Skip to content

Commit

Permalink
refactor(Security): 권한 검사 방식 변경(@secured -> @PreAuthorize)
Browse files Browse the repository at this point in the history
  • Loading branch information
@limehee
limehee committed Aug 11, 2024
1 parent ec20c87 commit a7cea01
Show file tree
Hide file tree
Showing 124 changed files with 309 additions and 292 deletions.
20 changes: 10 additions & 10 deletions ...in/java/page/clab/api/domain/activity/activitygroup/api/ActivityGroupAdminController.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
import lombok.RequiredArgsConstructor;
import org.springframework.data.domain.PageRequest;
import org.springframework.data.domain.Pageable;
import org.springframework.security.access.annotation.Secured;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.DeleteMapping;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PatchMapping;
Expand Down Expand Up @@ -43,7 +43,7 @@ public class ActivityGroupAdminController {
private final PageableUtils pageableUtils;

@Operation(summary = "[U] 활동 생성", description = "ROLE_USER 이상의 권한이 필요함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@PostMapping("")
public ApiResponse<Long> createActivityGroup(
@Valid @RequestBody ActivityGroupRequestDto requestDto
Expand All @@ -53,7 +53,7 @@ public ApiResponse<Long> createActivityGroup(
}

@Operation(summary = "[U] 활동 수정", description = "ROLE_USER 이상의 권한이 필요함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@PatchMapping("/{activityGroupId}")
public ApiResponse<Long> updateActivityGroup(
@PathVariable(name = "activityGroupId") Long activityGroupId,
Expand All @@ -64,7 +64,7 @@ public ApiResponse<Long> updateActivityGroup(
}

@Operation(summary = "[A] 활동 상태 변경", description = "ROLE_ADMIN 이상의 권한이 필요함")
@Secured({ "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('ADMIN')")
@PatchMapping("manage/{activityGroupId}")
public ApiResponse<Long> manageActivityGroupStatus(
@PathVariable(name = "activityGroupId") Long activityGroupId,
Expand All @@ -75,7 +75,7 @@ public ApiResponse<Long> manageActivityGroupStatus(
}

@Operation(summary = "[A] 활동 삭제", description = "ROLE_ADMIN 이상의 권한이 필요함")
@Secured({ "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('ADMIN')")
@DeleteMapping("/{activityGroupId}")
public ApiResponse<Long> deleteActivityGroup(
@PathVariable(name = "activityGroupId") Long activityGroupId
Expand All @@ -86,7 +86,7 @@ public ApiResponse<Long> deleteActivityGroup(

@Operation(summary = "[U] 프로젝트 진행도 수정", description = "ROLE_USER 이상의 권한이 필요함<br>" +
"진행도는 0~100 사이의 값으로 입력해야 함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@PatchMapping("/progress/{activityGroupId}")
public ApiResponse<Long> updateProjectProgress(
@PathVariable(name = "activityGroupId") Long activityGroupId,
Expand All @@ -97,7 +97,7 @@ public ApiResponse<Long> updateProjectProgress(
}

@Operation(summary = "[U] 커리큘럼 및 일정 생성", description = "ROLE_USER 이상의 권한이 필요함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@PostMapping("/schedule")
public ApiResponse<Long> addSchedule(
@RequestParam(name = "activityGroupId") Long activityGroupId,
Expand All @@ -110,7 +110,7 @@ public ApiResponse<Long> addSchedule(
@Operation(summary = "[U] 활동 멤버 및 지원서 조회", description = "ROLE_USER 이상의 권한이 필요함<br>" +
"관리자 또는 리더만 조회 가능<br>" +
"DTO의 필드명을 기준으로 정렬 가능하며, 정렬 방향은 오름차순(asc)과 내림차순(desc)이 가능함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@GetMapping("/members")
public ApiResponse<PagedResponseDto<ActivityGroupMemberWithApplyReasonResponseDto>> getApplyGroupMemberList(
@RequestParam(name = "activityGroupId") Long activityGroupId,
Expand All @@ -125,7 +125,7 @@ public ApiResponse<PagedResponseDto<ActivityGroupMemberWithApplyReasonResponseDt
}

@Operation(summary = "[U] 신청 멤버 상태 변경", description = "ROLE_USER 이상의 권한이 필요함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@PatchMapping("/accept")
public ApiResponse<String> acceptGroupMember(
@RequestParam(name = "activityGroupId") Long activityGroupId,
Expand All @@ -138,7 +138,7 @@ public ApiResponse<String> acceptGroupMember(

@GetMapping("/deleted")
@Operation(summary = "[S] 삭제된 활동그룹 조회하기", description = "ROLE_SUPER 이상의 권한이 필요함")
@Secured({ "ROLE_SUPER" })
@PreAuthorize("hasRole('SUPER')")
public ApiResponse<PagedResponseDto<ActivityGroupResponseDto>> getDeletedActivityGroups(
@RequestParam(name = "page", defaultValue = "0") int page,
@RequestParam(name = "size", defaultValue = "20") int size
Expand Down
22 changes: 11 additions & 11 deletions ...in/java/page/clab/api/domain/activity/activitygroup/api/ActivityGroupBoardController.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
import lombok.RequiredArgsConstructor;
import org.springframework.data.domain.PageRequest;
import org.springframework.data.domain.Pageable;
import org.springframework.security.access.annotation.Secured;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.DeleteMapping;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PatchMapping;
Expand Down Expand Up @@ -48,7 +48,7 @@ public class ActivityGroupBoardController {
"제출 : 부모 게시판(과제), 첨부파일 경로 리스트<br>" +
"피드백 : 부모 게시판(제출), 카테고리, 내용 , 첨부파일 경로 리스트(선택)"
)
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@PostMapping("")
public ApiResponse<Long> createActivityGroupBoard(
@RequestParam(name = "parentId", required = false) Long parentId,
Expand All @@ -61,7 +61,7 @@ public ApiResponse<Long> createActivityGroupBoard(

@Operation(summary = "[U] 활동 그룹 게시판 조회", description = "ROLE_USER 이상의 권한이 필요함<br>" +
"DTO의 필드명을 기준으로 정렬 가능하며, 정렬 방향은 오름차순(asc)과 내림차순(desc)이 가능함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@GetMapping("/list")
public ApiResponse<PagedResponseDto<ActivityGroupBoardResponseDto>> getActivityGroupBoardList(
@RequestParam(name = "page", defaultValue = "0") int page,
Expand All @@ -75,7 +75,7 @@ public ApiResponse<PagedResponseDto<ActivityGroupBoardResponseDto>> getActivityG
}

@Operation(summary = "[U] 활동 그룹 게시판 단일 조회", description = "ROLE_USER 이상의 권한이 필요함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@GetMapping("")
public ApiResponse<ActivityGroupBoardResponseDto> getActivityGroupBoardById(
@RequestParam(name = "activityGroupBoardId") Long activityGroupBoardId
Expand All @@ -86,7 +86,7 @@ public ApiResponse<ActivityGroupBoardResponseDto> getActivityGroupBoardById(

@Operation(summary = "[U] 활동 그룹 ID에 대한 카테고리별 게시판 조회", description = "ROLE_USER 이상의 권한이 필요함<br>" +
"DTO의 필드명을 기준으로 정렬 가능하며, 정렬 방향은 오름차순(asc)과 내림차순(desc)이 가능함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@GetMapping("/by-category")
public ApiResponse<PagedResponseDto<ActivityGroupBoardResponseDto>> getActivityGroupBoardByCategory(
@RequestParam(name = "activityGroupId") Long activityGroupId,
Expand All @@ -102,7 +102,7 @@ public ApiResponse<PagedResponseDto<ActivityGroupBoardResponseDto>> getActivityG
}

@Operation(summary = "[U] 활동 그룹 게시판 계층 구조적 조회, 부모 및 자식 게시판 함께 반환", description = "ROLE_USER 이상의 권한이 필요함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@GetMapping("/by-parent")
public ApiResponse<PagedResponseDto<ActivityGroupBoardChildResponseDto>> getActivityGroupBoardByParent(
@RequestParam(name = "parentId") Long parentId,
Expand All @@ -115,7 +115,7 @@ public ApiResponse<PagedResponseDto<ActivityGroupBoardChildResponseDto>> getActi
}

@Operation(summary = "[U] 나의 제출 과제 및 피드백 조회", description = "ROLE_USER 이상의 권한이 필요함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@GetMapping("/my-assignment")
public ApiResponse<List<AssignmentSubmissionWithFeedbackResponseDto>> getMyAssignmentBoardWithFeedback(
@RequestParam(name = "parentId") Long parentId
Expand All @@ -125,7 +125,7 @@ public ApiResponse<List<AssignmentSubmissionWithFeedbackResponseDto>> getMyAssig
}

@Operation(summary = "[U] 활동 그룹 게시판 수정", description = "ROLE_USER 이상의 권한이 필요함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@PatchMapping("")
public ApiResponse<ActivityGroupBoardUpdateResponseDto> updateActivityGroupBoard(
@RequestParam(name = "activityGroupBoardId") Long activityGroupBoardId,
Expand All @@ -136,7 +136,7 @@ public ApiResponse<ActivityGroupBoardUpdateResponseDto> updateActivityGroupBoard
}

@Operation(summary = "[U] 활동 그룹 게시판 삭제", description = "ROLE_USER 이상의 권한이 필요함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@DeleteMapping("")
public ApiResponse<Long> deleteActivityGroupBoard(
@RequestParam Long activityGroupBoardId
Expand All @@ -145,9 +145,9 @@ public ApiResponse<Long> deleteActivityGroupBoard(
return ApiResponse.success(id);
}

@GetMapping("/deleted")
@Operation(summary = "[S] 삭제된 활동 그룹 게시판 조회하기", description = "ROLE_SUPER 이상의 권한이 필요함")
@Secured({ "ROLE_SUPER" })
@PreAuthorize("hasRole('SUPER')")
@GetMapping("/deleted")
public ApiResponse<PagedResponseDto<ActivityGroupBoardResponseDto>> getDeletedActivityGroupBoards(
@RequestParam(name = "page", defaultValue = "0") int page,
@RequestParam(name = "size", defaultValue = "20") int size
Expand Down
21 changes: 12 additions & 9 deletions ...n/java/page/clab/api/domain/activity/activitygroup/api/ActivityGroupMemberController.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
import lombok.RequiredArgsConstructor;
import org.springframework.data.domain.PageRequest;
import org.springframework.data.domain.Pageable;
import org.springframework.security.access.annotation.Secured;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
Expand Down Expand Up @@ -39,8 +39,9 @@ public class ActivityGroupMemberController {
private final ActivityGroupMemberService activityGroupMemberService;
private final PageableUtils pageableUtils;

@Operation(summary = "활동 전체 목록 조회", description = "ROLE_ANONYMOUS 이상의 권한이 필요함<br>" +
@Operation(summary = "[U] 활동 전체 목록 조회", description = "ROLE_ANONYMOUS 이상의 권한이 필요함<br>" +
"DTO의 필드명을 기준으로 정렬 가능하며, 정렬 방향은 오름차순(asc)과 내림차순(desc)이 가능함")
@PreAuthorize("hasRole('USER')")
@GetMapping("")
public ApiResponse<PagedResponseDto<ActivityGroupResponseDto>> getActivityGroups(
@RequestParam(name = "page", defaultValue = "0") int page,
Expand All @@ -53,7 +54,8 @@ public ApiResponse<PagedResponseDto<ActivityGroupResponseDto>> getActivityGroups
return ApiResponse.success(activityGroups);
}

@Operation(summary = "활동 상세 조회", description = "ROLE_ANONYMOUS 이상의 권한이 필요함")
@Operation(summary = "[U] 활동 상세 조회", description = "ROLE_ANONYMOUS 이상의 권한이 필요함")
@PreAuthorize("hasRole('USER')")
@GetMapping("/{activityGroupId}")
public ApiResponse<Object> getActivityGroup(
@PathVariable(name = "activityGroupId") Long activityGroupId
Expand All @@ -63,7 +65,7 @@ public ApiResponse<Object> getActivityGroup(
}

@Operation(summary = "[U] 나의 활동 목록 조회", description = "ROLE_USER 이상의 권한이 필요함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@GetMapping("/my")
public ApiResponse<PagedResponseDto<ActivityGroupResponseDto>> getMyActivityGroups(
@RequestParam(name = "page", defaultValue = "0") int page,
Expand All @@ -75,7 +77,7 @@ public ApiResponse<PagedResponseDto<ActivityGroupResponseDto>> getMyActivityGrou
}

@Operation(summary = "[U] 활동 상태별 조회", description = "ROLE_USER 이상의 권한이 필요함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@GetMapping("/status")
public ApiResponse<PagedResponseDto<ActivityGroupStatusResponseDto>> getActivityGroupsByStatus(
@RequestParam(name = "activityGroupStatus") ActivityGroupStatus status,
Expand All @@ -87,8 +89,9 @@ public ApiResponse<PagedResponseDto<ActivityGroupStatusResponseDto>> getActivity
return ApiResponse.success(activityGroups);
}

@Operation(summary = "카테고리별 활동 목록 조회", description = "ROLE_ANONYMOUS 이상의 권한이 필요함<br>" +
@Operation(summary = "[U] 카테고리별 활동 목록 조회", description = "ROLE_ANONYMOUS 이상의 권한이 필요함<br>" +
"DTO의 필드명을 기준으로 정렬 가능하며, 정렬 방향은 오름차순(asc)과 내림차순(desc)이 가능함")
@PreAuthorize("hasRole('USER')")
@GetMapping("/list")
public ApiResponse<PagedResponseDto<ActivityGroupResponseDto>> getActivityGroupsByCategory(
@RequestParam(name = "category") ActivityGroupCategory category,
Expand All @@ -104,7 +107,7 @@ public ApiResponse<PagedResponseDto<ActivityGroupResponseDto>> getActivityGroups

@Operation(summary = "[U] 활동 일정 조회", description = "ROLE_USER 이상의 권한이 필요함<br>" +
"DTO의 필드명을 기준으로 정렬 가능하며, 정렬 방향은 오름차순(asc)과 내림차순(desc)이 가능함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@GetMapping("/schedule")
public ApiResponse<PagedResponseDto<GroupScheduleDto>> getGroupScheduleList(
@RequestParam(name = "activityGroupId") Long activityGroupId,
Expand All @@ -121,7 +124,7 @@ public ApiResponse<PagedResponseDto<GroupScheduleDto>> getGroupScheduleList(
@Operation(summary = "[U] 활동 멤버 조회", description = "ROLE_USER 이상의 권한이 필요함<br>" +
"활동에 참여(수락)된 멤버만 조회 가능<br>" +
"DTO의 필드명을 기준으로 정렬 가능하며, 정렬 방향은 오름차순(asc)과 내림차순(desc)이 가능함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@GetMapping("/members")
public ApiResponse<PagedResponseDto<GroupMemberResponseDto>> getActivityGroupMemberList(
@RequestParam(name = "activityGroupId") Long activityGroupId,
Expand All @@ -136,7 +139,7 @@ public ApiResponse<PagedResponseDto<GroupMemberResponseDto>> getActivityGroupMem
}

@Operation(summary = "[U] 활동 신청", description = "ROLE_USER 이상의 권한이 필요함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@PostMapping("/apply")
public ApiResponse<Long> applyActivityGroup(
@RequestParam Long activityGroupId,
Expand Down
16 changes: 8 additions & 8 deletions ...n/java/page/clab/api/domain/activity/activitygroup/api/ActivityGroupReportController.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
import lombok.RequiredArgsConstructor;
import org.springframework.data.domain.PageRequest;
import org.springframework.data.domain.Pageable;
import org.springframework.security.access.annotation.Secured;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.DeleteMapping;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PatchMapping;
Expand Down Expand Up @@ -39,8 +39,8 @@ public class ActivityGroupReportController {
private final PageableUtils pageableUtils;

@Operation(summary = "[U] 활동 보고서 작성", description = "ROLE_USER 이상의 권한이 필요함")
@PreAuthorize("hasRole('USER')")
@PostMapping("")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
public ApiResponse<Long> writeReport(
@Valid @RequestBody ActivityGroupReportRequestDto requestDto
) throws PermissionDeniedException, IllegalAccessException {
Expand All @@ -50,8 +50,8 @@ public ApiResponse<Long> writeReport(

@Operation(summary = "[U] 특정 그룹의 활동 보고서 전체 조회", description = "ROLE_USER 이상의 권한이 필요함<br>" +
"DTO의 필드명을 기준으로 정렬 가능하며, 정렬 방향은 오름차순(asc)과 내림차순(desc)이 가능함")
@PreAuthorize("hasRole('USER')")
@GetMapping("")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
public ApiResponse<PagedResponseDto<ActivityGroupReportResponseDto>> getReports(
@RequestParam(name = "activityGroupId") Long activityGroupId,
@RequestParam(name = "page", defaultValue = "0") int page,
Expand All @@ -65,8 +65,8 @@ public ApiResponse<PagedResponseDto<ActivityGroupReportResponseDto>> getReports(
}

@Operation(summary = "[U] 특정 그룹의 특정 차시 활동 보고서 검색", description = "ROLE_USER 이상의 권한이 필요함")
@PreAuthorize("hasRole('USER')")
@GetMapping("/search")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
public ApiResponse<ActivityGroupReportResponseDto> searchReport(
@RequestParam(name = "activityGroupId") Long activityGroupId,
@RequestParam(name = "turn") Long turn
Expand All @@ -76,8 +76,8 @@ public ApiResponse<ActivityGroupReportResponseDto> searchReport(
}

@Operation(summary = "[U] 활동 보고서 수정", description = "ROLE_USER 이상의 권한이 필요함")
@PreAuthorize("hasRole('USER')")
@PatchMapping("/{reportId}")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
public ApiResponse<Long> updateReport(
@PathVariable(name = "reportId") Long reportId,
@RequestParam(name = "activityGroupId") Long activityGroupId,
Expand All @@ -88,7 +88,7 @@ public ApiResponse<Long> updateReport(
}

@Operation(summary = "[U] 활동보고서 삭제", description = "ROLE_USER 이상의 권한이 필요함")
@Secured({ "ROLE_USER", "ROLE_ADMIN", "ROLE_SUPER" })
@PreAuthorize("hasRole('USER')")
@DeleteMapping("/{reportId}")
public ApiResponse<Long> deleteAward(
@PathVariable(name = "reportId") Long reportId
Expand All @@ -98,9 +98,9 @@ public ApiResponse<Long> deleteAward(
}


@GetMapping("/deleted")
@Operation(summary = "[S] 삭제된 활동보고서 조회하기", description = "ROLE_SUPER 이상의 권한이 필요함")
@Secured({ "ROLE_SUPER" })
@PreAuthorize("hasRole('SUPER')")
@GetMapping("/deleted")
public ApiResponse<PagedResponseDto<ActivityGroupReportResponseDto>> getDeletedActivityGroupReports(
@RequestParam(name = "page", defaultValue = "0") int page,
@RequestParam(name = "size", defaultValue = "20") int size
Expand Down
Loading

0 comments on commit a7cea01

Please sign in to comment.