Skip to content

Commit 6355371

Browse files
MEOHINMEOHIN
authored
[refactor] 컨트롤러에 @PreAuthorize 적용 및 인증 로직 제거 #184 (#186)
* Revert "chore: initData용 이미지 추가" This reverts commit ef30eef. * . * feat: @EnableMethodSecurity 추가로 메서드 레벨 권한 검증 활성화 * refactor: 컨트롤러에 @PreAuthorize 적용 및 인증 로직 제거
1 parent 83fe8f5 commit 6355371

File tree

5 files changed

+43
-22
lines changed

5 files changed

+43
-22
lines changed

‎src/main/java/com/back/domain/mybar/controller/MyBarController.java‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@
22

33
import com.back.domain.mybar.dto.MyBarListResponseDto;
44
import com.back.domain.mybar.service.MyBarService;
5-
import com.back.global.exception.ServiceException;
65
import com.back.global.rsData.RsData;
76
import com.back.global.security.SecurityUser;
87
import io.swagger.v3.oas.annotations.Operation;
98
import jakarta.validation.constraints.Max;
109
import jakarta.validation.constraints.Min;
1110
import lombok.RequiredArgsConstructor;
1211
import org.springframework.format.annotation.DateTimeFormat;
12+
import org.springframework.security.access.prepost.PreAuthorize;
1313
import org.springframework.security.core.annotation.AuthenticationPrincipal;
1414
import org.springframework.validation.annotation.Validated;
1515
import org.springframework.web.bind.annotation.*;
@@ -20,6 +20,7 @@
2020
@RequestMapping("/me/bar")
2121
@RequiredArgsConstructor
2222
@Validated
23+
@PreAuthorize("isAuthenticated()")
2324
public class MyBarController {
2425

2526
/**
@@ -40,14 +41,13 @@ public class MyBarController {
4041
@GetMapping
4142
@Operation(summary = "내 바 목록", description = "내가 킵한 칵테일 목록 조회. 무한 스크롤 커서 지원")
4243
public RsData<MyBarListResponseDto> getMyBarList(
43-
@AuthenticationPrincipal(errorOnInvalidType = false) SecurityUser principal,
44+
@AuthenticationPrincipal SecurityUser principal,
4445
@RequestParam(required = false)
4546
@DateTimeFormat(iso = DateTimeFormat.ISO.DATE_TIME) LocalDateTime lastKeptAt,
4647
@RequestParam(required = false) Long lastId,
4748
@RequestParam(defaultValue = "20") @Min(1) @Max(100) int limit
4849
) {
49-
Long userId = principal != null ? principal.getId() : null;
50-
if (userId == null) throw new ServiceException(401, "로그인이 필요합니다.");
50+
Long userId = principal.getId();
5151
MyBarListResponseDto body = myBarService.getMyBar(userId, lastKeptAt, lastId, limit);
5252
return RsData.successOf(body);
5353
}
@@ -61,11 +61,10 @@ public RsData<MyBarListResponseDto> getMyBarList(
6161
@PostMapping("/{cocktailId}/keep")
6262
@Operation(summary = "킵 추가/복원", description = "해당 칵테일을 내 바에 킵합니다. 이미 삭제 상태면 복원")
6363
public RsData<Void> keep(
64-
@AuthenticationPrincipal(errorOnInvalidType = false) SecurityUser principal,
64+
@AuthenticationPrincipal SecurityUser principal,
6565
@PathVariable Long cocktailId
6666
) {
67-
Long userId = principal != null ? principal.getId() : null;
68-
if (userId == null) throw new ServiceException(401, "로그인이 필요합니다.");
67+
Long userId = principal.getId();
6968
myBarService.keep(userId, cocktailId);
7069
return RsData.of(201, "kept"); // Aspect가 HTTP 201로 설정
7170
}
@@ -79,11 +78,10 @@ public RsData<Void> keep(
7978
@DeleteMapping("/{cocktailId}/keep")
8079
@Operation(summary = "킵 해제", description = "내 바에서 해당 칵테일을 삭제(소프트 삭제, 멱등)")
8180
public RsData<Void> unkeep(
82-
@AuthenticationPrincipal(errorOnInvalidType = false) SecurityUser principal,
81+
@AuthenticationPrincipal SecurityUser principal,
8382
@PathVariable Long cocktailId
8483
) {
85-
Long userId = principal != null ? principal.getId() : null;
86-
if (userId == null) throw new ServiceException(401, "로그인이 필요합니다.");
84+
Long userId = principal.getId();
8785
myBarService.unkeep(userId, cocktailId);
8886
return RsData.of(200, "deleted");
8987
}

‎src/main/java/com/back/domain/myhistory/controller/MyHistoryController.java‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,13 @@
66
import com.back.domain.myhistory.dto.MyHistoryLikedPostListDto;
77
import com.back.domain.myhistory.service.MyHistoryService;
88
import com.back.global.rsData.RsData;
9+
import com.back.global.security.SecurityUser;
910
import io.swagger.v3.oas.annotations.Operation;
1011
import jakarta.validation.constraints.Max;
1112
import jakarta.validation.constraints.Min;
1213
import lombok.RequiredArgsConstructor;
1314
import org.springframework.format.annotation.DateTimeFormat;
15+
import org.springframework.security.access.prepost.PreAuthorize;
1416
import org.springframework.security.core.annotation.AuthenticationPrincipal;
1517
import org.springframework.validation.annotation.Validated;
1618
import org.springframework.web.bind.annotation.*;
@@ -21,6 +23,7 @@
2123
@RequestMapping("/me")
2224
@RequiredArgsConstructor
2325
@Validated
26+
@PreAuthorize("isAuthenticated()")
2427
public class MyHistoryController {
2528

2629
private final MyHistoryService myHistoryService;
@@ -36,11 +39,12 @@ public class MyHistoryController {
3639
@GetMapping("/posts")
3740
@Operation(summary = "내 게시글 목록", description = "내가 작성한 게시글 최신순 목록. 무한스크롤 파라미터 지원")
3841
public RsData<MyHistoryPostListDto> getMyPosts(
39-
@AuthenticationPrincipal(expression = "id") Long userId,
42+
@AuthenticationPrincipal SecurityUser principal,
4043
@RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE_TIME) LocalDateTime lastCreatedAt,
4144
@RequestParam(required = false) Long lastId,
4245
@RequestParam(defaultValue = "20") @Min(1) @Max(100) int limit
4346
) {
47+
Long userId = principal.getId();
4448
MyHistoryPostListDto body = myHistoryService.getMyPosts(userId, lastCreatedAt, lastId, limit);
4549
return RsData.successOf(body);
4650
}
@@ -54,9 +58,10 @@ public RsData<MyHistoryPostListDto> getMyPosts(
5458
@GetMapping("/posts/{id}")
5559
@Operation(summary = "내 게시글로 이동", description = "내가 작성한 게시글 상세 링크 정보 반환")
5660
public RsData<com.back.domain.myhistory.dto.MyHistoryPostGoResponseDto> goFromPost(
57-
@AuthenticationPrincipal(expression = "id") Long userId,
61+
@AuthenticationPrincipal SecurityUser principal,
5862
@PathVariable("id") Long postId
5963
) {
64+
Long userId = principal.getId();
6065
var body = myHistoryService.getPostLinkFromMyPost(userId, postId);
6166
return RsData.successOf(body);
6267
}
@@ -72,11 +77,12 @@ public RsData<com.back.domain.myhistory.dto.MyHistoryPostGoResponseDto> goFromPo
7277
@GetMapping("/comments")
7378
@Operation(summary = "내 댓글 목록", description = "내가 작성한 댓글 최신순 목록. 무한스크롤 파라미터 지원")
7479
public RsData<MyHistoryCommentListDto> getMyComments(
75-
@AuthenticationPrincipal(expression = "id") Long userId,
80+
@AuthenticationPrincipal SecurityUser principal,
7681
@RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE_TIME) LocalDateTime lastCreatedAt,
7782
@RequestParam(required = false) Long lastId,
7883
@RequestParam(defaultValue = "20") @Min(1) @Max(100) int limit
7984
) {
85+
Long userId = principal.getId();
8086
MyHistoryCommentListDto body = myHistoryService.getMyComments(userId, lastCreatedAt, lastId, limit);
8187
return RsData.successOf(body);
8288
}
@@ -92,11 +98,12 @@ public RsData<MyHistoryCommentListDto> getMyComments(
9298
@GetMapping("/likes")
9399
@Operation(summary = "좋아요한 게시글 목록", description = "좋아요한 게시글 최신순 목록. 무한스크롤 파라미터 지원")
94100
public RsData<MyHistoryLikedPostListDto> getMyLikedPosts(
95-
@AuthenticationPrincipal(expression = "id") Long userId,
101+
@AuthenticationPrincipal SecurityUser principal,
96102
@RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE_TIME) LocalDateTime lastCreatedAt,
97103
@RequestParam(required = false) Long lastId,
98104
@RequestParam(defaultValue = "20") @Min(1) @Max(100) int limit
99105
) {
106+
Long userId = principal.getId();
100107
MyHistoryLikedPostListDto body = myHistoryService.getMyLikedPosts(userId, lastCreatedAt, lastId, limit);
101108
return RsData.successOf(body);
102109
}
@@ -110,9 +117,10 @@ public RsData<MyHistoryLikedPostListDto> getMyLikedPosts(
110117
@GetMapping("/comments/{id}")
111118
@Operation(summary = "댓글에서 게시글 이동", description = "내 댓글이 달린 게시글 상세 링크 정보 반환")
112119
public RsData<MyHistoryCommentGoResponseDto> goFromComment(
113-
@AuthenticationPrincipal(expression = "id") Long userId,
120+
@AuthenticationPrincipal SecurityUser principal,
114121
@PathVariable("id") Long commentId
115122
) {
123+
Long userId = principal.getId();
116124
var body = myHistoryService.getPostLinkFromMyComment(userId, commentId);
117125
return RsData.successOf(body);
118126
}
@@ -126,9 +134,10 @@ public RsData<MyHistoryCommentGoResponseDto> goFromComment(
126134
@GetMapping("/likes/{id}")
127135
@Operation(summary = "좋아요 목록에서 이동", description = "좋아요한 게시글 상세 링크 정보 반환")
128136
public RsData<com.back.domain.myhistory.dto.MyHistoryPostGoResponseDto> goFromLikedPost(
129-
@AuthenticationPrincipal(expression = "id") Long userId,
137+
@AuthenticationPrincipal SecurityUser principal,
130138
@PathVariable("id") Long postId
131139
) {
140+
Long userId = principal.getId();
132141
var body = myHistoryService.getPostLinkFromMyLikedPost(userId, postId);
133142
return RsData.successOf(body);
134143
}

‎src/main/java/com/back/domain/notification/controller/NotificationController.java‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,14 @@
77
import com.back.domain.notification.service.NotificationService;
88
import com.back.domain.notification.service.NotificationSettingService;
99
import com.back.global.rsData.RsData;
10+
import com.back.global.security.SecurityUser;
1011
import io.swagger.v3.oas.annotations.Operation;
1112
import jakarta.validation.Valid;
1213
import jakarta.validation.constraints.Max;
1314
import jakarta.validation.constraints.Min;
1415
import lombok.RequiredArgsConstructor;
1516
import org.springframework.format.annotation.DateTimeFormat;
17+
import org.springframework.security.access.prepost.PreAuthorize;
1618
import org.springframework.security.core.annotation.AuthenticationPrincipal;
1719
import org.springframework.validation.annotation.Validated;
1820
import org.springframework.web.bind.annotation.*;
@@ -24,6 +26,7 @@
2426
@RequestMapping("/me")
2527
@RequiredArgsConstructor
2628
@Validated
29+
@PreAuthorize("isAuthenticated()")
2730
public class NotificationController {
2831

2932
/**
@@ -59,11 +62,12 @@ public SseEmitter subscribe() {
5962
@GetMapping("/notifications")
6063
@Operation(summary = "알림 목록 조회", description = "무한스크롤(nextCreatedAt, nextId) 기반 최신순 조회. limit 1~100")
6164
public RsData<NotificationListResponseDto> getNotifications(
62-
@AuthenticationPrincipal(expression = "id") Long userId,
65+
@AuthenticationPrincipal SecurityUser principal,
6366
@RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE_TIME) LocalDateTime lastCreatedAt,
6467
@RequestParam(required = false) Long lastId,
6568
@RequestParam(defaultValue = "20") @Min(1) @Max(100) int limit
6669
) {
70+
Long userId = principal.getId();
6771
NotificationListResponseDto body = notificationService.getNotifications(userId, lastCreatedAt, lastId, limit);
6872
return RsData.successOf(body);
6973
}
@@ -77,8 +81,9 @@ public RsData<NotificationListResponseDto> getNotifications(
7781
@GetMapping("/notification-setting")
7882
@Operation(summary = "알림 설정 조회", description = "사용자 알림 on/off 상태 조회. 미생성 시 기본 true 반환")
7983
public RsData<NotificationSettingDto> getMyNotificationSetting(
80-
@AuthenticationPrincipal(expression = "id") Long userId
84+
@AuthenticationPrincipal SecurityUser principal
8185
) {
86+
Long userId = principal.getId();
8287
NotificationSettingDto body = notificationSettingService.getMySetting(userId);
8388
return RsData.successOf(body);
8489
}
@@ -93,9 +98,10 @@ public RsData<NotificationSettingDto> getMyNotificationSetting(
9398
@PatchMapping("/notification-setting")
9499
@Operation(summary = "알림 설정 변경", description = "enabled 값을 true/false로 설정(멱등)")
95100
public RsData<NotificationSettingDto> setMyNotificationSetting(
96-
@AuthenticationPrincipal(expression = "id") Long userId,
101+
@AuthenticationPrincipal SecurityUser principal,
97102
@Valid @RequestBody NotificationSettingUpdateRequestDto req
98103
) {
104+
Long userId = principal.getId();
99105
NotificationSettingDto body = notificationSettingService.setMySetting(userId, req.enabled());
100106
return RsData.successOf(body);
101107
}
@@ -110,9 +116,10 @@ public RsData<NotificationSettingDto> setMyNotificationSetting(
110116
@PostMapping("/notifications/{id}")
111117
@Operation(summary = "읽음 처리 후 이동 정보", description = "알림을 읽음 처리하고 해당 게시글 ID와 API URL 반환")
112118
public RsData<NotificationGoResponseDto> goPostLink(
113-
@AuthenticationPrincipal(expression = "id") Long userId,
119+
@AuthenticationPrincipal SecurityUser principal,
114120
@PathVariable("id") Long notificationId
115121
) {
122+
Long userId = principal.getId();
116123
var body = notificationService.markAsReadAndGetPostLink(userId, notificationId);
117124
return RsData.successOf(body);
118125
}

‎src/main/java/com/back/domain/profile/controller/ProfileController.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,18 @@
55
import com.back.domain.profile.service.ProfileService;
66
import com.back.domain.user.service.UserService;
77
import com.back.global.rsData.RsData;
8+
import com.back.global.security.SecurityUser;
89
import jakarta.validation.Valid;
910
import io.swagger.v3.oas.annotations.Operation;
1011
import lombok.RequiredArgsConstructor;
12+
import org.springframework.security.access.prepost.PreAuthorize;
1113
import org.springframework.security.core.annotation.AuthenticationPrincipal;
1214
import org.springframework.web.bind.annotation.*;
1315

1416
@RestController
1517
@RequestMapping("/me/profile")
1618
@RequiredArgsConstructor
19+
@PreAuthorize("isAuthenticated()")
1720
public class ProfileController {
1821

1922
/**
@@ -33,7 +36,8 @@ public class ProfileController {
3336
@GetMapping
3437
@Operation(summary = "내 프로필 요약 조회",
3538
description = "닉네임, 알콜도수(등급/라벨), 작성/댓글/좋아요 카운트를 반환")
36-
public RsData<ProfileResponseDto> getProfile(@AuthenticationPrincipal(expression = "id") Long userId) {
39+
public RsData<ProfileResponseDto> getProfile(@AuthenticationPrincipal SecurityUser principal) {
40+
Long userId = principal.getId();
3741
ProfileResponseDto body = profileService.getProfile(userId);
3842
return RsData.successOf(body); // code=200, message="success"
3943
}
@@ -50,9 +54,10 @@ public RsData<ProfileResponseDto> getProfile(@AuthenticationPrincipal(expression
5054
@PatchMapping
5155
@Operation(summary = "프로필 수정(닉네임)", description = "닉네임은 1~10자, 중복 불가")
5256
public RsData<ProfileResponseDto> patchNickname(
53-
@AuthenticationPrincipal(expression = "id") Long userId,
57+
@AuthenticationPrincipal SecurityUser principal,
5458
@Valid @RequestBody ProfileUpdateRequestDto request
5559
) {
60+
Long userId = principal.getId();
5661
ProfileResponseDto body = profileService.updateProfile(userId, request);
5762
return RsData.successOf(body);
5863
}

‎src/main/java/com/back/global/security/SecurityConfig.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
import org.springframework.beans.factory.annotation.Value;
44
import org.springframework.context.annotation.Bean;
55
import org.springframework.context.annotation.Configuration;
6+
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
67
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
78
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
89
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
@@ -17,6 +18,7 @@
1718

1819
@Configuration
1920
@EnableWebSecurity
21+
@EnableMethodSecurity
2022
public class SecurityConfig {
2123

2224
@Value("${custom.site.frontUrl}")

0 commit comments

Comments
 (0)