Week10/Hajin

hajin/build.gradle

@@ -29,8 +29,14 @@ dependencies {
 	implementation 'org.hibernate.orm:hibernate-core:6.0.2.Final'
 	implementation 'mysql:mysql-connector-java:8.0.33'
 
+	// Swagger
+	implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.3.0'
+
+	// Anotation Validation
+	implementation 'org.springframework.boot:spring-boot-starter-validation'
+
 	// Bean Validation
-	implementation 'org.hibernate.validator:hibernate-validator:8.0.0.Final'
+	//implementation 'org.hibernate.validator:hibernate-validator:8.0.0.Final'
 
 	// QueryDSL
 	implementation 'com.querydsl:querydsl-jpa:5.0.0:jakarta'
@@ -54,6 +60,21 @@ dependencies {
 	implementation 'org.springdoc:springdoc-openapi-ui:1.6.9'
 	implementation 'org.springdoc:springdoc-openapi-data-rest:1.6.9'
 
+	// SoringBoot Security
+	implementation 'org.springframework.boot:spring-boot-starter-security'
+	testImplementation 'org.springframework.security:spring-security-test'
+
+	// thymeleaf
+	implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
+
+	// thymeleaf 에서도 security 동작
+	implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity6:3.1.1.RELEASE'
+
+	// jwt
+	implementation 'io.jsonwebtoken:jjwt-api:0.11.5'
+	runtimeOnly 'io.jsonwebtoken:jjwt-impl:0.11.5'
+	runtimeOnly 'io.jsonwebtoken:jjwt-jackson:0.11.5'
+
 	testImplementation 'org.springframework.boot:spring-boot-starter-test'
 	testImplementation "com.querydsl:querydsl-jpa"
 }

hajin/src/main/java/umc/study/Application.java

@@ -4,14 +4,17 @@
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 import org.springframework.boot.autoconfigure.domain.EntityScan;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
 import org.springframework.data.jpa.repository.config.EnableJpaAuditing;
+import umc.study.config.properties.JwtProperties;
 import umc.study.service.StoreService.StoreQueryService;
 
 @SpringBootApplication
 @EntityScan(basePackages = "umc.study.domain")
 @EnableJpaAuditing // 데이터베이스 엔티티의 생성과 수정 정보 자동 기록, 관리
+@EnableConfigurationProperties(JwtProperties.class)
 public class Application {
 
 	public static void main(String[] args) {

hajin/src/main/java/umc/study/apiPayload/ApiResponse.java

@@ -21,7 +21,6 @@ public class ApiResponse<T> {
     private T reslt;
 
     // 성공한 경우 응답 생성
-
     public static <T> ApiResponse<T> onSuccess(T result){
         return new ApiResponse<>(true, SuccessStatus._OK.getCode() , SuccessStatus._OK.getMessage(), result);
     }

hajin/src/main/java/umc/study/apiPayload/code/status/ErrorStatus.java

@@ -15,13 +15,16 @@ public enum ErrorStatus implements BaseErrorCode {
     _BAD_REQUEST(HttpStatus.BAD_REQUEST,"COMMON400","잘못된 요청입니다."),
     _UNAUTHORIZED(HttpStatus.UNAUTHORIZED,"COMMON401","인증이 필요합니다."),
     _FORBIDDEN(HttpStatus.FORBIDDEN, "COMMON403", "금지된 요청입니다."),
-
+    FOOD_CATEGORY_NOT_FOUND(HttpStatus.NOT_FOUND, "COMMON400", "잘못된 요청입니다."),
+    STORE_NOT_FOUND(HttpStatus.NOT_FOUND, "COMMON400", "잘못된 요청입니다."),
     // 멤버 관려 에러
     MEMBER_NOT_FOUND(HttpStatus.BAD_REQUEST, "MEMBER4001", "사용자가 없습니다."),
-    NICKNAME_NOT_EXIST(HttpStatus.BAD_REQUEST, "MEMBER4002", "닉네임은 필수 입니다."),
+    INVALID_PASSWORD(HttpStatus.BAD_REQUEST, "MEMBER4003", "패스워드가 불일치합니다."),
+    // 페이징 에러
+    PAGE_INVALID(HttpStatus.BAD_REQUEST, "PAGE001", "page는 1 이상의 값이어야 합니다."),
 
-    // 예시
-    ARTICLE_NOT_FOUND(HttpStatus.NOT_FOUND, "ARTICLE4001", "게시글이 없습니다.");
+    // 인증 에러
+    INVALID_TOKEN(HttpStatus.UNAUTHORIZED, "AUTH001", "유효하지 않은 토큰입니다.");
 
     private final HttpStatus httpStatus;
     private final String code;

hajin/src/main/java/umc/study/apiPayload/exception/ExceptionAdvice.java

@@ -25,8 +25,6 @@
 @Slf4j
 @RestControllerAdvice(annotations = {RestController.class})
 public class ExceptionAdvice extends ResponseEntityExceptionHandler {
-
-
     @ExceptionHandler
     public ResponseEntity<Object> validation(ConstraintViolationException e, WebRequest request) {
         String errorMessage = e.getConstraintViolations().stream()
@@ -69,7 +67,7 @@ private ResponseEntity<Object> handleExceptionInternal(Exception e, ErrorReasonD
                                                            HttpHeaders headers, HttpServletRequest request) {
 
         ApiResponse<Object> body = ApiResponse.onFailure(reason.getCode(),reason.getMessage(),null);
-//        e.printStackTrace();
+//      e.printStackTrace();
 
         WebRequest webRequest = new ServletWebRequest(request);
         return super.handleExceptionInternal(

hajin/src/main/java/umc/study/apiPayload/exception/handler/FoodCategoryHandler.java

@@ -0,0 +1,10 @@
+package umc.study.apiPayload.exception.handler;
+
+import umc.study.apiPayload.code.status.ErrorStatus;
+import umc.study.apiPayload.exception.GeneralException;
+
+public class FoodCategoryHandler extends GeneralException {
+    public FoodCategoryHandler(ErrorStatus errorStatus) {
+        super(errorStatus);
+    }
+}

hajin/src/main/java/umc/study/apiPayload/exception/handler/TempHandler.java

@@ -9,4 +9,5 @@ public class TempHandler extends GeneralException {
     public TempHandler(BaseErrorCode errorCode) {
         super(errorCode);
     }
+
 }

hajin/src/main/java/umc/study/apiPayload/exception/handler/UserHandler.java

@@ -0,0 +1,10 @@
+package umc.study.apiPayload.exception.handler;
+
+import umc.study.apiPayload.code.BaseErrorCode;
+import umc.study.apiPayload.exception.GeneralException;
+
+public class UserHandler extends GeneralException {
+    public UserHandler(BaseErrorCode errorCode) {
+        super(errorCode);
+    }
+}

hajin/src/main/java/umc/study/config/SwaggerConfig.java

@@ -0,0 +1,39 @@
+package umc.study.config;
+
+import io.swagger.v3.oas.models.Components;
+import io.swagger.v3.oas.models.OpenAPI;
+import io.swagger.v3.oas.models.info.Info;
+import io.swagger.v3.oas.models.security.SecurityRequirement;
+import io.swagger.v3.oas.models.security.SecurityScheme;
+import io.swagger.v3.oas.models.servers.Server;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+public class SwaggerConfig {
+
+    @Bean
+    public OpenAPI UMCstudyAPI() {
+        Info info = new Info()
+                .title("UMC Server WorkBook API")
+                .description("UMC Server WorkBook API 명세서")
+                .version("1.0.0");
+
+        String jwtSchemeName = "JWT TOKEN";
+        // API 요청헤더에 인증정보 포함
+        SecurityRequirement securityRequirement = new SecurityRequirement().addList(jwtSchemeName);
+        // SecuritySchemes 등록
+        Components components = new Components()
+                .addSecuritySchemes(jwtSchemeName, new SecurityScheme()
+                        .name(jwtSchemeName)
+                        .type(SecurityScheme.Type.HTTP) // HTTP 방식
+                        .scheme("bearer")
+                        .bearerFormat("JWT"));
+
+        return new OpenAPI()
+                .addServersItem(new Server().url("/"))
+                .info(info)
+                .addSecurityItem(securityRequirement)
+                .components(components);
+    }
+}

hajin/src/main/java/umc/study/config/WebConfig.java

@@ -0,0 +1,16 @@
+package umc.study.config;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.method.support.HandlerMethodArgumentResolver;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+import umc.study.validation.resolver.PageParamResolver;
+
+import java.util.List;
+
+@Configuration
+public class WebConfig implements WebMvcConfigurer {
+    @Override
+    public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
+        resolvers.add(new PageParamResolver());
+    }
+}

hajin/src/main/java/umc/study/config/properties/Constants.java

@@ -0,0 +1,6 @@
+package umc.study.config.properties;
+
+public final class Constants {
+    public static final String AUTH_HEADER = "Authorization";
+    public static final String TOKEN_PREFIX = "Bearer ";
+}

hajin/src/main/java/umc/study/config/properties/JwtProperties.java

@@ -0,0 +1,31 @@
+package umc.study.config.properties;
+
+import jakarta.annotation.PostConstruct;
+import lombok.Getter;
+import lombok.Setter;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.stereotype.Component;
+
+@Component
+@Getter
+@Setter
+@ConfigurationProperties("jwt.token")
+public class JwtProperties {
+    private String secretKey="";
+    private Expiration expiration;
+
+    @Getter
+    @Setter
+    public static class Expiration{
+        private Long access;
+        // TODO: refreshToken
+    }
+
+    // 애플리케이션 시작 시 값 제대로 들어왔는지 확인
+    @PostConstruct
+    public void testInit() {
+        System.out.println("jwt.secretKey = " + secretKey);
+        System.out.println("jwt.expiration.access = " + (expiration != null ? expiration.getAccess() : "expiration is null"));
+    }
+
+}

hajin/src/main/java/umc/study/config/security/CustomUserDetailsService.java

@@ -0,0 +1,29 @@
+package umc.study.config.security;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.stereotype.Service;
+import umc.study.domain.Users;
+import umc.study.repository.UserRepository.UserRepository;
+
+@Service
+@RequiredArgsConstructor
+public class CustomUserDetailsService implements UserDetailsService {
+
+    private final UserRepository userRepository;
+
+    @Override
+    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
+        Users user = userRepository.findByEmail(username)
+                .orElseThrow(() -> new UsernameNotFoundException("해당 이메일을 가진 유저가 존재하지 않습니다: " + username));
+
+        return org.springframework.security.core.userdetails.User
+                .withUsername(user.getEmail())
+                .password(user.getPassword())
+                .roles(user.getRole().name())
+                .build();
+    }
+
+}

hajin/src/main/java/umc/study/config/security/SecurityConfig.java

@@ -0,0 +1,53 @@
+package umc.study.config.security;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import umc.study.config.security.jwt.JwtAuthenticationFilter;
+import umc.study.config.security.jwt.JwtTokenProvider;
+
+// 우리가 직접 작성한 보안 설정이 Spring Security의 기본 설정보다 우선 적용
+@EnableWebSecurity
+@Configuration
+@RequiredArgsConstructor
+public class SecurityConfig {
+
+    private final JwtTokenProvider jwtTokenProvider;
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        http
+                .authorizeHttpRequests((requests) -> requests
+                        .requestMatchers("/", "/home", "/signup", "/css/**", "/users/**", "/members/signup", "/users/join", "/users/login", "/swagger-ui/**", "/v3/api-docs/**").permitAll()
+                        .requestMatchers("/admin/**").hasRole("ADMIN")
+                        .anyRequest().authenticated()
+                )
+
+                .formLogin((form) -> form
+                        .loginPage("/login")
+                        .defaultSuccessUrl("/home", true)
+                        .permitAll()
+                )
+                .logout((logout) -> logout
+                        .logoutUrl("/logout")
+                        .logoutSuccessUrl("/login?logout")
+                        .permitAll()
+                )
+                .csrf()
+                .disable()
+                .addFilterBefore(new JwtAuthenticationFilter(jwtTokenProvider), UsernamePasswordAuthenticationFilter.class);
+
+        return http.build();
+    }
+
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+}

hajin/src/main/java/umc/study/config/security/jwt/JwtAuthenticationFilter.java

@@ -0,0 +1,43 @@
+package umc.study.config.security.jwt;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.util.StringUtils;
+import org.springframework.web.filter.OncePerRequestFilter;
+import umc.study.config.properties.Constants;
+
+import java.io.IOException;
+
+@RequiredArgsConstructor
+public class JwtAuthenticationFilter extends OncePerRequestFilter {
+
+    private final JwtTokenProvider jwtTokenProvider;
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request,
+                                    HttpServletResponse response,
+                                    FilterChain filterChain)
+            throws ServletException, IOException {
+
+        String token = resolveToken(request);
+
+        if(StringUtils.hasText(token) && jwtTokenProvider.validateToken(token)) {
+            Authentication authentication = jwtTokenProvider.getAuthentication(token);
+            SecurityContextHolder.getContext().setAuthentication(authentication);
+        }
+        filterChain.doFilter(request, response);
+    }
+
+    private String resolveToken(HttpServletRequest request) {
+        String bearerToken = request.getHeader(Constants.AUTH_HEADER);
+        if(StringUtils.hasText(bearerToken) && bearerToken.startsWith(Constants.TOKEN_PREFIX)) {
+            return bearerToken.substring(Constants.TOKEN_PREFIX.length());
+        }
+        return null;
+    }
+}