[fix/MAT-304-307-311] native 보안·딥링크·잡버그 묶음

apps/native/App.tsx

@@ -17,7 +17,11 @@ import { toastConfig } from '@/features/student/scrap/components/Notification/To
 import { PointingFeedbackQueueWiring } from '@/features/student/problem/services/PointingFeedbackQueueWiring';
 import { env } from '@utils';
 import { initializeKakaoSDK } from '@react-native-kakao/core';
-import { navigationRef } from '@/services/navigation';
+import {
+  navigationRef,
+  handleNavigationReady,
+  handleNavigationStateChange,
+} from '@/services/navigation';
 
 initializeKakaoSDK(env.kakaoNativeAppKey);
 
@@ -53,7 +57,11 @@ export default function App() {
       <GestureHandlerRootView style={{ flex: 1 }}>
         <SafeAreaProvider>
           {isReady && (
-            <NavigationContainer ref={navigationRef} theme={navigationTheme}>
+            <NavigationContainer
+              ref={navigationRef}
+              theme={navigationTheme}
+              onReady={handleNavigationReady}
+              onStateChange={handleNavigationStateChange}>
               <StatusBar style='dark' />
               <RootNavigator />
               <Toast config={toastConfig} />

apps/native/src/features/auth/login/hooks/useNativeOAuth.ts

@@ -1,5 +1,5 @@
 import { useState, useCallback, useEffect } from 'react';
-import { GoogleSignin } from '@react-native-google-signin/google-signin';
+import { GoogleSignin, statusCodes } from '@react-native-google-signin/google-signin';
 import { login as kakaoLogin, logout as kakaoLogout } from '@react-native-kakao/user';
 import * as AppleAuthentication from 'expo-apple-authentication';
 import { useNavigation } from '@react-navigation/native';
@@ -25,6 +25,25 @@ type UseNativeOAuthReturn = OAuthState & {
   signOut: () => Promise<void>;
 };
 
+const APPLE_CANCEL_CODE = 'ERR_REQUEST_CANCELED';
+
+const createOAuthCancelError = (code: string) => {
+  const error = new Error('OAuth sign in cancelled');
+  return Object.assign(error, { code });
+};
+
+const getErrorCode = (error: unknown) => {
+  if (typeof error === 'object' && error !== null && 'code' in error) {
+    return String((error as { code: unknown }).code);
+  }
+  return null;
+};
+
+const isOAuthCancelError = (error: unknown) => {
+  const code = getErrorCode(error);
+  return code === APPLE_CANCEL_CODE || code === statusCodes.SIGN_IN_CANCELLED;
+};
+
 const useNativeOAuth = (): UseNativeOAuthReturn => {
   const [state, setState] = useState<OAuthState>({
     loadingProvider: null,
@@ -46,14 +65,17 @@ const useNativeOAuth = (): UseNativeOAuthReturn => {
 
   const getGoogleToken = async (): Promise<string> => {
     await GoogleSignin.hasPlayServices();
-    await GoogleSignin.signIn();
-    const tokens = await GoogleSignin.getTokens();
 
-    if (!tokens.idToken) {
+    const result = await GoogleSignin.signIn();
+    if (result.type === 'cancelled') {
+      throw createOAuthCancelError(statusCodes.SIGN_IN_CANCELLED);
+    }
+
+    if (!result.data.idToken) {
       throw new Error('Google ID token not found');
     }
 
-    return tokens.idToken;
+    return result.data.idToken;
   };
 
   const getKakaoToken = async (): Promise<string> => {
@@ -170,13 +192,8 @@ const useNativeOAuth = (): UseNativeOAuthReturn => {
       } catch (error: unknown) {
         const errorMessage = error instanceof Error ? error.message : 'Unknown error occurred';
 
-        // Apple 로그인 취소는 에러로 처리하지 않음
-        if (
-          typeof error === 'object' &&
-          error !== null &&
-          'code' in error &&
-          (error as { code: string }).code === 'ERR_REQUEST_CANCELED'
-        ) {
+        // OAuth 취소는 에러로 처리하지 않음.
+        if (isOAuthCancelError(error)) {
           setState({ loadingProvider: null, error: null });
           return;
         }

apps/native/src/features/auth/login/screens/LoginScreen.tsx

@@ -18,8 +18,9 @@ const LoginScreen = () => {
   const navigation = useNavigation<NavigationProp>();
   const { isLoading, loadingProvider, error, signInWithProvider } = useNativeOAuth();
 
-  const handleSocialButtonPress = async (provider: OAuthProvider) => {
-    await signInWithProvider(provider);
+  const handleSocialButtonPress = (provider: OAuthProvider) => {
+    // useNativeOAuth 의 error state 로 이미 사용자에게 노출되므로 여기서는 void.
+    void signInWithProvider(provider);
   };
 
   const handleEmailButtonPress = () => {

apps/native/src/features/student/problem/screens/PointingScreen.tsx

@@ -49,8 +49,6 @@ const PointingScreen = ({
 
   const pointings = useProblemSessionStore(useShallow(selectPointingsForPointing));
 
-  if (pointings.length === 0) console.warn('[PointingScreen] empty pointings array');
-
   const { advanceMessage, advanceButtonLabel } = useMemo(() => {
     if (phase === 'MAIN_POINTINGS') {
       return {

apps/native/src/features/student/problem/utils/serializeJSONToHTML.ts

@@ -267,8 +267,16 @@ function serializeNode(node: JSONNode): string {
 
 export function serializeJSONToHTML(doc: JSONNode | string): string {
   let json: JSONNode;
-  if (typeof doc === 'string') json = JSON.parse(doc);
-  else json = doc;
+  if (typeof doc === 'string') {
+    try {
+      json = JSON.parse(doc);
+    } catch (e) {
+      const detail = e instanceof Error ? e.message : String(e);
+      throw new Error(`serializeJSONToHTML: invalid JSON input — ${detail}`);
+    }
+  } else {
+    json = doc;
+  }
 
   if (json.type !== 'doc') {
     throw new Error('root node must be type=doc');

apps/native/src/hooks/index.ts

@@ -3,5 +3,4 @@ export { default as useDeepLinkHandler, handleDeepLink } from './useDeepLinkHand
 export { default as useFcmToken } from './useFcmToken';
 export { default as useInvalidateStudyData } from './useInvalidateStudyData';
 export { default as useLoadAssets } from './useLoadAssets';
-export { default as useSocialLoginCallback } from './useSocialLoginCallback';
 export { default as useInvalidateAll } from './useInvalidateAll';

apps/native/src/hooks/useDeepLinkHandler.ts

@@ -1,10 +1,10 @@
-import { useEffect, useRef, useCallback } from 'react';
+import { useEffect, useRef } from 'react';
 import { Platform, Alert, Dimensions } from 'react-native';
 import messaging, { type FirebaseMessagingTypes } from '@react-native-firebase/messaging';
 import * as Notifications from 'expo-notifications';
 import { CommonActions } from '@react-navigation/native';
 
-import { navigationRef, isNavigationReady } from '@/services/navigation';
+import { navigationRef, waitForRouteRegistered } from '@/services/navigation';
 import { parseDeepLinkUrl, isValidDeepLink } from '@/utils/deepLink';
 import { getPublishDetailById } from '@/apis/controller/student/study';
 import { useProblemSessionStore, getInitialScreenForPhase } from '@/stores';
@@ -32,18 +32,16 @@ const handleDeepLink = async (url: string | undefined | null) => {
     return false;
   }
 
-  // 네비게이션이 준비될 때까지 대기 (최대 3초)
-  const waitForNavigation = async (timeout = 3000): Promise<boolean> => {
-    const startTime = Date.now();
-    while (!isNavigationReady() && Date.now() - startTime < timeout) {
-      await new Promise((resolve) => setTimeout(resolve, 100));
-    }
-    return isNavigationReady();
-  };
-
-  const isReady = await waitForNavigation();
-  if (!isReady) {
-    console.warn('[DeepLink] Navigation not ready, cannot handle deep link');
+  // RootNavigator 가 sessionStatus 에 따라 단일 root screen 만 등록하므로,
+  // 콜드스타트 hydrating 단계에는 Splash 만 등록되어 'StudentApp' 으로의 navigate 가
+  // silent no-op 이 된다. waitForRouteRegistered 는 navigation ready 와 auth hydration
+  // 후 StudentApp 등록을 단일 30s budget 으로 기다린다. (qna/publish 둘 다 StudentApp
+  // 안에서 처리되므로 동일 route 를 게이트로 사용.)
+  const studentAppReady = await waitForRouteRegistered('StudentApp');
+  if (!studentAppReady) {
+    console.warn(
+      '[DeepLink] StudentApp route 미등록 — 알림이 unauthenticated 상태에 도착했을 가능성'
+    );
     return false;
   }
 

apps/native/src/hooks/useFcmToken.ts

@@ -25,8 +25,6 @@ Notifications.setNotificationHandler({
  */
 const useFcmToken = () => {
   const hasRegistered = useRef(false);
-  const notificationListener = useRef<Notifications.EventSubscription | null>(null);
-  const responseListener = useRef<Notifications.EventSubscription | null>(null);
 
   useEffect(() => {
     // 웹에서는 FCM을 사용하지 않음
@@ -55,7 +53,7 @@ const useFcmToken = () => {
         // 2. APNs 토큰 확인 (iOS 필수: 이게 없으면 FCM 토큰이 있어도 동작 안 함)
         if (Platform.OS === 'ios') {
           const apnsToken = await messaging().getAPNSToken();
-          console.log('[FCM] APNs Token:', apnsToken);
+          if (__DEV__) console.log('[FCM] APNs Token:', apnsToken);
           if (!apnsToken) {
             console.error('[FCM] APNs Token is missing! Swizzling might be failed.');
             // 여기서 APNs 토큰이 없다면 iOS 설정 문제(Capabilities 등)일 가능성이 큼
@@ -64,12 +62,12 @@ const useFcmToken = () => {
 
         // 3. FCM 토큰 가져오기
         const token = await messaging().getToken();
-        console.log('[FCM] Device FCM Token:', token);
+        if (__DEV__) console.log('[FCM] Device FCM Token:', token);
 
         if (token && !hasRegistered.current) {
           await postPushToken(token);
           hasRegistered.current = true;
-          console.log('[FCM] Token registered to server');
+          if (__DEV__) console.log('[FCM] Token registered to server');
         }
       } catch (error) {
         console.error('[FCM] Registration failed:', error);
@@ -80,7 +78,9 @@ const useFcmToken = () => {
 
     // 4. 포그라운드 메시지 수신 (앱이 켜져 있을 때 로그 확인용)
     const unsubscribe = messaging().onMessage(async (remoteMessage) => {
-      console.log('[FCM] A new FCM message arrived!', JSON.stringify(remoteMessage));
+      if (__DEV__) {
+        console.log('[FCM] A new FCM message arrived!', JSON.stringify(remoteMessage));
+      }
 
       // 앱이 켜져 있을 때도 상단 알림을 띄우고 싶다면 expo-notifications 사용
       await Notifications.scheduleNotificationAsync({

apps/native/src/navigation/RootNavigator.tsx

@@ -7,7 +7,6 @@ import StudentNavigator from '@navigation/student/StudentNavigator';
 import AuthNavigator from '@navigation/auth/AuthNavigator';
 import { useAuthStore } from '@stores';
 import { LoadingScreen } from '@components/common';
-import { useSocialLoginCallback } from '@hooks';
 import { useSignupStore } from '@features/auth/signup/store/useSignupStore';
 import { useOnboardingStore } from '@features/student/onboarding/store/useOnboardingStore';
 
@@ -25,8 +24,6 @@ const RootNavigator = () => {
   const step1Completed = useSignupStore((s) => s.step1Completed);
   const onboardingStatus = useOnboardingStore((s) => s.status);
 
-  useSocialLoginCallback();
-
   const getActiveScreen = () => {
     if (
       sessionStatus === 'unknown' ||

apps/native/src/services/navigation/index.ts

@@ -1 +1,8 @@
-export { navigationRef, isNavigationReady } from './navigationRef';
+export {
+  navigationRef,
+  isNavigationReady,
+  waitForNavigationReady,
+  waitForRouteRegistered,
+  handleNavigationReady,
+  handleNavigationStateChange,
+} from './navigationRef';