03. SPRING SECURITY

dependencies {
    implementation "org.springframework.boot:spring-boot-starter-data-jpa"
    implementation "org.springframework.boot:spring-boot-starter-webmvc"
    // ↓ Spring Security 추가 (spring-security-crypto는 제거 — Security에 포함됨)
    implementation "org.springframework.boot:spring-boot-starter-security"
    implementation "io.jsonwebtoken:jjwt-api:0.12.3"
    runtimeOnly "io.jsonwebtoken:jjwt-impl:0.12.3"
    runtimeOnly "io.jsonwebtoken:jjwt-jackson:0.12.3"
    compileOnly "org.projectlombok:lombok"
    runtimeOnly "org.mariadb.jdbc:mariadb-java-client"
    annotationProcessor "org.projectlombok:lombok"
    testImplementation "org.springframework.boot:spring-boot-starter-test"
    testImplementation "org.springframework.boot:spring-boot-starter-security"
}

spring.datasource.url=jdbc:mariadb://localhost:3306/boarddb
spring.datasource.username=root
spring.datasource.password=1234
spring.datasource.driver-class-name=org.mariadb.jdbc.Driver
spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql=true
jwt.secret=mySecretKeyForJWTTokenGenerationAndValidation2024
jwt.expiration=86400000

# 관리자 코드 추가
admin.code=ADMIN2024

@Entity @Table(name = "users")
@Getter @Setter @NoArgsConstructor
public class User {
    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false) private String username;
    @Column(nullable = false) private String password;
    @Column(unique = true, nullable = false) private String nickname;

    @Column(nullable = false)
    private String role;  // "ROLE_USER" 또는 "ROLE_ADMIN" ← 추가!

    private LocalDateTime createdAt;

    @PrePersist
    public void prePersist() {
        this.createdAt = LocalDateTime.now();
        if (this.role == null) this.role = "ROLE_USER"; // 기본값
    }
}

@Getter @RequiredArgsConstructor
public class CustomUserDetails implements UserDetails {
    private final User user; // 우리가 만든 User Entity를 감싸는 래퍼

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        // ROLE_USER 또는 ROLE_ADMIN을 Spring Security 권한으로 변환
        return List.of(new SimpleGrantedAuthority(user.getRole()));
    }

    @Override public String getPassword() { return user.getPassword(); }
    @Override public String getUsername() { return user.getUsername(); }
    @Override public boolean isAccountNonExpired() { return true; }
    @Override public boolean isAccountNonLocked() { return true; }
    @Override public boolean isCredentialsNonExpired() { return true; }
    @Override public boolean isEnabled() { return true; }
}

@Service @RequiredArgsConstructor
public class CustomUserDetailsService implements UserDetailsService {
    private final UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username)
            .orElseThrow(() ->
                new UsernameNotFoundException("없는 유저입니다: " + username));
        return new CustomUserDetails(user); // UserDetails로 감싸서 반환
    }
}

@Component @RequiredArgsConstructor
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    private final JwtUtil jwtUtil;
    private final CustomUserDetailsService customUserDetailsService;

    @Override
    protected void doFilterInternal(HttpServletRequest request,
            HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {

        String authHeader = request.getHeader("Authorization");
        if (authHeader != null && authHeader.startsWith("Bearer ")) {
            String token = authHeader.substring(7);
            if (jwtUtil.validateToken(token)) {
                String username = jwtUtil.getUsername(token);
                UserDetails userDetails =
                    customUserDetailsService.loadUserByUsername(username);

                // 2차 JwtFilter와의 차이: request.setAttribute 대신 SecurityContext에 저장
                UsernamePasswordAuthenticationToken authentication =
                    new UsernamePasswordAuthenticationToken(
                        userDetails, null, userDetails.getAuthorities()
                    );
                SecurityContextHolder.getContext().setAuthentication(authentication);
            }
        }
        filterChain.doFilter(request, response);
    }
}

@Configuration @EnableWebSecurity @RequiredArgsConstructor
public class SecurityConfig {
    private final JwtAuthenticationFilter jwtAuthenticationFilter;

    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(AbstractHttpConfigurer::disable)
            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
            .sessionManagement(session ->
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/user/login", "/api/user/register")
                    .permitAll()              // 누구나
                .requestMatchers("/api/admin/**")
                    .hasRole("ADMIN")         // ROLE_ADMIN만
                .anyRequest().authenticated() // 나머지는 로그인 필요
            )
            .addFilterBefore(jwtAuthenticationFilter,
                UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration config = new CorsConfiguration();
        config.setAllowedOrigins(List.of("http://localhost:3000"));
        config.setAllowedMethods(List.of("GET","POST","PUT","DELETE","PATCH"));
        config.setAllowedHeaders(List.of("*"));
        config.setAllowCredentials(true);
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/api/**", config);
        return source;
    }
}

// createToken() — role 파라미터 추가
public String createToken(String username, String nickname, String role) {
    return Jwts.builder()
        .subject(username)
        .claim("nickname", nickname)
        .claim("role", role)  // role 추가!
        .issuedAt(new Date())
        .expiration(new Date(System.currentTimeMillis() + expiration))
        .signWith(getSigningKey())
        .compact();
}

// getRole() 추가
public String getRole(String token) {
    return getClaims(token).get("role", String.class);
}
// getUsername, validateToken, getClaims 는 2차와 동일

@Service @RequiredArgsConstructor
public class UserService {
    private final UserRepository userRepository;
    private final BCryptPasswordEncoder bCryptPasswordEncoder;
    private final JwtUtil jwtUtil;

    @Value("${admin.code}")
    private String adminCode;

    public void register(UserDto userDto) {
        if (userRepository.existsByUsername(userDto.getUsername()))
            throw new IllegalArgumentException("이미 사용중인 아이디입니다.");
        if (userRepository.existsByNickname(userDto.getNickname()))
            throw new IllegalArgumentException("이미 사용중인 닉네임입니다.");

        User user = new User();
        user.setUsername(userDto.getUsername());
        user.setPassword(bCryptPasswordEncoder.encode(userDto.getPassword()));
        user.setNickname(userDto.getNickname());
        // 관리자 코드 확인 후 role 부여
        if (adminCode.equals(userDto.getAdminCode()))
            user.setRole("ROLE_ADMIN");
        else
            user.setRole("ROLE_USER");
        userRepository.save(user);
    }

    // 반환타입 변경: String → Map<String, String> (role 포함)
    public Map<String, String> login(String username, String password) {
        User user = userRepository.findByUsername(username)
            .orElseThrow(() -> new IllegalArgumentException("아이디 또는 비밀번호가 틀렸습니다."));
        if (!bCryptPasswordEncoder.matches(password, user.getPassword()))
            throw new IllegalArgumentException("아이디 또는 비밀번호가 틀렸습니다.");
        String token = jwtUtil.createToken(
            user.getUsername(), user.getNickname(), user.getRole()
        );
        return Map.of("token", token, "role", user.getRole());
    }
}

@RestController @RequiredArgsConstructor
@RequestMapping("/api/board")
public class BoardController {
    private final BoardService boardService;

    @GetMapping("/list")
    public ResponseEntity<?> list(@RequestParam(defaultValue="0") int page) {
        return ResponseEntity.ok(boardService.getBoardList(page));
    }

    // 2차: User loginUser = (User) request.getAttribute("loginUser")
    // 3차: @AuthenticationPrincipal 로 Spring이 자동 주입!
    @PostMapping("/write")
    public ResponseEntity<?> write(
            @RequestBody BoardDto boardDto,
            @AuthenticationPrincipal CustomUserDetails userDetails) {
        boardService.write(boardDto, userDetails.getUser());
        return ResponseEntity.ok(Map.of("message", "글쓰기 성공"));
    }

    @PutMapping("/edit/{id}")
    public ResponseEntity<?> edit(
            @PathVariable Long id,
            @RequestBody BoardDto boardDto,
            @AuthenticationPrincipal CustomUserDetails userDetails) {
        boardService.update(id, boardDto, userDetails.getUser());
        return ResponseEntity.ok(Map.of("message", "수정 성공"));
    }

    @DeleteMapping("/delete/{id}")
    public ResponseEntity<?> delete(
            @PathVariable Long id,
            @AuthenticationPrincipal CustomUserDetails userDetails) {
        boardService.delete(id, userDetails.getUser());
        return ResponseEntity.ok(Map.of("message", "삭제 성공"));
    }

    @GetMapping("/detail/{id}")
    public ResponseEntity<?> detail(
            @PathVariable Long id,
            @AuthenticationPrincipal CustomUserDetails userDetails) {
        return ResponseEntity.ok(boardService.getDetail(id, userDetails.getUser()));
    }
}

@RestController @RequiredArgsConstructor
@RequestMapping("/api/admin") // SecurityConfig에서 ROLE_ADMIN만 접근 허용
public class AdminController {
    private final AdminService adminService;

    @GetMapping("/users")
    public ResponseEntity<List<UserDto>> getAllUsers() {
        return ResponseEntity.ok(adminService.getAllUsers());
    }

    @DeleteMapping("/users/{userId}")
    public ResponseEntity<?> deleteUser(@PathVariable Long userId) {
        adminService.deleteUser(userId);
        return ResponseEntity.ok(Map.of("message", "유저 삭제 성공"));
    }

    @GetMapping("/boards")
    public ResponseEntity<List<BoardDto>> getAllBoards() {
        return ResponseEntity.ok(adminService.getAllBoards());
    }

    @DeleteMapping("/boards/{boardId}")
    public ResponseEntity<?> deleteBoard(@PathVariable Long boardId) {
        adminService.deleteBoard(boardId);
        return ResponseEntity.ok(Map.of("message", "게시글 삭제 성공"));
    }
}

@Service @RequiredArgsConstructor
public class AdminService {
    private final UserRepository userRepository;
    private final BoardRepository boardRepository;

    public List<UserDto> getAllUsers() {
        return userRepository.findAll().stream().map(user -> {
            UserDto dto = new UserDto();
            dto.setId(user.getId());
            dto.setUsername(user.getUsername());
            dto.setNickname(user.getNickname());
            dto.setRole(user.getRole());
            return dto;
        }).collect(Collectors.toList());
    }

    @Transactional
    public void deleteUser(Long userId) {
        User user = userRepository.findById(userId)
            .orElseThrow(() -> new IllegalArgumentException("없는 유저입니다."));
        boardRepository.deleteByUser(user); // FK 제약 → 게시글 먼저 삭제
        userRepository.delete(user);
    }

    public List<BoardDto> getAllBoards() {
        return boardRepository.findAll().stream().map(board -> {
            BoardDto dto = new BoardDto();
            dto.setId(board.getId());
            dto.setTitle(board.getTitle());
            dto.setNickname(board.getUser().getNickname());
            dto.setViewCount(board.getViewCount());
            return dto;
        }).collect(Collectors.toList());
    }

    @Transactional
    public void deleteBoard(Long boardId) {
        Board board = boardRepository.findById(boardId)
            .orElseThrow(() -> new IllegalArgumentException("없는 게시글입니다."));
        boardRepository.delete(board);
    }
}

public interface BoardRepository extends JpaRepository<Board, Long> {
    Page<Board> findAllByOrderByCreatedAtDesc(Pageable pageable);
    void deleteByUser(User user); // 추가! — 유저 삭제 시 게시글 먼저 삭제
}

// PrivateRoute는 2차와 동일
const PrivateRoute = ({ children }) => {
    const token = localStorage.getItem("token");
    return token ? children : <Navigate to="/login" />;
};

// 관리자 전용 Route 추가
const AdminRoute = ({ children }) => {
    const role = localStorage.getItem("role");
    return role === "ROLE_ADMIN" ? children : <Navigate to="/board/list" />;
};

// 라우트에 추가
<Route path="/admin"
    element={<AdminRoute><AdminPage /></AdminRoute>} />

function AdminPage() {
    const [users, setUsers] = useState([]);
    const [boards, setBoards] = useState([]);
    const [activeTab, setActiveTab] = useState("users");

    useEffect(() => {
        api.get("/api/admin/users").then(res => setUsers(res.data));
        api.get("/api/admin/boards").then(res => setBoards(res.data));
    }, []);

    const handleDeleteUser = async (userId) => {
        if (window.confirm("유저를 삭제하시겠습니까?")) {
            await api.delete(`/api/admin/users/${userId}`);
            api.get("/api/admin/users").then(res => setUsers(res.data));
        }
    };

    const handleDeleteBoard = async (boardId) => {
        if (window.confirm("게시글을 삭제하시겠습니까?")) {
            await api.delete(`/api/admin/boards/${boardId}`);
            api.get("/api/admin/boards").then(res => setBoards(res.data));
        }
    };
    // 탭 전환으로 유저/게시글 관리
    // 관리자(ROLE_ADMIN) 계정은 삭제 버튼 미표시
}