feat: 토큰 응답 시 사용자 권한 응답 추가

* feat: 토큰 생성 응답 DTO에 사용자 권한 필드 추가

* feat: 토큰 생성, 갱신 로직 수정
- 토큰과 사용자 권한을 같이 응답시키도록 구현

Author: ysw789

src/main/java/dmu/dasom/api/domain/member/controller/MemberController.java

@@ -64,6 +64,7 @@ public ResponseEntity<Void> tokenRotation(@AuthenticationPrincipal final UserDet
         final HttpHeaders headers = new HttpHeaders();
         headers.add("Access-Token", tokenBox.getAccessToken());
         headers.add("Refresh-Token", tokenBox.getRefreshToken());
+        headers.add("Authority", tokenBox.getAuthority());
 
         return ResponseEntity.ok().headers(headers).build();
     }

src/main/java/dmu/dasom/api/domain/member/service/MemberServiceImpl.java

@@ -9,10 +9,14 @@
 import dmu.dasom.api.global.auth.jwt.JwtUtil;
 import dmu.dasom.api.global.auth.userdetails.UserDetailsImpl;
 import lombok.RequiredArgsConstructor;
+import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
+import java.util.Collection;
+import java.util.Iterator;
+
 @RequiredArgsConstructor
 @Service
 @Transactional(readOnly = true)
@@ -49,7 +53,13 @@ public void signUp(final SignupRequestDto request) {
     // 토큰 갱신
     @Override
     public TokenBox tokenRotation(final UserDetailsImpl userDetails) {
-        return jwtUtil.tokenRotation(userDetails);
+        final Collection<? extends GrantedAuthority> authorities = userDetails.getAuthorities();
+        final Iterator<? extends GrantedAuthority> iterator = authorities.iterator();
+        final GrantedAuthority auth = iterator.next();
+
+        final String authority = auth.getAuthority();
+
+        return jwtUtil.tokenRotation(userDetails.getUsername(), authority);
     }
 
 }

src/main/java/dmu/dasom/api/global/auth/dto/TokenBox.java

@@ -19,4 +19,8 @@ public class TokenBox {
     @NotNull
     private String refreshToken;
 
+    @Schema(description = "권한")
+    @NotNull
+    private String authority;
+
 }

src/main/java/dmu/dasom/api/global/auth/filter/CustomAuthenticationFilter.java

@@ -17,9 +17,12 @@
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 
 import java.io.IOException;
+import java.util.Collection;
+import java.util.Iterator;
 
 @RequiredArgsConstructor
 public class CustomAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
@@ -47,12 +50,19 @@ protected void successfulAuthentication(final HttpServletRequest request, final
         // 기존 토큰 만료 처리
         jwtUtil.blacklistTokens(authResult.getName());
 
+        final Collection<? extends GrantedAuthority> authorities = authResult.getAuthorities();
+        final Iterator<? extends GrantedAuthority> iterator = authorities.iterator();
+        final GrantedAuthority auth = iterator.next();
+
+        final String authority = auth.getAuthority();
+
         // 토큰 생성
-        final TokenBox tokenBox = jwtUtil.generateTokenBox(authResult.getName());
+        final TokenBox tokenBox = jwtUtil.generateTokenBox(authResult.getName(), authority);
 
         response.setStatus(HttpStatus.OK.value());
         response.setHeader("Access-Token", tokenBox.getAccessToken());
         response.setHeader("Refresh-Token", tokenBox.getRefreshToken());
+        response.setHeader("Authority", tokenBox.getAuthority());
     }
 
     @Override

src/main/java/dmu/dasom/api/global/auth/jwt/JwtUtil.java

@@ -38,10 +38,11 @@ public JwtUtil(@Value("${jwt.secret}") final String secretKey, final StringRedis
     }
 
     // Access, Refresh 토큰 생성
-    public TokenBox generateTokenBox(final String email) {
+    public TokenBox generateTokenBox(final String email, final String authority) {
         final TokenBox tokenBox = TokenBox.builder()
                 .accessToken(generateToken(email, accessTokenExpiration))
                 .refreshToken(generateToken(email, refreshTokenExpiration))
+                .authority(authority)
                 .build();
 
         saveTokens(tokenBox, email);
@@ -132,9 +133,9 @@ public boolean isExpired(final String token) {
     }
 
     // Access, Refresh 토큰 갱신
-    public TokenBox tokenRotation(final UserDetailsImpl userDetails) {
-        blacklistTokens(userDetails.getUsername());
-        return generateTokenBox(userDetails.getUsername());
+    public TokenBox tokenRotation(final String email, final String authority) {
+        blacklistTokens(email);
+        return generateTokenBox(email, authority);
     }
 
 }