인터셉터에서 request jwt를 활용하도록 수정

be/src/main/java/yeonba/be/config/AuthInterceptor.java

@@ -0,0 +1,51 @@
+package yeonba.be.config;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+import org.springframework.web.servlet.HandlerInterceptor;
+import yeonba.be.exception.GeneralException;
+import yeonba.be.exception.UtilException;
+import yeonba.be.user.repository.user.UserQuery;
+import yeonba.be.util.JwtUtil;
+
+@Component
+@RequiredArgsConstructor
+public class AuthInterceptor implements HandlerInterceptor {
+
+    private final UserQuery userQuery;
+    private final JwtUtil jwtUtil;
+
+    @Override
+    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
+
+        if (request.getMethod().equals("OPTIONS")) {
+            return true;
+        }
+
+        String header = request.getHeader("Authorization");
+        if (header == null) {
+            throw new GeneralException(UtilException.NOT_FOUND_AUTHORIZATION_HEADER);
+        }
+
+        Pattern pattern = Pattern.compile("^Bearer\\s(.+)$");
+        Matcher matcher = pattern.matcher(header);
+        if (!matcher.matches()) {
+            throw new GeneralException(UtilException.INVALID_AUTHORIZATION_FORMAT);
+        }
+
+        String token = matcher.group(1);
+
+        if (!jwtUtil.validateToken(token)) {
+            throw new GeneralException(UtilException.INVALID_JWT);
+        }
+
+        long userId = jwtUtil.getUserIdFromJwt(token);
+        request.setAttribute("userId", userId);
+
+        return true;
+    }
+}

be/src/main/java/yeonba/be/config/SwaggerConfig.java

@@ -3,6 +3,8 @@
 import io.swagger.v3.oas.models.info.Info;
 import io.swagger.v3.oas.models.Components;
 import io.swagger.v3.oas.models.OpenAPI;
+import io.swagger.v3.oas.models.security.SecurityRequirement;
+import io.swagger.v3.oas.models.security.SecurityScheme;
 import io.swagger.v3.oas.models.servers.Server;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -16,14 +18,23 @@ public OpenAPI customOpenAPI() {
         Info info = new Info()
             .title("Yeonba API Docs")
             .description("연바 API 명세서입니다.")
-            .description("<h3> Yeonba API</h3><img src=\"https://avatars.githubusercontent.com/u/156646513?s=200&v=4\" width=150 height=150 />")
+            .description(
+                "<h3> Yeonba API</h3><img src=\"https://avatars.githubusercontent.com/u/156646513?s=200&v=4\" width=150 height=150 />")
             .version("0.0.1");
 
         return new OpenAPI()
-            .components(new Components())
-//            .addServersItem(new Server().url("https://api.yeonba.co.kr"))
+            .addSecurityItem(new SecurityRequirement().addList("Bearer Authentication"))
+            .components(
+                new Components().addSecuritySchemes("Bearer Authentication", createAPIKeyScheme()))
+            .addServersItem(new Server().url("https://api.yeonba.co.kr"))
             .info(info);
     }
 
+    private SecurityScheme createAPIKeyScheme() {
 
+        return new SecurityScheme()
+            .type(SecurityScheme.Type.HTTP)
+            .bearerFormat("JWT")
+            .scheme("bearer");
+    }
 }

be/src/main/java/yeonba/be/config/WebConfig.java

@@ -9,7 +9,7 @@
 @RequiredArgsConstructor
 public class WebConfig implements WebMvcConfigurer {
 
-    private final DevAuthInterceptor devAuthInterceptor;
+    private final AuthInterceptor devAuthInterceptor;
 
     @Override
     public void addInterceptors(InterceptorRegistry registry) {

be/src/main/java/yeonba/be/exception/UtilException.java

@@ -8,6 +8,14 @@
 @AllArgsConstructor
 public enum UtilException implements BaseException {
 
+    INVALID_AUTHORIZATION_FORMAT(
+        HttpStatus.BAD_REQUEST,
+        "Authorization 헤더가 올바른 형식이 아닙니다."),
+
+    NOT_FOUND_AUTHORIZATION_HEADER(
+        HttpStatus.BAD_REQUEST,
+        "Authorization 헤더가 존재하지 않습니다."),
+
     INVALID_JWT(
         HttpStatus.BAD_REQUEST,
         "유효하지 않은 JWT입니다. 다시 로그인 해주세요."),

be/src/main/java/yeonba/be/login/service/LoginService.java

@@ -54,7 +54,7 @@ private void validateLoginInfo(User user, long socialId, LoginType loginType) {
     @Transactional
     public UserRefrehJwtResponse refreshJwt(UserRefreshJwtRequest request) {
 
-        long userId = jwtUtil.getUserIdFromToken(request.getRefreshToken());
+        long userId = jwtUtil.getUserIdFromJwt(request.getRefreshToken());
 
         User user = userQuery.findById(userId);
         user.validateRefreshToken(request.getRefreshToken());

be/src/main/java/yeonba/be/util/JwtUtil.java

@@ -1,11 +1,15 @@
 package yeonba.be.util;
 
+import io.jsonwebtoken.JwtException;
 import io.jsonwebtoken.Jwts;
 import io.jsonwebtoken.SignatureAlgorithm;
+import java.security.Key;
 import java.time.Duration;
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
+import java.util.Base64;
 import java.util.Date;
+import javax.crypto.spec.SecretKeySpec;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
 import yeonba.be.user.entity.User;
@@ -33,7 +37,7 @@ public String generateRefreshToken(User user, Date generatedAt) {
         return generateUserJwt(user, generatedAt, expiredAt);
     }
 
-    public long getUserIdFromToken(String token) {
+    public long getUserIdFromJwt(String token) {
 
         Object userIdObject = Jwts.parser()
             .setSigningKey(jwtSecret)
@@ -68,4 +72,20 @@ private String generateUserJwt(User user, Date issuedAt, Date generatedAt) {
             .signWith(SignatureAlgorithm.HS256, jwtSecret)
             .compact();
     }
+
+    public boolean validateToken(String token) {
+
+        try {
+            byte[] decodedSecretKey = Base64.getDecoder().decode(jwtSecret);
+            Key key = new SecretKeySpec(decodedSecretKey, 0, decodedSecretKey.length, "HmacSHA256");
+
+            Jwts.parser()
+                .setSigningKey(key) // 비밀 키를 사용하여 서명을 검증
+                .parseClaimsJws(token);
+
+            return true;
+        } catch (JwtException e) {
+            return false;
+        }
+    }
 }