Project Lab 12. 게시판 개발(댓글) - 8

<module-domain-core/src/main/java/kr/ac/univ/noticeBoard/domain/NoticeBoardComment.java>

package kr.ac.univ.noticeBoard.domain;

import kr.ac.univ.common.domain.CommonAudit;
import kr.ac.univ.common.domain.enums.ActiveStatus;
import lombok.Builder;
import lombok.Getter;
import lombok.NoArgsConstructor;
import lombok.ToString;

import javax.persistence.Column;
import javax.persistence.Entity;
import javax.persistence.Table;

@Getter
@NoArgsConstructor
@Entity
@Table
@ToString
public class NoticeBoardComment extends CommonAudit {
   @Column
   private Long noticeBoardIdx;

   @Column
   private String content;

   @Builder
   public NoticeBoardComment(Long idx, String createdBy, String lastModifiedBy, ActiveStatus activeStatus, Long noticeBoardIdx, String content) {
       setIdx(idx);
       setCreatedBy(createdBy);
       setLastModifiedBy(lastModifiedBy);
       setActiveStatus(activeStatus);
       this.noticeBoardIdx = noticeBoardIdx;
       this.content = content;
   }

   public void update(NoticeBoardComment noticeBoard) {
       setActiveStatus(noticeBoard.getActiveStatus());
       this.content = noticeBoard.getContent();
   }
}

<module-domain-core/src/main/java/kr/ac/univ/noticeBoard/dto/NoticeBoardCommentDto.java>

package kr.ac.univ.noticeBoard.dto;

import kr.ac.univ.common.dto.CommonDto;
import lombok.Getter;
import lombok.NoArgsConstructor;
import lombok.Setter;
import lombok.ToString;

@Getter
@Setter
@NoArgsConstructor
@ToString
public class NoticeBoardCommentDto extends CommonDto {
   /* CommonDto: JPA Audit */

   /* 기본 정보 */
   private Long noticeBoardIdx;
   private String content;

   /* newIcon */
   private boolean isNewIcon;

   /* 접근 여부 */
   private boolean isAccess;
}

<module-domain-core/src/main/java/kr/ac/univ/noticeBoard/dto/mapper/NoticeBoardCommentMapper.java>

package kr.ac.univ.noticeBoard.dto.mapper;

import kr.ac.univ.common.dto.mapper.EntityMapper;
import kr.ac.univ.noticeBoard.domain.NoticeBoardComment;
import kr.ac.univ.noticeBoard.dto.NoticeBoardCommentDto;
import org.mapstruct.Mapper;
import org.mapstruct.factory.Mappers;

@Mapper(componentModel = "spring")
public interface NoticeBoardCommentMapper extends EntityMapper<NoticeBoardCommentDto, NoticeBoardComment> {
   NoticeBoardCommentMapper INSTANCE = Mappers.getMapper(NoticeBoardCommentMapper.class);
}

<module-domain-core/src/main/java/kr/ac/univ/noticeBoard/repository/NoticeBoardCommentRepository.java>

package kr.ac.univ.noticeBoard.repository;

import java.util.List;

import kr.ac.univ.noticeBoard.domain.NoticeBoardComment;
import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.stereotype.Repository;

@Repository
public interface NoticeBoardCommentRepository extends JpaRepository<NoticeBoardComment, Long> {
   List<NoticeBoardComment> findAllByNoticeBoardIdxOrderByCreatedDateDesc(Long noticeBoardIdx);

   void deleteAllByNoticeBoardIdx(Long noticeBoardIdx);
}

<module-domain-core/src/main/java/kr/ac/univ/noticeBoard/repository/NoticeBoardCommentRepositoryImpl.java>

package kr.ac.univ.noticeBoard.repository;

import javax.transaction.Transactional;

import kr.ac.univ.noticeBoard.domain.NoticeBoardComment;
import kr.ac.univ.noticeBoard.domain.QNoticeBoardComment;
import org.springframework.data.jpa.repository.support.QuerydslRepositorySupport;
import org.springframework.stereotype.Repository;

import com.querydsl.jpa.impl.JPAQueryFactory;

@Repository
@Transactional
public class NoticeBoardCommentRepositoryImpl extends QuerydslRepositorySupport {
   private final JPAQueryFactory queryFactory;

   public NoticeBoardCommentRepositoryImpl(JPAQueryFactory queryFactory) {
       super(NoticeBoardComment.class);
       this.queryFactory = queryFactory;
   }

   public Long deleteAllByNoticeBoardIdx(Long noticeBoardIdx) {
       QNoticeBoardComment noticeBoardComment = QNoticeBoardComment.noticeBoardComment;

       /*
        * DELETE FROM AttachedFile
        * WHERE noticeBoardIdx = 'noticeBoardIdx'
        */
       return queryFactory
               .delete(noticeBoardComment)
               .where(noticeBoardComment.noticeBoardIdx.eq(noticeBoardIdx))
               .execute();
   }
}

<module-domain-core/src/main/java/kr/ac/univ/noticeBoard/service/NoticeBoardCommentService.java>

package kr.ac.univ.noticeBoard.service;

import kr.ac.univ.maintenance.dto.mapper.MaintenanceMapper;
import kr.ac.univ.noticeBoard.domain.NoticeBoardComment;
import kr.ac.univ.noticeBoard.dto.NoticeBoardCommentDto;
import kr.ac.univ.noticeBoard.dto.mapper.NoticeBoardCommentMapper;
import kr.ac.univ.noticeBoard.repository.NoticeBoardCommentRepository;
import kr.ac.univ.noticeBoard.repository.NoticeBoardCommentRepositoryImpl;
import kr.ac.univ.user.domain.User;
import kr.ac.univ.user.repository.UserRepository;
import kr.ac.univ.util.AccessCheck;
import kr.ac.univ.util.EmptyUtil;
import kr.ac.univ.util.NewIconCheck;
import org.springframework.stereotype.Service;

import javax.transaction.Transactional;
import java.util.List;

@Service
public class NoticeBoardCommentService {
    private final NoticeBoardCommentRepository noticeBoardCommentRepository;
    private final NoticeBoardCommentRepositoryImpl noticeBoardCommentRepositoryImpl;
    private final UserRepository userRepository;

    public NoticeBoardCommentService(NoticeBoardCommentRepository noticeBoardCommentRepository, NoticeBoardCommentRepositoryImpl noticeBoardCommentRepositoryImpl, UserRepository userRepository) {
        this.noticeBoardCommentRepository = noticeBoardCommentRepository;
        this.noticeBoardCommentRepositoryImpl = noticeBoardCommentRepositoryImpl;
        this.userRepository = userRepository;
    }

    public List<NoticeBoardCommentDto> findAllByNoticeBoardIdxOrderByCreatedDateDesc(Long noticeBoardIdx) {
        List<NoticeBoardCommentDto> noticeBoardCommentDtoList = null;

        noticeBoardCommentDtoList = NoticeBoardCommentMapper.INSTANCE.toDto(noticeBoardCommentRepository.findAllByNoticeBoardIdxOrderByCreatedDateDesc(noticeBoardIdx));

        for (NoticeBoardCommentDto noticeBoardCommentDto : noticeBoardCommentDtoList) {
            // NewIcon 판별
            noticeBoardCommentDto.setNewIcon(NewIconCheck.isNew(noticeBoardCommentDto.getCreatedDate()));

            // 권한 설정
            // Update: isAccessInGeneral 메소드에 따라 접근 가능 및 불가
            // 탈퇴 회원은 권한을 general로 설정 후 권한을 검사함
            User user = userRepository.findByUsername(noticeBoardCommentDto.getCreatedBy());

            noticeBoardCommentDto.setAccess(AccessCheck.isAccessInGeneral(noticeBoardCommentDto.getCreatedBy(), EmptyUtil.isEmpty(user) ? "general" : user.getAuthorityType().getAuthorityType()));
        }

        return noticeBoardCommentDtoList;
    }

    public Long insertNoticeBoardComment(NoticeBoardCommentDto noticeBoardCommentDto) {
        return noticeBoardCommentRepository.save(NoticeBoardCommentMapper.INSTANCE.toEntity(noticeBoardCommentDto)).getIdx();
    }

    @Transactional
    public Long updateNoticeBoardComment(Long idx, NoticeBoardCommentDto noticeBoardCommentDto) {
        NoticeBoardComment persistNoticeBoardComment = noticeBoardCommentRepository.getOne(idx);
        NoticeBoardComment noticeBoardComment = NoticeBoardCommentMapper.INSTANCE.toEntity(noticeBoardCommentDto);

        persistNoticeBoardComment.update(noticeBoardComment);

        return noticeBoardCommentRepository.save(persistNoticeBoardComment).getIdx();
    }


    public void deleteNoticeBoardCommentByIdx(Long idx) {
        noticeBoardCommentRepository.deleteById(idx);
    }

    public void deleteAllByNoticeBoardIdx(Long idx) {
        noticeBoardCommentRepositoryImpl.deleteAllByNoticeBoardIdx(idx);
    }

}

<module-app-web/src/main/java/kr/ac/univ/controller/NoticeBoardController.java>

package kr.ac.univ.controller;

import kr.ac.univ.common.dto.SearchDto;
import kr.ac.univ.noticeBoard.dto.NoticeBoardCommentDto;
import kr.ac.univ.noticeBoard.dto.NoticeBoardDto;
import kr.ac.univ.noticeBoard.service.NoticeBoardAttachedFileService;
import kr.ac.univ.noticeBoard.service.NoticeBoardCommentService;
import kr.ac.univ.noticeBoard.service.NoticeBoardService;
import org.springframework.data.domain.Pageable;
import org.springframework.data.web.PageableDefault;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;

import java.util.List;

@Controller
@RequestMapping("/notice-board")
public class NoticeBoardController {
   private final NoticeBoardService noticeBoardService;
   private final NoticeBoardAttachedFileService noticeBoardAttachedFileService;
   private final NoticeBoardCommentService noticeBoardCommentService;

   public NoticeBoardController(NoticeBoardService noticeBoardService, NoticeBoardAttachedFileService noticeBoardAttachedFileService, NoticeBoardCommentService noticeBoardCommentService) {
       this.noticeBoardService = noticeBoardService;
       this.noticeBoardAttachedFileService = noticeBoardAttachedFileService;
       this.noticeBoardCommentService = noticeBoardCommentService;
   }

   // List
   @GetMapping("/list")
   public String noticeBoardList(@PageableDefault Pageable pageable, SearchDto searchDto, Model model) {
       model.addAttribute("noticeBoardDtoList", noticeBoardService.findNoticeBoardList(pageable, searchDto));

       return "/noticeBoard/list";
   }

   // Form Update
   @GetMapping("/form{idx}")
   public String noticeBoardForm(@RequestParam(value = "idx", defaultValue = "0") Long idx, Model model) {
       NoticeBoardDto noticeBoardDto = noticeBoardService.findNoticeBoardByIdx(idx);
       String returnPage = null;

       // 권한 확인
       if (noticeBoardDto.isAccess()) {
           noticeBoardDto = noticeBoardAttachedFileService.findAttachedFileByNoticeBoardIdx(idx, noticeBoardDto);

           model.addAttribute("noticeBoardDto", noticeBoardDto);

           returnPage = "/noticeBoard/form";
       } else {
           returnPage = "/user/permission-denied";
       }

       return returnPage;
   }

   // Read
   @GetMapping({"", "/"})
   public String noticeBoardRead(@RequestParam(value = "idx", defaultValue = "0") Long idx, Model model) {
       NoticeBoardDto noticeBoardDto = null;
       List<NoticeBoardCommentDto> noticeBoardCommentDtoList = null;

       noticeBoardDto = noticeBoardService.findNoticeBoardByIdx(idx);
       noticeBoardDto = noticeBoardAttachedFileService.findAttachedFileByNoticeBoardIdx(idx, noticeBoardDto);
       noticeBoardCommentDtoList = noticeBoardCommentService.findAllByNoticeBoardIdxOrderByCreatedDateDesc(idx);

       model.addAttribute("noticeBoardDto", noticeBoardDto);
       model.addAttribute("noticeBoardCommentDtoList", noticeBoardCommentDtoList);

       return "/noticeBoard/read";
   }
}

<module-app-api/src/main/java/kr/ac/univ/controller/NoticeBoardCommentRestController.java>

package kr.ac.univ.controller;

import kr.ac.univ.noticeBoard.domain.NoticeBoardComment;
import kr.ac.univ.noticeBoard.dto.NoticeBoardCommentDto;
import kr.ac.univ.noticeBoard.service.NoticeBoardCommentService;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.DeleteMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.PutMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/api/notice-boards-comments")
public class NoticeBoardCommentRestController {
   private final NoticeBoardCommentService noticeBoardCommentService;

   public NoticeBoardCommentRestController(NoticeBoardCommentService noticeBoardCommentService) {
       this.noticeBoardCommentService = noticeBoardCommentService;
   }

   @PostMapping
   public ResponseEntity<?> postNoticeBoard(@RequestBody NoticeBoardComment noticeBoardComment) {
       Long idx = noticeBoardCommentService.insertNoticeBoardComment(noticeBoardComment);

       return new ResponseEntity<>(idx, HttpStatus.CREATED);
   }

   @PutMapping("/{idx}")
   public ResponseEntity<?> putNoticeBoard(@PathVariable("idx") Long idx, @RequestBody NoticeBoardCommentDto noticeBoardCommentDto) {
       noticeBoardCommentService.updateNoticeBoardComment(idx, noticeBoardCommentDto);

       return new ResponseEntity<>("{}", HttpStatus.OK);
   }

   @DeleteMapping("/{idx}")
   public ResponseEntity<?> deleteNoticeBoard(@PathVariable("idx") Long idx) {
       noticeBoardCommentService.deleteNoticeBoardCommentByIdx(idx);

       return new ResponseEntity<>("{}", HttpStatus.OK);
   }
}

<module-system-common/src/main/java/kr/ac/univ/util/AccessCheck.java>

package kr.ac.univ.util;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;

public class AccessCheck {
    /**
     * [일반적인 상황에서 사용자 권한에 따른 접근 가능 여부]
     * <p>
     * root: 모든 권한에 대한 접근 허용, admin 페이지 접근 가능
     * manager: 작성자 권한이 root인 경우 접근 불가, 작성자 권한이 manager인 경우 로그인한 사용자의 username과 작성자가 같은 경우 접근 허용, 작성자 권한이 general인 경우 접근 허용, admin 페이지 접근 가능
     * general: 작성자 권한이 root, manager인 경우 접근 불가, 작성자 권한이 general인 경우 로그인한 사용자의 username과 작성자가 같은 경우 접근 허용
     * non_user: 로그인 불가
     * anonymous: 로그인 불가
     *
     * @param createdBy
     * @return
     */
    public static Boolean isAccessInGeneral(String createdBy, String authorityType) {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        boolean result = false;

        // 비인증 사용자, 인증이 안된 경우, authentication 객체가 null인 경우
        // -> 접근 불가
        if (!"anonymousUser".equals(authentication.getPrincipal()) || !authentication.isAuthenticated() || EmptyUtil.isEmpty(authentication)) {
            UserDetails userDetails = (UserDetails) authentication.getPrincipal();
            String authenticationUsername = userDetails.getUsername();

            for (GrantedAuthority grantedAuthority : userDetails.getAuthorities()) {
                switch (grantedAuthority.getAuthority()) {
                    // 로그인한 사용자의 권한: root
                    // -> 접근 가능
                    case "root":
                        result = true;
                        break;
                    case "manager":
                        // createdBy: root
                        // -> 접근 불가
                        if ("root".equals(createdBy)) {
                            result = false;
                        }
                        // username authority: MANAGER
                        // 로그인한 사용자의 username과 username: 다름
                        // -> 접근 불가
                        else if ("manager".equals(authorityType) && !authenticationUsername.equals(createdBy)) {
                            result = false;
                        }
                        // 나머지 조건
                        // -> 접근 가능
                        else {
                            result = true;
                        }
                        break;
                    default:
                        // 로그인한 사용자의 username과 createdBy: 같음
                        // -> 접근 가능
                        if (authenticationUsername.equals(createdBy)) {
                            result = true;
                        }
                        // 로그인한 사용자의 username과 createdBy: 다름
                        // -> 접근 불가
                        else {
                            result = false;
                        }
                        break;
                }
            }
        }

        return result;
    }

    /**
     * [module-app-admin user에서 사용자 권한에 따른 접근 가능 여부]
     * <p>
     * 비인증 사용자인 경우 접근 불가
     * root: 모든 권한에 대한 접근 허용
     * manager: 작성자가 root인 경우 접근 허용, 로그인한 사용자의 username과 작성자가 같은 경우 접근 허용
     *
     * @param createdBy
     * @return
     */
    public static Boolean isAccessInModuleAdminUser(String createdBy, String username, String authorityType) {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        boolean result = false;

        // 비인증 사용자, 인증이 안된 경우, authentication 객체가 null인 경우
        // -> 접근 불가
        if (!"anonymousUser".equals(authentication.getPrincipal()) || !authentication.isAuthenticated() || EmptyUtil.isEmpty(authentication)) {
            UserDetails userDetails = (UserDetails) authentication.getPrincipal();
            String authenticationUsername = userDetails.getUsername();

            for (GrantedAuthority grantedAuthority : userDetails.getAuthorities()) {
                switch (grantedAuthority.getAuthority()) {
                    // 로그인한 사용자의 권한: root
                    // -> 접근 가능
                    case "root":
                        result = true;
                        break;
                    case "manager":
                        // 로그인한 사용자의 권한: manager
                        // 로그인한 사용자의 username과 createdBy: 같음
                        // -> 접근 가능
                        if (authenticationUsername.equals(createdBy)) {
                            result = true;
                        }
                        // 로그인한 사용자의 권한: manager
                        // username의 권한 general || non_user
                        // -> 접근 가능
                        else if (("general".equals(authorityType) || "non_user".equals(authorityType))) {
                            result = true;
                        }
                        // 로그인한 사용자의 권한: manager
                        // 로그인한 사용자의 username과 username: 같음
                        // -> 접근 가능
                        else if (authenticationUsername.equals(username)) {
                            result = true;
                        }
                        // 이외
                        // -> 접근 불가
                        else {
                            result = false;
                        }
                        break;
                    default:
                        result = false;
                        break;
                }
            }
        }

        return result;
    }

    /**
     * [module-app-web user에서 사용자 권한에 따른 접근 가능 여부]
     * <p>
     * 비인증 사용자인 경우 접근 불가
     * 작성자가 root인 경우 접근 허용
     * 작성자 권한이 MANAGER인 경우 접근 허용
     * 작성자와 사용자 아이디가 같은 경우 접근 허용
     *
     * @param createdBy
     * @return
     */
    public static Boolean isAccessInModuleWebUser(String createdBy, String username, String authorityType) {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        boolean result = false;

        // 비인증 사용자, 인증이 안된 경우, authentication 객체가 null인 경우
        // -> 접근 불가
        if ("anonymousUser".equals(authentication.getPrincipal()) || !authentication.isAuthenticated() || EmptyUtil.isEmpty(authentication)) {
            result = false;
        } else {
            UserDetails userDetails = (UserDetails) authentication.getPrincipal();
            String authenticationUsername = userDetails.getUsername();

            // createdBy: root
            // username authority: MANAGER
            // 로그인한 사용자의 username과 username: 같음
            // -> 접근 가능
            if ("root".equals(createdBy) || "MANAGER".equals(authorityType) && username.equals(authenticationUsername)) {
                result = true;
            }
            // 로그인한 사용자의 username과 createdBy: 같음
            // -> 접근 가능
            else if (authenticationUsername.equals(createdBy)) {
                result = true;
            } else {
                result = false;
            }
        }

        return result;
    }
}