[step2] 리팩터링

src/main/java/nextstep/app/config/AuthConfig.java

@@ -2,8 +2,9 @@
 
 import nextstep.security.access.matcher.MvcRequestMatcher;
 import nextstep.security.authentication.*;
-import nextstep.security.authorization.LoginAuthorizationFilter;
+import nextstep.security.authorization.SessionAuthorizationFilter;
 import nextstep.security.authorization.RoleAuthorizationFilter;
+import nextstep.security.config.AuthorizeRequestMatcherRegistry;
 import nextstep.security.config.DefaultSecurityFilterChain;
 import nextstep.security.config.FilterChainProxy;
 import nextstep.security.config.SecurityFilterChain;
@@ -29,6 +30,15 @@ public AuthConfig(UserDetailsService userDetailsService) {
         this.userDetailsService = userDetailsService;
     }
 
+    @Bean
+    public AuthorizeRequestMatcherRegistry requestMatcherRegistryMapping() {
+        AuthorizeRequestMatcherRegistry requestMatcherRegistry = new AuthorizeRequestMatcherRegistry();
+        requestMatcherRegistry
+                .matcher(new MvcRequestMatcher(HttpMethod.GET, "/members")).hasAuthority("ADMIN")
+                .matcher(new MvcRequestMatcher(HttpMethod.GET, "/members/me")).authenticated();
+        return requestMatcherRegistry;
+    }
+
     @Bean
     public DelegatingFilterProxy securityFilterChainProxy() {
         return new DelegatingFilterProxy("filterChainProxy");
@@ -50,8 +60,8 @@ public SecurityFilterChain loginSecurityFilterChain() {
     public SecurityFilterChain membersSecurityFilterChain() {
         List<Filter> filters = new ArrayList<>();
         filters.add(new BasicAuthenticationFilter(authenticationManager()));
-        filters.add(new LoginAuthorizationFilter(securityContextRepository()));
-        filters.add(new RoleAuthorizationFilter());
+        filters.add(new SessionAuthorizationFilter(securityContextRepository(), requestMatcherRegistryMapping()));
+        filters.add(new RoleAuthorizationFilter(requestMatcherRegistryMapping()));
         return new DefaultSecurityFilterChain(new MvcRequestMatcher(HttpMethod.GET, "/members"), filters);
     }
 
@@ -64,5 +74,4 @@ public SecurityContextRepository securityContextRepository() {
     public AuthenticationManager authenticationManager() {
         return new AuthenticationManager(new UsernamePasswordAuthenticationProvider(userDetailsService));
     }
-
 }

src/main/java/nextstep/app/ui/MemberController.java

@@ -25,4 +25,11 @@ public ResponseEntity<List<Member>> list() {
         return ResponseEntity.ok(members);
     }
 
+    @GetMapping("/members/me")
+    public ResponseEntity<Member> me() {
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+        String email = authentication.getPrincipal().toString();
+        Member member = memberRepository.findByEmail(email).orElseThrow();
+        return ResponseEntity.ok(member);
+    }
 }

src/main/java/nextstep/security/access/matcher/MvcRequestMatcher.java

@@ -28,6 +28,6 @@ public boolean matches(HttpServletRequest request) {
             return false;
         }
 
-        return request.getRequestURI().contains(pattern);
+        return request.getRequestURI().contains(pattern) || request.getRequestURI().startsWith(pattern);
     }
 }

src/main/java/nextstep/security/authorization/RoleAuthorizationFilter.java

@@ -1,10 +1,9 @@
 package nextstep.security.authorization;
 
-import nextstep.security.access.matcher.MvcRequestMatcher;
 import nextstep.security.authentication.Authentication;
+import nextstep.security.config.AuthorizeRequestMatcherRegistry;
 import nextstep.security.context.SecurityContextHolder;
 import nextstep.security.exception.AuthenticationException;
-import org.springframework.http.HttpMethod;
 import org.springframework.http.HttpStatus;
 import org.springframework.web.filter.GenericFilterBean;
 
@@ -17,22 +16,22 @@
 import java.io.IOException;
 
 public class RoleAuthorizationFilter extends GenericFilterBean {
-    private static final MvcRequestMatcher DEFAULT_REQUEST_MATCHER = new MvcRequestMatcher(HttpMethod.GET,
-            "/members");
-
     private static final String ADMIN_ROLE = "ADMIN";
 
+    private final AuthorizeRequestMatcherRegistry requestMatcherRegistry;
+
+    public RoleAuthorizationFilter(AuthorizeRequestMatcherRegistry requestMatcherRegistry) {
+        this.requestMatcherRegistry = requestMatcherRegistry;
+    }
+
     @Override
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
         try {
-            if (!DEFAULT_REQUEST_MATCHER.matches((HttpServletRequest) request)) {
-                chain.doFilter(request, response);
-                return;
-            }
-
+            String attribute = requestMatcherRegistry.getAttribute((HttpServletRequest) request);
             Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+            boolean isAuthorized = requestMatcherRegistry.isAuthorized(attribute, authentication);
 
-            if (!authentication.getAuthorities().contains(ADMIN_ROLE)) {
+            if (!isAuthorized) {
                 ((HttpServletResponse) response).sendError(HttpStatus.FORBIDDEN.value(), HttpStatus.FORBIDDEN.getReasonPhrase());
                 return;
             }

src/main/java/nextstep/security/authorization/LoginAuthorizationFilter.java → src/main/java/nextstep/security/authorization/SessionAuthorizationFilter.java

@@ -1,11 +1,10 @@
 package nextstep.security.authorization;
 
-import nextstep.security.access.matcher.MvcRequestMatcher;
+import nextstep.security.config.AuthorizeRequestMatcherRegistry;
 import nextstep.security.context.SecurityContext;
 import nextstep.security.context.SecurityContextHolder;
 import nextstep.security.context.SecurityContextRepository;
 import nextstep.security.exception.AuthenticationException;
-import org.springframework.http.HttpMethod;
 import org.springframework.http.HttpStatus;
 import org.springframework.web.filter.GenericFilterBean;
 
@@ -17,33 +16,33 @@
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 
-public class LoginAuthorizationFilter extends GenericFilterBean {
-    private static final MvcRequestMatcher DEFAULT_REQUEST_MATCHER = new MvcRequestMatcher(HttpMethod.GET,
-            "/members");
+public class SessionAuthorizationFilter extends GenericFilterBean {
 
     private final SecurityContextRepository securityContextRepository;
 
-    public LoginAuthorizationFilter(SecurityContextRepository securityContextRepository) {
+    private final AuthorizeRequestMatcherRegistry requestMatcherRegistry;
+
+    public SessionAuthorizationFilter(SecurityContextRepository securityContextRepository, AuthorizeRequestMatcherRegistry requestMatcherRegistry) {
         this.securityContextRepository = securityContextRepository;
+        this.requestMatcherRegistry = requestMatcherRegistry;
     }
 
     @Override
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
         try {
-            if (!DEFAULT_REQUEST_MATCHER.matches((HttpServletRequest) request)) {
-                chain.doFilter(request, response);
-                return;
-            }
-
+            String attribute = requestMatcherRegistry.getAttribute((HttpServletRequest) request);
             SecurityContext loadedContext = securityContextRepository.loadContext((HttpServletRequest) request);
             if (loadedContext == null) {
                 ((HttpServletResponse) response).sendError(HttpStatus.FORBIDDEN.value(), HttpStatus.FORBIDDEN.getReasonPhrase());
                 return;
             }
+            boolean isAuthorized = requestMatcherRegistry.isAuthorized(attribute, loadedContext.getAuthentication());
 
-            SecurityContext context = SecurityContextHolder.createEmptyContext();
-            context.setAuthentication(loadedContext.getAuthentication());
-            SecurityContextHolder.setContext(context);
+            if (isAuthorized) {
+                SecurityContext context = SecurityContextHolder.createEmptyContext();
+                context.setAuthentication(loadedContext.getAuthentication());
+                SecurityContextHolder.setContext(context);
+            }
         } catch (AuthenticationException e) {
             ((HttpServletResponse) response).sendError(HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.getReasonPhrase());
             return;

src/main/java/nextstep/security/config/AuthorizeRequestMatcherRegistry.java

@@ -0,0 +1,82 @@
+package nextstep.security.config;
+
+import nextstep.security.access.matcher.RequestMatcher;
+import nextstep.security.authentication.Authentication;
+
+import javax.servlet.http.HttpServletRequest;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+public class AuthorizeRequestMatcherRegistry {
+    private final Map<RequestMatcher, String> mappings = new HashMap<>();
+
+    public AuthorizedUrl matcher(RequestMatcher requestMatcher) {
+        return new AuthorizedUrl(requestMatcher);
+    }
+
+    AuthorizeRequestMatcherRegistry addMapping(RequestMatcher requestMatcher, String attributes) {
+        mappings.put(requestMatcher, attributes);
+        return this;
+    }
+
+    public String getAttribute(HttpServletRequest request) {
+        for (Map.Entry<RequestMatcher, String> entry : mappings.entrySet()) {
+            if (entry.getKey().matches(request)) {
+                return entry.getValue();
+            }
+        }
+
+        return null;
+    }
+
+    public class AuthorizedUrl {
+        public static final String PERMIT_ALL = "permitAll";
+        public static final String DENY_ALL = "denyAll";
+        public static final String AUTHENTICATED = "authenticated";
+        public static final String AUTHORITY = "hasAuthority";
+
+        private final RequestMatcher requestMatcher;
+
+        public AuthorizedUrl(RequestMatcher requestMatcher) {
+            this.requestMatcher = requestMatcher;
+        }
+
+        public AuthorizeRequestMatcherRegistry permitAll() {
+            return access(PERMIT_ALL);
+        }
+
+        public AuthorizeRequestMatcherRegistry denyAll() {
+            return access(DENY_ALL);
+        }
+
+        public AuthorizeRequestMatcherRegistry hasAuthority(String authority) {
+            return access(AUTHORITY + "(" + authority + ")");
+        }
+
+        public AuthorizeRequestMatcherRegistry authenticated() {
+            return access(AUTHENTICATED);
+        }
+
+        private AuthorizeRequestMatcherRegistry access(String attribute) {
+            return addMapping(requestMatcher, attribute);
+        }
+    }
+
+    public Boolean isAuthorized(String attribute, Authentication authentication) {
+        if (attribute.contains(AuthorizedUrl.AUTHORITY)) {
+            Pattern pattern = Pattern.compile("\\((.*?)\\)");
+            Matcher matcher = pattern.matcher(attribute);
+            if(matcher.find()) {
+                String role = matcher.group(1).trim();
+                return authentication.getAuthorities().contains(role);
+            }
+        } else if (attribute.contains(AuthorizedUrl.AUTHENTICATED)) {
+            return authentication.isAuthenticated();
+        }
+
+        return false;
+    }
+
+}

src/test/java/nextstep/app/MemberAcceptanceTest.java

@@ -24,36 +24,86 @@ void get_members_after_form_login() {
         params.put("username", TEST_MEMBER.getEmail());
         params.put("password", TEST_MEMBER.getPassword());
 
-        ExtractableResponse<Response> loginResponse = RestAssured.given().log().all()
-                .formParams(params)
-                .contentType(MediaType.APPLICATION_FORM_URLENCODED_VALUE)
-                .when()
-                .post("/login")
-                .then().log().all()
-                .extract();
+        ExtractableResponse<Response> loginResponse = requestLogin(params);
+
+        ExtractableResponse<Response> memberResponse = requestMembers(loginResponse);
 
+        assertThat(memberResponse.statusCode()).isEqualTo(HttpStatus.OK.value());
+        List<Member> members = memberResponse.jsonPath().getList(".", Member.class);
+        assertThat(members.size()).isEqualTo(2);
+    }
+
+    @Test
+    void get_members_before_form_login() {
         ExtractableResponse<Response> memberResponse = RestAssured.given().log().all()
-                .cookies(loginResponse.cookies())
                 .contentType(MediaType.APPLICATION_JSON_VALUE)
                 .when()
                 .get("/members")
                 .then().log().all()
                 .extract();
 
+        assertThat(memberResponse.statusCode()).isEqualTo(HttpStatus.FORBIDDEN.value());
+    }
+
+    @Test
+    void get_members_me_after_form_login() {
+        Map<String, String> params = new HashMap<>();
+        params.put("username", TEST_MEMBER.getEmail());
+        params.put("password", TEST_MEMBER.getPassword());
+
+        ExtractableResponse<Response> loginResponse = requestLogin(params);
+
+        ExtractableResponse<Response> memberResponse = requestMembersMe(loginResponse);
+
         assertThat(memberResponse.statusCode()).isEqualTo(HttpStatus.OK.value());
-        List<Member> members = memberResponse.jsonPath().getList(".", Member.class);
-        assertThat(members.size()).isEqualTo(2);
+        assertThat(memberResponse.jsonPath().getString("email")).isEqualTo(TEST_MEMBER.getEmail());
     }
 
     @Test
-    void get_members_before_form_login() {
+    void get_members_me_before_form_login() {
+        ExtractableResponse<Response> memberResponse = requestMembersMe(null);
+
+        assertThat(memberResponse.statusCode()).isEqualTo(HttpStatus.FORBIDDEN.value());
+    }
+
+    private static ExtractableResponse<Response> requestLogin(Map<String, String> params) {
+        ExtractableResponse<Response> loginResponse = RestAssured.given().log().all()
+                .formParams(params)
+                .contentType(MediaType.APPLICATION_FORM_URLENCODED_VALUE)
+                .when()
+                .post("/login")
+                .then().log().all()
+                .extract();
+        return loginResponse;
+    }
+
+    private static ExtractableResponse<Response> requestMembers(ExtractableResponse<Response> loginResponse) {
         ExtractableResponse<Response> memberResponse = RestAssured.given().log().all()
+                .cookies(loginResponse.cookies())
                 .contentType(MediaType.APPLICATION_JSON_VALUE)
                 .when()
                 .get("/members")
                 .then().log().all()
                 .extract();
+        return memberResponse;
+    }
 
-        assertThat(memberResponse.statusCode()).isEqualTo(HttpStatus.FORBIDDEN.value());
+    private static ExtractableResponse<Response> requestMembersMe(ExtractableResponse<Response> loginResponse) {
+        if (loginResponse == null) {
+            return RestAssured.given().log().all()
+                    .contentType(MediaType.APPLICATION_JSON_VALUE)
+                    .when()
+                    .get("/members/me")
+                    .then().log().all()
+                    .extract();
+        } else {
+            return RestAssured.given().log().all()
+                    .contentType(MediaType.APPLICATION_JSON_VALUE)
+                    .cookies(loginResponse.cookies())
+                    .when()
+                    .get("/members/me")
+                    .then().log().all()
+                    .extract();
+        }
     }
 }