequest>,
) -> Result<Json<AuthResponse>, AppError> {
    // 사용자 조회
    let user = sqlx::query_as::<_, (i64, String, String, String)>(
        "SELECT id, name, email, password FROM users WHERE email = $1",
    )
    .bind(&req.email)
    .fetch_optional(&state.db)
    .await?
    .ok_or_else(|| AppError::Unauthorized("이메일 또는 비밀번호가 올바르지 않습니다".to_string()))?;
 
    // 비밀번호 검증
    let password = req.password.clone();
    let hash = user.3.clone();
    let valid = tokio::task::spawn_blocking(move || {
        auth::verify_password(&password, &hash)
    })
    .await
    .map_err(|e| AppError::Internal(anyhow::anyhow!("{}", e)))??;
 
    if !valid {
        return Err(AppError::Unauthorized(
            "이메일 또는 비밀번호가 올바르지 않습니다".to_string(),
        ));
    }
 
    let token = auth::create_token(
        user.0,
        &user.2,
        &state.config.auth.jwt_secret,
        state.config.auth.token_expiry_hours,
    )?;
 
    Ok(Json(AuthResponse {
        token,
        user: UserInfo {
            id: user.0,
            name: user.1,
            email: user.2,
        },
    }))
}

use axum::{Json, extract::{Path, Query, State, Extension}};
use axum::http::StatusCode;
use serde::{Deserialize, Serialize};
use std::sync::Arc;
use crate::{error::AppError, state::AppState, services::auth::Claims};
 
#[derive(Debug, sqlx::FromRow, Serialize)]
pub struct Bookmark {
    pub id: i64,
    pub user_id: i64,
    pub url: String,
    pub title: String,
    pub description: Option<String>,
    pub tags: Vec<String>,
    pub created_at: chrono::DateTime<chrono::Utc>,
    pub updated_at: chrono::DateTime<chrono::Utc>,
}
 
#[derive(Deserialize)]
pub struct CreateBookmarkRequest {
    pub url: String,
    pub title: String,
    pub description: Option<String>,
    pub tags: Option<Vec<String>>,
}
 
#[derive(Deserialize)]
pub struct ListBookmarksQuery {
    pub page: Option<i64>,
    pub per_page: Option<i64>,
    pub search: Option<String>,
    pub tag: Option<String>,
}
 
#[derive(Serialize)]
pub struct PaginatedResponse<T> {
    pub data: Vec<T>,
    pub total: i64,
    pub page: i64,
    pub per_page: i64,
}
 
pub async fn list(
    State(state): State<Arc<AppState>>,
    Extension(claims): Extension<Claims>,
    Query(params): Query<ListBookmarksQuery>,
) -> Result<Json<PaginatedResponse<Bookmark>>, AppError> {
    let page = params.page.unwrap_or(1).max(1);
    let per_page = params.per_page.unwrap_or(20).clamp(1, 100);
    let offset = (page - 1) * per_page;
 
    let (bookmarks, total) = match (&params.search, &params.tag) {
        (Some(search), _) => {
            let items = sqlx::query_as::<_, Bookmark>(
                r#"
                SELECT * FROM bookmarks
                WHERE user_id = $1 AND to_tsvector('simple', title) @@ plainto_tsquery('simple', $2)
                ORDER BY created_at DESC LIMIT $3 OFFSET $4
                "#,
            )
            .bind(claims.sub)
            .bind(search)
            .bind(per_page)
            .bind(offset)
            .fetch_all(&state.db)
            .await?;
 
            let count = sqlx::query_as::<_, (i64,)>(
                r#"
                SELECT COUNT(*) FROM bookmarks
                WHERE user_id = $1 AND to_tsvector('simple', title) @@ plainto_tsquery('simple', $2)
                "#,
            )
            .bind(claims.sub)
            .bind(search)
            .fetch_one(&state.db)
            .await?;
 
            (items, count.0)
        }
        (_, Some(tag)) => {
            let items = sqlx::query_as::<_, Bookmark>(
                r#"
                SELECT * FROM bookmarks
                WHERE user_id = $1 AND $2 = ANY(tags)
                ORDER BY created_at DESC LIMIT $3 OFFSET $4
                "#,
            )
            .bind(claims.sub)
            .bind(tag)
            .bind(per_page)
            .bind(offset)
            .fetch_all(&state.db)
            .await?;
 
            let count = sqlx::query_as::<_, (i64,)>(
                "SELECT COUNT(*) FROM bookmarks WHERE user_id = $1 AND $2 = ANY(tags)",
            )
            .bind(claims.sub)
            .bind(tag)
            .fetch_one(&state.db)
            .await?;
 
            (items, count.0)
        }
        _ => {
            let items = sqlx::query_as::<_, Bookmark>(
                r#"
                SELECT * FROM bookmarks
                WHERE user_id = $1
                ORDER BY created_at DESC LIMIT $2 OFFSET $3
                "#,
            )
            .bind(claims.sub)
            .bind(per_page)
            .bind(offset)
            .fetch_all(&state.db)
            .await?;
 
            let count = sqlx::query_as::<_, (i64,)>(
                "SELECT COUNT(*) FROM bookmarks WHERE user_id = $1",
            )
            .bind(claims.sub)
            .fetch_one(&state.db)
            .await?;
 
            (items, count.0)
        }
    };
 
    Ok(Json(PaginatedResponse {
        data: bookmarks,
        total,
        page,
        per_page,
    }))
}
 
pub async fn create(
    State(state): State<Arc<AppState>>,
    Extension(claims): Extension<Claims>,
    Json(req): Json<CreateBookmarkRequest>,
) -> Result<(StatusCode, Json<Bookmark>), AppError> {
    let tags = req.tags.unwrap_or_default();
 
    let bookmark = sqlx::query_as::<_, Bookmark>(
        r#"
        INSERT INTO bookmarks (user_id, url, title, description, tags)
        VALUES ($1, $2, $3, $4, $5)
        RETURNING *
        "#,
    )
    .bind(claims.sub)
    .bind(&req.url)
    .bind(&req.title)
    .bind(&req.description)
    .bind(&tags)
    .fetch_one(&state.db)
    .await?;
 
    Ok((StatusCode::CREATED, Json(bookmark)))
}
 
pub async fn get_one(
    State(state): State<Arc<AppState>>,
    Extension(claims): Extension<Claims>,
    Path(id): Path<i64>,
) -> Result<Json<Bookmark>, AppError> {
    let bookmark = sqlx::query_as::<_, Bookmark>(
        "SELECT * FROM bookmarks WHERE id = $1 AND user_id = $2",
    )
    .bind(id)
    .bind(claims.sub)
    .fetch_optional(&state.db)
    .await?
    .ok_or(AppError::NotFound(format!("북마크 id={}", id)))?;
 
    Ok(Json(bookmark))
}
 
pub async fn delete(
    State(state): State<Arc<AppState>>,
    Extension(claims): Extension<Claims>,
    Path(id): Path<i64>,
) -> Result<StatusCode, AppError> {
    let result = sqlx::query(
        "DELETE FROM bookmarks WHERE id = $1 AND user_id = $2",
    )
    .bind(id)
    .bind(claims.sub)
    .execute(&state.db)
    .await?;
 
    if result.rows_affected() == 0 {
        Err(AppError::NotFound(format!("북마크 id={}", id)))
    } else {
        Ok(StatusCode::NO_CONTENT)
    }
}

use axum::{Router, middleware};
use std::sync::Arc;
use crate::state::AppState;
 
pub mod auth;
pub mod bookmarks;
pub mod health;
 
pub fn create_router(state: Arc<AppState>) -> Router {
    let public_routes = Router::new()
        .merge(auth::routes())
        .merge(health::routes());
 
    let protected_routes = Router::new()
        .merge(bookmarks::routes())
        .layer(middleware::from_fn_with_state(
            state.clone(),
            crate::middleware::auth::auth_middleware,
        ));
 
    Router::new()
        .merge(public_routes)
        .merge(protected_routes)
        .with_state(state)
}

# 빌드 스테이지
FROM rust:1.83-slim AS builder
 
WORKDIR /app
 
# 의존성 캐싱을 위해 Cargo 파일만 먼저 복사
COPY Cargo.toml Cargo.lock ./
RUN mkdir src && echo "fn main() {}" > src/main.rs
RUN cargo build --release && rm -rf src
 
# 소스 복사 및 빌드
COPY . .
RUN touch src/main.rs && cargo build --release
 
# 실행 스테이지
FROM debian:bookworm-slim
 
RUN apt-get update && apt-get install -y \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*
 
COPY --from=builder /app/target/release/bookmark-api /usr/local/bin/
COPY --from=builder /app/migrations /app/migrations
 
WORKDIR /app
 
EXPOSE 3000
 
CMD ["bookmark-api", "serve"]

services:
  db:
    image: postgres:16
    environment:
      POSTGRES_USER: bookmark
      POSTGRES_PASSWORD: bookmark_pass
      POSTGRES_DB: bookmark_db
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
 
  api:
    build: .
    ports:
      - "3000:3000"
    environment:
      APP_DATABASE__URL: postgresql://bookmark:bookmark_pass@db/bookmark_db
      APP_AUTH__JWT_SECRET: production-secret-change-me
      APP_SERVER__PORT: "3000"
      LOG_LEVEL: info
    depends_on:
      - db
 
volumes:
  pgdata:

docker compose up -d

# wrk 설치 (macOS)
brew install wrk
 
# GET /health 벤치마크
wrk -t4 -c100 -d30s http://localhost:3000/health
 
# 인증 후 GET /bookmarks 벤치마크
TOKEN=$(curl -s -X POST http://localhost:3000/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"test@example.com","password":"12345678"}' \
  | jq -r '.token')
 
wrk -t4 -c100 -d30s -H "Authorization: Bearer $TOKEN" \
  http://localhost:3000/bookmarks