---

title: OAuth Auto Signup Engine E2E status: ongoing created: 2026-05-14 updated: 2026-05-14

OAuth Auto Signup Engine E2E

• Implement server model and callback flow from spec.md.

• Implement seller admin Kakao mode and mapping UI.

• Implement shop callback spinner copy.

• Add server unit tests for eligibility and fallback cases.

• Add client tests for nickname optional and completeSignupPath redirect preservation.

• Add client/server tests proving complete-signup fallback submits and accepts dynamic consents[].

• Server now stores non-secret providerBehaviors.KAKAO.mode and Kakao Sync service term mappings under ShopAuthSettings.

• Kakao Sync authorize scope derives account_email automatically; phone_number still follows the existing phoneScopeEnabled gate and signup phone policy.

• OAuth state stores the start-time marketCode; callback uses that value before request context so market-specific signup policy and service term mappings do not drift.

• OAuth callback keeps the access token internal-only for Kakao additional API calls, then falls back to SIGNUP_PENDING on missing data or Kakao API failure.

• Auto signup records CustomerConsent snapshot fields (externalConsentTag, externalConsentAgreedAt, consentMappingVersion, policyPageId, policySlug) with source=SIGNUP_KAKAO_SYNC.

• CompleteOAuthSignupRequest.nickname is optional; server falls back to provider name, email prefix, then provider random.

• Confirm Kakao dev app can request account_email.

• Confirm Kakao dev app has service terms configured for auto signup test.

• Provide sample Kakao service term tags for Henriette KR.

• Confirm active market list used by seller admin market status.

• Decide whether phoneScopeEnabled can be toggled by support/admin only or visible to sellers as read-only status.

• The feature is named OAuth Auto Signup Engine.

• Phase 1 enables auto signup only for KAKAO_SYNC.

• ResolvedSignupPolicy.consents is the signup consent SSOT.

• SignupPolicy.java remains phone-only.

• completeSignupPath is HCS-driven and only echoed by the server.

• Market coverage gaps produce MISCONFIGURED; save is allowed and runtime falls back to SIGNUP_PENDING.

• mappingVersion is runtime-derived SHA-256 and saved only as a CustomerConsent snapshot.

• Kakao API failures fall back to SIGNUP_PENDING; no retry in callback path.

• Existing customer re-consent is a follow-up track, not Phase 1.

• KakaoServiceTermMapping is keyed by MarketCode (serviceTermMappingsByMarket); a single mapping list per shop would not capture per-market policy variation.

• mode is the single SSOT in Phase 1; no separate autoSignupMode field until a second provider requires independent behavior.

• Complete-signup fallback uses dynamic consents[] via CompleteOAuthSignupRequest.policyConsentGrants(); legacy four boolean fields are not the only path and must not be the fallback for new scopes such as THIRD_PARTY_SHARE.

Case	Setup	Expected
Existing linked Kakao customer	OAuthAccountLookup hit	LOGIN
BASIC_LOGIN new Kakao customer	mode=BASIC_LOGIN	SIGNUP_PENDING
KAKAO_SYNC happy path	verified email, required service terms agreed, phone present if required	LOGIN
Missing email scope	account_email absent or user declined	SIGNUP_PENDING
Invalid Kakao email	has_email=true, email exists, is_email_valid=false	SIGNUP_PENDING
Unverified Kakao email	is_email_verified=false	SIGNUP_PENDING
Phone required but missing	phone policy REQUIRED, no provider phone	SIGNUP_PENDING
Phone required + phoneScope disabled	phone policy REQUIRED, phoneScopeEnabled=false	market MISCONFIGURED, runtime SIGNUP_PENDING
Required term mapping missing	required ResolvedSignupPolicy.consents[] scope unmapped	market MISCONFIGURED, runtime SIGNUP_PENDING
Required term not agreed	mapping exists, user did not agree	SIGNUP_PENDING
Required dynamic term fallback	auto signup fails, required THIRD_PARTY_SHARE rendered on complete signup form	complete signup succeeds when consents[] grants it
Optional marketing term missing	required terms agreed, optional term not agreed	LOGIN; optional consent not recorded
Duplicate email	provider email already belongs to another customer	CUSTOMER_DUPLICATE_EMAIL
Kakao service_terms timeout	API 5xx/timeout	SIGNUP_PENDING
Nickname missing	no user input, no provider nickname	generated nickname like KAKAO8F3A
Consent snapshot	happy path	CustomerConsent has source=SIGNUP_KAKAO_SYNC, externalConsentTag, consentMappingVersion, policyPageId, policySlug

Case	Expected
auth.completeOAuthSignup schema without nickname	valid
OAuth callback LOGIN	redirects to returnTo
OAuth callback SIGNUP_PENDING with response redirect	redirects to result.redirect.completeSignupPath
OAuth callback SIGNUP_PENDING without response redirect	falls back to state/session then /auth/complete-signup
Callback loading state	shows "회원가입을 완료하는 중입니다" while callback is in progress
Seller admin Kakao mode radio	persists BASIC_LOGIN / KAKAO_SYNC
Seller admin market coverage	shows READY and MISCONFIGURED per market
Seller admin enable confirm	explains new customers only and fallback behavior
Complete signup dynamic consent	renders and submits THIRD_PARTY_SHARE / MARKETING_KAKAO_BRAND_MESSAGE from auth.signupPolicy.consents[]

• OAuth callback auto signup path should complete in under 2 seconds in normal dev conditions.
• Kakao additional API timeout should abort auto signup and return SIGNUP_PENDING rather than holding the callback page.
• Raw provider access tokens must not be logged during timing/debug output.

1. Start from a Kakao dev app without account_email scope.
   • Expected: Kakao signup returns SIGNUP_PENDING.
2. Add account_email to dev scope and consent in Kakao.
   • Expected: email is present in /v2/user/me.
3. Configure service terms in Kakao Developers.
   • Expected: /v2/user/service_terms returns mapped tags.
4. Configure Henriette KR mapping for terms/privacy and any required THIRD_PARTY_SHARE.
   • Expected: KR status READY.
5. Run new Kakao signup with all conditions satisfied.
   • Expected: callback spinner appears briefly, no complete signup form page, session cookie set, redirected to returnTo.
6. Remove one required Kakao term mapping.
   • Expected: market MISCONFIGURED, runtime falls back to SIGNUP_PENDING.
7. Simulate Kakao API failure in test.
   • Expected: SIGNUP_PENDING and no customer created.

• Server deployed before client UI exposes KAKAO_SYNC.

• Existing BASIC_LOGIN Kakao flow regression tested.

• CustomerConsent nullable fields verified in DynamoDB dev item.

• No raw Kakao access token appears in application logs.

• Henriette oauth-login-button.completeSignupPath still controls fallback page.

• Seller admin warns that existing users are not re-consented in Phase 1.

• Existing customer required-consent re-consent is tracked as follow-up.

• Kakao ECP /v1/ecp_app verification is tracked as follow-up.

• Policy document hash verification is tracked as follow-up.

• Google/Naver auto signup is tracked as follow-up only after consent audit design exists.