[Spring MVC (인증)] 김진학 미션 제출합니다.

src/main/java/roomescape/auth/AdminInterceptor.java

@@ -0,0 +1,32 @@
+package roomescape.auth;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.stereotype.Component;
+import org.springframework.web.servlet.HandlerInterceptor;
+
+@Component
+public class AdminInterceptor implements HandlerInterceptor {
+    private final AuthService authService;
+    private final AuthorizationExtractor authorizationExtractor;
+
+    public AdminInterceptor(AuthService authService, AuthorizationExtractor authorizationExtractor) {
+        this.authService = authService;
+        this.authorizationExtractor = authorizationExtractor;
+    }
+
+    @Override
+    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
+            throws Exception {
+
+        String token = authorizationExtractor.extract(request);
+        LoginMember loginMember = authService.createAuthentication(token);
+
+        if (!loginMember.isAdmin()) {
+            response.setStatus(401);
+            return false;
+        }
+
+        return true;
+    }
+}

src/main/java/roomescape/auth/AuthController.java

@@ -3,11 +3,9 @@
 import io.jsonwebtoken.JwtException;
 import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletResponse;
-import java.util.Map;
 import org.springframework.dao.EmptyResultDataAccessException;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.CookieValue;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -36,10 +34,9 @@ public ResponseEntity login(@RequestBody LoginRequest loginRequest, HttpServletR
     }
 
     @GetMapping("/login/check")
-    public ResponseEntity check(@CookieValue(name = TOKEN_COOKIE) String token) {
+    public ResponseEntity check(LoginMember loginMember) {
         try {
-            Map<String, Object> claims = authService.extractClaims(token);
-            return ResponseEntity.ok().body(claims);
+            return ResponseEntity.ok().body(loginMember);
         } catch (JwtException | IllegalArgumentException e) {
             return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Invalid token");
         }

src/main/java/roomescape/auth/AuthService.java

@@ -1,6 +1,6 @@
 package roomescape.auth;
 
-import java.util.Map;
+import io.jsonwebtoken.Claims;
 import org.springframework.stereotype.Service;
 import roomescape.member.Member;
 import roomescape.member.MemberDao;
@@ -20,7 +20,8 @@ public String createToken(String email, String password) {
         return jwtTokenProvider.createToken(member);
     }
 
-    public Map<String, Object> extractClaims(String token) {
-        return jwtTokenProvider.getClaims(token);
+    public LoginMember createAuthentication(String token) {
+        Claims claims = jwtTokenProvider.getClaims(token);
+        return LoginMember.from(claims);
     }
 }

src/main/java/roomescape/auth/AuthorizationExtractor.java

@@ -0,0 +1,7 @@
+package roomescape.auth;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+public interface AuthorizationExtractor {
+    String extract(HttpServletRequest request);
+}

src/main/java/roomescape/auth/CookieAuthorizationExtractor.java

@@ -0,0 +1,20 @@
+package roomescape.auth;
+
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+import java.util.Arrays;
+import org.springframework.stereotype.Component;
+
+@Component
+public class CookieAuthorizationExtractor implements AuthorizationExtractor {
+    private static final String AUTHORIZATION_NAME = "token";
+
+    @Override
+    public String extract(HttpServletRequest request) {
+        return Arrays.stream(request.getCookies())
+                .filter(cookie -> cookie.getName().equals(AUTHORIZATION_NAME))
+                .map(Cookie::getValue)
+                .findFirst()
+                .orElseThrow(() -> new IllegalArgumentException("Empty cookie"));
+    }
+}

src/main/java/roomescape/auth/JwtTokenProvider.java

@@ -4,7 +4,6 @@
 import io.jsonwebtoken.Jwts;
 import io.jsonwebtoken.security.Keys;
 import java.util.Date;
-import java.util.Map;
 import javax.crypto.SecretKey;
 import org.springframework.stereotype.Component;
 import roomescape.member.Member;
@@ -14,15 +13,17 @@ public class JwtTokenProvider {
 
     private final SecretKey secretKey;
     private final long validityInMilliseconds;
+    private final TimeProvider timeProvider;
 
-    public JwtTokenProvider(JwtProperties jwtProperties) {
+    public JwtTokenProvider(JwtProperties jwtProperties, TimeProvider timeProvider) {
         this.secretKey = Keys.hmacShaKeyFor(jwtProperties.getSecretKey().getBytes());
         this.validityInMilliseconds = jwtProperties.getValidityInMilliseconds();
+        this.timeProvider = timeProvider;
     }
 
     public String createToken(Member member) {
         Claims claims = Jwts.claims().setSubject(member.getEmail());
-        Date now = new Date();
+        Date now = timeProvider.now();
         Date validity = new Date(now.getTime() + validityInMilliseconds);
 
         return Jwts.builder()
@@ -35,7 +36,7 @@ public String createToken(Member member) {
                 .compact();
     }
 
-    public Map<String, Object> getClaims(String token) {
+    public Claims getClaims(String token) {
         return Jwts.parserBuilder()
                 .setSigningKey(secretKey)
                 .build()

src/main/java/roomescape/auth/LoginMember.java

@@ -0,0 +1,22 @@
+package roomescape.auth;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import io.jsonwebtoken.Claims;
+
+public record LoginMember(
+        String email,
+        String name,
+        String role
+) {
+    public static LoginMember from(Claims claims) {
+        return new LoginMember(
+                claims.getSubject(),
+                claims.get("name", String.class),
+                claims.get("role", String.class));
+    }
+
+    @JsonIgnore
+    public boolean isAdmin() {
+        return this.role.equals("ADMIN");
+    }
+}

src/main/java/roomescape/auth/LoginMemberArgumentResolver.java

@@ -0,0 +1,32 @@
+package roomescape.auth;
+
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.core.MethodParameter;
+import org.springframework.stereotype.Component;
+import org.springframework.web.bind.support.WebDataBinderFactory;
+import org.springframework.web.context.request.NativeWebRequest;
+import org.springframework.web.method.support.HandlerMethodArgumentResolver;
+import org.springframework.web.method.support.ModelAndViewContainer;
+
+@Component
+public class LoginMemberArgumentResolver implements HandlerMethodArgumentResolver {
+    private final AuthService authService;
+    private final AuthorizationExtractor authorizationExtractor;
+
+    public LoginMemberArgumentResolver(AuthService authService, AuthorizationExtractor authorizationExtractor) {
+        this.authService = authService;
+        this.authorizationExtractor = authorizationExtractor;
+    }
+
+    @Override
+    public boolean supportsParameter(MethodParameter parameter) {
+        return parameter.getParameterType().equals(LoginMember.class);
+    }
+
+    @Override
+    public Object resolveArgument(MethodParameter parameter, ModelAndViewContainer mavContainer,
+                                  NativeWebRequest webRequest, WebDataBinderFactory binderFactory) throws Exception {
+        String token = authorizationExtractor.extract((HttpServletRequest) webRequest.getNativeRequest());
+        return authService.createAuthentication(token);
+    }
+}

src/main/java/roomescape/auth/SystemTimeProvider.java

@@ -0,0 +1,12 @@
+package roomescape.auth;
+
+import java.util.Date;
+import org.springframework.stereotype.Component;
+
+@Component
+public class SystemTimeProvider implements TimeProvider {
+    @Override
+    public Date now() {
+        return new Date();
+    }
+}

src/main/java/roomescape/auth/TimeProvider.java

@@ -0,0 +1,7 @@
+package roomescape.auth;
+
+import java.util.Date;
+
+public interface TimeProvider {
+    Date now();
+}

src/main/java/roomescape/auth/WebConfig.java

@@ -0,0 +1,29 @@
+package roomescape.auth;
+
+import java.util.List;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.method.support.HandlerMethodArgumentResolver;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+@Configuration
+public class WebConfig implements WebMvcConfigurer {
+    private final LoginMemberArgumentResolver loginMemberArgumentResolver;
+    private final AdminInterceptor adminInterceptor;
+
+    public WebConfig(LoginMemberArgumentResolver loginMemberArgumentResolver, AdminInterceptor adminInterceptor) {
+        this.loginMemberArgumentResolver = loginMemberArgumentResolver;
+        this.adminInterceptor = adminInterceptor;
+    }
+
+    @Override
+    public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
+        resolvers.add(loginMemberArgumentResolver);
+    }
+
+    @Override
+    public void addInterceptors(InterceptorRegistry registry) {
+        registry.addInterceptor(adminInterceptor)
+                .addPathPatterns("/admin/**");
+    }
+}

src/main/java/roomescape/reservation/ReservationController.java

@@ -1,15 +1,15 @@
 package roomescape.reservation;
 
+import java.net.URI;
+import java.util.List;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.DeleteMapping;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RestController;
-
-import java.net.URI;
-import java.util.List;
+import roomescape.auth.LoginMember;
 
 @RestController
 public class ReservationController {
@@ -26,12 +26,16 @@ public List<ReservationResponse> list() {
     }
 
     @PostMapping("/reservations")
-    public ResponseEntity create(@RequestBody ReservationRequest reservationRequest) {
-        if (reservationRequest.getName() == null
-                || reservationRequest.getDate() == null
+    public ResponseEntity create(@RequestBody ReservationRequest reservationRequest, LoginMember loginMember) {
+        if (reservationRequest.getDate() == null
                 || reservationRequest.getTheme() == null
                 || reservationRequest.getTime() == null) {
-            return ResponseEntity.badRequest().build();
+            return ResponseEntity.badRequest().body("Invalid reservation request");
+        }
+
+        if (reservationRequest.getName() == null) {
+            reservationRequest = new ReservationRequest(loginMember.name(), reservationRequest.getDate(),
+                    reservationRequest.getTheme(), reservationRequest.getTime());
         }
         ReservationResponse reservation = reservationService.save(reservationRequest);
 

src/main/java/roomescape/reservation/ReservationRequest.java

@@ -6,6 +6,13 @@ public class ReservationRequest {
     private Long theme;
     private Long time;
 
+    public ReservationRequest(String name, String date, Long theme, Long time) {
+        this.name = name;
+        this.date = date;
+        this.theme = theme;
+        this.time = time;
+    }
+
     public String getName() {
         return name;
     }

src/test/java/roomescape/MissionStepTest.java

@@ -11,6 +11,7 @@
 import org.junit.jupiter.api.Test;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.test.annotation.DirtiesContext;
+import roomescape.reservation.ReservationResponse;
 
 @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.DEFINED_PORT)
 @DirtiesContext(classMode = DirtiesContext.ClassMode.BEFORE_EACH_TEST_METHOD)
@@ -43,4 +44,73 @@ public class MissionStepTest {
 
         assertThat(checkResponse.body().jsonPath().getString("name")).isEqualTo("어드민");
     }
+
+    @Test
+    void 이단계() {
+        String token = createToken("[email protected]", "password");  // 일단계에서 토큰을 추출하는 로직을 메서드로 따로 만들어서 활용하세요.
+
+        Map<String, String> params = new HashMap<>();
+        params.put("date", "2024-03-01");
+        params.put("time", "1");
+        params.put("theme", "1");
+
+        ExtractableResponse<Response> response = RestAssured.given().log().all()
+                .body(params)
+                .cookie("token", token)
+                .contentType(ContentType.JSON)
+                .post("/reservations")
+                .then().log().all()
+                .extract();
+
+        assertThat(response.statusCode()).isEqualTo(201);
+        assertThat(response.as(ReservationResponse.class).getName()).isEqualTo("어드민");
+
+        params.put("name", "브라운");
+
+        ExtractableResponse<Response> adminResponse = RestAssured.given().log().all()
+                .body(params)
+                .cookie("token", token)
+                .contentType(ContentType.JSON)
+                .post("/reservations")
+                .then().log().all()
+                .extract();
+
+        assertThat(adminResponse.statusCode()).isEqualTo(201);
+        assertThat(adminResponse.as(ReservationResponse.class).getName()).isEqualTo("브라운");
+    }
+
+    private String createToken(String email, String password) {
+        Map<String, String> params = new HashMap<>();
+        params.put("email", email);
+        params.put("password", password);
+
+        ExtractableResponse<Response> response = RestAssured.given().log().all()
+                .contentType(ContentType.JSON)
+                .body(params)
+                .when().post("/login")
+                .then().log().all()
+                .statusCode(200)
+                .extract();
+
+        return response.headers().get("Set-Cookie").getValue().split(";")[0].split("=")[1];
+    }
+
+    @Test
+    void 삼단계() {
+        String brownToken = createToken("[email protected]", "password");
+
+        RestAssured.given().log().all()
+                .cookie("token", brownToken)
+                .get("/admin")
+                .then().log().all()
+                .statusCode(401);
+
+        String adminToken = createToken("[email protected]", "password");
+
+        RestAssured.given().log().all()
+                .cookie("token", adminToken)
+                .get("/admin")
+                .then().log().all()
+                .statusCode(200);
+    }
 }