[hoony-lab-issue23] authentication: jwt token 기능

build.gradle

@@ -15,12 +15,22 @@ repositories {
 
 dependencies {
     implementation 'org.springframework.boot:spring-boot-starter-web'
+
     implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
+
     implementation 'org.springframework.boot:spring-boot-starter-security'
+
     implementation 'org.projectlombok:lombok'
     annotationProcessor 'org.projectlombok:lombok'
     testAnnotationProcessor 'org.projectlombok:lombok'
+
+    implementation 'io.jsonwebtoken:jjwt:0.9.1'
+    implementation 'io.jsonwebtoken:jjwt-api:0.11.2'
+    runtimeOnly 'io.jsonwebtoken:jjwt-impl:0.11.2'
+    runtimeOnly 'io.jsonwebtoken:jjwt-jackson:0.11.2'
+
     runtimeOnly 'com.h2database:h2'
+
     testImplementation 'org.springframework.boot:spring-boot-starter-test'
 }
 

src/main/java/com/study/realworld/config/SecurityConfig.java

@@ -1,29 +1,42 @@
 package com.study.realworld.config;
 
+import com.study.realworld.config.auth.JwtAuthenticationFilter;
 import lombok.RequiredArgsConstructor;
 import org.springframework.context.annotation.Bean;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 
+@RequiredArgsConstructor
 @EnableWebSecurity
 public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
+    private final JwtAuthenticationFilter jwtAuthenticationFilter;
+
     @Override
     protected void configure(HttpSecurity http) throws Exception {
         http
+                .formLogin().disable()
                 .csrf().disable()
                 .headers().frameOptions().disable()
                 .and()
-                    .authorizeRequests()
-                    .antMatchers("/api/hello", "/h2-console/**").permitAll()
-                    .antMatchers("/api/users/**", "/api/users/login/**").permitAll()
-                    .antMatchers("/api/articles/**").permitAll()
-                    .antMatchers("/api/tags/**").permitAll()
-                    .antMatchers("/error").permitAll()
-                    .anyRequest().authenticated();
+                .authorizeRequests()
+                .antMatchers("/api/hello", "/h2-console/**").permitAll()
+                .antMatchers("/api/users/**", "/api/users/login/**").permitAll()
+                .antMatchers("/api/articles/**").permitAll()
+                .antMatchers("/api/tags/**").permitAll()
+                .antMatchers("/error").permitAll()
+                .anyRequest().authenticated()
+                .and()
+                .sessionManagement()
+                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+                .and()
+                .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
+        ;
     }
 
     @Bean

src/main/java/com/study/realworld/config/auth/JwtAuthenticationFilter.java

@@ -0,0 +1,44 @@
+package com.study.realworld.config.auth;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpHeaders;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.Collections;
+
+@Slf4j
+@RequiredArgsConstructor
+@Component
+public class JwtAuthenticationFilter extends OncePerRequestFilter {
+
+    private final JwtProvider jwtProvider;
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
+        log.info("{} {} : {}", request.getMethod(), request.getRequestURI(), request.getHeader(HttpHeaders.AUTHORIZATION));
+        String header = request.getHeader(HttpHeaders.AUTHORIZATION);
+
+        if(header != null) {
+            String accessToken = header.split(" ")[1];
+
+            if(jwtProvider.isValidToken(accessToken)) {
+                String email = jwtProvider.getSubjectFromToken(accessToken);
+                final UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(email, accessToken, Collections.emptyList());
+
+                SecurityContextHolder.getContext().setAuthentication(authentication);
+            }
+        }
+
+        filterChain.doFilter(request, response);
+    }
+
+}

src/main/java/com/study/realworld/config/auth/JwtProvider.java

@@ -0,0 +1,66 @@
+package com.study.realworld.config.auth;
+
+import com.study.realworld.user.domain.User;
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.JwtException;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.SignatureAlgorithm;
+import org.springframework.stereotype.Component;
+
+import javax.crypto.spec.SecretKeySpec;
+import javax.xml.bind.DatatypeConverter;
+import java.security.Key;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
+
+@Component
+public class JwtProvider {
+
+    private static final String SECRET_KEY = "real-world-with-hoony-lab";
+    private static final int ACCESS_TIME = 30;
+
+    public String generateJwtToken(User user) {
+        return Jwts.builder()
+                .setSubject(user.getEmail())
+                .setHeader(createHeader())
+                .setIssuedAt(new Date(System.currentTimeMillis()))
+                .setExpiration(new Date(System.currentTimeMillis() + 1000 * ACCESS_TIME))
+                .signWith(SignatureAlgorithm.HS512, createKey())
+                .compact();
+    }
+
+    public Claims getClaimsFromToken(String token) {
+        return Jwts.parser()
+                .setSigningKey(DatatypeConverter.parseBase64Binary(SECRET_KEY))
+                .parseClaimsJws(token)
+                .getBody();
+    }
+
+    public String getSubjectFromToken(String token) {
+        return this.getClaimsFromToken(token)
+                .getSubject();
+    }
+
+    public boolean isValidToken(String token) {
+        try {
+            Claims claims = this.getClaimsFromToken(token);
+            return true;
+        } catch (JwtException | NullPointerException e) {
+            return false;
+        }
+    }
+
+    private Map<String, Object> createHeader() {
+        Map<String, Object> header = new HashMap<>();
+        header.put("alg", "HS512");
+        header.put("typ", "JWT");
+        return header;
+    }
+
+    private Key createKey() {
+        byte[] secretKeyBytes = DatatypeConverter.parseBase64Binary(SECRET_KEY);
+        return new SecretKeySpec(secretKeyBytes, SignatureAlgorithm.HS512.getJcaName());
+    }
+
+}

src/main/java/com/study/realworld/user/service/UserService.java

@@ -8,54 +8,55 @@
 import org.springframework.dao.DuplicateKeyException;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Propagation;
 import org.springframework.transaction.annotation.Transactional;
 
 import java.util.List;
 import java.util.NoSuchElementException;
 
 @RequiredArgsConstructor
-@Transactional
+@Transactional(readOnly = true)
 @Service
 public class UserService {
 
     private final PasswordEncoder passwordEncoder;
     private final UserRepository userRepository;
 
-    @Transactional(readOnly = true)
     public List<User> findAll() {
         return userRepository.findAll();
     }
 
-    @Transactional(readOnly = true)
     public User findById(Long id) {
         return userRepository.findById(id)
                 .orElseThrow(() -> new NoSuchElementException(id + " not found"));
     }
 
-    @Transactional(readOnly = true)
     public User findByEmail(String email) {
         return userRepository.findByEmail(email)
                 .orElseThrow(() -> new NoSuchElementException(email + " not found"));
     }
 
+    @Transactional(propagation = Propagation.NEVER)
     public User save(UserJoinRequest request) {
         User user = UserJoinRequest.toUser(request);
         user.encodePassword(passwordEncoder);
 
+        validateDuplicateUser(user);
+
         return userRepository.save(user);
     }
 
+    @Transactional
     public User deleteById(Long id) {
-        User user = userRepository.findById(id)
-                .orElseThrow(() -> new NoSuchElementException(id + " not found"));
+        User user = this.findById(id);
 
         userRepository.delete(user);
         return user;
     }
 
-    @Transactional(readOnly = true)
     public User login(UserLoginRequest request) {
         User user = this.findByEmail(request.getEmail());
+
         validateMatchesPassword(user, request.getPassword());
 
         return user;
@@ -67,4 +68,10 @@ private void validateMatchesPassword(User user, String rawPassword) {
         }
     }
 
+    private void validateDuplicateUser(User user) {
+        if(userRepository.findByEmail(user.getEmail()).isPresent()) {
+            throw new DuplicateKeyException(user.getEmail() + " duplicated email");
+        }
+    }
+
 }

src/main/java/com/study/realworld/user/web/UserController.java

@@ -1,38 +1,56 @@
 package com.study.realworld.user.web;
 
+import com.study.realworld.config.auth.JwtProvider;
 import com.study.realworld.user.domain.User;
 import com.study.realworld.user.dto.UserJoinRequest;
 import com.study.realworld.user.dto.UserLoginRequest;
 import com.study.realworld.user.dto.UserResponse;
 import com.study.realworld.user.service.UserService;
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpHeaders;
 import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.web.bind.annotation.*;
 
+import javax.servlet.http.HttpServletRequest;
+
+@Slf4j
 @RequiredArgsConstructor
 @RequestMapping("/api")
 @RestController
 public class UserController {
 
+    private final JwtProvider jwtProvider;
     private final UserService userService;
 
     @PostMapping("/users")
     public ResponseEntity<UserResponse> joinUser(@RequestBody UserJoinRequest request) {
         User user = userService.save(request);
-        String token = null;
 
-        return ResponseEntity.ok().body(UserResponse.of(user, token));
+        return ResponseEntity.ok()
+                .body(UserResponse.of(user, "token"));
     }
 
     @PostMapping("/users/login")
     public ResponseEntity<UserResponse> loginUser(@RequestBody UserLoginRequest request) {
         User user = userService.login(request);
-        String token = null;
+        String token = jwtProvider.generateJwtToken(user);
+
+        return ResponseEntity.ok()
+                .header(HttpHeaders.AUTHORIZATION, "Bearer " + token)
+                .body(UserResponse.of(user, token));
+    }
+
+    @GetMapping("/user")
+    public ResponseEntity<UserResponse> getUser(HttpServletRequest servletRequest) {
+        String email = (String) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
+        User user = userService.findByEmail(email);
+        String token = servletRequest.getHeader(HttpHeaders.AUTHORIZATION).split(" ")[1];
 
-        return ResponseEntity.ok().body(UserResponse.of(user, token));
+        return ResponseEntity.ok()
+                .body(UserResponse.of(user, token));
     }
 
 }

src/test/java/com/study/realworld/config/auth/JwtAuthenticationFilterTest.java

@@ -0,0 +1,69 @@
+package com.study.realworld.config.auth;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.HttpHeaders;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.context.SecurityContextHolder;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class JwtAuthenticationFilterTest {
+
+    private static final String EMAIL = "email";
+    private static final String TOKEN = "token";
+
+    @Mock
+    private HttpServletRequest request;
+
+    @Mock
+    private HttpServletResponse response;
+
+    @Mock
+    private FilterChain filterChain;
+
+    @Mock
+    private JwtProvider jwtProvider;
+
+    @InjectMocks
+    private JwtAuthenticationFilter jwtAuthenticationFilter;
+
+    @BeforeEach
+    void beforeEach() {
+        SecurityContextHolder.clearContext();
+    }
+
+    @Test
+    void doFilterInternal() throws ServletException, IOException {
+        // given
+        when(request.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn("Bearer token");
+        when(jwtProvider.isValidToken(anyString())).thenReturn(true);
+        when(jwtProvider.getSubjectFromToken(anyString())).thenReturn(EMAIL);
+
+        jwtAuthenticationFilter.doFilterInternal(request, response, filterChain);
+
+        // when
+        UsernamePasswordAuthenticationToken authentication =
+                (UsernamePasswordAuthenticationToken) SecurityContextHolder.getContext().getAuthentication();
+
+        // then
+        assertThat(authentication).isNotNull();
+        assertThat(authentication.getPrincipal()).isEqualTo(EMAIL);
+        assertThat(authentication.getCredentials()).isEqualTo(TOKEN);
+    }
+
+}