[FIX] 인증/인가 개선 및 리팩토링

src/main/java/org/websoso/WSSServer/auth/AuthorizationService.java

@@ -0,0 +1,16 @@
+package org.websoso.WSSServer.auth;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.websoso.WSSServer.domain.User;
+
+@Service
+@RequiredArgsConstructor
+public class AuthorizationService {
+
+    private final ResourceAuthorizationHandler resourceAuthorizationHandler;
+
+    public boolean validate(Long resourceId, User user, Class<?> resourceType) {
+        return resourceAuthorizationHandler.authorizeResourceAccess(resourceId, user, resourceType);
+    }
+}

src/main/java/org/websoso/WSSServer/auth/CustomUserArgumentResolver.java

@@ -0,0 +1,43 @@
+package org.websoso.WSSServer.auth;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.core.MethodParameter;
+import org.springframework.security.authentication.AnonymousAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+import org.springframework.web.bind.support.WebDataBinderFactory;
+import org.springframework.web.context.request.NativeWebRequest;
+import org.springframework.web.method.support.HandlerMethodArgumentResolver;
+import org.springframework.web.method.support.ModelAndViewContainer;
+import org.websoso.WSSServer.domain.User;
+import org.websoso.WSSServer.service.UserService;
+
+@Component
+@RequiredArgsConstructor
+public class CustomUserArgumentResolver implements HandlerMethodArgumentResolver {
+
+    private final UserService userService;
+
+    @Override
+    public boolean supportsParameter(MethodParameter parameter) {
+        return parameter.getParameterType().equals(User.class) &&
+                parameter.hasParameterAnnotation(AuthenticationPrincipal.class);
+    }
+
+    @Override
+    public Object resolveArgument(MethodParameter parameter,
+                                  ModelAndViewContainer mavContainer,
+                                  NativeWebRequest webRequest,
+                                  WebDataBinderFactory binderFactory) {
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+
+        if (authentication == null || authentication instanceof AnonymousAuthenticationToken) {
+            return null;
+        }
+
+        Long userId = (Long) authentication.getPrincipal();
+        return userService.getUserOrException(userId);
+    }
+}

src/main/java/org/websoso/WSSServer/auth/ResourceAuthorizationHandler.java

@@ -0,0 +1,33 @@
+package org.websoso.WSSServer.auth;
+
+import static org.websoso.WSSServer.exception.error.CustomAuthorizationError.UNSUPPORTED_RESOURCE_TYPE;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+import org.websoso.WSSServer.auth.validator.ResourceAuthorizationValidator;
+import org.websoso.WSSServer.domain.User;
+import org.websoso.WSSServer.exception.exception.CustomAuthorizationException;
+
+@Component
+public class ResourceAuthorizationHandler {
+
+    private final Map<Class<?>, ResourceAuthorizationValidator> validatorMap = new HashMap<>();
+
+    @Autowired
+    public ResourceAuthorizationHandler(List<ResourceAuthorizationValidator> validators) {
+        for (ResourceAuthorizationValidator validator : validators) {
+            validatorMap.put(validator.getResourceType(), validator);
+        }
+    }
+
+    public boolean authorizeResourceAccess(Long resourceId, User user, Class<?> resourceType) {
+        return Optional.ofNullable(validatorMap.get(resourceType))
+                .orElseThrow(() -> new CustomAuthorizationException(
+                        UNSUPPORTED_RESOURCE_TYPE, "Unsupported resource type for authorization"))
+                .hasPermission(resourceId, user);
+    }
+}

src/main/java/org/websoso/WSSServer/auth/validator/BlockAuthorizationValidator.java

@@ -0,0 +1,44 @@
+package org.websoso.WSSServer.auth.validator;
+
+import static org.websoso.WSSServer.exception.error.CustomBlockError.BLOCK_NOT_FOUND;
+import static org.websoso.WSSServer.exception.error.CustomBlockError.INVALID_AUTHORIZED_BLOCK;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+import org.websoso.WSSServer.domain.Block;
+import org.websoso.WSSServer.domain.User;
+import org.websoso.WSSServer.exception.exception.CustomBlockException;
+import org.websoso.WSSServer.repository.BlockRepository;
+
+@Component
+@RequiredArgsConstructor
+public class BlockAuthorizationValidator implements ResourceAuthorizationValidator {
+
+    private final BlockRepository blockRepository;
+
+    @Override
+    public boolean hasPermission(Long blockId, User user) {
+        Block block = getBlockOrException(blockId);
+
+        if (!isBlockOwner(block, user)) {
+            throw new CustomBlockException(INVALID_AUTHORIZED_BLOCK,
+                    "block with the given blockId is not from user with the given userId");
+        }
+        return true;
+    }
+
+    private Block getBlockOrException(Long blockId) {
+        return blockRepository.findById(blockId)
+                .orElseThrow(() -> new CustomBlockException(BLOCK_NOT_FOUND,
+                        "block with the given blockId was not found"));
+    }
+
+    private boolean isBlockOwner(Block block, User user) {
+        return block.getBlockingId().equals(user.getUserId());
+    }
+
+    @Override
+    public Class<?> getResourceType() {
+        return Block.class;
+    }
+}

src/main/java/org/websoso/WSSServer/auth/validator/FeedAccessValidator.java

@@ -0,0 +1,45 @@
+package org.websoso.WSSServer.auth.validator;
+
+import static org.websoso.WSSServer.exception.error.CustomFeedError.BLOCKED_USER_ACCESS;
+import static org.websoso.WSSServer.exception.error.CustomFeedError.FEED_NOT_FOUND;
+import static org.websoso.WSSServer.exception.error.CustomFeedError.HIDDEN_FEED_ACCESS;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+import org.websoso.WSSServer.domain.Feed;
+import org.websoso.WSSServer.domain.User;
+import org.websoso.WSSServer.exception.exception.CustomFeedException;
+import org.websoso.WSSServer.repository.FeedRepository;
+import org.websoso.WSSServer.service.BlockService;
+
+@Component
+@RequiredArgsConstructor
+public class FeedAccessValidator {
+
+    private final FeedRepository feedRepository;
+    private final BlockService blockService;
+
+    public boolean canAccess(Long feedId, User user) {
+        Feed feed = getFeedOrException(feedId);
+
+        if (feed.getUser().equals(user)) {
+            return true;
+        }
+
+        if (feed.getIsHidden()) {
+            throw new CustomFeedException(HIDDEN_FEED_ACCESS, "Cannot access hidden feed.");
+        }
+
+        if (blockService.isBlocked(user.getUserId(), feed.getWriterId())) {
+            throw new CustomFeedException(BLOCKED_USER_ACCESS,
+                    "cannot access this feed because either you or the feed author has blocked the other.");
+        }
+
+        return true;
+    }
+
+    private Feed getFeedOrException(Long feedId) {
+        return feedRepository.findById(feedId)
+                .orElseThrow(() -> new CustomFeedException(FEED_NOT_FOUND, "feed with the given id was not found"));
+    }
+}

src/main/java/org/websoso/WSSServer/auth/validator/FeedAuthorizationValidator.java

@@ -0,0 +1,40 @@
+package org.websoso.WSSServer.auth.validator;
+
+import static org.websoso.WSSServer.exception.error.CustomFeedError.FEED_NOT_FOUND;
+import static org.websoso.WSSServer.exception.error.CustomUserError.INVALID_AUTHORIZED;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+import org.websoso.WSSServer.domain.Feed;
+import org.websoso.WSSServer.domain.User;
+import org.websoso.WSSServer.exception.exception.CustomFeedException;
+import org.websoso.WSSServer.exception.exception.CustomUserException;
+import org.websoso.WSSServer.repository.FeedRepository;
+
+@Component
+@RequiredArgsConstructor
+public class FeedAuthorizationValidator implements ResourceAuthorizationValidator {
+
+    private final FeedRepository feedRepository;
+
+    @Override
+    public boolean hasPermission(Long feedId, User user) {
+        Feed feed = getFeedOrException(feedId);
+
+        if (!feed.isMine(user.getUserId())) {
+            throw new CustomUserException(INVALID_AUTHORIZED,
+                    "User with ID " + user.getUserId() + " is not the owner of feed " + feed.getFeedId());
+        }
+        return true;
+    }
+
+    private Feed getFeedOrException(Long feedId) {
+        return feedRepository.findById(feedId)
+                .orElseThrow(() -> new CustomFeedException(FEED_NOT_FOUND, "feed with the given id was not found"));
+    }
+
+    @Override
+    public Class<?> getResourceType() {
+        return Feed.class;
+    }
+}

src/main/java/org/websoso/WSSServer/auth/validator/NotificationAuthorizationValidator.java

@@ -0,0 +1,49 @@
+package org.websoso.WSSServer.auth.validator;
+
+import static org.websoso.WSSServer.domain.common.Role.ADMIN;
+import static org.websoso.WSSServer.exception.error.CustomNotificationError.NOTIFICATION_ADMIN_ONLY;
+import static org.websoso.WSSServer.exception.error.CustomNotificationError.NOTIFICATION_NOT_FOUND;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+import org.websoso.WSSServer.domain.Notification;
+import org.websoso.WSSServer.domain.User;
+import org.websoso.WSSServer.exception.exception.CustomNotificationException;
+import org.websoso.WSSServer.repository.NotificationRepository;
+
+@Component
+@RequiredArgsConstructor
+public class NotificationAuthorizationValidator implements ResourceAuthorizationValidator {
+
+    private final NotificationRepository notificationRepository;
+
+    @Override
+    public boolean hasPermission(Long resourceId, User user) {
+        if (resourceId == null) {
+            return isAdmin(user);
+        }
+
+        // 수정이나 삭제에서 리소스 존재 여부 검증을 위함
+        Notification notification = getNotificationOrException(resourceId);
+        return isAdmin(user);
+    }
+
+    private Notification getNotificationOrException(Long notificationId) {
+        return notificationRepository.findById(notificationId)
+                .orElseThrow(() -> new CustomNotificationException(NOTIFICATION_NOT_FOUND,
+                        "notification with the given id is not found"));
+    }
+
+    private boolean isAdmin(User user) {
+        if (user.getRole() != ADMIN) {
+            throw new CustomNotificationException(NOTIFICATION_ADMIN_ONLY,
+                    "User who tried to create, modify, or delete the notice is not an ADMIN.");
+        }
+        return true;
+    }
+
+    @Override
+    public Class<?> getResourceType() {
+        return Notification.class;
+    }
+}

src/main/java/org/websoso/WSSServer/auth/validator/NovelAuthorizationValidator.java

@@ -0,0 +1,33 @@
+package org.websoso.WSSServer.auth.validator;
+
+import static org.websoso.WSSServer.exception.error.CustomNovelError.NOVEL_NOT_FOUND;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+import org.websoso.WSSServer.domain.Novel;
+import org.websoso.WSSServer.domain.User;
+import org.websoso.WSSServer.exception.exception.CustomNovelException;
+import org.websoso.WSSServer.repository.NovelRepository;
+
+@Component
+@RequiredArgsConstructor
+public class NovelAuthorizationValidator implements ResourceAuthorizationValidator {
+
+    private final NovelRepository novelRepository;
+
+    @Override
+    public boolean hasPermission(Long resourceId, User user) {
+        Novel novel = getNovelOrException(resourceId);
+        return true;
+    }
+
+    private Novel getNovelOrException(Long novelId) {
+        return novelRepository.findById(novelId)
+                .orElseThrow(() -> new CustomNovelException(NOVEL_NOT_FOUND, "novel with the given id is not found"));
+    }
+
+    @Override
+    public Class<?> getResourceType() {
+        return Novel.class;
+    }
+}

src/main/java/org/websoso/WSSServer/auth/validator/ResourceAuthorizationValidator.java

@@ -0,0 +1,10 @@
+package org.websoso.WSSServer.auth.validator;
+
+import org.websoso.WSSServer.domain.User;
+
+public interface ResourceAuthorizationValidator {
+
+    boolean hasPermission(Long resourceId, User user);
+
+    Class<?> getResourceType();
+}

src/main/java/org/websoso/WSSServer/auth/validator/UserNovelAuthorizationValidator.java

@@ -0,0 +1,45 @@
+package org.websoso.WSSServer.auth.validator;
+
+import static org.websoso.WSSServer.exception.error.CustomNovelError.NOVEL_NOT_FOUND;
+import static org.websoso.WSSServer.exception.error.CustomUserNovelError.USER_NOVEL_NOT_FOUND;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+import org.websoso.WSSServer.domain.Novel;
+import org.websoso.WSSServer.domain.User;
+import org.websoso.WSSServer.domain.UserNovel;
+import org.websoso.WSSServer.exception.exception.CustomNovelException;
+import org.websoso.WSSServer.exception.exception.CustomUserNovelException;
+import org.websoso.WSSServer.repository.NovelRepository;
+import org.websoso.WSSServer.repository.UserNovelRepository;
+
+@Component
+@RequiredArgsConstructor
+public class UserNovelAuthorizationValidator implements ResourceAuthorizationValidator {
+
+    private final NovelRepository novelRepository;
+    private final UserNovelRepository userNovelRepository;
+
+    @Override
+    public boolean hasPermission(Long resourceId, User user) {
+        Novel novel = getNovelOrException(resourceId);
+        UserNovel userNovel = getUserNovelOrException(user, novel);
+        return true;
+    }
+
+    private Novel getNovelOrException(Long novelId) {
+        return novelRepository.findById(novelId)
+                .orElseThrow(() -> new CustomNovelException(NOVEL_NOT_FOUND, "novel with the given id is not found"));
+    }
+
+    private UserNovel getUserNovelOrException(User user, Novel novel) {
+        return userNovelRepository.findByNovelAndUser(novel, user)
+                .orElseThrow(() -> new CustomUserNovelException(USER_NOVEL_NOT_FOUND,
+                        "user novel with the given user and novel is not found"));
+    }
+
+    @Override
+    public Class<?> getResourceType() {
+        return UserNovel.class;
+    }
+}

src/main/java/org/websoso/WSSServer/config/SecurityConfig.java

@@ -3,6 +3,7 @@
 import lombok.RequiredArgsConstructor;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
@@ -18,6 +19,7 @@
 @Configuration
 @RequiredArgsConstructor
 @EnableWebSecurity
+@EnableMethodSecurity
 public class SecurityConfig {
     private final JwtAuthenticationFilter jwtAuthenticationFilter;
     private final CustomJwtAuthenticationEntryPoint customJwtAuthenticationEntryPoint;