[그리디] 강동현 Spring JPA (2차) 4, 5, 6 단계 미션 제출합니다.

.gitignore

@@ -35,3 +35,6 @@ out/
 
 ### VS Code ###
 .vscode/
+
+
+application-local.properties

build.gradle

@@ -13,9 +13,15 @@ repositories {
 }
 
 dependencies {
+
+
     implementation 'org.springframework.boot:spring-boot-starter-web'
     implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
-    implementation 'org.springframework.boot:spring-boot-starter-jdbc'
+    implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
+    implementation 'org.springframework.boot:spring-boot-starter-validation'
+
+    compileOnly 'org.projectlombok:lombok:1.18.30'
+    annotationProcessor 'org.projectlombok:lombok:1.18.30'
 
     implementation 'dev.akkinoc.spring.boot:logback-access-spring-boot-starter:4.0.0'
 

src/main/java/roomescape/ExceptionController.java

@@ -1,14 +1,49 @@
 package roomescape;
 
+import jakarta.persistence.EntityNotFoundException;
 import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.ControllerAdvice;
+import org.springframework.http.converter.HttpMessageNotReadableException;
+import org.springframework.web.bind.MethodArgumentNotValidException;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
 import org.springframework.web.bind.annotation.ExceptionHandler;
+import roomescape.common.ApiError;
 
-@ControllerAdvice
+import java.util.HashMap;
+import java.util.Map;
+import java.util.NoSuchElementException;
+
+@RestControllerAdvice
 public class ExceptionController {
-    @ExceptionHandler(Exception.class)
-    public ResponseEntity<Void> handleRuntimeException(Exception e) {
-        e.printStackTrace();
-        return ResponseEntity.badRequest().build();
-    }
+	@ExceptionHandler(MethodArgumentNotValidException.class)
+	public ResponseEntity<Map<String, Object>> handleValidation(MethodArgumentNotValidException e) {
+		return build(ApiError.BAD_REQUEST_INVALID_INPUT);
+	}
+
+	@ExceptionHandler({IllegalStateException.class})
+	public ResponseEntity<Map<String, Object>> handleIllegalState(IllegalStateException e) {
+		return build(ApiError.BAD_REQUEST_ILLEGAL_STATE);
+	}
+
+	@ExceptionHandler({NoSuchElementException.class, EntityNotFoundException.class})
+	public ResponseEntity<Map<String, Object>> handleNotFound(RuntimeException e) {
+		return build(ApiError.NOT_FOUND_RESOURCE);
+	}
+
+	@ExceptionHandler(HttpMessageNotReadableException.class)
+	public ResponseEntity<Map<String, Object>> handleNotReadable(HttpMessageNotReadableException e) {
+		return build(ApiError.BAD_REQUEST_INVALID_INPUT);
+	}
+
+	@ExceptionHandler(Exception.class)
+	public ResponseEntity<Map<String, Object>> handleUnknown(Exception e) {
+		e.printStackTrace();
+		return build(ApiError.INTERNAL_SERVER_ERROR);
+	}
+
+	private ResponseEntity<Map<String, Object>> build(ApiError apiError) {
+		Map<String, Object> body = new HashMap<>();
+		body.put("code", apiError.getCode());
+		body.put("message", apiError.getMessage());
+		return ResponseEntity.status(apiError.getHttpStatus()).body(body);
+	}
 }

src/main/java/roomescape/WebConfig.java

@@ -0,0 +1,30 @@
+package roomescape;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.method.support.HandlerMethodArgumentResolver;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+import roomescape.auth.AdminAuthInterceptor;
+import roomescape.auth.LoginMemberArgumentResolver;
+
+import java.util.List;
+
+@Configuration
+public class WebConfig implements WebMvcConfigurer {
+    @Value("${roomescape.auth.jwt.secret}")
+    private String secretKey;
+
+    @Override
+    public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
+        resolvers.add(new LoginMemberArgumentResolver(secretKey));
+    }
+
+    @Override
+    public void addInterceptors(InterceptorRegistry registry) {
+        registry.addInterceptor(new AdminAuthInterceptor(secretKey))
+                .addPathPatterns("/admin", "/admin/**");
+    }
+}
+
+

src/main/java/roomescape/auth/AdminAuthInterceptor.java

@@ -0,0 +1,57 @@
+package roomescape.auth;
+
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.ExpiredJwtException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.web.servlet.HandlerInterceptor;
+import roomescape.common.ApiError;
+import roomescape.util.JwtUtil;
+
+import java.io.IOException;
+
+public class AdminAuthInterceptor implements HandlerInterceptor {
+
+    private final String secretKey;
+
+    public AdminAuthInterceptor(String secretKey) {
+        this.secretKey = secretKey;
+    }
+
+    @Override
+    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
+        String token = JwtUtil.extractTokenFromCookies(request.getCookies());
+        if (token.isEmpty()) {
+			writeError(response, ApiError.UNAUTHORIZED_MISSING_TOKEN);
+            return false;
+        }
+
+        try {
+			Claims claims = JwtUtil.parseClaims(token, secretKey);
+			String role = claims.get("role", String.class);
+			if (!"ADMIN".equals(role)) {
+				writeError(response, ApiError.FORBIDDEN_ADMIN_ONLY);
+                return false;
+            }
+            return true;
+		} catch (ExpiredJwtException e) {
+			writeError(response, ApiError.UNAUTHORIZED_EXPIRED_TOKEN);
+			return false;
+        } catch (Exception e) {
+			writeError(response, ApiError.UNAUTHORIZED_INVALID_TOKEN);
+            return false;
+        }
+    }
+
+	private void writeError(HttpServletResponse response, ApiError apiError) {
+		response.setStatus(apiError.getHttpStatus().value());
+		response.setContentType("application/json;charset=UTF-8");
+		try {
+			String payload = "{\"code\":" + apiError.getCode() + ",\"message\":\"" + apiError.getMessage() + "\"}";
+			response.getWriter().write(payload);
+		} catch (IOException ignored) {
+		}
+	}
+}
+
+

src/main/java/roomescape/auth/LoginMemberArgumentResolver.java

@@ -0,0 +1,50 @@
+package roomescape.auth;
+
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.ExpiredJwtException;
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.core.MethodParameter;
+import org.springframework.web.bind.support.WebDataBinderFactory;
+import org.springframework.web.context.request.NativeWebRequest;
+import org.springframework.web.method.support.HandlerMethodArgumentResolver;
+import org.springframework.web.method.support.ModelAndViewContainer;
+import roomescape.member.LoginMemberDto;
+import roomescape.util.JwtUtil;
+
+public class LoginMemberArgumentResolver implements HandlerMethodArgumentResolver {
+
+    private final String secretKey;
+
+    public LoginMemberArgumentResolver(String secretKey) {
+        this.secretKey = secretKey;
+    }
+
+    @Override
+    public boolean supportsParameter(MethodParameter parameter) {
+		return parameter.getParameterType().equals(LoginMemberDto.class);
+    }
+
+    @Override
+    public Object resolveArgument(MethodParameter parameter, ModelAndViewContainer mavContainer, NativeWebRequest webRequest, WebDataBinderFactory binderFactory) {
+        HttpServletRequest request = (HttpServletRequest) webRequest.getNativeRequest();
+        String token = JwtUtil.extractTokenFromCookies(request.getCookies());
+
+        if (token.isEmpty()) {
+            return null;
+        }
+
+		try {
+			Claims claims = JwtUtil.parseClaims(token, secretKey);
+
+			Long id = Long.valueOf(claims.getSubject());
+			String name = claims.get("name", String.class);
+			String role = claims.get("role", String.class);
+
+			return new LoginMemberDto(id, name, null, role);
+		} catch (ExpiredJwtException e) {
+			return null;
+		} catch (Exception e) {
+			return null;
+		}
+    }
+}

src/main/java/roomescape/common/ApiError.java

@@ -0,0 +1,29 @@
+package roomescape.common;
+
+import lombok.Getter;
+import org.springframework.http.HttpStatus;
+
+@Getter
+public enum ApiError {
+	BAD_REQUEST_INVALID_INPUT(HttpStatus.BAD_REQUEST, 40001, "잘못된 요청입니다."),
+	BAD_REQUEST_ILLEGAL_STATE(HttpStatus.BAD_REQUEST, 40002, "요청을 처리할 수 없습니다."),
+	NOT_FOUND_RESOURCE(HttpStatus.NOT_FOUND, 40401, "리소스를 찾을 수 없습니다."),
+	UNAUTHORIZED_MISSING_TOKEN(HttpStatus.UNAUTHORIZED, 40101, "토큰이 없습니다."),
+	UNAUTHORIZED_INVALID_TOKEN(HttpStatus.UNAUTHORIZED, 40102, "토큰이 유효하지 않습니다."),
+	UNAUTHORIZED_EXPIRED_TOKEN(HttpStatus.UNAUTHORIZED, 40103, "토큰이 만료되었습니다."),
+	FORBIDDEN_ADMIN_ONLY(HttpStatus.FORBIDDEN, 40301, "관리자 권한이 필요합니다."),
+	INTERNAL_SERVER_ERROR(HttpStatus.INTERNAL_SERVER_ERROR, 50000, "서버 오류가 발생했습니다.");
+
+	private final HttpStatus httpStatus;
+	private final int code;
+	private final String message;
+
+	ApiError(HttpStatus httpStatus, int code, String message) {
+		this.httpStatus = httpStatus;
+		this.code = code;
+		this.message = message;
+	}
+}
+
+
+

src/main/java/roomescape/member/LoginMemberDto.java

@@ -0,0 +1,6 @@
+package roomescape.member;
+
+public record LoginMemberDto(Long id, String name, String email, String role) {}
+
+
+

src/main/java/roomescape/member/Member.java

@@ -1,20 +1,30 @@
 package roomescape.member;
 
+import jakarta.persistence.*;
+
+@Entity
 public class Member {
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
     private Long id;
     private String name;
+    @Column(unique = true)
     private String email;
     private String password;
-    private String role;
+	@Enumerated(EnumType.STRING)
+	private Role role;
+
+    public Member() {
+    }
 
-    public Member(Long id, String name, String email, String role) {
+	public Member(Long id, String name, String email, Role role) {
         this.id = id;
         this.name = name;
         this.email = email;
         this.role = role;
     }
 
-    public Member(String name, String email, String password, String role) {
+	public Member(String name, String email, String password, Role role) {
         this.name = name;
         this.email = email;
         this.password = password;
@@ -37,7 +47,7 @@ public String getPassword() {
         return password;
     }
 
-    public String getRole() {
+	public Role getRole() {
         return role;
     }
 }

src/main/java/roomescape/member/MemberController.java

@@ -3,34 +3,68 @@
 import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RestController;
+import roomescape.util.JwtUtil;
 
 import java.net.URI;
 
 @RestController
 public class MemberController {
     private MemberService memberService;
+    @Value("${roomescape.auth.jwt.secret}")
+    private String secretKey;
 
     public MemberController(MemberService memberService) {
         this.memberService = memberService;
     }
 
     @PostMapping("/members")
-    public ResponseEntity createMember(@RequestBody MemberRequest memberRequest) {
-        MemberResponse member = memberService.createMember(memberRequest);
-        return ResponseEntity.created(URI.create("/members/" + member.getId())).body(member);
+	public ResponseEntity createMember(@RequestBody MemberRequestDto memberRequest) {
+		MemberResponseDto member = memberService.createMember(memberRequest);
+		return ResponseEntity.created(URI.create("/members/" + member.getId())).body(member);
     }
 
+    @PostMapping("/login")
+	public ResponseEntity login(@RequestBody MemberRequestDto memberRequest, HttpServletResponse response) {
+		Member member = memberService.login(memberRequest.email(), memberRequest.password());
+
+		String accessToken = createToken(member);
+
+		Cookie cookie = JwtUtil.createAuthCookie(accessToken, JwtUtil.DEFAULT_MAX_AGE_SECONDS, false);
+		response.addCookie(cookie);
+
+        return ResponseEntity.ok().build();
+    }
+
+    @GetMapping("/login/check")
+	public ResponseEntity<MemberResponseDto> checkLogin(HttpServletRequest request) {
+		String token = JwtUtil.extractTokenFromCookies(request.getCookies());
+
+		String name = JwtUtil.parseClaims(token, secretKey).get("name", String.class);
+
+		MemberResponseDto body = new MemberResponseDto(null, name, null);
+        return ResponseEntity.ok(body);
+    }
+
+    public String createToken(Member member) {
+		return JwtUtil.createToken(member.getId().toString(), member.getName(), member.getRole(), secretKey);
+    }
+
+
+    public String createTokenFromEmailAndPassword(String email, String password) {
+        Member member = memberService.login(email, password);
+		return JwtUtil.createToken(member.getId().toString(), member.getName(), member.getRole(), secretKey);
+    }
+
+
     @PostMapping("/logout")
     public ResponseEntity logout(HttpServletResponse response) {
-        Cookie cookie = new Cookie("token", "");
-        cookie.setHttpOnly(true);
-        cookie.setPath("/");
-        cookie.setMaxAge(0);
+		Cookie cookie = JwtUtil.createExpiredAuthCookie();
         response.addCookie(cookie);
         return ResponseEntity.ok().build();
     }