Merge pull request #26 from ghtndl/main

[Refactor] MemberController, MemberDTO , SecurityConfig
prgrms-be-devcourse · Nov 4, 2024 · 03e5fb0 · 03e5fb0
2 parents 8b31e85 + 6b997c5
commit 03e5fb0
Show file tree

Hide file tree

Showing 6 changed files with 41 additions and 18 deletions.
diff --git a/src/main/kotlin/org/tenten/bittakotlin/jobpost/controller/JobPostViewController.kt b/src/main/kotlin/org/tenten/bittakotlin/jobpost/controller/JobPostViewController.kt
@@ -6,7 +6,7 @@ import org.springframework.web.bind.annotation.GetMapping
 import org.springframework.web.bind.annotation.RequestMapping
 
 @Controller
-@RequestMapping("/jobpost")
+@RequestMapping("/job-post")
 class JobPostViewController {
     @GetMapping
     fun showJobpostPage(model: Model?): String {

diff --git a/src/main/kotlin/org/tenten/bittakotlin/member/controller/MemberController.kt b/src/main/kotlin/org/tenten/bittakotlin/member/controller/MemberController.kt
@@ -6,12 +6,13 @@ import org.springframework.security.access.AccessDeniedException
 import org.springframework.web.bind.annotation.*
 import org.tenten.bittakotlin.member.dto.MemberRequestDTO
 import org.tenten.bittakotlin.member.dto.MemberResponseDTO
+import org.tenten.bittakotlin.member.exception.MemberException
 import org.tenten.bittakotlin.member.repository.MemberRepository
 import org.tenten.bittakotlin.member.service.MemberService
 import org.tenten.bittakotlin.security.jwt.JWTUtil
 
 @RestController
-@RequestMapping("/api/member")
+@RequestMapping("/api/v1/member")
 class MemberController(
     private val memberService: MemberService,
     private val jwtUtil: JWTUtil,
@@ -32,17 +33,31 @@ class MemberController(
         return ResponseEntity(memberInfo, HttpStatus.OK)
     }
 
-    // 회원 정보 업데이트
+
     @PutMapping("/{id}")
     fun updateMember(
         @PathVariable id: Long,
-        @RequestBody updateRequest: MemberRequestDTO.UpdateMemberRequest
+        @RequestBody updateRequest: MemberRequestDTO.UpdateMemberRequest,
+        @RequestHeader("access") token: String // JWT 토큰을 헤더에서 추출
     ): ResponseEntity<Void> {
-        // id는 updateRequest에서 가져오는 것이 아니라, PathVariable로 받아온 id를 그대로 사용
-        memberService.updateMember(updateRequest.copy(id = id)) // copy() 메서드를 사용하여 새로운 인스턴스를 생성
+        // 현재 로그인한 사용자 username 추출
+        val usernameFromToken = jwtUtil.getUsername(token)
+
+        // id로 회원 정보 조회
+        val member = memberRepository.findById(id)
+            .orElseThrow { MemberException.NOT_FOUND.get() }
+
+        // username 비교
+        if (member.username != usernameFromToken) {
+            throw AccessDeniedException("You don't have permission to update this member.")
+        }
+
+        // 유효성 검증 후 회원 정보 업데이트
+        memberService.updateMember(updateRequest, id) // id를 포함하여 업데이트 메서드 호출
         return ResponseEntity.ok().build()
     }
 
+
     @DeleteMapping("/{id}")
     fun remove(@PathVariable id: Long, @RequestHeader("access") token: String): ResponseEntity<String> {
         val username = jwtUtil.getUsername(token)

diff --git a/src/main/kotlin/org/tenten/bittakotlin/member/dto/MemberRequestDTO.kt b/src/main/kotlin/org/tenten/bittakotlin/member/dto/MemberRequestDTO.kt
@@ -31,11 +31,7 @@ class MemberRequestDTO {
 
     @Schema(title = "회원정보 수정 및 비밀번호 변경 DTO", description = "회원정보 수정 및 비밀번호 변경 요청에 사용하는 DTO입니다.")
     data class UpdateMemberRequest(
-        @Schema(title = "회원 ID (PK)", description = "수정할 회원의 기본키입니다.", example = "1")
-        val id: Long,
 
-        @Schema(title = "아이디", description = "비밀번호를 변경할 아이디입니다.", example = "username")
-        val username: String,
 
         @Schema(title = "새로운 별명", description = "새롭게 변경할 별명입니다.", example = "nickname")
         val nickname: String? = null, // nullable로 설정

diff --git a/src/main/kotlin/org/tenten/bittakotlin/member/service/MemberService.kt b/src/main/kotlin/org/tenten/bittakotlin/member/service/MemberService.kt
@@ -9,7 +9,7 @@ interface MemberService {
 
     fun read(id: Long): MemberResponseDTO.Information
 
-    fun updateMember(request: MemberRequestDTO.UpdateMemberRequest)
+    fun updateMember(request: MemberRequestDTO.UpdateMemberRequest, id: Long)
 
     fun remove(id: Long)
 

diff --git a/src/main/kotlin/org/tenten/bittakotlin/member/service/MemberServiceImpl.kt b/src/main/kotlin/org/tenten/bittakotlin/member/service/MemberServiceImpl.kt
@@ -63,8 +63,8 @@ class MemberServiceImpl  (
         )
     }
 
-    override fun updateMember(request: MemberRequestDTO.UpdateMemberRequest) {
-        val member = memberRepository.findById(request.id)
+    override fun updateMember(request: MemberRequestDTO.UpdateMemberRequest, id: Long) {
+        val member = memberRepository.findById(id)
             .orElseThrow { MemberException.NOT_FOUND.get() }
 
         // 비밀번호 변경 요청이 있을 경우
@@ -80,7 +80,7 @@ class MemberServiceImpl  (
         request.nickname?.let { member.nickname = it }
         request.address?.let { member.address = it }
 
-        member.username = request.username // 아이디는 항상 업데이트
+        // username은 변경할 수 없으므로 해당 줄 제거
 
         memberRepository.save(member) // 수정 후 저장
     }

diff --git a/src/main/kotlin/org/tenten/bittakotlin/security/config/SecurityConfig.kt b/src/main/kotlin/org/tenten/bittakotlin/security/config/SecurityConfig.kt
@@ -72,11 +72,23 @@ class SecurityConfig(
             auth
                 .requestMatchers(
                     "/",
-                    "/api/member/login",
-                    "/api/member/join",
-                    "/api/member/reissue").permitAll()
-                .requestMatchers("/api/member/{id}/**").hasRole("USER")
+                    "/api/v1/member/login",
+                    "/member/login",
+                    "/api/v1/member/join",
+                    "/member/join",
+                    "/api/v1/member/reissue").permitAll()
+
+                .requestMatchers(
+                    "/api/v1/member/{id}/**",
+                    "member/{id}/**",
+                    "/api/v1/job-post/**",
+                    "/job-post/**",
+                    "/api/v1/like/**").hasRole("USER")
+
                 .requestMatchers(HttpMethod.DELETE,"/api/member/{id}").authenticated()
+                .requestMatchers(HttpMethod.PUT,"/api/member/{id}").authenticated()
+                .requestMatchers("/api/v1/chat/**").authenticated()
+
                 .anyRequest().authenticated()
         }