2단계 - 인가(Authorization) 리뷰 요청 드립니다.

src/main/java/nextstep/app/SecurityConfig.java

@@ -5,19 +5,28 @@
 import nextstep.security.authentication.AuthenticationException;
 import nextstep.security.authentication.BasicAuthenticationFilter;
 import nextstep.security.authentication.UsernamePasswordAuthenticationFilter;
-import nextstep.security.authorization.CheckAuthenticationFilter;
-import nextstep.security.authorization.SecuredAspect;
-import nextstep.security.authorization.SecuredMethodInterceptor;
+import nextstep.security.authorization.AuthenticatedAuthorizationManager;
+import nextstep.security.authorization.AuthorityAuthorizationManager;
+import nextstep.security.authorization.AuthorizationFilter;
+import nextstep.security.authorization.AuthorizationManagerBeforeMethodInterceptor;
+import nextstep.security.authorization.AuthenticatedAuthorizationStrategy;
+import nextstep.security.authorization.PermitAllAuthorizationManager;
+import nextstep.security.authorization.RequestMatcherDelegatingAuthorizationManager;
+import nextstep.security.authorization.SecuredAuthorizationManager;
 import nextstep.security.config.DefaultSecurityFilterChain;
 import nextstep.security.config.DelegatingFilterProxy;
 import nextstep.security.config.FilterChainProxy;
 import nextstep.security.config.SecurityFilterChain;
 import nextstep.security.context.SecurityContextHolderFilter;
 import nextstep.security.userdetails.UserDetails;
 import nextstep.security.userdetails.UserDetailsService;
+import nextstep.security.util.AnyRequestMatcher;
+import nextstep.security.util.MvcRequestMatcher;
+import nextstep.security.util.RequestMatcherEntry;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.EnableAspectJAutoProxy;
+import org.springframework.http.HttpMethod;
 
 import java.util.List;
 import java.util.Set;
@@ -42,27 +51,32 @@ public FilterChainProxy filterChainProxy(List<SecurityFilterChain> securityFilte
         return new FilterChainProxy(securityFilterChains);
     }
 
-    @Bean
-    public SecuredMethodInterceptor securedMethodInterceptor() {
-        return new SecuredMethodInterceptor();
-    }
-//    @Bean
-//    public SecuredAspect securedAspect() {
-//        return new SecuredAspect();
-//    }
-
     @Bean
     public SecurityFilterChain securityFilterChain() {
         return new DefaultSecurityFilterChain(
                 List.of(
                         new SecurityContextHolderFilter(),
                         new UsernamePasswordAuthenticationFilter(userDetailsService()),
                         new BasicAuthenticationFilter(userDetailsService()),
-                        new CheckAuthenticationFilter()
+                        new AuthorizationFilter(new RequestMatcherDelegatingAuthorizationManager(List.of(
+                                new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/members/me"), new AuthenticatedAuthorizationManager<>(new AuthenticatedAuthorizationStrategy())),
+                                new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/members"), new AuthorityAuthorizationManager<>(Set.of("ADMIN"))),
+                                new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/search"), new PermitAllAuthorizationManager<>()),
+                                new RequestMatcherEntry<>(new AnyRequestMatcher(), new PermitAllAuthorizationManager())
+                        )))
                 )
         );
     }
 
+    @Bean
+    public AuthorizationManagerBeforeMethodInterceptor authorizationManagerBeforeMethodInterceptor() {
+        return new AuthorizationManagerBeforeMethodInterceptor(securedAuthorizationManager());
+    }
+
+    private SecuredAuthorizationManager securedAuthorizationManager() {
+        return new SecuredAuthorizationManager(new AuthorityAuthorizationManager<>(Set.of("ADMIN")));
+    }
+
     @Bean
     public UserDetailsService userDetailsService() {
         return username -> {

src/main/java/nextstep/app/ui/MemberController.java

@@ -2,7 +2,10 @@
 
 import nextstep.app.domain.Member;
 import nextstep.app.domain.MemberRepository;
+import nextstep.security.authentication.Authentication;
+import nextstep.security.authentication.AuthenticationException;
 import nextstep.security.authorization.Secured;
+import nextstep.security.context.SecurityContextHolder;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RestController;
@@ -30,4 +33,18 @@ public ResponseEntity<List<Member>> search() {
         List<Member> members = memberRepository.findAll();
         return ResponseEntity.ok(members);
     }
+
+    @GetMapping("/members/me")
+    public ResponseEntity<Member> me() {
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+        if (authentication == null) {
+            throw new AuthenticationException();
+        }
+
+        String email = authentication.getPrincipal().toString();
+        Member member = memberRepository.findByEmail(email)
+                .orElseThrow(RuntimeException::new);
+
+        return ResponseEntity.ok(member);
+    }
 }

src/main/java/nextstep/security/authentication/BasicAuthenticationFilter.java

@@ -3,6 +3,7 @@
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import nextstep.security.authorization.ForbiddenException;
 import nextstep.security.context.SecurityContext;
 import nextstep.security.context.SecurityContextHolder;
 import nextstep.security.userdetails.UserDetailsService;
@@ -40,8 +41,12 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
             SecurityContextHolder.setContext(context);
 
             filterChain.doFilter(request, response);
-        } catch (Exception e) {
+        } catch (AuthenticationException e) {
             response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+        } catch (ForbiddenException e) {
+            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
+        } catch (Exception e) {
+            response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
         }
     }
 

src/main/java/nextstep/security/authorization/AuthenticatedAuthorizationManager.java

@@ -0,0 +1,18 @@
+package nextstep.security.authorization;
+
+import nextstep.security.authentication.Authentication;
+
+public class AuthenticatedAuthorizationManager<T> implements AuthorizationManager<T> {
+
+    private final AuthorizationStrategy authorizationStrategy;
+
+    public AuthenticatedAuthorizationManager(AuthorizationStrategy authorizationStrategy) {
+        this.authorizationStrategy = authorizationStrategy;
+    }
+
+    @Override
+    public AuthorizationDecision check(Authentication authentication, T object) {
+        var granted = authorizationStrategy.isGranted(authentication);
+        return new AuthorizationDecision(granted);
+    }
+}

src/main/java/nextstep/security/authorization/AuthenticatedAuthorizationStrategy.java

@@ -0,0 +1,15 @@
+package nextstep.security.authorization;
+
+import nextstep.security.authentication.Authentication;
+
+public class AuthenticatedAuthorizationStrategy implements AuthorizationStrategy {
+
+    @Override
+    public boolean isGranted(Authentication authentication) {
+        if (authentication == null) {
+            return false;
+        }
+
+        return authentication.isAuthenticated();
+    }
+}

src/main/java/nextstep/security/authorization/AuthorityAuthorizationManager.java

@@ -0,0 +1,24 @@
+package nextstep.security.authorization;
+
+import nextstep.security.authentication.Authentication;
+
+import java.util.Set;
+
+public class AuthorityAuthorizationManager<T> implements AuthorizationManager<T> {
+
+    private final Set<String> authorities;
+
+    public AuthorityAuthorizationManager(Set<String> authorities) {
+        this.authorities = authorities;
+    }
+
+    @Override
+    public AuthorizationDecision check(Authentication authentication, T object) {
+
+        boolean granted = authentication.getAuthorities()
+                .stream()
+                .anyMatch(authorities::contains);
+
+        return new AuthorizationDecision(granted);
+    }
+}

src/main/java/nextstep/security/authorization/AuthorizationDecision.java

@@ -0,0 +1,14 @@
+package nextstep.security.authorization;
+
+public class AuthorizationDecision {
+
+    private final boolean granted;
+
+    public AuthorizationDecision(boolean granted) {
+        this.granted = granted;
+    }
+
+    public boolean isGranted() {
+        return granted;
+    }
+}

src/main/java/nextstep/security/authorization/CheckAuthenticationFilter.java → src/main/java/nextstep/security/authorization/AuthorizationFilter.java

@@ -8,31 +8,28 @@
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+
 import java.io.IOException;
-import java.util.Set;
 
-public class CheckAuthenticationFilter extends OncePerRequestFilter {
-    private static final String DEFAULT_REQUEST_URI = "/members";
+public class AuthorizationFilter extends OncePerRequestFilter {
+
+    private final AuthorizationManager<HttpServletRequest> authorizationManager;
+
+    public AuthorizationFilter(AuthorizationManager<HttpServletRequest> authorizationManager) {
+        this.authorizationManager = authorizationManager;
+    }
 
     @Override
     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
-        if (!DEFAULT_REQUEST_URI.equals(request.getRequestURI())) {
-            filterChain.doFilter(request, response);
-            return;
-        }
 
         Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
-        if (authentication == null || !authentication.isAuthenticated()) {
-            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
-            return;
-        }
+        AuthorizationDecision decision = this.authorizationManager.check(authentication, request);
 
-        Set<String> authorities = authentication.getAuthorities();
-        if (!authorities.contains("ADMIN")) {
-            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
-            return;
+        if (decision != null && !decision.isGranted()) {
+            throw new ForbiddenException();
         }
 
         filterChain.doFilter(request, response);
+
     }
 }

src/main/java/nextstep/security/authorization/AuthorizationManager.java

@@ -0,0 +1,8 @@
+package nextstep.security.authorization;
+
+import nextstep.security.authentication.Authentication;
+
+@FunctionalInterface
+public interface AuthorizationManager<T> {
+    AuthorizationDecision check(Authentication authentication, T object);
+}

src/main/java/nextstep/security/authorization/AuthorizationManagerBeforeMethodInterceptor.java

@@ -0,0 +1,42 @@
+package nextstep.security.authorization;
+
+import nextstep.security.authentication.Authentication;
+import nextstep.security.context.SecurityContextHolder;
+import org.aopalliance.aop.Advice;
+import org.aopalliance.intercept.MethodInterceptor;
+import org.aopalliance.intercept.MethodInvocation;
+import org.springframework.aop.Pointcut;
+import org.springframework.aop.PointcutAdvisor;
+import org.springframework.aop.support.annotation.AnnotationMatchingPointcut;
+
+public class AuthorizationManagerBeforeMethodInterceptor implements MethodInterceptor, PointcutAdvisor {
+
+    private final AuthorizationManager<MethodInvocation> authorizationManager;
+
+    public AuthorizationManagerBeforeMethodInterceptor(AuthorizationManager<MethodInvocation> authorizationManager) {
+        this.authorizationManager = authorizationManager;
+    }
+
+    @Override
+    public Object invoke(MethodInvocation methodInvocation) throws Throwable {
+
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+        AuthorizationDecision decision = authorizationManager.check(authentication, methodInvocation);
+
+        if (decision != null && !decision.isGranted()) {
+            throw new ForbiddenException();
+        }
+
+        return methodInvocation.proceed();
+    }
+
+    @Override
+    public Pointcut getPointcut() {
+        return new AnnotationMatchingPointcut(null, Secured.class);
+    }
+
+    @Override
+    public Advice getAdvice() {
+        return this;
+    }
+}

src/main/java/nextstep/security/authorization/AuthorizationStrategy.java

@@ -0,0 +1,8 @@
+package nextstep.security.authorization;
+
+import nextstep.security.authentication.Authentication;
+
+public interface AuthorizationStrategy {
+
+    boolean isGranted(Authentication authentication);
+}

src/main/java/nextstep/security/authorization/PermitAllAuthorizationManager.java

@@ -0,0 +1,11 @@
+package nextstep.security.authorization;
+
+import nextstep.security.authentication.Authentication;
+
+public class PermitAllAuthorizationManager<T> implements AuthorizationManager<T> {
+
+    @Override
+    public AuthorizationDecision check(Authentication authentication, T object) {
+        return new AuthorizationDecision(true);
+    }
+}

src/main/java/nextstep/security/authorization/RequestMatcherDelegatingAuthorizationManager.java

@@ -0,0 +1,33 @@
+package nextstep.security.authorization;
+
+import jakarta.servlet.http.HttpServletRequest;
+import nextstep.security.authentication.Authentication;
+import nextstep.security.util.RequestMatcher;
+import nextstep.security.util.RequestMatcherEntry;
+
+import java.util.List;
+
+public class RequestMatcherDelegatingAuthorizationManager implements AuthorizationManager<HttpServletRequest> {
+
+    private final List<RequestMatcherEntry<AuthorizationManager>> mappings;
+
+    public RequestMatcherDelegatingAuthorizationManager(List<RequestMatcherEntry<AuthorizationManager>> mappings) {
+        this.mappings = mappings;
+    }
+
+    @Override
+    public AuthorizationDecision check(Authentication authentication, HttpServletRequest request) {
+
+        for (RequestMatcherEntry<AuthorizationManager> mapping : this.mappings) {
+            RequestMatcher matcher = mapping.getRequestMatcher();
+            RequestMatcher.MatchResult matchResult = matcher.matcher(request);
+            if (matchResult.isMatch()) {
+                AuthorizationManager manager = mapping.getEntry();
+
+                return manager.check(authentication, request);
+            }
+        }
+
+        return new AuthorizationDecision(false);
+    }
+}