Merge pull request #37 from AI-Tutor-2024/security

Security

Author: hyunbin1

src/main/java/com/example/ai_tutor/domain/auth/application/CustomTokenProviderService.java

@@ -1,6 +1,7 @@
 package com.example.ai_tutor.domain.auth.application;
 
 import com.example.ai_tutor.domain.auth.dto.TokenMapping;
+import com.example.ai_tutor.domain.user.domain.User;
 import com.example.ai_tutor.global.config.security.OAuth2Config;
 import com.example.ai_tutor.global.config.security.token.UserPrincipal;
 import io.jsonwebtoken.*;
@@ -122,8 +123,10 @@ public String getEmailFromToken(String token) {
 
     public UsernamePasswordAuthenticationToken getAuthenticationByToken(String jwtToken) {
         String email = getEmailFromToken(jwtToken);
-        UserDetails userDetails = customUserDetailsService.loadUserByUsername(email);
-        return new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
+        User user = customUserDetailsService.getUserByEmail(email);
+        UserPrincipal userPrincipal = UserPrincipal.create(user);
+
+        return new UsernamePasswordAuthenticationToken(userPrincipal, null, userPrincipal.getAuthorities());
     }
 
     public Long getExpiration(String token) {

src/main/java/com/example/ai_tutor/domain/auth/application/CustomUserDetailsService.java

@@ -4,13 +4,13 @@
 import com.example.ai_tutor.domain.user.domain.repository.UserRepository;
 import com.example.ai_tutor.global.DefaultAssert;
 import com.example.ai_tutor.global.config.security.token.UserPrincipal;
-import jakarta.transaction.Transactional;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
 
 import java.util.Optional;
 
@@ -31,7 +31,13 @@ public UserDetails loadUserByUsername(String email) throws UsernameNotFoundExcep
         return UserPrincipal.create(user);
     }
 
-    @Transactional
+    @Transactional(readOnly = true)
+    public User getUserByEmail(String email) {
+        return userRepository.findByEmail(email)
+                .orElseThrow(() -> new UsernameNotFoundException("유저 정보를 찾을 수 없습니다: " + email));
+    }
+
+    @Transactional(readOnly = true)
     public UserDetails loadUserById(Long id) {
         log.debug("Trying to load user by ID: {}", id);
         Optional<User> user = userRepository.findById(id);