공부방

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
    implementation 'org.springframework.boot:spring-boot-starter-security'
    implementation 'org.springframework.boot:spring-boot-starter-validation'
    implementation 'org.springframework.boot:spring-boot-starter-web'
    compileOnly 'org.projectlombok:lombok'
    runtimeOnly 'com.mysql:mysql-connector-j'
    annotationProcessor 'org.projectlombok:lombok'
    testImplementation 'org.springframework.boot:spring-boot-starter-test'
    testImplementation 'org.springframework.security:spring-security-test'
    testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
    implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.2.0'
    implementation 'io.jsonwebtoken:jjwt-api:0.12.3'
    implementation 'io.jsonwebtoken:jjwt-impl:0.12.3'
    implementation 'io.jsonwebtoken:jjwt-jackson:0.12.3'
}

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

    http
            // CORS(Cross-Origin Resource Sharing) 설정
            .cors((cors) -> cors.configurationSource(new CorsConfigurationSource() {
                @Override
                public CorsConfiguration getCorsConfiguration(HttpServletRequest request) {
                    CorsConfiguration corsConfiguration = new CorsConfiguration();
                    corsConfiguration.setAllowedOrigins(Collections.singletonList("*")); // 모든 출처 허용
                    corsConfiguration.setAllowedMethods(Collections.singletonList("*")); // 모든 HTTP 메서드 허용
                    corsConfiguration.setAllowCredentials(true); // 자격 증명 허용
                    corsConfiguration.setAllowedHeaders(Arrays.asList("Authorization", "Cache-Control", "Content-Type")); // 허용된 헤더
                    corsConfiguration.setExposedHeaders(Arrays.asList("Authorization", "Cache-Control", "Content-Type")); // 노출된 헤더
                    return corsConfiguration;
                }
            }))
            // CSRF 토큰 비활성화
            .csrf((auth) -> auth.disable())
            // 폼 로그인 비활성화
            .formLogin((auth) -> auth.disable())
            // HTTP 기본 인증 비활성화
            .httpBasic((auth) -> auth.disable())
            // 권한 설정
            .authorizeHttpRequests((auth) -> auth
                    .requestMatchers("/login", "/", "/join").permitAll() // 로그인, 홈, 회원가입 페이지 접근 허용
                    .requestMatchers("/imgs/**").permitAll() // 이미지 파일 접근 허용
                    .requestMatchers("/admin/**","/swagger-ui/**").hasRole("ADMIN") // 관리자 권한 필요
                    .requestMatchers("/user/**").hasRole("USER") // 사용자 권한 필요
                    .anyRequest().authenticated() // 나머지 요청은 인증 필요
            )
            // 세션 관리 설정
            .sessionManagement((session) -> session
                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS) // 무상태 세션 정책
            )
            // JWT 필터 추가
            .addFilterBefore(new JwtFilter(jwtUtil), LoginFilter.class)
            // 로그인 필터 추가
            .addFilterAt(new LoginFilter(authenticationManager(authenticationConfiguration), jwtUtil),
                    UsernamePasswordAuthenticationFilter.class)
    ;

    return http.build();
}

@RequiredArgsConstructor
public class CustomUserDetails implements UserDetails {

    private final UserEntity userEntity;

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        Collection<GrantedAuthority> collection = new ArrayList<>();
        collection.add(
                new GrantedAuthority() {
                    @Override
                    public String getAuthority() {
                        return String.valueOf(userEntity.getRole());
                    }
                }
        );
        return collection;
    }

    @Override
    public String getPassword() {
        return userEntity.getPassword();
    }

    @Override
    public String getUsername() {
        return userEntity.getEmail();
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }
}

@Service
@RequiredArgsConstructor
public static class CustomUserDetailsService implements UserDetailsService {

    private final UserRepository userRepository;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        UserEntity byEmail = userRepository.findByEmail(username).orElseThrow(IllegalArgumentException::new);
        return new CustomUserDetails(byEmail);
    }
}

@Component
public class JwtUtil {
    private SecretKey secretKey;
    private String EMAIL = "email";
    private String ROLE = "role";

    public JwtUtil(@Value("${spring.jwt.secret}")String secret) {
        this.secretKey = new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), SIG.HS256.key().build().getAlgorithm());
    }

    public String getUsername(String token) {

        return Jwts.parser().verifyWith(secretKey).build().parseSignedClaims(token).getPayload().get(EMAIL, String.class);
    }

    public String getRole(String token) {

        return Jwts.parser().verifyWith(secretKey).build().parseSignedClaims(token).getPayload().get(ROLE, String.class);
    }

    public Boolean isExpired(String token) {
        JwtParser parser = Jwts.parser().verifyWith(secretKey).build();
        Jws<Claims> claimsJws = parser.parseSignedClaims(token);
        Claims payload = claimsJws.getPayload();
        Date expiration = payload.getExpiration();
        boolean before = expiration.before(new Date());
        return before;
    }

    public String createJwt(String username, String role, Long expiredMs) {
        long now = System.currentTimeMillis();
        Date expiration = new Date(now + expiredMs);
        return Jwts.builder()
                .claim(EMAIL, username)
                .claim(ROLE, role)
                .issuedAt(new Date(now))
                .expiration(expiration)
                .signWith(secretKey)
                .compact();
    }
}

@RequiredArgsConstructor
@Slf4j
public class LoginFilter extends UsernamePasswordAuthenticationFilter {

    private final AuthenticationManager authenticationManager;
    private final JwtUtil jwtUtil;

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
            throws AuthenticationException {
        // 1. 클라이언트가 보낸 username과 password를 추출합니다.
        String userName = obtainUsername(request);
        String password = obtainPassword(request);

        // 2. 추출한 username과 password로 UsernamePasswordAuthenticationToken을 생성합니다.
        UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userName, password, null);

        // 3. AuthenticationManager에게 인증을 요청합니다.
        return authenticationManager.authenticate(authenticationToken);
    }

    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
                                            Authentication authResult) throws IOException, ServletException {
        // 4. 인증이 성공하면 CustomUserDetails 객체를 가져옵니다.
        CustomUserDetails customUserDetails = (CustomUserDetails) authResult.getPrincipal();

        // 5. CustomUserDetails에서 username과 role을 추출합니다.
        String username = customUserDetails.getUsername();
        String role = getRole(customUserDetails);

        // 6. JwtUtil을 사용하여 JWT 토큰을 생성합니다.
        String token = jwtUtil.createJwt(username, role, 60 * 60 * 1000L);

        // 7. 생성한 JWT 토큰을 응답 헤더에 추가합니다.
        response.addHeader("Authorization", "Bearer " + token);
    }

    @Override
    protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,
                                              AuthenticationException failed) throws IOException, ServletException {
        // 8. 인증이 실패하면 응답 상태 코드를 401(Unauthorized)로 설정합니다.
        response.setStatus(401);
    }

    private String getRole(CustomUserDetails customUserDetails) {
        // 9. CustomUserDetails에서 사용자의 권한(role)을 추출합니다.
        return customUserDetails.getAuthorities().iterator().next().getAuthority();
    }
}