7주차 : 보안

app/build.gradle

@@ -76,6 +76,12 @@ dependencies {
     testImplementation('org.springframework.boot:spring-boot-starter-test') {
         exclude group: 'org.junit.vintage', module: 'junit-vintage-engine'
     }
+    // Spring Security
+    implementation 'org.springframework.boot:spring-boot-starter-security'
+
+    // Spring AOP
+    implementation 'org.springframework:spring-aop'
+
 }
 
 application {

app/src/main/java/com/codesoom/assignment/App.java

@@ -5,6 +5,8 @@
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 import org.springframework.context.annotation.Bean;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
 
 @SpringBootApplication
 public class App {
@@ -16,4 +18,9 @@ public static void main(String[] args) {
     public Mapper dozerMapper() {
         return DozerBeanMapperBuilder.buildDefault();
     }
+
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
 }

app/src/main/java/com/codesoom/assignment/aop/OwnerCheckAspect.java

@@ -0,0 +1,50 @@
+package com.codesoom.assignment.aop;
+
+import com.codesoom.assignment.application.ProductService;
+import com.codesoom.assignment.domain.Product;
+import com.codesoom.assignment.errors.InvalidTokenException;
+import com.codesoom.assignment.errors.ProductNotFoundException;
+import com.codesoom.assignment.errors.UserNoPermission;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.annotation.Before;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+
+@Aspect
+@Component
+public class OwnerCheckAspect {
+    private final ProductService productService;
+
+    public OwnerCheckAspect(ProductService productService) {
+        this.productService = productService;
+    }
+
+    @Before("@annotation(com.codesoom.assignment.aop.annotation.CheckOwner) && args(id,..)")
+    public void checkOwner(Long id) throws InvalidTokenException, UserNoPermission, ProductNotFoundException {
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+
+        authenticationValidate(authentication);
+
+        Long loginUserId = (Long) authentication.getPrincipal();
+
+        Product product = productService.getProduct(id);
+
+        Long createdUserId = product.getCreateUserId();
+
+        if (loginUserId != createdUserId) {
+            throw new UserNoPermission("You do not have permission.");
+        }
+    }
+
+    private void authenticationValidate(Authentication authentication) {
+        if (authentication == null) {
+            throw new InvalidTokenException("AccessToken is Invalid.");
+        }
+        if (authentication.getPrincipal().equals("anonymousUser")) {
+            throw new AccessDeniedException("You do not have permission.");
+        }
+    }
+}
+

app/src/main/java/com/codesoom/assignment/aop/annotation/CheckOwner.java

@@ -0,0 +1,11 @@
+package com.codesoom.assignment.aop.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.METHOD)
+public @interface CheckOwner {
+}

app/src/main/java/com/codesoom/assignment/application/AuthenticationService.java

@@ -4,33 +4,30 @@
 import com.codesoom.assignment.domain.UserRepository;
 import com.codesoom.assignment.errors.LoginFailException;
 import com.codesoom.assignment.utils.JwtUtil;
-import io.jsonwebtoken.Claims;
+import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Service;
 
 @Service
 public class AuthenticationService {
     private final UserRepository userRepository;
     private final JwtUtil jwtUtil;
+    private PasswordEncoder passwordEncoder;
 
-    public AuthenticationService(UserRepository userRepository,
-                                 JwtUtil jwtUtil) {
+    public AuthenticationService(UserRepository userRepository, JwtUtil jwtUtil, PasswordEncoder passwordEncoder) {
         this.userRepository = userRepository;
         this.jwtUtil = jwtUtil;
+        this.passwordEncoder = passwordEncoder;
     }
 
     public String login(String email, String password) {
         User user = userRepository.findByEmail(email)
                 .orElseThrow(() -> new LoginFailException(email));
 
-        if (!user.authenticate(password)) {
+        if (!user.authenticate(password, passwordEncoder)) {
             throw new LoginFailException(email);
         }
 
-        return jwtUtil.encode(1L);
+        return jwtUtil.encode(user.getId());
     }
 
-    public Long parseToken(String accessToken) {
-        Claims claims = jwtUtil.decode(accessToken);
-        return claims.get("userId", Long.class);
-    }
 }

app/src/main/java/com/codesoom/assignment/application/ProductService.java

@@ -32,8 +32,9 @@ public Product getProduct(Long id) {
         return findProduct(id);
     }
 
-    public Product createProduct(ProductData productData) {
+    public Product createProduct(ProductData productData, Long createUserId) {
         Product product = mapper.map(productData, Product.class);
+        product.setCreateUserId(createUserId);
         return productRepository.save(product);
     }
 

app/src/main/java/com/codesoom/assignment/application/UserService.java

@@ -7,6 +7,7 @@
 import com.codesoom.assignment.errors.UserEmailDuplicationException;
 import com.codesoom.assignment.errors.UserNotFoundException;
 import com.github.dozermapper.core.Mapper;
+import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Service;
 
 import javax.transaction.Transactional;
@@ -17,9 +18,12 @@ public class UserService {
     private final Mapper mapper;
     private final UserRepository userRepository;
 
-    public UserService(Mapper dozerMapper, UserRepository userRepository) {
-        this.mapper = dozerMapper;
+    private final PasswordEncoder passwordEncoder;
+
+    public UserService(Mapper mapper, UserRepository userRepository, PasswordEncoder passwordEncoder) {
+        this.mapper = mapper;
         this.userRepository = userRepository;
+        this.passwordEncoder = passwordEncoder;
     }
 
     public User registerUser(UserRegistrationData registrationData) {
@@ -29,6 +33,9 @@ public User registerUser(UserRegistrationData registrationData) {
         }
 
         User user = mapper.map(registrationData, User.class);
+
+        user.changePassword(registrationData.getPassword(),passwordEncoder);
+
         return userRepository.save(user);
     }
 

app/src/main/java/com/codesoom/assignment/config/SecurityJavaConfig.java

@@ -0,0 +1,120 @@
+package com.codesoom.assignment.config;
+
+import com.codesoom.assignment.filters.AuthenticationErrorFilter;
+import com.codesoom.assignment.filters.JwtAuthenticationFilter;
+import com.codesoom.assignment.utils.JwtUtil;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.authentication.HttpStatusEntryPoint;
+
+import javax.servlet.Filter;
+import javax.servlet.http.HttpServletRequest;
+
+@Configuration
+@EnableGlobalMethodSecurity(prePostEnabled = true)
+public class SecurityJavaConfig extends WebSecurityConfigurerAdapter {
+    private final JwtUtil jwtUtil;
+    public SecurityJavaConfig(JwtUtil jwtUtil) {
+        this.jwtUtil = jwtUtil;
+    }
+
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+
+        Filter authenticationFilter = new JwtAuthenticationFilter(authenticationManager(), jwtUtil);
+        Filter authenticationErrorFilter = new AuthenticationErrorFilter();
+
+        http
+                .csrf().disable()
+                .addFilter(authenticationFilter)
+                .addFilterBefore(authenticationErrorFilter, JwtAuthenticationFilter.class)
+                .sessionManagement()
+                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+                .and();
+
+        configureAuthorizations(http);
+
+        http
+                .authorizeRequests()
+                .anyRequest().permitAll()
+                .and()
+                .exceptionHandling()
+                .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED));
+    }
+
+    private void configureAuthorizations(HttpSecurity http) throws Exception {
+        http.authorizeRequests()
+                .requestMatchers(this::matchesPostProductRequest).authenticated()
+                .and()
+                .authorizeRequests()
+                .requestMatchers(this::matchesPatchProductRequest).authenticated()
+                .and()
+                .authorizeRequests()
+                .requestMatchers(this::matchesDeleteProductRequest).authenticated()
+                .and()
+                .authorizeRequests()
+                .requestMatchers(this::matchesPostUserRequest).authenticated()
+                .and()
+                .authorizeRequests()
+                .requestMatchers(this::matchesDeleteUserRequest).authenticated();
+    }
+
+    /**
+     * 요청이 상품 생성 요청인 경우 true를 아닌경우 false를 반환합니다.
+     * @param req
+     * @return
+     */
+    private boolean matchesPostProductRequest(HttpServletRequest req) {
+        return req.getMethod().equals("POST") &&
+                (req.getRequestURI().matches("^/products$") ||
+                        req.getRequestURI().matches("^/products/[0-9]+$"));
+    }
+
+    /**
+     * 요청이 상품 수정 요청인 경우 true를 아닌경우 false를 반환합니다.
+     * @param req
+     * @return
+     */
+    private boolean matchesPatchProductRequest(HttpServletRequest req) {
+        return req.getMethod().equals("PATCH") &&
+                        req.getRequestURI().matches("^/products/[0-9]+$");
+    }
+
+    /**
+     * 요청이 상품 삭제 요청인 경우 true를 아닌경우 false를 반환합니다.
+     * @param req
+     * @return
+     */
+    private boolean matchesDeleteProductRequest(HttpServletRequest req) {
+        return req.getMethod().equals("DELETE") &&
+                req.getRequestURI().matches("^/products/[0-9]+$");
+    }
+
+    /**
+     * 요청이 유저 생성 요청인 경우 true를 아닌경우 false를 반환합니다.
+     * @param req
+     * @return
+     */
+    private boolean matchesPostUserRequest(HttpServletRequest req) {
+        return req.getMethod().equals("POST") && req.getRequestURI().matches("^/users/[0-9]+$");
+    }
+
+    /**
+     * 요청이 유저 삭제 요청인 경우 true를 아닌경우 false를 반환합니다.
+     * @param req
+     * @return
+     */
+    private boolean matchesDeleteUserRequest(HttpServletRequest req) {
+        return req.getMethod().equals("DELETE") && req.getRequestURI().matches("^/users/[0-9]+$");
+    }
+
+
+}

app/src/main/java/com/codesoom/assignment/controllers/ControllerErrorAdvice.java

@@ -39,12 +39,6 @@ public ErrorResponse handleLoginFailException() {
         return new ErrorResponse("Log-in failed");
     }
 
-    @ResponseStatus(HttpStatus.UNAUTHORIZED)
-    @ExceptionHandler(InvalidTokenException.class)
-    public ErrorResponse handleInvalidAccessTokenException() {
-        return new ErrorResponse("Invalid access token");
-    }
-
     @ResponseBody
     @ResponseStatus(HttpStatus.BAD_REQUEST)
     @ExceptionHandler(ConstraintViolationException.class)
@@ -55,6 +49,13 @@ public ErrorResponse handleConstraintValidateError(
         return new ErrorResponse(messageTemplate);
     }
 
+    @ResponseBody
+    @ResponseStatus(HttpStatus.FORBIDDEN)
+    @ExceptionHandler(UserNoPermission.class)
+    public ErrorResponse handleUserNoPermission(UserNoPermission exception) {
+        return new ErrorResponse(exception.getMessage());
+    }
+
     private String getViolatedMessage(ConstraintViolationException exception) {
         String messageTemplate = null;
         Set<ConstraintViolation<?>> violations = exception.getConstraintViolations();