Spring Security 인증/인가 구조 개편 및 GUEST 로그인 도입 완료

src/main/java/page/clab/api/domain/auth/login/domain/RedisToken.java

@@ -1,6 +1,5 @@
 package page.clab.api.domain.auth.login.domain;
 
-import jakarta.persistence.Column;
 import jakarta.persistence.Id;
 import lombok.AccessLevel;
 import lombok.AllArgsConstructor;
@@ -51,6 +50,6 @@ public boolean isSameIp(String ip) {
     }
 
     public boolean isAdminToken() {
-        return role == Role.ADMIN || role == Role.SUPER;
+        return role.isHigherThan(Role.ADMIN);
     }
 }

src/main/java/page/clab/api/domain/memberManagement/member/domain/Role.java

@@ -23,4 +23,8 @@ public Long toRoleLevel() {
             case SUPER -> 3L;
         };
     }
+
+    public boolean isHigherThan(Role role) {
+        return this.toRoleLevel() > role.toRoleLevel();
+    }
 }

src/main/java/page/clab/api/global/auth/filter/JwtAuthenticationFilter.java

@@ -64,14 +64,18 @@ private boolean verifyIpAddressAccess(HttpServletResponse response, String clien
 
     private boolean authenticateToken(HttpServletRequest request, HttpServletResponse response, String clientIpAddress) throws IOException {
         String token = jwtTokenProvider.resolveToken(request);
+
+        // 토큰이 존재하고 유효한 경우
         if (token != null && jwtTokenProvider.validateToken(token)) {
             RedisToken redisToken = jwtTokenProvider.isRefreshToken(token) ? externalManageRedisTokenUseCase.findByRefreshToken(token) : externalManageRedisTokenUseCase.findByAccessToken(token);
             if (redisToken == null) {
                 log.warn("존재하지 않는 토큰입니다.");
                 ResponseUtil.sendErrorResponse(response, HttpServletResponse.SC_UNAUTHORIZED);
                 return false;
             }
-            if (!redisToken.getIp().equals(clientIpAddress)) {
+
+            // 관리자 토큰이고, 토큰 발급 IP와 다른 IP에서 접속한 경우 토큰 삭제
+            if (redisToken.isAdminToken() && !redisToken.isSameIp(clientIpAddress)) {
                 externalManageRedisTokenUseCase.deleteByAccessToken(token);
                 sendSecurityAlertSlackMessage(request, redisToken);
                 log.warn("[{}] 토큰 발급 IP와 다른 IP에서 접속하여 토큰을 삭제하였습니다.", clientIpAddress);
@@ -80,10 +84,8 @@ private boolean authenticateToken(HttpServletRequest request, HttpServletRespons
             }
             Authentication authentication = jwtTokenProvider.getAuthentication(token);
             SecurityContextHolder.getContext().setAuthentication(authentication);
-            return true;
-        } else {
-            return true;
         }
+        return true;
     }
 
     private void sendSecurityAlertSlackMessage(HttpServletRequest request, RedisToken redisToken) {