Feat/#20 토큰 체인 필터 구현

src/main/java/kr/ac/ks/cs_web_back/domain/auth/controller/code/AuthExceptionCode.java

@@ -10,8 +10,9 @@ public enum AuthExceptionCode implements ExceptionCode {
 
     BAD_REQUEST_NO_EMAIL(9010, "이메일이 입력되지 않았습니다."),
     BAD_REQUEST_NO_PASSWORD(9010, "비밀번호가 입력되지 않았습니다."),
+    UNAUTHORIZED_INVALID_TOKEN(8001, "유효하지 않은 토큰입니다."),
+    UNAUTHORIZED_FAILED_VALIDATION(8002, "인증에 실패했습니다."),
     UNAUTHORIZED_PASSWORD(8011, "비밀번호가 일치하지 않습니다."),
-    NOT_FOUND_USER(6001, "일치하는 사용자가 존재하지 않습니다."),
     ;
 
     private final int code;

src/main/java/kr/ac/ks/cs_web_back/domain/auth/service/AuthService.java

@@ -24,7 +24,7 @@ public class AuthService {
 
     public AuthLoginResponse loginMember(AuthLoginRequest request) {
         Member member = memberRepository.findByEmail(request.email())
-                .orElseThrow(() -> new NotFoundException(AuthExceptionCode.NOT_FOUND_USER));
+                .orElseThrow(() -> new NotFoundException(AuthExceptionCode.UNAUTHORIZED_FAILED_VALIDATION));
 
         if(!passwordEncoder.matches(request.password(), member.getPassword()))
             throw new UnauthorizedException(AuthExceptionCode.UNAUTHORIZED_PASSWORD);

src/main/java/kr/ac/ks/cs_web_back/domain/member/controller/MemberController.java

@@ -3,7 +3,6 @@
 import jakarta.validation.Valid;
 import kr.ac.ks.cs_web_back.domain.member.controller.code.MemberSuccessCode;
 import kr.ac.ks.cs_web_back.domain.member.dto.request.MemberCreateRequest;
-import kr.ac.ks.cs_web_back.domain.auth.dto.request.AuthLoginRequest;
 import kr.ac.ks.cs_web_back.domain.member.service.MemberService;
 import kr.ac.ks.cs_web_back.global.response.CsResponse;
 import lombok.RequiredArgsConstructor;

src/main/java/kr/ac/ks/cs_web_back/domain/member/dto/request/MemberCreateRequest.java

@@ -12,12 +12,12 @@ public record MemberCreateRequest(
 
         @Schema(description = "비밀번호", example = "examplePassword123")
         @NotBlank(message = "비밀번호가 입력되지 않았습니다.")
-        @Size(max = 24, message = "비밀번호는 24자 내로 입력해 주세요.")
+        @Size(max = 48, message = "비밀번호는 48자 이상일 수 없습니다.")
         String password,
 
         @Schema(description = "사용자명", example = "userNickName")
         @NotBlank(message = "사용자명이 입력되지 않았습니다.")
-        @Size(max = 12, message = "유저명은 12자 내로 입력해 주세요.")
+        @Size(max = 12, message = "사용자명은 12자 이상일 수 없습니다.")
         String username
 ) {
 }

src/main/java/kr/ac/ks/cs_web_back/domain/member/model/Member.java

@@ -6,13 +6,17 @@
 import lombok.Builder;
 import lombok.Getter;
 import lombok.NoArgsConstructor;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.userdetails.UserDetails;
 
 import java.time.LocalDate;
+import java.util.Collection;
+import java.util.Collections;
 
 @Entity
 @Getter
 @NoArgsConstructor(access = AccessLevel.PROTECTED)
-public class Member extends BaseEntity {
+public class Member extends BaseEntity implements UserDetails {
     @Id
     @GeneratedValue(strategy = GenerationType.IDENTITY)
     private Long id;
@@ -40,4 +44,18 @@ private Member(String email,  String password, String username, LocalDate birthd
         this.birthdate = birthdate;
         this.number = number;
     }
+
+    public String getNickname() {
+        return username;
+    }
+
+    @Override
+    public Collection<? extends GrantedAuthority> getAuthorities() {
+        return Collections.emptyList();
+    }
+
+    @Override
+    public String getUsername() {
+        return email;
+    }
 }

src/main/java/kr/ac/ks/cs_web_back/domain/member/service/MemberService.java

@@ -2,22 +2,21 @@
 
 import kr.ac.ks.cs_web_back.domain.member.controller.code.MemberExceptionCode;
 import kr.ac.ks.cs_web_back.domain.member.dto.request.MemberCreateRequest;
-import kr.ac.ks.cs_web_back.domain.auth.dto.request.AuthLoginRequest;
 import kr.ac.ks.cs_web_back.domain.member.model.Member;
 import kr.ac.ks.cs_web_back.domain.member.repository.MemberRepository;
 import kr.ac.ks.cs_web_back.global.exeption.domain.ConflictException;
-import kr.ac.ks.cs_web_back.global.exeption.domain.NotFoundException;
-import kr.ac.ks.cs_web_back.global.exeption.domain.UnauthorizedException;
-import kr.ac.ks.cs_web_back.global.jwt.JwtUtil;
 import lombok.RequiredArgsConstructor;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
 @Service
 @RequiredArgsConstructor
 @Transactional
-public class MemberService {
+public class MemberService implements UserDetailsService {
 
     private final MemberRepository memberRepository;
     private final PasswordEncoder passwordEncoder;
@@ -39,4 +38,11 @@ public Long createMember(MemberCreateRequest request) {
 
         return memberRepository.save(member).getId();
     }
+
+    @Override
+    @Transactional(readOnly = true)
+    public UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {
+        return memberRepository.findByEmail(email)
+                .orElseThrow(() -> new UsernameNotFoundException("User not found"));
+    }
 }

src/main/java/kr/ac/ks/cs_web_back/global/annotation/IdentifiedUser.java

@@ -0,0 +1,11 @@
+package kr.ac.ks.cs_web_back.global.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target(ElementType.PARAMETER)
+@Retention(RetentionPolicy.RUNTIME)
+public @interface IdentifiedUser {
+}

src/main/java/kr/ac/ks/cs_web_back/global/annotation/ResolvedUser.java

@@ -0,0 +1,11 @@
+package kr.ac.ks.cs_web_back.global.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target(ElementType.PARAMETER)
+@Retention(RetentionPolicy.RUNTIME)
+public @interface ResolvedUser {
+}

src/main/java/kr/ac/ks/cs_web_back/global/config/AppConfig.java

@@ -0,0 +1,14 @@
+package kr.ac.ks.cs_web_back.global.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+
+@Configuration
+public class AppConfig {
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+}

src/main/java/kr/ac/ks/cs_web_back/global/config/SecurityConfig.java

@@ -1,37 +1,39 @@
 package kr.ac.ks.cs_web_back.global.config;
 
+import kr.ac.ks.cs_web_back.global.jwt.CustomAuthenticationEntryPoint;
+import kr.ac.ks.cs_web_back.global.jwt.JwtAuthenticationFilter;
+import lombok.RequiredArgsConstructor;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.http.SessionCreationPolicy;
-import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
-import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.boot.autoconfigure.security.servlet.PathRequest;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 
 @Configuration
 @EnableWebSecurity
+@RequiredArgsConstructor
 public class SecurityConfig {
 
-    @Bean
-    public PasswordEncoder passwordEncoder() {
-        return new BCryptPasswordEncoder();
-    }
-
+    private final JwtAuthenticationFilter jwtAuthenticationFilter;
+    private final CustomAuthenticationEntryPoint customAuthenticationEntryPoint;
 
     @Bean
     public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         http
                 .csrf(csrf -> csrf.disable())
-                // H2 콘솔을 위한 설정
                 .headers(headers -> headers.frameOptions(frameOptions -> frameOptions.sameOrigin()))
                 .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                 .authorizeHttpRequests(authz -> authz
                         .requestMatchers(PathRequest.toH2Console()).permitAll() // H2 콘솔 경로 허용
                         .requestMatchers("/member/register", "/auth/login", "/swagger-ui/**", "/v3/api-docs/**").permitAll()
                         .anyRequest().authenticated()
-                );
+                )
+                .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
+                .exceptionHandling(exceptions -> exceptions
+                        .authenticationEntryPoint(customAuthenticationEntryPoint));
 
         return http.build();
     }

src/main/java/kr/ac/ks/cs_web_back/global/config/WebConfig.java

@@ -0,0 +1,24 @@
+package kr.ac.ks.cs_web_back.global.config;
+
+import kr.ac.ks.cs_web_back.global.resolver.IdentifiedUserArgumentResolver;
+import kr.ac.ks.cs_web_back.global.resolver.ResolvedUserArgumentResolver;
+import lombok.RequiredArgsConstructor;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.method.support.HandlerMethodArgumentResolver;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+import java.util.List;
+
+@Configuration
+@RequiredArgsConstructor
+public class WebConfig implements WebMvcConfigurer {
+
+    private final IdentifiedUserArgumentResolver identifiedUserArgumentResolver;
+    private final ResolvedUserArgumentResolver resolvedUserArgumentResolver;
+
+    @Override
+    public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
+        resolvers.add(identifiedUserArgumentResolver);
+        resolvers.add(resolvedUserArgumentResolver);
+    }
+}

src/main/java/kr/ac/ks/cs_web_back/global/exeption/GlobalExceptionHandler.java

@@ -10,10 +10,6 @@
 import org.springframework.web.bind.MethodArgumentNotValidException;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RestControllerAdvice;
-import kr.ac.ks.cs_web_back.global.exeption.dto.ValidationExceptionCode;
-import org.springframework.validation.FieldError;
-
-import java.util.List;
 
 @RestControllerAdvice
 public class GlobalExceptionHandler {

src/main/java/kr/ac/ks/cs_web_back/global/exeption/domain/InvalidTokenException.java

@@ -0,0 +1,9 @@
+package kr.ac.ks.cs_web_back.global.exeption.domain;
+
+import kr.ac.ks.cs_web_back.global.exeption.dto.ExceptionCode;
+
+public class InvalidTokenException extends UnauthorizedException {
+  public InvalidTokenException(final ExceptionCode exception) {
+    super(exception);
+  }
+}

src/main/java/kr/ac/ks/cs_web_back/global/jwt/CustomAuthenticationEntryPoint.java

@@ -0,0 +1,37 @@
+package kr.ac.ks.cs_web_back.global.jwt;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import kr.ac.ks.cs_web_back.domain.auth.controller.code.AuthExceptionCode;
+import kr.ac.ks.cs_web_back.global.exeption.dto.ExceptionResponse;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.stereotype.Component;
+
+import java.io.IOException;
+
+@Component
+@RequiredArgsConstructor
+public class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint {
+
+    private final ObjectMapper objectMapper;
+
+    @Override
+    public void commence(
+            HttpServletRequest request,
+            HttpServletResponse response,
+            AuthenticationException authException
+    ) throws IOException {
+        final AuthExceptionCode responseCode = AuthExceptionCode.UNAUTHORIZED_INVALID_TOKEN;
+
+        response.setCharacterEncoding("UTF-8");
+        response.setStatus(HttpStatus.UNAUTHORIZED.value());
+        response.setContentType("application/json;charset=UTF-8");
+
+        ExceptionResponse exceptionResponse = new ExceptionResponse(responseCode.getCode(), responseCode.getMessage());
+        response.getWriter().write(objectMapper.writeValueAsString(exceptionResponse));
+    }
+}

src/main/java/kr/ac/ks/cs_web_back/global/jwt/JwtAuthenticationFilter.java

@@ -0,0 +1,64 @@
+package kr.ac.ks.cs_web_back.global.jwt;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import kr.ac.ks.cs_web_back.global.exeption.domain.InvalidTokenException;
+import kr.ac.ks.cs_web_back.global.exeption.dto.ExceptionResponse;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import java.io.IOException;
+
+@Component
+@RequiredArgsConstructor
+public class JwtAuthenticationFilter extends OncePerRequestFilter {
+
+    private final JwtUtil jwtUtil;
+    private final JwtTokenResolver jwtTokenResolver;
+    private final UserDetailsService userDetailsService;
+    private final ObjectMapper objectMapper;
+
+    @Override
+    protected void doFilterInternal(
+            HttpServletRequest request,
+            HttpServletResponse response,
+            FilterChain filterChain
+    ) throws ServletException, IOException {
+        try {
+            String token = jwtTokenResolver.resolveToken(request);
+
+            if (token != null) {
+                jwtUtil.validateToken(token);
+
+                String email = jwtUtil.getEmailFromToken(token);
+                UserDetails userDetails = userDetailsService.loadUserByUsername(email);
+                UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
+                SecurityContextHolder.getContext().setAuthentication(authentication);
+            }
+        } catch (InvalidTokenException e) {
+            response.setCharacterEncoding("UTF-8");
+            response.setStatus(HttpStatus.UNAUTHORIZED.value());
+            response.setContentType("application/json;charset=UTF-8");
+
+            ExceptionResponse exceptionResponse = new ExceptionResponse(
+                    e.getExceptionCode().getCode(),
+                    e.getExceptionCode().getMessage()
+            );
+
+            response.getWriter().write(objectMapper.writeValueAsString(exceptionResponse));
+            return;
+        }
+
+        filterChain.doFilter(request, response);
+    }
+
+}

src/main/java/kr/ac/ks/cs_web_back/global/jwt/JwtTokenResolver.java

@@ -0,0 +1,20 @@
+package kr.ac.ks.cs_web_back.global.jwt;
+
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.stereotype.Component;
+import org.springframework.util.StringUtils;
+
+@Component
+public class JwtTokenResolver {
+    public static final String AUTHORIZATION_HEADER = "Authorization";
+    public static final String HEADER_PREFIX = "Bearer ";
+
+    public String resolveToken(HttpServletRequest request) {
+        String token = request.getHeader(AUTHORIZATION_HEADER);
+        if (StringUtils.hasText(token) && token.startsWith(HEADER_PREFIX))
+            return token.substring(HEADER_PREFIX.length());
+
+        return null;
+    }
+
+}