From 85b2b18945b19eadc78cb211bf3d645fa152b172 Mon Sep 17 00:00:00 2001
From: jjoonleo <jjoonleo@gmail.com>
Date: Sun, 28 Jun 2026 13:10:18 +0900
Subject: [PATCH 1/2] Add Apple login benchmark harness

---
 docs/performance/apple-login-323.md           |  54 ++++
 .../global/oauth/apple/AppleLoginService.java |   8 +-
 .../resources/application-bench.properties    |  53 ++++
 scripts/benchmarks/apple-login/README.md      |  96 +++++++
 .../benchmarks/apple-login/apple-login.k6.js  |  74 ++++++
 scripts/benchmarks/apple-login/apple-stub.mjs | 147 +++++++++++
 .../benchmarks/apple-login/results/.gitkeep   |   1 +
 scripts/benchmarks/apple-login/run.sh         | 238 ++++++++++++++++++
 .../apple-login/seed-returning-user.sql       |  53 ++++
 scripts/benchmarks/apple-login/summarize.py   |  93 +++++++
 10 files changed, 815 insertions(+), 2 deletions(-)
 create mode 100644 docs/performance/apple-login-323.md
 create mode 100644 ontime-back/src/main/resources/application-bench.properties
 create mode 100644 scripts/benchmarks/apple-login/README.md
 create mode 100644 scripts/benchmarks/apple-login/apple-login.k6.js
 create mode 100644 scripts/benchmarks/apple-login/apple-stub.mjs
 create mode 100644 scripts/benchmarks/apple-login/results/.gitkeep
 create mode 100755 scripts/benchmarks/apple-login/run.sh
 create mode 100644 scripts/benchmarks/apple-login/seed-returning-user.sql
 create mode 100755 scripts/benchmarks/apple-login/summarize.py

diff --git a/docs/performance/apple-login-323.md b/docs/performance/apple-login-323.md
new file mode 100644
index 00000000..966cc681
--- /dev/null
+++ b/docs/performance/apple-login-323.md
@@ -0,0 +1,54 @@
+# Apple Login Performance Evidence for Issue #323
+
+## Measurement Contract
+
+This document records before/after evidence for reducing Apple login latency by removing repeated Apple provider round trips from the returning Apple User login path.
+
+Primary benchmark environment:
+
+- Backend: local Spring Boot process with `bench` profile
+- Database: isolated Docker MySQL database `ontime_bench`
+- Apple provider: local stub
+- Returning Apple User: `social_type=APPLE`, `social_id=bench-apple-user`
+- Stub delay:
+  - `GET /auth/keys`: 80 ms
+  - `POST /auth/token`: 300 ms
+- Warmup: 2 minutes
+- Measurement: 5 minutes
+- Full run count: 10 per scenario
+
+The benchmark harness lives in `scripts/benchmarks/apple-login/`.
+
+## Acceptance Gate
+
+Primary scenario: returning Apple User, warm cache, concurrency 1.
+
+- JWKS network calls/request: `before 1.0 -> after 0.0`
+- Apple token exchange calls/request: `before 1.0 -> after 0.0`
+- Error rate: `0%`
+- p95 latency: `after <= before * 0.70`
+
+Secondary scenarios: returning Apple User, concurrency 10 and 20.
+
+- Error rate: `0%`
+- Apple token exchange calls/request: `after 0.0`
+- p95 latency: `after <= before`
+
+## Results
+
+Populate this table from `scripts/benchmarks/apple-login/results/*/summary.csv` after running both before and after measurements.
+
+| scenario | version | runs | requests | error_rate | p50_ms | p95_ms | p99_ms | jwks_calls/request | token_exchange_calls/request |
+| --- | --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
+| c1 returning warm-cache | before | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
+| c1 returning warm-cache | after | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
+| c10 returning warm-cache | before | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
+| c10 returning warm-cache | after | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
+| c20 returning warm-cache | before | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
+| c20 returning warm-cache | after | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
+
+## Notes
+
+- Real Apple network calls are intentionally excluded from the primary benchmark because provider and network variability would obscure backend request-path changes.
+- The script labels results as `before` or `after` but does not change git refs. Select the checkout explicitly before running.
+- Quick mode is for development feedback. Full mode is the acceptance evidence.
diff --git a/ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginService.java b/ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginService.java
index 1cd59a86..e327e5bc 100644
--- a/ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginService.java
+++ b/ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginService.java
@@ -54,6 +54,10 @@ public class AppleLoginService {
     private static final String APPLE_KEYS_URL = "https://appleid.apple.com/auth/keys";
     private static final String APPLE_TOKEN_URL = "https://appleid.apple.com/auth/token";
     private String issuer = "https://appleid.apple.com";
+    @Value("${apple.keys-url:" + APPLE_KEYS_URL + "}")
+    private String appleKeysUrl = APPLE_KEYS_URL;
+    @Value("${apple.token-url:" + APPLE_TOKEN_URL + "}")
+    private String appleTokenUrl = APPLE_TOKEN_URL;
     @Value("${apple.client.id}")
     private String clientId;
     @Value("${apple.team.id}")
@@ -167,7 +171,7 @@ public Claims verifyIdentityToken(String identityToken) throws
         log.info("Verify Apple identity credential");
         Map<String, String> headers = jwtUtils.parseHeaders(identityToken);
         // apple publickey
-        ApplePublicKeyResponse applePublicKeyResponse = restTemplate.getForObject(APPLE_KEYS_URL, ApplePublicKeyResponse.class);
+        ApplePublicKeyResponse applePublicKeyResponse = restTemplate.getForObject(appleKeysUrl, ApplePublicKeyResponse.class);
         PublicKey publicKey = applePublicKeyGenerator.generatePublicKey(headers, applePublicKeyResponse);
         // claim
         Claims tokenClaims = jwtUtils.getTokenClaims(identityToken, publicKey);
@@ -201,7 +205,7 @@ public AppleTokenResponseDto getAppleAccessTokenAndRefreshToken(String authCode)
         HttpEntity<MultiValueMap<String, String>> requestEntity = new HttpEntity<>(requestBody, headers);
 
         ResponseEntity<JsonNode> responseEntity = restTemplate.exchange(
-                APPLE_TOKEN_URL, HttpMethod.POST, requestEntity, JsonNode.class);
+                appleTokenUrl, HttpMethod.POST, requestEntity, JsonNode.class);
 
         JsonNode response = responseEntity.getBody();
 
diff --git a/ontime-back/src/main/resources/application-bench.properties b/ontime-back/src/main/resources/application-bench.properties
new file mode 100644
index 00000000..4eb48855
--- /dev/null
+++ b/ontime-back/src/main/resources/application-bench.properties
@@ -0,0 +1,53 @@
+# Database Configuration
+spring.datasource.url=${SPRING_DATASOURCE_URL}
+spring.datasource.username=${SPRING_DATASOURCE_USERNAME}
+spring.datasource.password=${SPRING_DATASOURCE_PASSWORD}
+spring.datasource.driver-class-name=${SPRING_DATASOURCE_DRIVER_CLASS_NAME:com.mysql.cj.jdbc.Driver}
+
+# JPA / Hibernate
+spring.jpa.database=mysql
+spring.jpa.database-platform=org.hibernate.dialect.MySQL8Dialect
+spring.jpa.hibernate.ddl-auto=validate
+spring.jpa.show-sql=false
+spring.jpa.properties.hibernate.format_sql=false
+
+# Flyway
+spring.flyway.enabled=true
+spring.flyway.baseline-on-migrate=false
+
+# JWT Configuration
+jwt.secret.key=${JWT_SECRET_KEY}
+jwt.access.expiration=${JWT_ACCESS_EXPIRATION:3600000}
+jwt.refresh.expiration=${JWT_REFRESH_EXPIRATION:1209600000}
+jwt.access.header=${JWT_ACCESS_HEADER:Authorization}
+jwt.refresh.header=${JWT_REFRESH_HEADER:Authorization-refresh}
+
+# OAuth
+google.web.client-id=${GOOGLE_WEB_CLIENT_ID:bench-google-web-client-id}
+google.app.client-id=${GOOGLE_APP_CLIENT_ID:bench-google-app-client-id}
+apple.client.id=${APPLE_CLIENT_ID}
+apple.team.id=${APPLE_TEAM_ID}
+apple.login.key=${APPLE_LOGIN_KEY}
+apple.client.secret=${APPLE_CLIENT_SECRET:}
+apple.private-key.base64=${APPLE_PRIVATE_KEY_BASE64}
+apple.keys-url=${APPLE_KEYS_URL:https://appleid.apple.com/auth/keys}
+apple.token-url=${APPLE_TOKEN_URL:https://appleid.apple.com/auth/token}
+
+# Firebase
+firebase.credentials.base64=${FIREBASE_CREDENTIALS_BASE64:}
+
+# Logging
+logging.level.root=WARN
+logging.level.devkor.ontime_back=INFO
+
+# Feature flags
+feature.apple-login.enabled=true
+analytics.preference.default-enabled=${ANALYTICS_PREFERENCE_DEFAULT_ENABLED:false}
+
+# Actuator
+management.endpoint.health.probes.enabled=true
+management.endpoints.web.exposure.include=health
+management.health.readinessstate.enabled=true
+management.health.livenessstate.enabled=true
+server.shutdown=graceful
+spring.lifecycle.timeout-per-shutdown-phase=30s
diff --git a/scripts/benchmarks/apple-login/README.md b/scripts/benchmarks/apple-login/README.md
new file mode 100644
index 00000000..c23e710c
--- /dev/null
+++ b/scripts/benchmarks/apple-login/README.md
@@ -0,0 +1,96 @@
+# Apple Login Benchmark
+
+This benchmark measures issue #323: repeated Apple provider round trips on the returning Apple User login path.
+
+## Scenario
+
+- Endpoint: `POST /oauth2/apple/login`
+- Primary path: returning Apple User, warm Apple key cache
+- Seeded Apple subject: `bench-apple-user`
+- Apple provider: local stub, not the real Apple network
+- Stub delay:
+  - `GET /auth/keys`: 80 ms
+  - `POST /auth/token`: 300 ms
+
+## Why the Apple provider is stubbed
+
+The primary comparison should isolate backend request-path behavior. Real Apple calls include DNS, TLS, internet routing, and provider-side variability, so they are useful as smoke checks but not as the main before/after evidence.
+
+## Run
+
+Install `k6` first if it is not already available:
+
+```bash
+brew install k6
+```
+
+Run from the repository root:
+
+```bash
+scripts/benchmarks/apple-login/run.sh before quick
+scripts/benchmarks/apple-login/run.sh after quick
+```
+
+Full evidence runs:
+
+```bash
+scripts/benchmarks/apple-login/run.sh before full
+scripts/benchmarks/apple-login/run.sh after full
+```
+
+The script starts an isolated MySQL container, starts the Apple stub, starts the backend with the `bench` Spring profile, seeds the returning Apple User, runs k6, and writes results.
+
+The script does not run `git checkout`. Measure the checkout you have selected, and use `before` or `after` only as the result label.
+
+## Defaults
+
+- Database container: `ontime-bench-mysql`
+- Database: `ontime_bench`
+- MySQL port: `127.0.0.1:3307`
+- Backend port: `127.0.0.1:18081`
+- Apple stub port: `127.0.0.1:18080`
+- Quick mode: 1 run per concurrency
+- Full mode: 10 runs per concurrency
+- Warmup: 2 minutes
+- Measurement: 5 minutes
+- Concurrency: 1, 10, 20
+
+Override example:
+
+```bash
+WARMUP_DURATION=10s MEASUREMENT_DURATION=30s SCENARIOS="1" RUNS=1 \
+  scripts/benchmarks/apple-login/run.sh before quick
+```
+
+## Results
+
+Results are written under:
+
+```text
+scripts/benchmarks/apple-login/results/<timestamp>-<label>-<mode>/
+```
+
+Each result directory contains:
+
+- `k6-*.json`: k6 measurement summary
+- `stub-*.json`: Apple provider hit count during measurement
+- `summary.csv`: joined p50/p95/p99, error rate, and provider calls/request
+- `backend.log`: backend logs for the run
+- `apple-stub.log`: Apple stub logs for the run
+
+Use `docs/performance/apple-login-323.md` for the human-readable comparison table.
+
+## Acceptance Gate
+
+Primary scenario: returning Apple User, warm cache, concurrency 1.
+
+- JWKS network calls/request: `before 1.0 -> after 0.0`
+- Apple token exchange calls/request: `before 1.0 -> after 0.0`
+- Error rate: `0%`
+- p95 latency: `after <= before * 0.70`
+
+Secondary scenarios: returning Apple User, concurrency 10 and 20.
+
+- Error rate: `0%`
+- Apple token exchange calls/request: `after 0.0`
+- p95 latency: `after <= before`
diff --git a/scripts/benchmarks/apple-login/apple-login.k6.js b/scripts/benchmarks/apple-login/apple-login.k6.js
new file mode 100644
index 00000000..1bff97f2
--- /dev/null
+++ b/scripts/benchmarks/apple-login/apple-login.k6.js
@@ -0,0 +1,74 @@
+import http from "k6/http";
+import { check, sleep } from "k6";
+import { Counter, Rate, Trend } from "k6/metrics";
+
+const backendUrl = __ENV.BACKEND_URL || "http://127.0.0.1:18081";
+const stubUrl = __ENV.APPLE_STUB_URL || "http://127.0.0.1:18080";
+const vus = Number(__ENV.K6_VUS || 1);
+const duration = __ENV.K6_DURATION || "5m";
+const resultJson = __ENV.K6_RESULT_JSON || "k6-summary.json";
+
+const loginRequests = new Counter("apple_login_requests");
+const loginFailed = new Rate("apple_login_failed");
+const loginDuration = new Trend("apple_login_duration", true);
+
+export const options = {
+  vus,
+  duration,
+  thresholds: {
+    http_req_failed: ["rate==0"],
+  },
+};
+
+export function setup() {
+  const response = http.get(`${stubUrl}/fixture/apple-login-payload`);
+  if (response.status !== 200) {
+    throw new Error(`fixture request failed with status ${response.status}`);
+  }
+  return response.json();
+}
+
+export default function (payload) {
+  const response = http.post(
+    `${backendUrl}/oauth2/apple/login`,
+    JSON.stringify(payload),
+    {
+      headers: {
+        "content-type": "application/json",
+      },
+      tags: {
+        endpoint: "apple-login",
+      },
+    },
+  );
+
+  check(response, {
+    "status is 200": (res) => res.status === 200,
+  });
+  loginRequests.add(1);
+  loginFailed.add(response.status !== 200);
+  loginDuration.add(response.timings.duration);
+
+  sleep(0.1);
+}
+
+export function handleSummary(data) {
+  const requestValues = data.metrics.apple_login_requests?.values || {};
+  const failedValues = data.metrics.apple_login_failed?.values || {};
+  const durationValues = data.metrics.apple_login_duration?.values || {};
+
+  return {
+    [resultJson]: JSON.stringify(data, null, 2),
+    stdout: JSON.stringify(
+      {
+        requests: requestValues.count || 0,
+        failedRate: failedValues.rate || 0,
+        p50: durationValues["p(50)"] || durationValues.med || null,
+        p95: durationValues["p(95)"] || null,
+        p99: durationValues["p(99)"] || null,
+      },
+      null,
+      2,
+    ) + "\n",
+  };
+}
diff --git a/scripts/benchmarks/apple-login/apple-stub.mjs b/scripts/benchmarks/apple-login/apple-stub.mjs
new file mode 100644
index 00000000..556c6087
--- /dev/null
+++ b/scripts/benchmarks/apple-login/apple-stub.mjs
@@ -0,0 +1,147 @@
+import http from "node:http";
+import { createSign, generateKeyPairSync } from "node:crypto";
+
+const port = Number(process.env.APPLE_STUB_PORT || 18080);
+const clientId = process.env.APPLE_CLIENT_ID || "club.devkor.ontime.bench";
+const subject = process.env.BENCH_APPLE_SUB || "bench-apple-user";
+const fullName = process.env.BENCH_APPLE_FULL_NAME || "Bench User";
+const email = process.env.BENCH_APPLE_EMAIL || "bench.apple@example.com";
+const keyDelayMs = Number(process.env.APPLE_KEYS_DELAY_MS || 80);
+const exchangeDelayMs = Number(process.env.APPLE_EXCHANGE_DELAY_MS || 300);
+const kid = "bench-rsa-key";
+
+const { publicKey, privateKey } = generateKeyPairSync("rsa", {
+  modulusLength: 2048,
+});
+
+const publicJwk = publicKey.export({ format: "jwk" });
+let counts = {
+  keys: 0,
+  exchange: 0,
+};
+
+function base64url(input) {
+  return Buffer.from(input)
+    .toString("base64")
+    .replaceAll("+", "-")
+    .replaceAll("/", "_")
+    .replaceAll("=", "");
+}
+
+function jsonResponse(response, statusCode, body) {
+  response.writeHead(statusCode, {
+    "content-type": "application/json",
+    "cache-control": "no-store",
+  });
+  response.end(JSON.stringify(body));
+}
+
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function readBody(request) {
+  return new Promise((resolve, reject) => {
+    let body = "";
+    request.setEncoding("utf8");
+    request.on("data", (chunk) => {
+      body += chunk;
+    });
+    request.on("end", () => resolve(body));
+    request.on("error", reject);
+  });
+}
+
+function signedIdentity() {
+  const nowSeconds = Math.floor(Date.now() / 1000);
+  const header = {
+    alg: "RS256",
+    kid,
+    typ: "JWT",
+  };
+  const payload = {
+    iss: "https://appleid.apple.com",
+    aud: clientId,
+    exp: nowSeconds + 3600,
+    iat: nowSeconds,
+    sub: subject,
+    email,
+  };
+  const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(payload))}`;
+  const signature = createSign("RSA-SHA256")
+    .update(signingInput)
+    .sign(privateKey);
+  return `${signingInput}.${base64url(signature)}`;
+}
+
+const server = http.createServer(async (request, response) => {
+  try {
+    const url = new URL(request.url, `http://${request.headers.host}`);
+
+    if (request.method === "GET" && url.pathname === "/auth/keys") {
+      counts.keys += 1;
+      await delay(keyDelayMs);
+      jsonResponse(response, 200, {
+        keys: [
+          {
+            kty: "RSA",
+            kid,
+            alg: "RS256",
+            n: publicJwk.n,
+            e: publicJwk.e,
+          },
+        ],
+      });
+      return;
+    }
+
+    if (request.method === "POST" && url.pathname === "/auth/token") {
+      counts.exchange += 1;
+      await readBody(request);
+      await delay(exchangeDelayMs);
+      jsonResponse(response, 200, {
+        access_token: "bench-apple-access",
+        refresh_token: "bench-apple-refresh",
+        id_token: signedIdentity(),
+        token_type: "Bearer",
+        expires_in: 3600,
+      });
+      return;
+    }
+
+    if (request.method === "GET" && url.pathname === "/fixture/apple-login-payload") {
+      jsonResponse(response, 200, {
+        idToken: signedIdentity(),
+        authCode: "bench-auth-code",
+        fullName,
+        email,
+      });
+      return;
+    }
+
+    if (request.method === "POST" && url.pathname === "/__reset") {
+      counts = { keys: 0, exchange: 0 };
+      jsonResponse(response, 200, counts);
+      return;
+    }
+
+    if (request.method === "GET" && url.pathname === "/__counts") {
+      jsonResponse(response, 200, counts);
+      return;
+    }
+
+    jsonResponse(response, 404, { error: "not_found" });
+  } catch (error) {
+    jsonResponse(response, 500, { error: error.message });
+  }
+});
+
+server.listen(port, "127.0.0.1", () => {
+  console.log(`Apple benchmark stub listening on http://127.0.0.1:${port}`);
+});
+
+for (const signal of ["SIGINT", "SIGTERM"]) {
+  process.on(signal, () => {
+    server.close(() => process.exit(0));
+  });
+}
diff --git a/scripts/benchmarks/apple-login/results/.gitkeep b/scripts/benchmarks/apple-login/results/.gitkeep
new file mode 100644
index 00000000..8b137891
--- /dev/null
+++ b/scripts/benchmarks/apple-login/results/.gitkeep
@@ -0,0 +1 @@
+
diff --git a/scripts/benchmarks/apple-login/run.sh b/scripts/benchmarks/apple-login/run.sh
new file mode 100755
index 00000000..9d08c80c
--- /dev/null
+++ b/scripts/benchmarks/apple-login/run.sh
@@ -0,0 +1,238 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+LABEL="${1:-}"
+MODE="${2:-quick}"
+
+if [[ "$LABEL" != "before" && "$LABEL" != "after" ]]; then
+  echo "usage: $0 <before|after> [quick|full]" >&2
+  exit 2
+fi
+
+if [[ "$MODE" != "quick" && "$MODE" != "full" ]]; then
+  echo "usage: $0 <before|after> [quick|full]" >&2
+  exit 2
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+APP_DIR="$REPO_ROOT/ontime-back"
+
+DB_CONTAINER="${BENCH_DB_CONTAINER:-ontime-bench-mysql}"
+DB_HOST="${BENCH_DB_HOST:-127.0.0.1}"
+DB_PORT="${BENCH_DB_PORT:-3307}"
+DB_NAME="${BENCH_DB_NAME:-ontime_bench}"
+DB_USER="${BENCH_DB_USER:-ontime_bench}"
+DB_PASSWORD="${BENCH_DB_PASSWORD:-ontime_bench_password}"
+DB_ROOT_PASSWORD="${BENCH_DB_ROOT_PASSWORD:-ontime_bench_root_password}"
+
+BACKEND_PORT="${BENCH_BACKEND_PORT:-18081}"
+STUB_PORT="${APPLE_STUB_PORT:-18080}"
+BACKEND_URL="http://127.0.0.1:${BACKEND_PORT}"
+APPLE_STUB_URL="http://127.0.0.1:${STUB_PORT}"
+APPLE_CLIENT_ID="${APPLE_CLIENT_ID:-club.devkor.ontime.bench}"
+
+RUNS="${RUNS:-}"
+if [[ -z "$RUNS" ]]; then
+  if [[ "$MODE" == "full" ]]; then
+    RUNS=10
+  else
+    RUNS=1
+  fi
+fi
+
+WARMUP_DURATION="${WARMUP_DURATION:-2m}"
+MEASUREMENT_DURATION="${MEASUREMENT_DURATION:-5m}"
+SCENARIOS="${SCENARIOS:-1 10 20}"
+
+TIMESTAMP="$(date -u +%Y%m%dT%H%M%SZ)"
+RESULT_DIR="${RESULT_DIR:-$SCRIPT_DIR/results/${TIMESTAMP}-${LABEL}-${MODE}}"
+mkdir -p "$RESULT_DIR"
+
+BACKEND_PID=""
+STUB_PID=""
+
+require_command() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "missing required command: $1" >&2
+    exit 1
+  fi
+}
+
+require_docker_daemon() {
+  if ! docker info >/dev/null 2>&1; then
+    echo "Docker daemon is not running. Start Docker Desktop and retry." >&2
+    exit 1
+  fi
+}
+
+cleanup() {
+  if [[ -n "$BACKEND_PID" ]] && kill -0 "$BACKEND_PID" >/dev/null 2>&1; then
+    kill "$BACKEND_PID" >/dev/null 2>&1 || true
+    wait "$BACKEND_PID" >/dev/null 2>&1 || true
+  fi
+  if [[ -n "$STUB_PID" ]] && kill -0 "$STUB_PID" >/dev/null 2>&1; then
+    kill "$STUB_PID" >/dev/null 2>&1 || true
+    wait "$STUB_PID" >/dev/null 2>&1 || true
+  fi
+}
+trap cleanup EXIT
+
+wait_for_mysql() {
+  for _ in {1..90}; do
+    if mysqladmin ping -h"$DB_HOST" -P"$DB_PORT" -uroot -p"$DB_ROOT_PASSWORD" --silent >/dev/null 2>&1; then
+      return 0
+    fi
+    sleep 1
+  done
+  echo "MySQL did not become ready" >&2
+  exit 1
+}
+
+wait_for_http() {
+  local url="$1"
+  local name="$2"
+  local log_path="${3:-}"
+  for _ in {1..180}; do
+    if curl -fsS "$url" >/dev/null 2>&1; then
+      return 0
+    fi
+    if [[ -n "$log_path" && ! -s "$log_path" ]]; then
+      true
+    fi
+    sleep 1
+  done
+  echo "$name did not become ready at $url" >&2
+  if [[ -n "$log_path" && -f "$log_path" ]]; then
+    tail -n 120 "$log_path" >&2 || true
+  fi
+  exit 1
+}
+
+reset_database() {
+  mysql -h"$DB_HOST" -P"$DB_PORT" -uroot -p"$DB_ROOT_PASSWORD" <<SQL
+DROP DATABASE IF EXISTS ${DB_NAME};
+CREATE DATABASE ${DB_NAME} CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+GRANT ALL PRIVILEGES ON ${DB_NAME}.* TO '${DB_USER}'@'%';
+FLUSH PRIVILEGES;
+SQL
+}
+
+seed_returning_user() {
+  mysql -h"$DB_HOST" -P"$DB_PORT" -u"$DB_USER" -p"$DB_PASSWORD" "$DB_NAME" < "$SCRIPT_DIR/seed-returning-user.sql"
+}
+
+generate_private_key_base64() {
+  node - <<'NODE'
+const { generateKeyPairSync } = require("node:crypto");
+const { privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+const pem = privateKey.export({ type: "pkcs8", format: "pem" });
+process.stdout.write(Buffer.from(pem).toString("base64"));
+NODE
+}
+
+start_mysql() {
+  if docker ps -a --format '{{.Names}}' | grep -qx "$DB_CONTAINER"; then
+    docker start "$DB_CONTAINER" >/dev/null
+  else
+    docker run -d \
+      --name "$DB_CONTAINER" \
+      -e MYSQL_DATABASE="$DB_NAME" \
+      -e MYSQL_USER="$DB_USER" \
+      -e MYSQL_PASSWORD="$DB_PASSWORD" \
+      -e MYSQL_ROOT_PASSWORD="$DB_ROOT_PASSWORD" \
+      -e TZ=Asia/Seoul \
+      -p "127.0.0.1:${DB_PORT}:3306" \
+      mysql:8.0 \
+      --character-set-server=utf8mb4 \
+      --collation-server=utf8mb4_unicode_ci \
+      --default-time-zone=+09:00 >/dev/null
+  fi
+  wait_for_mysql
+  reset_database
+}
+
+start_stub() {
+  APPLE_STUB_PORT="$STUB_PORT" \
+  APPLE_CLIENT_ID="$APPLE_CLIENT_ID" \
+  BENCH_APPLE_SUB="bench-apple-user" \
+  APPLE_KEYS_DELAY_MS=80 \
+  APPLE_EXCHANGE_DELAY_MS=300 \
+    node "$SCRIPT_DIR/apple-stub.mjs" > "$RESULT_DIR/apple-stub.log" 2>&1 &
+  STUB_PID="$!"
+  wait_for_http "$APPLE_STUB_URL/fixture/apple-login-payload" "Apple stub" "$RESULT_DIR/apple-stub.log"
+}
+
+start_backend() {
+  local private_key_base64
+  private_key_base64="$(generate_private_key_base64)"
+  (
+    cd "$APP_DIR"
+    SPRING_PROFILES_ACTIVE=bench \
+    SERVER_PORT="$BACKEND_PORT" \
+    SPRING_DATASOURCE_URL="jdbc:mysql://${DB_HOST}:${DB_PORT}/${DB_NAME}?useSSL=false&serverTimezone=Asia/Seoul&characterEncoding=UTF-8&allowPublicKeyRetrieval=true" \
+    SPRING_DATASOURCE_USERNAME="$DB_USER" \
+    SPRING_DATASOURCE_PASSWORD="$DB_PASSWORD" \
+    JWT_SECRET_KEY="bench_secret_key_for_ontime_back_application_benchmark_environment_1234567890" \
+    APPLE_CLIENT_ID="$APPLE_CLIENT_ID" \
+    APPLE_TEAM_ID="BENCHTEAM1" \
+    APPLE_LOGIN_KEY="BENCHKEY1" \
+    APPLE_PRIVATE_KEY_BASE64="$private_key_base64" \
+    APPLE_KEYS_URL="$APPLE_STUB_URL/auth/keys" \
+    APPLE_TOKEN_URL="$APPLE_STUB_URL/auth/token" \
+      ./gradlew bootRun
+  ) > "$RESULT_DIR/backend.log" 2>&1 &
+  BACKEND_PID="$!"
+  wait_for_http "$BACKEND_URL/health" "backend" "$RESULT_DIR/backend.log"
+  seed_returning_user
+}
+
+run_k6_once() {
+  local concurrency="$1"
+  local run_number="$2"
+  local run_id
+  run_id="$(printf 'run%02d' "$run_number")"
+
+  K6_VUS="$concurrency" \
+  K6_DURATION="$WARMUP_DURATION" \
+  BACKEND_URL="$BACKEND_URL" \
+  APPLE_STUB_URL="$APPLE_STUB_URL" \
+  K6_RESULT_JSON="$RESULT_DIR/warmup-${LABEL}-c${concurrency}-${run_id}.json" \
+    k6 run "$SCRIPT_DIR/apple-login.k6.js" > "$RESULT_DIR/warmup-${LABEL}-c${concurrency}-${run_id}.log"
+
+  curl -fsS -X POST "$APPLE_STUB_URL/__reset" >/dev/null
+
+  K6_VUS="$concurrency" \
+  K6_DURATION="$MEASUREMENT_DURATION" \
+  BACKEND_URL="$BACKEND_URL" \
+  APPLE_STUB_URL="$APPLE_STUB_URL" \
+  K6_RESULT_JSON="$RESULT_DIR/k6-${LABEL}-c${concurrency}-${run_id}.json" \
+    k6 run "$SCRIPT_DIR/apple-login.k6.js" > "$RESULT_DIR/k6-${LABEL}-c${concurrency}-${run_id}.log"
+
+  curl -fsS "$APPLE_STUB_URL/__counts" > "$RESULT_DIR/stub-${LABEL}-c${concurrency}-${run_id}.json"
+}
+
+main() {
+  require_command docker
+  require_command mysql
+  require_command mysqladmin
+  require_command curl
+  require_command node
+  require_command k6
+  require_docker_daemon
+
+  start_mysql
+  start_stub
+  start_backend
+
+  for concurrency in $SCENARIOS; do
+    for run_number in $(seq 1 "$RUNS"); do
+      echo "running ${LABEL}/${MODE}: concurrency=${concurrency}, run=${run_number}/${RUNS}"
+      run_k6_once "$concurrency" "$run_number"
+    done
+  done
+
+  python3 "$SCRIPT_DIR/summarize.py" "$RESULT_DIR"
+}
+
+main
diff --git a/scripts/benchmarks/apple-login/seed-returning-user.sql b/scripts/benchmarks/apple-login/seed-returning-user.sql
new file mode 100644
index 00000000..d95c7533
--- /dev/null
+++ b/scripts/benchmarks/apple-login/seed-returning-user.sql
@@ -0,0 +1,53 @@
+DELETE urt
+FROM user_refresh_token urt
+JOIN `user` u ON u.user_id = urt.user_id
+WHERE u.social_type = 'APPLE'
+  AND u.social_id = 'bench-apple-user';
+
+INSERT INTO `user` (
+  email,
+  password,
+  image_url,
+  name,
+  spare_time,
+  note,
+  punctuality_score,
+  schedule_count_after_reset,
+  lateness_count_after_reset,
+  role,
+  social_type,
+  social_id,
+  refresh_token,
+  firebase_token,
+  social_login_token,
+  access_token
+) VALUES (
+  'bench.apple@example.com',
+  NULL,
+  NULL,
+  'Bench User',
+  10,
+  NULL,
+  100.0,
+  0,
+  0,
+  'USER',
+  'APPLE',
+  'bench-apple-user',
+  NULL,
+  NULL,
+  'bench-existing-provider-grant',
+  NULL
+) ON DUPLICATE KEY UPDATE
+  email = VALUES(email),
+  name = VALUES(name),
+  spare_time = VALUES(spare_time),
+  note = VALUES(note),
+  punctuality_score = VALUES(punctuality_score),
+  schedule_count_after_reset = VALUES(schedule_count_after_reset),
+  lateness_count_after_reset = VALUES(lateness_count_after_reset),
+  role = VALUES(role),
+  refresh_token = VALUES(refresh_token),
+  firebase_token = VALUES(firebase_token),
+  social_login_token = VALUES(social_login_token),
+  access_token = VALUES(access_token);
diff --git a/scripts/benchmarks/apple-login/summarize.py b/scripts/benchmarks/apple-login/summarize.py
new file mode 100755
index 00000000..f1333ff2
--- /dev/null
+++ b/scripts/benchmarks/apple-login/summarize.py
@@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+import csv
+import json
+import re
+import sys
+from pathlib import Path
+
+
+K6_NAME = re.compile(r"k6-(?P<label>[^-]+)-c(?P<concurrency>\d+)-run(?P<run>\d+)\.json")
+
+
+def metric_value(metrics, name, field, default=0):
+    value = metrics.get(name, {})
+    values = value.get("values", {})
+    return values.get(field, value.get(field, default))
+
+
+def percentile(metrics, name, key):
+    metric = metrics.get(name, {})
+    values = metric.get("values", {})
+    if key == "p(50)":
+        return values.get(key, values.get("med"))
+    return values.get(key, metric.get("percentiles", {}).get(key))
+
+
+def read_json(path):
+    with path.open() as file:
+        return json.load(file)
+
+
+def summarize(result_dir):
+    rows = []
+    for k6_path in sorted(result_dir.glob("k6-*-c*-run*.json")):
+        match = K6_NAME.fullmatch(k6_path.name)
+        if not match:
+            continue
+
+        label = match.group("label")
+        concurrency = match.group("concurrency")
+        run = match.group("run")
+        stub_path = result_dir / f"stub-{label}-c{concurrency}-run{run}.json"
+        k6_summary = read_json(k6_path)
+        stub_counts = read_json(stub_path) if stub_path.exists() else {}
+
+        metrics = k6_summary.get("metrics", {})
+        requests = metric_value(metrics, "apple_login_requests", "count", 0)
+        failed_rate = metric_value(metrics, "apple_login_failed", "rate", 0)
+        keys = stub_counts.get("keys", 0)
+        exchange = stub_counts.get("exchange", 0)
+
+        rows.append(
+            {
+                "label": label,
+                "concurrency": concurrency,
+                "run": run,
+                "requests": requests,
+                "error_rate": failed_rate,
+                "p50_ms": percentile(metrics, "apple_login_duration", "p(50)"),
+                "p95_ms": percentile(metrics, "apple_login_duration", "p(95)"),
+                "p99_ms": percentile(metrics, "apple_login_duration", "p(99)"),
+                "jwks_calls": keys,
+                "token_exchange_calls": exchange,
+                "jwks_calls_per_request": keys / requests if requests else None,
+                "token_exchange_calls_per_request": exchange / requests if requests else None,
+            }
+        )
+
+    return rows
+
+
+def main():
+    if len(sys.argv) != 2:
+        print("usage: summarize.py <result-dir>", file=sys.stderr)
+        return 2
+
+    result_dir = Path(sys.argv[1]).resolve()
+    rows = summarize(result_dir)
+    if not rows:
+        print(f"no k6 result files found in {result_dir}", file=sys.stderr)
+        return 1
+
+    output_path = result_dir / "summary.csv"
+    with output_path.open("w", newline="") as file:
+        writer = csv.DictWriter(file, fieldnames=list(rows[0].keys()))
+        writer.writeheader()
+        writer.writerows(rows)
+
+    print(output_path)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

From 2fc2c6c48a351b10d092eea4ebb1d2e501de9a69 Mon Sep 17 00:00:00 2001
From: jjoonleo <jjoonleo@gmail.com>
Date: Sun, 28 Jun 2026 14:54:38 +0900
Subject: [PATCH 2/2] Reduce Apple login provider round trips

---
 docs/performance/apple-login-323.md           | 51 ++++++++++++++-----
 .../global/oauth/apple/AppleLoginFilter.java  | 31 ++++++++---
 .../global/oauth/apple/AppleLoginService.java | 33 ++++++++++--
 .../oauth/OAuthLoginFilterValidationTest.java | 17 +++----
 .../oauth/apple/AppleLoginServiceTest.java    | 49 ++++++++++++++++++
 scripts/benchmarks/apple-login/README.md      |  6 ++-
 .../benchmarks/apple-login/apple-login.k6.js  | 16 ++++--
 scripts/benchmarks/apple-login/apple-stub.mjs | 13 ++---
 .../benchmarks/apple-login/results/.gitignore |  4 ++
 .../20260628T043649Z-before-quick/summary.csv |  4 ++
 .../20260628T045808Z-after-quick/summary.csv  |  4 ++
 .../20260628T051949Z-before-full/summary.csv  | 10 ++++
 .../20260628T053451Z-after-full/summary.csv   | 10 ++++
 .../apple-login/seed-returning-user.sql       | 24 ++++++---
 14 files changed, 221 insertions(+), 51 deletions(-)
 create mode 100644 scripts/benchmarks/apple-login/results/.gitignore
 create mode 100644 scripts/benchmarks/apple-login/results/20260628T043649Z-before-quick/summary.csv
 create mode 100644 scripts/benchmarks/apple-login/results/20260628T045808Z-after-quick/summary.csv
 create mode 100644 scripts/benchmarks/apple-login/results/20260628T051949Z-before-full/summary.csv
 create mode 100644 scripts/benchmarks/apple-login/results/20260628T053451Z-after-full/summary.csv

diff --git a/docs/performance/apple-login-323.md b/docs/performance/apple-login-323.md
index 966cc681..7489b08a 100644
--- a/docs/performance/apple-login-323.md
+++ b/docs/performance/apple-login-323.md
@@ -9,13 +9,14 @@ Primary benchmark environment:
 - Backend: local Spring Boot process with `bench` profile
 - Database: isolated Docker MySQL database `ontime_bench`
 - Apple provider: local stub
-- Returning Apple User: `social_type=APPLE`, `social_id=bench-apple-user`
+- Returning Apple Users: `social_type=APPLE`, `social_id=bench-apple-user-<vu>`
 - Stub delay:
   - `GET /auth/keys`: 80 ms
   - `POST /auth/token`: 300 ms
-- Warmup: 2 minutes
-- Measurement: 5 minutes
-- Full run count: 10 per scenario
+- Quick run: default harness settings, 2 minutes warmup and 5 minutes measurement, 1 run per scenario
+- Full evidence run: bounded local run, 30 seconds warmup and 60 seconds measurement, 3 runs per scenario
+- Before checkout: `origin/main` (`ab5fc7f`) plus benchmark harness only (`85b2b18`)
+- After checkout: same benchmark harness plus the #323 fix under test
 
 The benchmark harness lives in `scripts/benchmarks/apple-login/`.
 
@@ -36,19 +37,41 @@ Secondary scenarios: returning Apple User, concurrency 10 and 20.
 
 ## Results
 
-Populate this table from `scripts/benchmarks/apple-login/results/*/summary.csv` after running both before and after measurements.
+The full rows aggregate 3 runs per scenario by summing requests/provider calls and averaging per-run p50/p95 latency.
 
-| scenario | version | runs | requests | error_rate | p50_ms | p95_ms | p99_ms | jwks_calls/request | token_exchange_calls/request |
-| --- | --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
-| c1 returning warm-cache | before | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
-| c1 returning warm-cache | after | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
-| c10 returning warm-cache | before | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
-| c10 returning warm-cache | after | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
-| c20 returning warm-cache | before | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
-| c20 returning warm-cache | after | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
+| mode | scenario | version | runs | requests | error_rate | p50_ms | p95_ms | jwks_calls/request | token_exchange_calls/request |
+| --- | --- | --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
+| quick | c1 returning warm-cache | before | 1 | 590 | 0.000 | 405.6 | 425.5 | 1.000 | 1.000 |
+| quick | c1 returning warm-cache | after | 1 | 2,327 | 0.000 | 26.0 | 40.1 | 0.000 | 0.000 |
+| quick | c10 returning warm-cache | before | 1 | 5,773 | 0.000 | 417.9 | 435.1 | 1.000 | 1.000 |
+| quick | c10 returning warm-cache | after | 1 | 22,366 | 0.000 | 33.7 | 46.5 | 0.000 | 0.000 |
+| quick | c20 returning warm-cache | before | 1 | 11,745 | 0.000 | 408.0 | 431.2 | 1.000 | 1.000 |
+| quick | c20 returning warm-cache | after | 1 | 47,844 | 0.000 | 20.7 | 46.8 | 0.000 | 0.000 |
+| full | c1 returning warm-cache | before | 3 | 346 | 0.000 | 413.6 | 435.8 | 1.000 | 1.000 |
+| full | c1 returning warm-cache | after | 3 | 1,407 | 0.000 | 23.1 | 46.5 | 0.000 | 0.000 |
+| full | c10 returning warm-cache | before | 3 | 3,492 | 0.000 | 415.1 | 429.1 | 1.000 | 1.000 |
+| full | c10 returning warm-cache | after | 3 | 13,425 | 0.000 | 29.3 | 58.5 | 0.000 | 0.000 |
+| full | c20 returning warm-cache | before | 3 | 6,829 | 0.000 | 420.4 | 506.9 | 1.000 | 1.000 |
+| full | c20 returning warm-cache | after | 3 | 27,824 | 0.000 | 19.9 | 60.4 | 0.000 | 0.000 |
+
+## Result Files
+
+- Quick before: `scripts/benchmarks/apple-login/results/20260628T043649Z-before-quick/summary.csv`
+- Quick after: `scripts/benchmarks/apple-login/results/20260628T045808Z-after-quick/summary.csv`
+- Full before: `scripts/benchmarks/apple-login/results/20260628T051949Z-before-full/summary.csv`
+- Full after: `scripts/benchmarks/apple-login/results/20260628T053451Z-after-full/summary.csv`
+
+## Decision
+
+The #323 fix passes the acceptance gate in both quick and bounded full runs:
+
+- c1 p95 improved from 435.8 ms to 46.5 ms in the full run, an 89.3% reduction.
+- Returning Apple User login used 0.0 JWKS network calls/request after warmup.
+- Returning Apple User login used 0.0 Apple token exchange calls/request after the fix.
+- Error rate stayed at 0% across c1, c10, and c20.
 
 ## Notes
 
 - Real Apple network calls are intentionally excluded from the primary benchmark because provider and network variability would obscure backend request-path changes.
 - The script labels results as `before` or `after` but does not change git refs. Select the checkout explicitly before running.
-- Quick mode is for development feedback. Full mode is the acceptance evidence.
+- The original single-user concurrency harness caused c10 failures unrelated to #323 because concurrent logins for one **User** raced on single-active-session token rotation. The harness now seeds one returning Apple User per VU so c10/c20 measure Apple provider round trips rather than same-user session contention.
diff --git a/ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginFilter.java b/ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginFilter.java
index ad842cce..41847b46 100644
--- a/ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginFilter.java
+++ b/ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginFilter.java
@@ -74,8 +74,9 @@ public Authentication attemptAuthentication(HttpServletRequest request, HttpServ
         }
 
         try {
-            // Apple Identity Token 검증
+            long startedAt = System.nanoTime();
             Claims tokenClaims = appleLoginService.verifyIdentityToken(oAuthAppleRequestDto.getIdToken());
+            long verifiedAt = System.nanoTime();
             if (tokenClaims.getSubject() == null) {
                 throw new IllegalStateException("Apple 로그인 검증 실패");
             }
@@ -85,18 +86,21 @@ public Authentication attemptAuthentication(HttpServletRequest request, HttpServ
                     oAuthAppleRequestDto.getEmail(),
                     tokenClaims.get("email", String.class)
             );
-            String appleRefreshToken = exchangeAppleRefreshToken(oAuthAppleRequestDto);
-
             OAuthAppleUserDto oAuthAppleUserDto = new OAuthAppleUserDto(appleUserId, email, oAuthAppleRequestDto.getFullName());
 
             Optional<User> existingUser = userRepository.findBySocialTypeAndSocialId(SocialType.APPLE, appleUserId);
+            long userLookupAt = System.nanoTime();
 
             if (existingUser.isPresent()) {
-                return appleLoginService.handleLogin(appleRefreshToken, existingUser.get(), response);
-            } else {
-                return appleLoginService.handleRegister(appleRefreshToken, oAuthAppleUserDto, response);
+                logAppleLoginTiming("existing_user", startedAt, verifiedAt, userLookupAt, userLookupAt);
+                return appleLoginService.handleLogin(null, existingUser.get(), response);
             }
 
+            String appleRefreshToken = exchangeAppleRefreshToken(oAuthAppleRequestDto);
+            long credentialExchangeAt = System.nanoTime();
+            logAppleLoginTiming("new_user", startedAt, verifiedAt, userLookupAt, credentialExchangeAt);
+            return appleLoginService.handleRegister(appleRefreshToken, oAuthAppleUserDto, response);
+
         } catch (Exception e) {
             log.error("Apple login failed", e);
             throw new AppleLoginException();
@@ -115,6 +119,21 @@ private String exchangeAppleRefreshToken(OAuthAppleRequestDto oAuthAppleRequestD
         }
     }
 
+    private void logAppleLoginTiming(String result, long startedAt, long verifiedAt, long userLookupAt, long credentialExchangeAt) {
+        log.info(
+                "Apple login stage timing result={} verifyMs={} dbLookupMs={} credentialExchangeMs={} totalMs={}",
+                result,
+                elapsedMillis(startedAt, verifiedAt),
+                elapsedMillis(verifiedAt, userLookupAt),
+                elapsedMillis(userLookupAt, credentialExchangeAt),
+                elapsedMillis(startedAt, credentialExchangeAt)
+        );
+    }
+
+    private long elapsedMillis(long from, long to) {
+        return (to - from) / 1_000_000;
+    }
+
     private String firstNonBlank(String first, String second) {
         if (first != null && !first.isBlank()) {
             return first;
diff --git a/ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginService.java b/ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginService.java
index e327e5bc..24c35658 100644
--- a/ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginService.java
+++ b/ontime-back/src/main/java/devkor/ontime_back/global/oauth/apple/AppleLoginService.java
@@ -43,6 +43,7 @@
 import java.security.PrivateKey;
 import java.security.PublicKey;
 import java.security.spec.PKCS8EncodedKeySpec;
+import java.time.Duration;
 import java.time.Instant;
 import java.util.*;
 
@@ -53,6 +54,7 @@ public class AppleLoginService {
 
     private static final String APPLE_KEYS_URL = "https://appleid.apple.com/auth/keys";
     private static final String APPLE_TOKEN_URL = "https://appleid.apple.com/auth/token";
+    private static final Duration APPLE_PUBLIC_KEY_CACHE_TTL = Duration.ofHours(24);
     private String issuer = "https://appleid.apple.com";
     @Value("${apple.keys-url:" + APPLE_KEYS_URL + "}")
     private String appleKeysUrl = APPLE_KEYS_URL;
@@ -80,6 +82,9 @@ public class AppleLoginService {
     private final AuthTokenService authTokenService;
 
     private final RestTemplate restTemplate = new RestTemplate();
+    private ApplePublicKeyResponse cachedApplePublicKeys;
+    private Instant cachedApplePublicKeysAt;
+
     public Authentication handleLogin(String appleRefreshToken, User user, HttpServletResponse response) throws IOException {
         log.info("handleLogin");
         if (appleRefreshToken != null && !appleRefreshToken.isBlank()) {
@@ -170,9 +175,7 @@ public Claims verifyIdentityToken(String identityToken) throws
             Exception {
         log.info("Verify Apple identity credential");
         Map<String, String> headers = jwtUtils.parseHeaders(identityToken);
-        // apple publickey
-        ApplePublicKeyResponse applePublicKeyResponse = restTemplate.getForObject(appleKeysUrl, ApplePublicKeyResponse.class);
-        PublicKey publicKey = applePublicKeyGenerator.generatePublicKey(headers, applePublicKeyResponse);
+        PublicKey publicKey = resolveApplePublicKey(headers);
         // claim
         Claims tokenClaims = jwtUtils.getTokenClaims(identityToken, publicKey);
         // iss 확인
@@ -192,6 +195,30 @@ public Claims verifyIdentityToken(String identityToken) throws
         return tokenClaims;
     }
 
+    private PublicKey resolveApplePublicKey(Map<String, String> headers) throws Exception {
+        ApplePublicKeyResponse applePublicKeys = getCachedApplePublicKeys();
+        try {
+            return applePublicKeyGenerator.generatePublicKey(headers, applePublicKeys);
+        } catch (IllegalArgumentException e) {
+            log.info("Apple public key cache miss for signed credential header; refreshing key set");
+            return applePublicKeyGenerator.generatePublicKey(headers, refreshApplePublicKeys());
+        }
+    }
+
+    private synchronized ApplePublicKeyResponse getCachedApplePublicKeys() {
+        if (cachedApplePublicKeys == null || cachedApplePublicKeysAt == null ||
+                cachedApplePublicKeysAt.plus(APPLE_PUBLIC_KEY_CACHE_TTL).isBefore(Instant.now())) {
+            return refreshApplePublicKeys();
+        }
+        return cachedApplePublicKeys;
+    }
+
+    private synchronized ApplePublicKeyResponse refreshApplePublicKeys() {
+        cachedApplePublicKeys = restTemplate.getForObject(appleKeysUrl, ApplePublicKeyResponse.class);
+        cachedApplePublicKeysAt = Instant.now();
+        return cachedApplePublicKeys;
+    }
+
     // apple 서버로부터 accesstoken, refreshtoken 발급
     public AppleTokenResponseDto getAppleAccessTokenAndRefreshToken(String authCode) throws Exception {
         // clientSecret
diff --git a/ontime-back/src/test/java/devkor/ontime_back/global/oauth/OAuthLoginFilterValidationTest.java b/ontime-back/src/test/java/devkor/ontime_back/global/oauth/OAuthLoginFilterValidationTest.java
index 6e50b43f..96e7a628 100644
--- a/ontime-back/src/test/java/devkor/ontime_back/global/oauth/OAuthLoginFilterValidationTest.java
+++ b/ontime-back/src/test/java/devkor/ontime_back/global/oauth/OAuthLoginFilterValidationTest.java
@@ -42,6 +42,7 @@
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.when;
 
@@ -330,7 +331,7 @@ void appleLoginFilterRejectsInvalidRequest() throws Exception {
     }
 
     @Test
-    @DisplayName("애플 로그인 필터가 기존 유저를 Apple refresh token으로 로그인 처리한다")
+    @DisplayName("애플 로그인 필터가 기존 유저는 Apple token 교환 없이 로그인 처리한다")
     void appleLoginFilterLogsInExistingUser() throws Exception {
         AppleLoginFilter filter = new AppleLoginFilter(
                 "/oauth2/apple/login",
@@ -341,14 +342,12 @@ void appleLoginFilterLogsInExistingUser() throws Exception {
         MockHttpServletResponse response = new MockHttpServletResponse();
         Claims claims = Jwts.claims().setSubject("apple-id");
         claims.put("email", "user@example.com");
-        AppleTokenResponseDto tokenResponse = appleTokenResponse("apple-refresh-token");
         User existingUser = user(1L, "user@example.com", Role.USER);
 
         when(appleLoginService.verifyIdentityToken("apple-id-token")).thenReturn(claims);
-        when(appleLoginService.getAppleAccessTokenAndRefreshToken("auth-code")).thenReturn(tokenResponse);
         when(userRepository.findBySocialTypeAndSocialId(SocialType.APPLE, "apple-id"))
                 .thenReturn(Optional.of(existingUser));
-        when(appleLoginService.handleLogin("apple-refresh-token", existingUser, response)).thenReturn(
+        when(appleLoginService.handleLogin(null, existingUser, response)).thenReturn(
                 new org.springframework.security.authentication.UsernamePasswordAuthenticationToken(existingUser, null)
         );
 
@@ -356,12 +355,13 @@ void appleLoginFilterLogsInExistingUser() throws Exception {
                 request("/oauth2/apple/login", validAppleBody()),
                 response).getPrincipal()).isSameAs(existingUser);
 
-        verify(appleLoginService).handleLogin("apple-refresh-token", existingUser, response);
+        verify(appleLoginService, never()).getAppleAccessTokenAndRefreshToken("auth-code");
+        verify(appleLoginService).handleLogin(null, existingUser, response);
     }
 
     @Test
-    @DisplayName("애플 로그인 필터가 Apple refresh token 교환 실패 시 identity token 검증만으로 기존 유저를 로그인 처리한다")
-    void appleLoginFilterLogsInExistingUserWhenTokenExchangeFails() throws Exception {
+    @DisplayName("애플 로그인 필터가 기존 유저 경로에서는 실패 가능한 Apple token 교환을 시도하지 않는다")
+    void appleLoginFilterSkipsTokenExchangeForExistingUser() throws Exception {
         AppleLoginFilter filter = new AppleLoginFilter(
                 "/oauth2/apple/login",
                 objectMapper,
@@ -373,8 +373,6 @@ void appleLoginFilterLogsInExistingUserWhenTokenExchangeFails() throws Exception
         User existingUser = user(1L, "user@example.com", Role.USER);
 
         when(appleLoginService.verifyIdentityToken("apple-id-token")).thenReturn(claims);
-        when(appleLoginService.getAppleAccessTokenAndRefreshToken("auth-code"))
-                .thenThrow(new RuntimeException("invalid_client"));
         when(userRepository.findBySocialTypeAndSocialId(SocialType.APPLE, "apple-id"))
                 .thenReturn(Optional.of(existingUser));
         when(appleLoginService.handleLogin(null, existingUser, response)).thenReturn(
@@ -385,6 +383,7 @@ void appleLoginFilterLogsInExistingUserWhenTokenExchangeFails() throws Exception
                 request("/oauth2/apple/login", validAppleBody()),
                 response).getPrincipal()).isSameAs(existingUser);
 
+        verify(appleLoginService, never()).getAppleAccessTokenAndRefreshToken("auth-code");
         verify(appleLoginService).handleLogin(null, existingUser, response);
     }
 
diff --git a/ontime-back/src/test/java/devkor/ontime_back/global/oauth/apple/AppleLoginServiceTest.java b/ontime-back/src/test/java/devkor/ontime_back/global/oauth/apple/AppleLoginServiceTest.java
index c2b7bbbf..16900f6e 100644
--- a/ontime-back/src/test/java/devkor/ontime_back/global/oauth/apple/AppleLoginServiceTest.java
+++ b/ontime-back/src/test/java/devkor/ontime_back/global/oauth/apple/AppleLoginServiceTest.java
@@ -163,6 +163,55 @@ void verifyIdentityTokenReturnsClaimsWhenIssuerAudienceAndExpirationAreValid() t
         assertThat(verifiedClaims).isSameAs(claims);
     }
 
+    @Test
+    void verifyIdentityTokenReusesCachedApplePublicKeys() throws Exception {
+        RestTemplate restTemplate = mockRestTemplate();
+        ApplePublicKeyResponse appleKeys = new ApplePublicKeyResponse(java.util.List.of());
+        PublicKey publicKey = java.security.KeyPairGenerator.getInstance("RSA").generateKeyPair().getPublic();
+        Claims claims = validAppleClaims();
+        Map<String, String> headers = Map.of("kid", "key-id", "alg", "RS256");
+        ReflectionTestUtils.setField(appleLoginService, "clientId", "com.ontime.service");
+        when(jwtUtils.parseHeaders("identity-token")).thenReturn(headers);
+        when(restTemplate.getForObject("https://appleid.apple.com/auth/keys", ApplePublicKeyResponse.class))
+                .thenReturn(appleKeys);
+        when(applePublicKeyGenerator.generatePublicKey(headers, appleKeys)).thenReturn(publicKey);
+        when(jwtUtils.getTokenClaims("identity-token", publicKey)).thenReturn(claims);
+
+        appleLoginService.verifyIdentityToken("identity-token");
+        appleLoginService.verifyIdentityToken("identity-token");
+
+        verify(restTemplate, times(1)).getForObject("https://appleid.apple.com/auth/keys", ApplePublicKeyResponse.class);
+        verify(applePublicKeyGenerator, times(2)).generatePublicKey(headers, appleKeys);
+    }
+
+    @Test
+    void verifyIdentityTokenRefreshesApplePublicKeysOnceWhenKidIsUnknown() throws Exception {
+        RestTemplate restTemplate = mockRestTemplate();
+        ApplePublicKeyResponse staleKeys = new ApplePublicKeyResponse(java.util.List.of(
+                new ApplePublicKey("RSA", "old-key-id", "RS256", "AQAB", "AQAB")
+        ));
+        ApplePublicKeyResponse rotatedKeys = new ApplePublicKeyResponse(java.util.List.of(
+                new ApplePublicKey("RSA", "new-key-id", "RS256", "AQAB", "AQAB")
+        ));
+        PublicKey publicKey = java.security.KeyPairGenerator.getInstance("RSA").generateKeyPair().getPublic();
+        Claims claims = validAppleClaims();
+        Map<String, String> headers = Map.of("kid", "new-key-id", "alg", "RS256");
+        ReflectionTestUtils.setField(appleLoginService, "clientId", "com.ontime.service");
+        when(jwtUtils.parseHeaders("identity-token")).thenReturn(headers);
+        when(restTemplate.getForObject("https://appleid.apple.com/auth/keys", ApplePublicKeyResponse.class))
+                .thenReturn(staleKeys)
+                .thenReturn(rotatedKeys);
+        when(applePublicKeyGenerator.generatePublicKey(headers, staleKeys))
+                .thenThrow(new IllegalArgumentException("Invalid JWT: No matching Apple Public Key found"));
+        when(applePublicKeyGenerator.generatePublicKey(headers, rotatedKeys)).thenReturn(publicKey);
+        when(jwtUtils.getTokenClaims("identity-token", publicKey)).thenReturn(claims);
+
+        Claims verifiedClaims = appleLoginService.verifyIdentityToken("identity-token");
+
+        assertThat(verifiedClaims).isSameAs(claims);
+        verify(restTemplate, times(2)).getForObject("https://appleid.apple.com/auth/keys", ApplePublicKeyResponse.class);
+    }
+
     @Test
     void verifyIdentityTokenRejectsTokenFromUnexpectedIssuer() throws Exception {
         RestTemplate restTemplate = mockRestTemplate();
diff --git a/scripts/benchmarks/apple-login/README.md b/scripts/benchmarks/apple-login/README.md
index c23e710c..fc7048a1 100644
--- a/scripts/benchmarks/apple-login/README.md
+++ b/scripts/benchmarks/apple-login/README.md
@@ -6,7 +6,7 @@ This benchmark measures issue #323: repeated Apple provider round trips on the r
 
 - Endpoint: `POST /oauth2/apple/login`
 - Primary path: returning Apple User, warm Apple key cache
-- Seeded Apple subject: `bench-apple-user`
+- Seeded Apple subjects: `bench-apple-user-<vu>` up to `bench-apple-user-64`
 - Apple provider: local stub, not the real Apple network
 - Stub delay:
   - `GET /auth/keys`: 80 ms
@@ -38,7 +38,7 @@ scripts/benchmarks/apple-login/run.sh before full
 scripts/benchmarks/apple-login/run.sh after full
 ```
 
-The script starts an isolated MySQL container, starts the Apple stub, starts the backend with the `bench` Spring profile, seeds the returning Apple User, runs k6, and writes results.
+The script starts an isolated MySQL container, starts the Apple stub, starts the backend with the `bench` Spring profile, seeds returning Apple Users, runs k6, and writes results.
 
 The script does not run `git checkout`. Measure the checkout you have selected, and use `before` or `after` only as the result label.
 
@@ -55,6 +55,8 @@ The script does not run `git checkout`. Measure the checkout you have selected,
 - Measurement: 5 minutes
 - Concurrency: 1, 10, 20
 
+Each VU uses a distinct returning Apple User. This keeps the benchmark focused on Apple provider round trips instead of same-user active-session token rotation under concurrent login load.
+
 Override example:
 
 ```bash
diff --git a/scripts/benchmarks/apple-login/apple-login.k6.js b/scripts/benchmarks/apple-login/apple-login.k6.js
index 1bff97f2..13ebe5d4 100644
--- a/scripts/benchmarks/apple-login/apple-login.k6.js
+++ b/scripts/benchmarks/apple-login/apple-login.k6.js
@@ -21,14 +21,20 @@ export const options = {
 };
 
 export function setup() {
-  const response = http.get(`${stubUrl}/fixture/apple-login-payload`);
-  if (response.status !== 200) {
-    throw new Error(`fixture request failed with status ${response.status}`);
+  const payloads = [];
+  for (let index = 1; index <= vus; index += 1) {
+    const subject = `bench-apple-user-${index}`;
+    const response = http.get(`${stubUrl}/fixture/apple-login-payload?subject=${subject}`);
+    if (response.status !== 200) {
+      throw new Error(`fixture request failed for ${subject} with status ${response.status}`);
+    }
+    payloads.push(response.json());
   }
-  return response.json();
+  return payloads;
 }
 
-export default function (payload) {
+export default function (payloads) {
+  const payload = payloads[(__VU - 1) % payloads.length];
   const response = http.post(
     `${backendUrl}/oauth2/apple/login`,
     JSON.stringify(payload),
diff --git a/scripts/benchmarks/apple-login/apple-stub.mjs b/scripts/benchmarks/apple-login/apple-stub.mjs
index 556c6087..e34290fa 100644
--- a/scripts/benchmarks/apple-login/apple-stub.mjs
+++ b/scripts/benchmarks/apple-login/apple-stub.mjs
@@ -3,7 +3,7 @@ import { createSign, generateKeyPairSync } from "node:crypto";
 
 const port = Number(process.env.APPLE_STUB_PORT || 18080);
 const clientId = process.env.APPLE_CLIENT_ID || "club.devkor.ontime.bench";
-const subject = process.env.BENCH_APPLE_SUB || "bench-apple-user";
+const defaultSubject = process.env.BENCH_APPLE_SUB || "bench-apple-user-1";
 const fullName = process.env.BENCH_APPLE_FULL_NAME || "Bench User";
 const email = process.env.BENCH_APPLE_EMAIL || "bench.apple@example.com";
 const keyDelayMs = Number(process.env.APPLE_KEYS_DELAY_MS || 80);
@@ -52,7 +52,7 @@ function readBody(request) {
   });
 }
 
-function signedIdentity() {
+function signedIdentity(subject) {
   const nowSeconds = Math.floor(Date.now() / 1000);
   const header = {
     alg: "RS256",
@@ -64,7 +64,7 @@ function signedIdentity() {
     aud: clientId,
     exp: nowSeconds + 3600,
     iat: nowSeconds,
-    sub: subject,
+    sub: subject || defaultSubject,
     email,
   };
   const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(payload))}`;
@@ -102,7 +102,7 @@ const server = http.createServer(async (request, response) => {
       jsonResponse(response, 200, {
         access_token: "bench-apple-access",
         refresh_token: "bench-apple-refresh",
-        id_token: signedIdentity(),
+        id_token: signedIdentity(defaultSubject),
         token_type: "Bearer",
         expires_in: 3600,
       });
@@ -110,11 +110,12 @@ const server = http.createServer(async (request, response) => {
     }
 
     if (request.method === "GET" && url.pathname === "/fixture/apple-login-payload") {
+      const subject = url.searchParams.get("subject") || defaultSubject;
       jsonResponse(response, 200, {
-        idToken: signedIdentity(),
+        idToken: signedIdentity(subject),
         authCode: "bench-auth-code",
         fullName,
-        email,
+        email: email.replace("@", `+${subject}@`),
       });
       return;
     }
diff --git a/scripts/benchmarks/apple-login/results/.gitignore b/scripts/benchmarks/apple-login/results/.gitignore
new file mode 100644
index 00000000..fc4d5046
--- /dev/null
+++ b/scripts/benchmarks/apple-login/results/.gitignore
@@ -0,0 +1,4 @@
+*
+!.gitignore
+!*/
+!*/summary.csv
diff --git a/scripts/benchmarks/apple-login/results/20260628T043649Z-before-quick/summary.csv b/scripts/benchmarks/apple-login/results/20260628T043649Z-before-quick/summary.csv
new file mode 100644
index 00000000..186e96ba
--- /dev/null
+++ b/scripts/benchmarks/apple-login/results/20260628T043649Z-before-quick/summary.csv
@@ -0,0 +1,4 @@
+label,concurrency,run,requests,error_rate,p50_ms,p95_ms,p99_ms,jwks_calls,token_exchange_calls,jwks_calls_per_request,token_exchange_calls_per_request
+before,1,01,590,0,405.59299999999996,425.5111,,590,590,1.0,1.0
+before,10,01,5773,0,417.912,435.10979999999995,,5773,5773,1.0,1.0
+before,20,01,11745,0,408.035,431.1746,,11745,11745,1.0,1.0
diff --git a/scripts/benchmarks/apple-login/results/20260628T045808Z-after-quick/summary.csv b/scripts/benchmarks/apple-login/results/20260628T045808Z-after-quick/summary.csv
new file mode 100644
index 00000000..6b128daa
--- /dev/null
+++ b/scripts/benchmarks/apple-login/results/20260628T045808Z-after-quick/summary.csv
@@ -0,0 +1,4 @@
+label,concurrency,run,requests,error_rate,p50_ms,p95_ms,p99_ms,jwks_calls,token_exchange_calls,jwks_calls_per_request,token_exchange_calls_per_request
+after,1,01,2327,0,26.024,40.14949999999999,,0,0,0.0,0.0
+after,10,01,22366,0,33.663,46.50249999999999,,0,0,0.0,0.0
+after,20,01,47844,0,20.653,46.78279999999998,,0,0,0.0,0.0
diff --git a/scripts/benchmarks/apple-login/results/20260628T051949Z-before-full/summary.csv b/scripts/benchmarks/apple-login/results/20260628T051949Z-before-full/summary.csv
new file mode 100644
index 00000000..aa3f300a
--- /dev/null
+++ b/scripts/benchmarks/apple-login/results/20260628T051949Z-before-full/summary.csv
@@ -0,0 +1,10 @@
+label,concurrency,run,requests,error_rate,p50_ms,p95_ms,p99_ms,jwks_calls,token_exchange_calls,jwks_calls_per_request,token_exchange_calls_per_request
+before,1,01,114,0,415.7785,437.1531,,114,114,1.0,1.0
+before,1,02,117,0,412.042,432.1922,,117,117,1.0,1.0
+before,1,03,115,0,413.111,438.0401,,115,115,1.0,1.0
+before,10,01,1162,0,415.65700000000004,428.11190000000005,,1162,1162,1.0,1.0
+before,10,02,1160,0,415.48,430.75655,,1160,1160,1.0,1.0
+before,10,03,1170,0,414.127,428.41595,,1170,1170,1.0,1.0
+before,20,01,2166,0,432.72950000000003,642.6642499999999,,2166,2166,1.0,1.0
+before,20,02,2340,0,413.7035,432.6287,,2340,2340,1.0,1.0
+before,20,03,2323,0,414.857,445.5289999999998,,2323,2323,1.0,1.0
diff --git a/scripts/benchmarks/apple-login/results/20260628T053451Z-after-full/summary.csv b/scripts/benchmarks/apple-login/results/20260628T053451Z-after-full/summary.csv
new file mode 100644
index 00000000..fca095f0
--- /dev/null
+++ b/scripts/benchmarks/apple-login/results/20260628T053451Z-after-full/summary.csv
@@ -0,0 +1,10 @@
+label,concurrency,run,requests,error_rate,p50_ms,p95_ms,p99_ms,jwks_calls,token_exchange_calls,jwks_calls_per_request,token_exchange_calls_per_request
+after,1,01,451,0,25.081,63.13999999999992,,0,0,0.0,0.0
+after,1,02,488,0,20.983,30.662599999999994,,0,0,0.0,0.0
+after,1,03,468,0,23.088,45.69389999999997,,0,0,0.0,0.0
+after,10,01,4748,0,25.4595,36.92124999999999,,0,0,0.0,0.0
+after,10,02,4635,0,25.643,48.76719999999999,,0,0,0.0,0.0
+after,10,03,4042,0,36.7535,89.77299999999994,,0,0,0.0,0.0
+after,20,01,8006,0,22.1935,109.86375,,0,0,0.0,0.0
+after,20,02,9905,0,18.571,36.8086,,0,0,0.0,0.0
+after,20,03,9913,0,18.918,34.4832,,0,0,0.0,0.0
diff --git a/scripts/benchmarks/apple-login/seed-returning-user.sql b/scripts/benchmarks/apple-login/seed-returning-user.sql
index d95c7533..e8445e2a 100644
--- a/scripts/benchmarks/apple-login/seed-returning-user.sql
+++ b/scripts/benchmarks/apple-login/seed-returning-user.sql
@@ -2,7 +2,7 @@ DELETE urt
 FROM user_refresh_token urt
 JOIN `user` u ON u.user_id = urt.user_id
 WHERE u.social_type = 'APPLE'
-  AND u.social_id = 'bench-apple-user';
+  AND u.social_id LIKE 'bench-apple-user-%';
 
 INSERT INTO `user` (
   email,
@@ -21,11 +21,11 @@ INSERT INTO `user` (
   firebase_token,
   social_login_token,
   access_token
-) VALUES (
-  'bench.apple@example.com',
+) SELECT
+  CONCAT('bench.apple+', seq.n, '@example.com'),
   NULL,
   NULL,
-  'Bench User',
+  CONCAT('Bench User ', seq.n),
   10,
   NULL,
   100.0,
@@ -33,12 +33,24 @@ INSERT INTO `user` (
   0,
   'USER',
   'APPLE',
-  'bench-apple-user',
+  CONCAT('bench-apple-user-', seq.n),
   NULL,
   NULL,
   'bench-existing-provider-grant',
   NULL
-) ON DUPLICATE KEY UPDATE
+FROM (
+  SELECT ones.n + tens.n * 10 + 1 AS n
+  FROM (
+    SELECT 0 n UNION ALL SELECT 1 UNION ALL SELECT 2 UNION ALL SELECT 3 UNION ALL SELECT 4
+    UNION ALL SELECT 5 UNION ALL SELECT 6 UNION ALL SELECT 7 UNION ALL SELECT 8 UNION ALL SELECT 9
+  ) ones
+  CROSS JOIN (
+    SELECT 0 n UNION ALL SELECT 1 UNION ALL SELECT 2 UNION ALL SELECT 3 UNION ALL SELECT 4
+    UNION ALL SELECT 5 UNION ALL SELECT 6
+  ) tens
+  WHERE ones.n + tens.n * 10 + 1 <= 64
+) seq
+ON DUPLICATE KEY UPDATE
   email = VALUES(email),
   name = VALUES(name),
   spare_time = VALUES(spare_time),