[Feat] 스프링 시큐리티 및 스웨거 설정 + 유저 엔티티 작성 - #2

backend/build.gradle

@@ -25,6 +25,12 @@ dependencies {
     implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
     implementation 'org.springframework.boot:spring-boot-starter-security'
     implementation 'org.springframework.boot:spring-boot-starter-validation'
+    implementation 'org.springframework.boot:spring-boot-starter-web'
+    implementation group: 'io.jsonwebtoken', name: 'jjwt', version: '0.9.1'
+    implementation 'org.javassist:javassist:3.27.0-GA'
+    implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.0.2'
+    // https://mvnrepository.com/artifact/jakarta.servlet/jakarta.servlet-api
+    compileOnly 'jakarta.servlet:jakarta.servlet-api:6.0.0'
     compileOnly 'org.projectlombok:lombok'
     runtimeOnly 'com.mysql:mysql-connector-j'
     annotationProcessor 'org.projectlombok:lombok'

backend/src/main/java/com/likelion/nsu/dailycoding/config/OpenApiConfig.java

@@ -0,0 +1,33 @@
+package com.likelion.nsu.dailycoding.config;
+
+import io.swagger.v3.oas.annotations.OpenAPIDefinition;
+import io.swagger.v3.oas.models.Components;
+import io.swagger.v3.oas.models.OpenAPI;
+import io.swagger.v3.oas.models.info.Info;
+import io.swagger.v3.oas.models.security.SecurityRequirement;
+import io.swagger.v3.oas.models.security.SecurityScheme;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+@OpenAPIDefinition
+public class OpenApiConfig {
+    @Bean
+    public OpenAPI openAPI() {
+        Info info = new Info()
+                .title("Todo API Document")
+                .version("v1.0.0")
+                .description("Todo API 명세서");
+
+        String jwtSchemeName = "bearerAuth";
+        SecurityRequirement securityRequirement = new SecurityRequirement().addList(jwtSchemeName);
+        Components components = new Components()
+                .addSecuritySchemes(jwtSchemeName, new SecurityScheme()
+                        .name(jwtSchemeName)
+                        .type(SecurityScheme.Type.HTTP) // HTTP 방식
+                        .scheme("bearer")
+                        .bearerFormat("JWT")); // 토큰 형식을 지정하는 임의의 문자(Optional)
+
+        return new OpenAPI().info(info).addSecurityItem(securityRequirement).components(components);
+    }
+}

backend/src/main/java/com/likelion/nsu/dailycoding/entity/User.java

@@ -0,0 +1,92 @@
+package com.likelion.nsu.dailycoding.entity;
+
+import jakarta.persistence.*;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.UserDetails;
+
+import java.util.Collection;
+import java.util.List;
+import java.util.stream.Collectors;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@Entity
+public class User implements UserDetails {
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(nullable = false)
+    private String userName;
+
+    @Column(nullable = false)
+    private String userId;
+
+    @Column(nullable = false)
+//    @Pattern(regexp = "^(?=.*[A-Za-z])(?=.*\\d)(?=.*[@$!%*#?&])[A-Za-z\\d@$!%*#?&]{8,}$")
+    private String password;
+
+    /*
+    * 나중에 추가할 타이머
+    * @Column(nullable = false)
+    * @@OneToMany(mappedBy = "user")
+    * private List<Timer> timerList;
+    * */
+
+    /*
+    * 나중에 추가할 스터디그룹
+    * @Column(nullable = false)
+    * @ManyToOne(fetch = FetchType.LAZY)
+    * @JoinColumn(name = "group_id")
+    * private Group group;
+    * */
+
+    @ElementCollection(fetch = FetchType.EAGER)
+    private List<String> roles;
+
+    @Override
+    public Collection<? extends GrantedAuthority> getAuthorities() {
+        return this.roles.stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList());
+    }
+
+    @Override
+    public String getPassword() {
+        return this.getPassword();
+    }
+
+    public String getUserName() {
+        return this.userName;
+    }
+
+    @Override
+    public String getUsername() {
+        return this.userId;
+    }
+
+    @Override
+    public boolean isAccountNonExpired() {
+        return true;
+    }
+
+    @Override
+    public boolean isAccountNonLocked() {
+        return true;
+    }
+
+    @Override
+    public boolean isCredentialsNonExpired() {
+        return true;
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return true;
+    }
+}

backend/src/main/java/com/likelion/nsu/dailycoding/security/CorsConfig.java

@@ -0,0 +1,27 @@
+package com.likelion.nsu.dailycoding.security;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+import org.springframework.web.filter.CorsFilter;
+
+import java.util.List;
+
+@Configuration
+public class CorsConfig {
+    @Bean
+    public CorsFilter corsFilter() {
+        CorsConfiguration config = new CorsConfiguration();
+        config.setAllowCredentials(true);
+        config.setAllowedOrigins(List.of("http://localhost:3000"));
+        config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"));
+        config.setAllowedHeaders(List.of("*"));
+        config.setExposedHeaders(List.of("*"));
+        config.setAllowCredentials(true);
+
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", config);
+        return new CorsFilter(source);
+    }
+}

backend/src/main/java/com/likelion/nsu/dailycoding/security/JwtAuthenticationFilter.java

@@ -0,0 +1,33 @@
+package com.likelion.nsu.dailycoding.security;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.RequiredArgsConstructor;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import java.io.IOException;
+
+@RequiredArgsConstructor
+public class JwtAuthenticationFilter extends OncePerRequestFilter {
+    private final Logger logger = LoggerFactory.getLogger(JwtTokenProvider.class);
+    private final JwtTokenProvider jwtTokenProvider;
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
+        String token = jwtTokenProvider.resolveToken(request);
+        logger.info("[doFilterInternal] token 값 추출 완료, token: {}", token);
+        logger.info("[doFilterInternal] token 값 유효성 체크 시작");
+        if (token != null && jwtTokenProvider.validateToken(token)) {
+            Authentication authentication = jwtTokenProvider.getAuthentication(token);
+            SecurityContextHolder.getContext().setAuthentication(authentication);
+            logger.info("[doFilterInternal] token 값 유효성 체크 완료");
+        }
+        filterChain.doFilter(request, response);
+    }
+}

backend/src/main/java/com/likelion/nsu/dailycoding/security/JwtTokenProvider.java

@@ -0,0 +1,90 @@
+package com.likelion.nsu.dailycoding.security;
+
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.Jws;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.SignatureAlgorithm;
+import jakarta.annotation.PostConstruct;
+import jakarta.servlet.http.HttpServletRequest;
+import lombok.RequiredArgsConstructor;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.stereotype.Component;
+import org.springframework.util.StringUtils;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.Date;
+import java.util.List;
+
+@Component
+@RequiredArgsConstructor
+public class JwtTokenProvider {
+    private final Logger logger = LoggerFactory.getLogger(JwtTokenProvider.class);
+    private final UserDetailsService userDetailsService;
+
+    @Value("${springboot.jwt.secret}")
+    private String secretKey = "secretKey";
+    private final long tokenValidMillisecond = 1000L * 60 * 60;
+
+    @PostConstruct
+    protected void init() {
+        logger.info("[init] JwtTokenProvider 내 secretKey 초기화 시작");
+        secretKey = Base64.getEncoder().encodeToString(secretKey.getBytes(StandardCharsets.UTF_8));
+        logger.info("[init] JwtTokenProvider 내 secretKey 초기화 완료");
+    }
+
+    public String createToken(String userId, List<String> roles) {
+        logger.info("[createToken] 토큰 생성 시작");
+        Claims claims = Jwts.claims().setSubject(userId);
+        claims.put("roles", roles);
+        Date now = new Date();
+        String token = Jwts.builder()
+                .setClaims(claims)
+                .setIssuedAt(now)
+                .setExpiration(new Date(now.getTime() + tokenValidMillisecond))
+                .signWith(SignatureAlgorithm.HS256, secretKey)
+                .compact();
+        logger.info("[createToken] 토큰 생성 완료");
+        return token;
+    }
+
+    public Authentication getAuthentication(String token) {
+        logger.info("[getAuthentication] 토큰 인증 정보 조회 시작");
+        UserDetails userDetails = userDetailsService.loadUserByUsername(this.getUsername(token));
+        logger.info("[getAuthentication] 토큰 인증 정보 조회 완료, UserDetails UserName: {}", userDetails.getUsername());
+        return new UsernamePasswordAuthenticationToken(userDetails, "", userDetails.getAuthorities());
+    }
+
+    public String getUsername(String token) {
+        logger.info("[getUsername] 토큰 기반 회원 구별 정보 추출");
+        String info = Jwts.parser().setSigningKey(secretKey).parseClaimsJws(token).getBody().getSubject();
+        logger.info("[getUsername] 토큰 기반 회원 구별 정보 추출 완료, info: {}", info);
+        return info;
+    }
+
+    public String resolveToken(HttpServletRequest request) {
+        logger.info("[resolveToken] HTTP 헤더에서 Toeken 값 추출");
+        String bearerToken = request.getHeader("Authorization");
+        if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
+            return bearerToken.substring(7);
+        }
+        return null;
+    }
+
+    public boolean validateToken(String token) {
+        logger.info("[validateToken] 토큰 유효 체크 시작");
+        try {
+            Jws<Claims> claims = Jwts.parser().setSigningKey(secretKey).parseClaimsJws(token);
+            return !claims.getBody().getExpiration().before(new Date());
+        } catch (Exception e) {
+            logger.info("[validateToken] 토큰 유효 체크 예외 발생");
+            return false;
+        }
+    }
+}

backend/src/main/java/com/likelion/nsu/dailycoding/security/SecurityConfiguration.java

@@ -0,0 +1,46 @@
+package com.likelion.nsu.dailycoding.security;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+
+@Configuration
+@RequiredArgsConstructor
+public class SecurityConfiguration{
+    private final JwtTokenProvider jwtTokenProvider;
+    private final CorsConfig corsConfig;
+
+    @Bean
+    public SecurityFilterChain configure(HttpSecurity http) throws Exception{
+        http.csrf(AbstractHttpConfigurer::disable)
+            .httpBasic(AbstractHttpConfigurer::disable)
+            .sessionManagement(sessionManagement ->
+                sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+            )
+            .authorizeHttpRequests(authorizeRequest ->
+                authorizeRequest.requestMatchers("/", "/users", "/users/login").permitAll()
+                                .requestMatchers("/swagger-ui.html", "/swagger-ui/**", "/v3/api-docs/**").permitAll()
+                                .requestMatchers("/users/exception").permitAll()
+                                .requestMatchers("**exception**").permitAll()
+                                .anyRequest().authenticated()
+            );
+
+            /*
+            * 나중에 예외처리 추가
+            * .exceptionHandling(handler -> {
+            *   handler.accessDeniedHandler(new CustomAccessDeniedHandler());
+            *   handler.authenticationEntryPoint(new CustomAuthenticationEntryPoint());
+            * });
+            * */
+
+        http.addFilter(corsConfig.corsFilter())
+            .addFilterBefore(new JwtAuthenticationFilter(jwtTokenProvider), UsernamePasswordAuthenticationFilter.class);
+
+        return http.build();
+    }
+}

backend/src/main/resources/application.properties

@@ -1 +1,10 @@
+spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
+spring.datasource.url=jdbc:mysql://localhost:3306/daily_coding?useSSL=false&useUnicode=true&serverTimezone=Asia/Seoul&allowPublicKeyRetrieval=true
+spring.datasource.username=root
+spring.datasource.password=1q2w3e4r
 
+spring.jpa.hibernate.ddl-auto=create
+spring.jpa.properties.hibernate.format_sql=true
+spring.jpa.properties.hibernate.show_sql=true
+
+springboot.jwt.secret = X1acF6kDq3Gv58f6K2dJf6m7M6v7hG3zF4hYk7u9r6jg9w0G4i5U3Kh8JrHqe5C5o7hF35H