[FEAT] 프로필 수정 및 편집 정보 조회에 프로필 이미지 URL 추가

src/main/java/org/sopt/buddys/domain/user/code/UserErrorCode.java

@@ -18,7 +18,8 @@ public enum UserErrorCode implements ErrorCode {
   EXCHANGE_INFO_INCOMPLETE("USER-E007", HttpStatus.BAD_REQUEST, "교환학생 국가, 대학교, 기간은 모두 입력하거나 모두 비워야 합니다."),
   INVALID_TAG_SELECTION_COUNT("USER-E008", HttpStatus.BAD_REQUEST, "활동과 관심사 태그는 각각 1~3개, 여행 스타일 태그는 1~5개 선택해야 합니다."),
   DUPLICATE_TAG("USER-E009", HttpStatus.BAD_REQUEST, "중복된 태그가 포함되어 있습니다."),
-  RESERVED_NICKNAME("USER-E010", HttpStatus.BAD_REQUEST, "사용할 수 없는 닉네임입니다.");
+  RESERVED_NICKNAME("USER-E010", HttpStatus.BAD_REQUEST, "사용할 수 없는 닉네임입니다."),
+  INVALID_PROFILE_IMAGE_URL("USER-E011", HttpStatus.BAD_REQUEST, "사용할 수 없는 프로필 이미지 URL입니다.");
 
   private final String code;
   private final HttpStatus httpStatus;

src/main/java/org/sopt/buddys/domain/user/controller/swagger/CompleteOnboardingSwagger.java

@@ -118,6 +118,17 @@
                           "data": null
                         }
                         """
+                ),
+                @ExampleObject(
+                    name = "허용되지 않는 프로필 이미지 URL",
+                    value = """
+                        {
+                          "success": false,
+                          "code": "USER-E011",
+                          "message": "사용할 수 없는 프로필 이미지 URL입니다.",
+                          "data": null
+                        }
+                        """
                 )
             }
         )

src/main/java/org/sopt/buddys/domain/user/controller/swagger/GetProfileEditSwagger.java

@@ -36,6 +36,7 @@
                     "gender": "FEMALE",
                     "birthDate": "2004-10-24",
                     "bio": "안녕하세요 김버디입니다~~",
+                    "profileImageUrl": "https://example.com/profile.png",
                     "orderedTags": [
                       { "id": 27, "name": "계획형", "tagType": "TRAVEL_STYLE" },
                       { "id": 1, "name": "여행", "tagType": "ACTIVITY" },

src/main/java/org/sopt/buddys/domain/user/controller/swagger/UpdateProfileSwagger.java

@@ -22,6 +22,8 @@
             모든 필드를 요청에 포함해야 합니다.
             태그는 전달된 orderedTagIds로 전체 교체되며,
             bio를 null로 전달하면 기존 자기소개가 삭제됩니다.
+            profileImageUrl을 null로 전달하면 기존 프로필 이미지가 삭제됩니다.
+            profileImageUrl은 이미지 업로드 API(imageDomain=PROFILE)로 발급받은 URL이거나 현재 설정된 값이어야 합니다.
             태그 배열의 앞 3개가 대표 태그입니다.
             """
 )
@@ -42,6 +44,7 @@
                     "gender": "FEMALE",
                     "birthDate": "2004-10-24",
                     "bio": "안녕하세요 김버디입니다~~",
+                    "profileImageUrl": "https://example.com/profile.png",
                     "orderedTags": [
                       { "id": 27, "name": "계획형", "tagType": "TRAVEL_STYLE" },
                       { "id": 1, "name": "여행", "tagType": "ACTIVITY" },
@@ -84,6 +87,17 @@
                         }
                         """
                 ),
+                @ExampleObject(
+                    name = "허용되지 않는 프로필 이미지 URL",
+                    value = """
+                        {
+                          "success": false,
+                          "code": "USER-E011",
+                          "message": "사용할 수 없는 프로필 이미지 URL입니다.",
+                          "data": null
+                        }
+                        """
+                ),
                 @ExampleObject(
                     name = "중복 태그 포함",
                     value = """

src/main/java/org/sopt/buddys/domain/user/dto/request/OnboardingRequest.java

@@ -53,7 +53,7 @@ public record OnboardingRequest(
     @Schema(description = "자기소개. 최대 69자", example = "버디즈 화이팅!", nullable = true)
     @Size(max = 69) String bio,
 
-    @Schema(description = "프로필 이미지 URL", example = "https://example.com/profile.png", nullable = true)
+    @Schema(description = "프로필 이미지 URL. 이미지 업로드 API(imageDomain=PROFILE)로 발급받은 URL 또는 현재 설정된 값만 허용합니다.", example = "https://example.com/profile.png", nullable = true)
     @Size(max = 512) String profileImageUrl
 ) {
     public OnboardingCommand toCommand() {

src/main/java/org/sopt/buddys/domain/user/dto/request/UpdateProfileRequest.java

@@ -47,6 +47,15 @@ public record UpdateProfileRequest(
         @Size(max = 69)
         String bio,
 
+        @Schema(
+                description = "프로필 이미지 URL. 최대 512자. 이미지 업로드 API(imageDomain=PROFILE)로 발급받은 URL 또는 현재 설정된 값만 허용합니다. null이면 기존 프로필 이미지를 삭제합니다.",
+                example = "https://example.com/profile.png",
+                requiredMode = Schema.RequiredMode.REQUIRED,
+                nullable = true
+        )
+        @Size(max = 512)
+        String profileImageUrl,
+
         @Schema(
                 description = """
             드래그앤드롭으로 정렬한 전체 선택 태그 ID 목록입니다.
@@ -67,6 +76,7 @@ public UpdateProfileCommand toCommand() {
                 gender,
                 birthDate,
                 bio,
+                profileImageUrl,
                 orderedTagIds
         );
     }

src/main/java/org/sopt/buddys/domain/user/dto/response/ProfileEditResponse.java

@@ -37,6 +37,14 @@ public record ProfileEditResponse(
         )
         String bio,
 
+        @Schema(
+                description = "프로필 이미지 URL",
+                example = "https://example.com/profile.png",
+                requiredMode = Schema.RequiredMode.REQUIRED,
+                nullable = true
+        )
+        String profileImageUrl,
+
         @Schema(
                 description = "드래그앤드롭으로 지정한 순서대로 정렬된 전체 선택 태그. 앞 3개가 대표 태그",
                 requiredMode = Schema.RequiredMode.REQUIRED
@@ -54,7 +62,7 @@ public static ProfileEditResponse of(User user, List<UserTag> userTags) {
         .toList();
     return new ProfileEditResponse(
         user.getNickname(), user.getGender(), user.getBirthDate(), user.getIntroduction(),
-        orderedTags
+        user.getProfileImageUrl(), orderedTags
     );
   }
 }

src/main/java/org/sopt/buddys/domain/user/entity/User.java

@@ -203,12 +203,14 @@ public void updateProfile(
       String nickname,
       Gender gender,
       LocalDate birthDate,
-      String introduction
+      String introduction,
+      String profileImageUrl
   ) {
     this.nickname = nickname;
     this.gender = gender;
     this.birthDate = birthDate;
     this.introduction = introduction;
+    this.profileImageUrl = profileImageUrl;
   }
 
   public void verifyUniversity(University university) {

src/main/java/org/sopt/buddys/domain/user/service/ProfileImageUrlValidator.java

@@ -0,0 +1,36 @@
+package org.sopt.buddys.domain.user.service;
+
+import java.util.regex.Pattern;
+import lombok.RequiredArgsConstructor;
+import org.sopt.buddys.domain.image.entity.ImageDomain;
+import org.sopt.buddys.domain.user.code.UserErrorCode;
+import org.sopt.buddys.global.aws.s3.S3PresignedUrlManager;
+import org.sopt.buddys.global.exception.BaseException;
+import org.springframework.stereotype.Component;
+
+/**
+ * 프로필 이미지 URL은 다른 사용자 화면에 로드되므로, 프로필 이미지 업로드 경로의 URL만 새로 설정할 수 있다.
+ * 소셜 로그인으로 받은 외부 이미지처럼 이미 설정된 값은 그대로 유지할 수 있다.
+ */
+@Component
+@RequiredArgsConstructor
+public class ProfileImageUrlValidator {
+
+  private static final Pattern UPLOADED_FILE_NAME = Pattern.compile("^[A-Za-z0-9-]+\\.[A-Za-z0-9]+$");
+
+  private final S3PresignedUrlManager s3PresignedUrlManager;
+
+  public void validate(String requestedUrl, String currentUrl) {
+    if (requestedUrl == null || requestedUrl.equals(currentUrl)) {
+      return;
+    }
+
+    String uploadUrlPrefix = s3PresignedUrlManager.buildPublicUrl(
+        ImageDomain.PROFILE.getFolder() + "/"
+    );
+    if (!requestedUrl.startsWith(uploadUrlPrefix)
+        || !UPLOADED_FILE_NAME.matcher(requestedUrl.substring(uploadUrlPrefix.length())).matches()) {
+      throw new BaseException(UserErrorCode.INVALID_PROFILE_IMAGE_URL);
+    }
+  }
+}

src/main/java/org/sopt/buddys/domain/user/service/UserOnboardingService.java

@@ -42,6 +42,7 @@ public class UserOnboardingService {
   private final CountryRepository countryRepository;
   private final CityRepository cityRepository;
   private final TagRepository tagRepository;
+  private final ProfileImageUrlValidator profileImageUrlValidator;
 
   @Transactional
   public User completeOnboarding(Long userId, OnboardingCommand request) {
@@ -50,6 +51,7 @@ public User completeOnboarding(Long userId, OnboardingCommand request) {
 
     validateNotAlreadyOnboarded(userId);
     validateNickname(request.nickname());
+    profileImageUrlValidator.validate(request.profileImageUrl(), user.getProfileImageUrl());
     City interestCity = validateAndGetCity(request.interestCountryId(), request.interestCityId());
     Country interestCountry = interestCity.getCountry();
 

src/main/java/org/sopt/buddys/domain/user/service/UserProfileEditService.java

@@ -40,6 +40,7 @@ public class UserProfileEditService {
   private final UserRepository userRepository;
   private final UserTagRepository userTagRepository;
   private final TagRepository tagRepository;
+  private final ProfileImageUrlValidator profileImageUrlValidator;
 
   public ProfileEditResponse getProfile(Long userId) {
     User user = getActiveUser(userId);
@@ -56,9 +57,16 @@ public ProfileEditResponse updateProfile(Long userId, UpdateProfileCommand comma
     User user = getActiveUserForUpdate(userId);
     List<Long> orderedTagIds = command.orderedTagIds();
     Map<Long, Tag> tagsById = getAndValidateTags(orderedTagIds);
+    profileImageUrlValidator.validate(command.profileImageUrl(), user.getProfileImageUrl());
 
     try {
-      user.updateProfile(command.nickname(), command.gender(), command.birthDate(), command.bio());
+      user.updateProfile(
+          command.nickname(),
+          command.gender(),
+          command.birthDate(),
+          command.bio(),
+          command.profileImageUrl()
+      );
       userRepository.flush();
     } catch (DataIntegrityViolationException exception) {
       if (!isNicknameConflict(exception)) {

src/main/java/org/sopt/buddys/domain/user/service/command/UpdateProfileCommand.java

@@ -9,5 +9,6 @@ public record UpdateProfileCommand(
     Gender gender,
     LocalDate birthDate,
     String bio,
+    String profileImageUrl,
     List<Long> orderedTagIds
 ) {}

src/main/java/org/sopt/buddys/global/aws/s3/S3PresignedUrlManager.java

@@ -110,7 +110,7 @@ public String createGetUrl(String key) {
     return presigned.url().toString();
   }
 
-  private String buildPublicUrl(String key) {
+  public String buildPublicUrl(String key) {
     return s3Utilities.getUrl(GetUrlRequest.builder()
             .bucket(s3Properties.getBucket())
             .key(key)

src/test/java/org/sopt/buddys/domain/user/service/ProfileImageUrlValidatorTest.java

@@ -0,0 +1,90 @@
+package org.sopt.buddys.domain.user.service;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatCode;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.BDDMockito.given;
+import static org.mockito.BDDMockito.then;
+import static org.mockito.Mockito.lenient;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.sopt.buddys.domain.user.code.UserErrorCode;
+import org.sopt.buddys.global.aws.s3.S3PresignedUrlManager;
+import org.sopt.buddys.global.exception.BaseException;
+
+@ExtendWith(MockitoExtension.class)
+class ProfileImageUrlValidatorTest {
+
+  private static final String UPLOAD_URL_PREFIX =
+      "https://buddys-test-bucket.s3.ap-northeast-2.amazonaws.com/profiles/";
+  private static final String CURRENT_URL = "http://k.kakaocdn.net/profile/current.jpg";
+
+  @InjectMocks
+  private ProfileImageUrlValidator profileImageUrlValidator;
+
+  @Mock
+  private S3PresignedUrlManager s3PresignedUrlManager;
+
+  @BeforeEach
+  void setUp() {
+    lenient().when(s3PresignedUrlManager.buildPublicUrl("profiles/")).thenReturn(UPLOAD_URL_PREFIX);
+  }
+
+  @DisplayName("프로필 이미지 업로드 경로의 URL은 허용한다")
+  @Test
+  void validate_uploadedProfileImageUrl_passes() {
+    // given
+    String requestedUrl = UPLOAD_URL_PREFIX + "0b6f2c1e-7a55-4a52-9d0c-3f1f6f2f9f10.png";
+
+    // when & then
+    assertThatCode(() -> profileImageUrlValidator.validate(requestedUrl, CURRENT_URL))
+        .doesNotThrowAnyException();
+  }
+
+  @DisplayName("현재 설정된 프로필 이미지 URL은 외부 도메인이어도 그대로 허용한다")
+  @Test
+  void validate_sameAsCurrentUrl_passes() {
+    // when & then
+    assertThatCode(() -> profileImageUrlValidator.validate(CURRENT_URL, CURRENT_URL))
+        .doesNotThrowAnyException();
+    then(s3PresignedUrlManager).shouldHaveNoInteractions();
+  }
+
+  @DisplayName("프로필 이미지를 삭제하는 null은 허용한다")
+  @Test
+  void validate_null_passes() {
+    // when & then
+    assertThatCode(() -> profileImageUrlValidator.validate(null, CURRENT_URL))
+        .doesNotThrowAnyException();
+  }
+
+  @DisplayName("업로드 경로가 아닌 URL은 거부한다")
+  @ParameterizedTest
+  @ValueSource(strings = {
+      "https://attacker.example/pixel.png",
+      "javascript:alert(1)",
+      "",
+      "   ",
+      "http://buddys-test-bucket.s3.ap-northeast-2.amazonaws.com/profiles/a.png",
+      "https://buddys-test-bucket.s3.ap-northeast-2.amazonaws.com/posts/a.png",
+      "https://buddys-test-bucket.s3.ap-northeast-2.amazonaws.com/profiles/",
+      "https://buddys-test-bucket.s3.ap-northeast-2.amazonaws.com/profiles/../posts/a.png",
+      "https://buddys-test-bucket.s3.ap-northeast-2.amazonaws.com/profiles/a.png?x=1",
+      "https://buddys-test-bucket.s3.ap-northeast-2.amazonaws.com.attacker.example/profiles/a.png"
+  })
+  void validate_urlOutsideUploadPath_throws(String requestedUrl) {
+    // when & then
+    assertThatThrownBy(() -> profileImageUrlValidator.validate(requestedUrl, CURRENT_URL))
+        .isInstanceOf(BaseException.class)
+        .satisfies(exception -> assertThat(((BaseException) exception).getErrorCode())
+            .isEqualTo(UserErrorCode.INVALID_PROFILE_IMAGE_URL));
+  }
+}

src/test/java/org/sopt/buddys/domain/user/service/UserOnboardingServiceTest.java

@@ -66,6 +66,9 @@ public class UserOnboardingServiceTest {
   @Mock
   private TagRepository tagRepository;
 
+  @Mock
+  private ProfileImageUrlValidator profileImageUrlValidator;
+
   @DisplayName("정상적인 온보딩 요청이면 유저 정보와 태그를 저장한다")
   @Test
   void completeOnboarding_validRequest_savesUserAndTags() {