psychology50 / springstudy Goto Github PK

@Log4j2
public class CustomAccessDeniedHandler implements AccessDeniedHandler {
//    private String errorPage;
//    public void setErrorPage(String errorPage) {
//        this.errorPage = errorPage;
//    }


    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
        String accessDeniedUrl = (String) request.getSession().getAttribute("accessDeniedUrl");
        if (accessDeniedUrl != null) {
            log.info("accessDeniedUrl : {}", accessDeniedUrl);
            log.info("accessDeniedException : {}", accessDeniedException.getMessage());
            log.info("request method : {}", request.getMethod());

//            response.sendRedirect(accessDeniedUrl + "?exception=" + accessDeniedException.getMessage()); // 저장된 API 주소로 리다이렉트
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.setContentType("application/json");
            response.setCharacterEncoding("UTF-8");

            PrintWriter writer = response.getWriter();
            writer.write("{\"error\": \"" + accessDeniedException.getMessage() + "\"}");
            writer.flush();

        } else {
            response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied");
        }

//        String deniedUrl = errorPage + "?exception=" + accessDeniedException.getMessage();
//        response.sendRedirect(deniedUrl);
    }
}

public class CustomSecurityExpressionHandler extends DefaultMethodSecurityExpressionHandler {
    private ApplicationContext applicationContext;
    private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();

    @Override
    protected MethodSecurityExpressionOperations createSecurityExpressionRoot(
            Authentication authentication, MethodInvocation invocation
    ) {
        CustomMethodSecurityExpressionRoot root = new CustomMethodSecurityExpressionRoot(authentication);
        root.setThis(invocation.getThis());
        root.setPermissionEvaluator(getPermissionEvaluator());
        root.setTrustResolver(this.trustResolver);
//        root.setRoleHierarchy(getRoleHierarchy());
        root.setReturnObject(invocation.getThis());
        return root;
    }

    @Override
    public void setApplicationContext(ApplicationContext applicationContext) {
        super.setApplicationContext(applicationContext);
        this.applicationContext = applicationContext;
    }
}

@Service("securityService")
@RequiredArgsConstructor
@Log4j2
public class SecurityService {

    private final UserSearchService userSearchService;
    private final Logger logger = Logger.getLogger(SecurityService.class.getName());
    Authentication authentication;
    ServletRequestAttributes attributes;

    public boolean isLeader(Long group_id) {
        authentication = SecurityContextHolder.getContext().getAuthentication();
        User user = userSearchService.findUserById(((User) authentication.getPrincipal()).getUser_id()).orElseThrow(()
            -> new RuntimeException("해당 유저를 찾을 수 없습니다."));
        log.info("isLeader = {}", user);

        boolean is_leader = user.getIs_leader().stream().anyMatch(group -> group.getGroup_id().equals(group_id));

        if (!is_leader)
            exception_handling();
        return is_leader;
    }

    public boolean isMember(Long group_id) {
        authentication = SecurityContextHolder.getContext().getAuthentication();
        User user = userSearchService.findUserById(((User) authentication.getPrincipal()).getUser_id()).orElseThrow(()
                -> new RuntimeException("해당 유저를 찾을 수 없습니다."));
        log.info("isMember = {}", user);

        boolean is_member = user.getMembers().stream().anyMatch(member -> member.getGroup().getGroup_id().equals(group_id));

        if (!is_member)
            exception_handling();
        return is_member;
    }

    public boolean isPayer(Long receipt_id) {
        authentication = SecurityContextHolder.getContext().getAuthentication();
        User user = userSearchService.findUserById(((User) authentication.getPrincipal()).getUser_id()).orElseThrow(()
                -> new RuntimeException("해당 유저를 찾을 수 없습니다."));
        log.info("isPayer = {}", user);

        boolean is_payer = user.getPay_receipts().stream().anyMatch(receipt -> receipt.getReceipt_id().equals(receipt_id));

        if (!is_payer)
            exception_handling();
        return is_payer;
    }

    private void exception_handling() {
        attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
        if (attributes != null) {
//                String currentUrl = attributes.getRequest().getRequestURI();
//                String currentUrl = attributes.getRequest().getRequestURL().toString();
            // XXX: 신뢰할 수 없는 url. 좋지 않다.
            String currentUrl = attributes.getRequest().getHeader("referer");
            attributes.getRequest().getSession().setAttribute("accessDeniedUrl", currentUrl);
        }
        log.info("attributes = {}", attributes);

        throw new AccessDeniedException("You do not have permission to access this resource.");
    }
}

    @DeleteMapping("/{receipt_id}/delete")
    @PreAuthorize("@securityService.isPayer(#receipt_id)")
    public ResponseEntity<String> delete(@PathVariable(value = "group_id") Long group_id,
                                         @PathVariable(value = "meeting_id") Long meeting_id,
                                         @PathVariable(value = "receipt_id") Long receipt_id) {
        receiptManageService.delete(receipt_id);
        return ResponseEntity.ok("receipt delete success");
    }