refactor: 코드리뷰 피드백 반영

* feat: 계층권한 구현

* refactor: 생성자 메서드 위치 변경

server/build.gradle.kts

@@ -1,7 +1,7 @@
 plugins {
-    java
-    id("org.springframework.boot") version "2.6.7"
-    id("io.spring.dependency-management") version "1.0.11.RELEASE"
+	java
+	id("org.springframework.boot") version "2.6.7"
+	id("io.spring.dependency-management") version "1.0.11.RELEASE"
 }
 
 group = "com.ticketing"
@@ -9,18 +9,18 @@ version = "0.0.1-SNAPSHOT"
 
 val javaVersion = JavaVersion.VERSION_11
 java {
-    sourceCompatibility = javaVersion
-    targetCompatibility = javaVersion
+	sourceCompatibility = javaVersion
+	targetCompatibility = javaVersion
 }
 
 configurations {
-    compileOnly {
-        extendsFrom(configurations.annotationProcessor.get())
-    }
+	compileOnly {
+		extendsFrom(configurations.annotationProcessor.get())
+	}
 }
 
 repositories {
-    mavenCentral()
+	mavenCentral()
 }
 
 
@@ -33,36 +33,36 @@ dependencies {
 	implementation("org.springframework.boot:spring-boot-starter-actuator")
 	implementation("org.springframework.boot:spring-boot-starter-log4j2")
 	implementation("org.projectlombok:lombok:1.18.20")
-    implementation("io.springfox:springfox-boot-starter:3.0.0")
+	implementation("io.springfox:springfox-boot-starter:3.0.0")
 	implementation("io.springfox:springfox-swagger-ui:3.0.0")
 	implementation("com.github.ulisesbocchio:jasypt-spring-boot-starter:3.0.4")
 	implementation("com.lmax:disruptor:3.4.2")
 	implementation("io.jsonwebtoken:jjwt-api:0.11.2")
-  implementation("com.googlecode.json-simple:json-simple:1.1.1")
+	implementation("com.googlecode.json-simple:json-simple:1.1.1")
 	implementation("org.springframework.boot:spring-boot-starter-data-redis")
 
-    modules {
-        module("org.springframework.boot:spring-boot-starter-logging") {
-            replacedBy("org.springframework.boot:spring-boot-starter-log4j2", "Use Log4j2 instead of Logback")
-        }
-    }
+	modules {
+		module("org.springframework.boot:spring-boot-starter-logging") {
+			replacedBy("org.springframework.boot:spring-boot-starter-log4j2", "Use Log4j2 instead of Logback")
+		}
+	}
 
-    testImplementation("org.springframework.boot:spring-boot-starter-test")
-    testImplementation("org.springframework.security:spring-security-test")
-    testImplementation("org.junit.jupiter:junit-jupiter-api:5.8.1")
+	testImplementation("org.springframework.boot:spring-boot-starter-test")
+	testImplementation("org.springframework.security:spring-security-test")
+	testImplementation("org.junit.jupiter:junit-jupiter-api:5.8.1")
 
-    compileOnly("org.projectlombok:lombok")
-    runtimeOnly("mysql:mysql-connector-java")
-    runtimeOnly("io.jsonwebtoken:jjwt-impl:0.11.2")
-    runtimeOnly("io.jsonwebtoken:jjwt-jackson:0.11.2")
-    annotationProcessor("org.projectlombok:lombok")
-    annotationProcessor("org.springframework.boot:spring-boot-configuration-processor")
+	compileOnly("org.projectlombok:lombok")
+	runtimeOnly("mysql:mysql-connector-java")
+	runtimeOnly("io.jsonwebtoken:jjwt-impl:0.11.2")
+	runtimeOnly("io.jsonwebtoken:jjwt-jackson:0.11.2")
+	annotationProcessor("org.projectlombok:lombok")
+	annotationProcessor("org.springframework.boot:spring-boot-configuration-processor")
 
-    testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine:5.8.1")
-    testImplementation("org.springframework.boot:spring-boot-starter-test")
-    testImplementation("org.springframework.security:spring-security-test")
+	testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine:5.8.1")
+	testImplementation("org.springframework.boot:spring-boot-starter-test")
+	testImplementation("org.springframework.security:spring-security-test")
 }
 
 tasks.withType<Test> {
-    useJUnitPlatform()
+	useJUnitPlatform()
 }

server/src/main/java/com/ticketing/server/global/factory/YamlPropertySourceFactory.java

@@ -5,19 +5,23 @@ import java.util.Properties;
 import org.springframework.beans.factory.config.YamlPropertiesFactoryBean;
 import org.springframework.core.env.PropertiesPropertySource;
 import org.springframework.core.env.PropertySource;
-import org.springframework.core.io.Resource;
 import org.springframework.core.io.support.EncodedResource;
 import org.springframework.core.io.support.PropertySourceFactory;
+import org.springframework.lang.Nullable;
+import org.springframework.util.StringUtils;
 
 public class YamlPropertySourceFactory implements PropertySourceFactory {
 
 	@Override
-	public PropertySource<?> createPropertySource(String name, EncodedResource encodedResource) {
-		Resource resource = encodedResource.getResource();
-		YamlPropertiesFactoryBean factoryBean = new YamlPropertiesFactoryBean();
-		factoryBean.setResources(resource);
+	public PropertySource<?> createPropertySource(@Nullable String name, EncodedResource resource) {
+		Properties yamlProperties = loadYamlProperties(resource);
+		String sourceName = StringUtils.hasText(name) ? name : resource.getResource().getFilename();
+		return new PropertiesPropertySource(Objects.requireNonNull(sourceName), Objects.requireNonNull(yamlProperties));
+	}
 
-		Properties properties = factoryBean.getObject();
-		return new PropertiesPropertySource(Objects.requireNonNull(resource.getFilename()), Objects.requireNonNull(properties));
+	private Properties loadYamlProperties(EncodedResource resource) {
+		YamlPropertiesFactoryBean factory = new YamlPropertiesFactoryBean();
+		factory.setResources(resource.getResource());
+		return factory.getObject();
 	}
 }

server/src/main/java/com/ticketing/server/global/security/RoleConfig.java

@@ -0,0 +1,56 @@
+package com.ticketing.server.global.security;
+
+import com.ticketing.server.user.domain.UserGrade;
+import java.util.ArrayList;
+import java.util.List;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.access.AccessDecisionManager;
+import org.springframework.security.access.AccessDecisionVoter;
+import org.springframework.security.access.annotation.Jsr250Voter;
+import org.springframework.security.access.expression.method.ExpressionBasedPreInvocationAdvice;
+import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
+import org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl;
+import org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter;
+import org.springframework.security.access.vote.AffirmativeBased;
+import org.springframework.security.access.vote.AuthenticatedVoter;
+import org.springframework.security.access.vote.RoleHierarchyVoter;
+import org.springframework.security.access.vote.RoleVoter;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;
+
+@EnableGlobalMethodSecurity(
+	securedEnabled = true,
+	jsr250Enabled = true,
+	prePostEnabled = true
+)
+@Configuration
+public class RoleConfig extends GlobalMethodSecurityConfiguration {
+
+	@Override
+	protected AccessDecisionManager accessDecisionManager() {
+		List<AccessDecisionVoter<?>> decisionVoters = new ArrayList<>();
+		ExpressionBasedPreInvocationAdvice expressionAdvice = new ExpressionBasedPreInvocationAdvice();
+		expressionAdvice.setExpressionHandler(getExpressionHandler());
+		decisionVoters.add(new PreInvocationAuthorizationAdviceVoter(expressionAdvice));
+		decisionVoters.add(new Jsr250Voter());
+
+		decisionVoters.add(new RoleVoter());
+		decisionVoters.add(roleHierarchyVoter());
+		decisionVoters.add(new AuthenticatedVoter());
+		return new AffirmativeBased(decisionVoters);
+	}
+
+	@Bean
+	public RoleHierarchyVoter roleHierarchyVoter() {
+		return new RoleHierarchyVoter(roleHierarchy());
+	}
+
+	@Bean
+	public RoleHierarchy roleHierarchy() {
+		RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
+		roleHierarchy.setHierarchy(UserGrade.getRoleHierarchy());
+		return roleHierarchy;
+	}
+
+}

server/src/main/java/com/ticketing/server/global/security/WebSecurityConfig.java

@@ -8,9 +8,7 @@ import lombok.RequiredArgsConstructor;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.builders.WebSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.http.SessionCreationPolicy;
@@ -19,7 +17,6 @@ import org.springframework.security.crypto.password.PasswordEncoder;
 
 @Configuration
 @EnableWebSecurity
-@EnableGlobalMethodSecurity(securedEnabled = true)
 @RequiredArgsConstructor
 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
@@ -53,9 +50,9 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
 			.and()
 			.authorizeRequests()
-			.antMatchers(HttpMethod.POST, "/api/user/login").permitAll()
-			.antMatchers(HttpMethod.POST, "/api/user/refresh").permitAll()
-			.antMatchers(HttpMethod.POST, "/api/user").permitAll()
+			.antMatchers(HttpMethod.POST, "/api/auth/token").permitAll()
+			.antMatchers(HttpMethod.POST, "/api/auth/refresh").permitAll()
+			.antMatchers(HttpMethod.POST, "/api/users").permitAll()
 			.antMatchers("/api/movies/**").permitAll()
 			.antMatchers("/l7check").permitAll()
 			.antMatchers("/actuator/**").permitAll()

server/src/main/java/com/ticketing/server/global/security/jwt/JwtProperties.java

@@ -10,7 +10,7 @@ import org.springframework.context.annotation.PropertySource;
 @Getter
 @RequiredArgsConstructor
 @ConstructorBinding
-@ConfigurationProperties("jwt")
+@ConfigurationProperties(value = "jwt")
 @PropertySource(value = "classpath:application.yml", factory = YamlPropertySourceFactory.class)
 public class JwtProperties {
 

server/src/main/java/com/ticketing/server/global/validator/constraints/FieldsValueNotMatch.java

@@ -0,0 +1,28 @@
+package com.ticketing.server.global.validator.constraints;
+
+import com.ticketing.server.global.validator.constraintvalidators.FieldsValueNotMatchValidator;
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+import javax.validation.Constraint;
+import javax.validation.Payload;
+
+@Constraint(validatedBy = FieldsValueNotMatchValidator.class)
+@Target(ElementType.TYPE)
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface FieldsValueNotMatch {
+
+	String message();
+
+	String field();
+
+	String fieldMatch();
+
+	Class<?>[] groups() default {};
+
+	Class<? extends Payload>[] payload() default {};
+
+}

server/src/main/java/com/ticketing/server/global/validator/constraintvalidators/FieldsValueNotMatchValidator.java

@@ -0,0 +1,29 @@
+package com.ticketing.server.global.validator.constraintvalidators;
+
+import com.ticketing.server.global.validator.constraints.FieldsValueNotMatch;
+import javax.validation.ConstraintValidator;
+import javax.validation.ConstraintValidatorContext;
+import org.springframework.beans.BeanWrapperImpl;
+
+public class FieldsValueNotMatchValidator implements ConstraintValidator<FieldsValueNotMatch, Object> {
+
+	private String field;
+	private String fieldMatch;
+
+	public void initialize(FieldsValueNotMatch constraintAnnotation) {
+		this.field = constraintAnnotation.field();
+		this.fieldMatch = constraintAnnotation.fieldMatch();
+	}
+
+	@Override
+	public boolean isValid(Object value, ConstraintValidatorContext context) {
+		Object fieldValue = new BeanWrapperImpl(value).getPropertyValue(field);
+		Object fieldMatchValue = new BeanWrapperImpl(value).getPropertyValue(fieldMatch);
+
+		if (fieldValue != null) {
+			return !fieldValue.equals(fieldMatchValue);
+		} else {
+			return fieldMatchValue != null;
+		}
+	}
+}

server/src/main/java/com/ticketing/server/user/application/AuthController.java

@@ -0,0 +1,52 @@
+package com.ticketing.server.user.application;
+
+import com.ticketing.server.user.application.request.LoginRequest;
+import com.ticketing.server.user.application.response.TokenDto;
+import com.ticketing.server.user.service.interfaces.AuthenticationService;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/api/auth")
+@Slf4j
+public class AuthController {
+
+	private final AuthenticationService authenticationService;
+
+	@PostMapping("/token")
+	public ResponseEntity<TokenDto> login(@RequestBody LoginRequest loginRequest) {
+		TokenDto tokenDto = authenticationService.generateTokenDto(loginRequest.toAuthentication());
+
+		return ResponseEntity.status(HttpStatus.OK)
+			.headers(getHttpHeaders())
+			.body(tokenDto);
+	}
+
+	@PostMapping("/refresh")
+	public ResponseEntity<TokenDto> refreshToken(@RequestParam("refreshToken") String refreshToken) {
+		TokenDto tokenDto = authenticationService.reissueTokenDto(refreshToken);
+
+		return ResponseEntity.status(HttpStatus.OK)
+			.headers(getHttpHeaders())
+			.body(tokenDto);
+	}
+
+	private HttpHeaders getHttpHeaders() {
+		HttpHeaders httpHeaders = new HttpHeaders();
+		httpHeaders.set(HttpHeaders.CACHE_CONTROL, "no-cache, no-store, must-revalidate");
+		httpHeaders.set(HttpHeaders.PRAGMA, "no-store");
+		httpHeaders.set(HttpHeaders.EXPIRES, "0");
+
+		return httpHeaders;
+	}
+
+}

server/src/main/java/com/ticketing/server/user/application/UserController.java

@@ -1,43 +1,40 @@
 package com.ticketing.server.user.application;
 
-import com.ticketing.server.global.security.jwt.JwtProperties;
-import com.ticketing.server.user.application.request.LoginRequest;
 import com.ticketing.server.user.application.request.SignUpRequest;
+import com.ticketing.server.user.application.request.UserChangePasswordRequest;
 import com.ticketing.server.user.application.request.UserDeleteRequest;
-import com.ticketing.server.user.application.request.UserModifyPasswordRequest;
 import com.ticketing.server.user.application.response.SignUpResponse;
-import com.ticketing.server.user.application.response.TokenDto;
 import com.ticketing.server.user.application.response.UserChangePasswordResponse;
 import com.ticketing.server.user.application.response.UserDeleteResponse;
+import com.ticketing.server.user.application.response.UserDetailResponse;
 import com.ticketing.server.user.domain.User;
+import com.ticketing.server.user.domain.UserGrade;
 import com.ticketing.server.user.service.UserServiceImpl;
-import com.ticketing.server.user.service.interfaces.AuthenticationService;
-import javax.servlet.http.HttpServletResponse;
 import javax.validation.Valid;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.annotation.Secured;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.PutMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 
 @RestController
 @RequiredArgsConstructor
-@RequestMapping("/api/user")
+@RequestMapping("/api/users")
 @Slf4j
 public class UserController {
 
 	private final UserServiceImpl userService;
-	private final AuthenticationService authenticationService;
 	private final PasswordEncoder passwordEncoder;
-	private final JwtProperties jwtProperties;
 
 	@PostMapping
 	public ResponseEntity<SignUpResponse> register(@RequestBody @Valid SignUpRequest request) {
@@ -45,41 +42,27 @@ public class UserController {
 		return ResponseEntity.status(HttpStatus.CREATED).body(SignUpResponse.from(user));
 	}
 
-	@DeleteMapping
+	@GetMapping("/details")
 	@Secured("ROLE_GUEST")
+	public ResponseEntity<UserDetailResponse> details(@AuthenticationPrincipal UserDetails userRequest) {
+		User user = userService.findByEmail(userRequest.getUsername());
+		return ResponseEntity.status(HttpStatus.OK).body(UserDetailResponse.from(user));
+	}
+
+	@DeleteMapping
+	@Secured(UserGrade.ROLES.GUEST)
 	public ResponseEntity<UserDeleteResponse> deleteUser(@RequestBody @Valid UserDeleteRequest request) {
 		User user = userService.delete(request.toDeleteUserDto(passwordEncoder));
 		return ResponseEntity.status(HttpStatus.OK).body(UserDeleteResponse.from(user));
 	}
 
 	@PutMapping("/password")
-	@Secured("ROLE_GUEST")
-	public ResponseEntity<UserChangePasswordResponse> changePassword(@RequestBody @Valid UserModifyPasswordRequest request) {
-		if (request.oldEqualNew()) {
-			log.error("기존 패스워드와 동일한 패스워드로 변경할 수 없습니다.");
-			return ResponseEntity.status(HttpStatus.BAD_REQUEST).build();
-		}
-
-		User user = userService.changePassword(request.toChangePasswordDto(passwordEncoder));
+	@Secured(UserGrade.ROLES.GUEST)
+	public ResponseEntity<UserChangePasswordResponse> changePassword(
+		@AuthenticationPrincipal UserDetails userRequest,
+		@RequestBody @Valid UserChangePasswordRequest request) {
+		User user = userService.changePassword(request.toChangePasswordDto(userRequest.getUsername(), passwordEncoder));
 		return ResponseEntity.status(HttpStatus.OK).body(UserChangePasswordResponse.from(user));
 	}
 
-	@PostMapping("/login")
-	public ResponseEntity<TokenDto> login(@RequestBody LoginRequest loginRequest, HttpServletResponse response) {
-		TokenDto tokenDto = authenticationService.login(loginRequest.toAuthentication());
-
-		response.setHeader("Cache-Control", "no-store");
-		response.setHeader("Pragma", "no-store");
-		return ResponseEntity.status(HttpStatus.OK).body(tokenDto);
-	}
-
-	@PostMapping("/refresh")
-	public ResponseEntity<TokenDto> refreshToken(@RequestParam("refreshToken") String refreshToken, HttpServletResponse response) {
-		TokenDto tokenDto = authenticationService.reissueAccessToken(refreshToken);
-
-		response.setHeader(jwtProperties.getAccessHeader(), tokenDto.getAccessToken());
-		response.setHeader(jwtProperties.getRefreshHeader(), tokenDto.getRefreshToken());
-		return ResponseEntity.status(HttpStatus.OK).body(tokenDto);
-	}
-
 }

server/src/main/java/com/ticketing/server/user/application/request/UserChangePasswordRequest.java

@@ -1,7 +1,7 @@
 package com.ticketing.server.user.application.request;
 
+import com.ticketing.server.global.validator.constraints.FieldsValueNotMatch;
 import com.ticketing.server.user.service.dto.ChangePasswordDTO;
-import javax.validation.constraints.Email;
 import javax.validation.constraints.NotEmpty;
 import lombok.AllArgsConstructor;
 import lombok.Getter;
@@ -11,11 +11,12 @@ import org.springframework.security.crypto.password.PasswordEncoder;
 @Getter
 @NoArgsConstructor
 @AllArgsConstructor
-public class UserModifyPasswordRequest {
-
-	@NotEmpty(message = "{validation.not.empty.email}")
-	@Email(message = "{validation.email}")
-	private String email;
+@FieldsValueNotMatch(
+	field = "oldPassword",
+	fieldMatch = "newPassword",
+	message = "{validation.password.not.change}"
+)
+public class UserChangePasswordRequest {
 
 	@NotEmpty(message = "{validation.not.empty.oldpassword}")
 	private String oldPassword;
@@ -23,12 +24,8 @@ public class UserModifyPasswordRequest {
 	@NotEmpty(message = "{validation.not.empty.newpassword}")
 	private String newPassword;
 
-	public ChangePasswordDTO toChangePasswordDto(PasswordEncoder passwordEncoder) {
+	public ChangePasswordDTO toChangePasswordDto(String email, PasswordEncoder passwordEncoder) {
 		return new ChangePasswordDTO(email, oldPassword, newPassword, passwordEncoder);
 	}
 
-	public boolean oldEqualNew() {
-		return oldPassword.equals(newPassword);
-	}
-
 }

server/src/main/java/com/ticketing/server/user/application/response/UserDetailResponse.java

@@ -0,0 +1,21 @@
+package com.ticketing.server.user.application.response;
+
+import com.ticketing.server.user.domain.User;
+import com.ticketing.server.user.domain.UserGrade;
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+
+@Getter
+@AllArgsConstructor
+public class UserDetailResponse {
+
+	private String name;
+	private String email;
+	private UserGrade grade;
+	private String phone;
+
+	public static UserDetailResponse from(User user) {
+		return new UserDetailResponse(user.getName(), user.getEmail(), user.getGrade(), user.getPhone());
+	}
+
+}

server/src/main/java/com/ticketing/server/user/domain/User.java

@@ -23,14 +23,6 @@ import lombok.NoArgsConstructor;
 @NoArgsConstructor
 public class User extends AbstractEntity {
 
-	public User(String name, String email, String password, UserGrade grade, String phone) {
-		this.name = name;
-		this.email = email;
-		this.password = password;
-		this.grade = grade;
-		this.phone = phone;
-	}
-
 	@Column(name = "name")
 	@NotEmpty(message = "{validation.not.empty.name}")
 	private String name;
@@ -58,6 +50,14 @@ public class User extends AbstractEntity {
 
 	private LocalDateTime deletedAt;
 
+	public User(String name, String email, String password, UserGrade grade, String phone) {
+		this.name = name;
+		this.email = email;
+		this.password = password;
+		this.grade = grade;
+		this.phone = phone;
+	}
+
 	public User delete(DeleteUserDTO deleteUser) {
 		if (isDeleted) {
 			throw new AlreadyDeletedException("이미 탈퇴된 회원 입니다.");

server/src/main/java/com/ticketing/server/user/domain/UserGrade.java

@@ -1,5 +1,38 @@
 package com.ticketing.server.user.domain;
 
+import lombok.RequiredArgsConstructor;
+
+@RequiredArgsConstructor
 public enum UserGrade {
-	GUEST, STAFF
+	ADMIN(ROLES.ADMIN, null),
+	STAFF(ROLES.STAFF, ROLES.ADMIN),
+	GUEST(ROLES.GUEST, ROLES.STAFF);
+
+	private final String roleName;
+	private final String parentName;
+
+	public static class ROLES {
+
+		public static final String ADMIN = "ROLE_ADMIN";
+		public static final String STAFF = "ROLE_STAFF";
+		public static final String GUEST = "ROLE_GUEST";
+
+		private ROLES() {
+		}
+	}
+
+	public static String getRoleHierarchy() {
+		StringBuilder sb = new StringBuilder();
+
+		for (UserGrade grade : UserGrade.values()) {
+			if (grade.parentName != null) {
+				sb.append(grade.parentName);
+				sb.append(" > ");
+				sb.append(grade.roleName);
+				sb.append("\n");
+			}
+		}
+
+		return sb.toString();
+	}
 }

server/src/main/java/com/ticketing/server/user/service/AuthenticationServiceImpl.java

@@ -29,7 +29,7 @@ public class AuthenticationServiceImpl implements AuthenticationService {
 
 	@Override
 	@Transactional
-	public TokenDto login(UsernamePasswordAuthenticationToken authenticationToken) {
+	public TokenDto generateTokenDto(UsernamePasswordAuthenticationToken authenticationToken) {
 		// 회원인증
 		Authentication authentication = authenticationManagerBuilder.getObject().authenticate(authenticationToken);
 
@@ -50,7 +50,7 @@ public class AuthenticationServiceImpl implements AuthenticationService {
 
 	@Override
 	@Transactional
-	public TokenDto reissueAccessToken(String bearerRefreshToken) {
+	public TokenDto reissueTokenDto(String bearerRefreshToken) {
 		String refreshToken = resolveToken(bearerRefreshToken);
 
 		// 토큰 검증

server/src/main/java/com/ticketing/server/user/service/CustomUserDetailsService.java

@@ -1,4 +1,4 @@
-package com.ticketing.server.global.security.service;
+package com.ticketing.server.user.service;
 
 import com.ticketing.server.user.domain.User;
 import com.ticketing.server.user.domain.repository.UserRepository;

server/src/main/java/com/ticketing/server/user/service/UserServiceImpl.java

@@ -39,13 +39,7 @@ public class UserServiceImpl implements UserService {
 	@Override
 	@Transactional
 	public User delete(@Valid DeleteUserDTO deleteUserDto) {
-		User user = userRepository.findByEmail(deleteUserDto.getEmail())
-			.orElseThrow(() -> {
-					log.error("존재하지 않는 이메일 입니다. :: {}", deleteUserDto.getEmail());
-					throw new EmailNotFoundException();
-				}
-			);
-
+		User user = findByEmail(deleteUserDto.getEmail());
 		return user.delete(deleteUserDto);
 	}
 
@@ -56,6 +50,16 @@ public class UserServiceImpl implements UserService {
 		return user.changePassword(changePasswordDto);
 	}
 
+	@Override
+	public User findByEmail(String email) {
+		return userRepository.findByEmail(email)
+			.orElseThrow(() -> {
+					log.error("존재하지 않는 이메일 입니다. :: {}", email);
+					throw new EmailNotFoundException();
+				}
+			);
+	}
+
 	private User findNotDeletedUserByEmail(String email) {
 		return userRepository.findByEmailAndIsDeletedFalse(email)
 			.orElseThrow(() -> {

server/src/main/java/com/ticketing/server/user/service/interfaces/AuthenticationService.java

@@ -5,8 +5,8 @@ import org.springframework.security.authentication.UsernamePasswordAuthenticatio
 
 public interface AuthenticationService {
 
-	TokenDto login(UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken);
+	TokenDto generateTokenDto(UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken);
 
-	TokenDto reissueAccessToken(String bearerRefreshToken);
+	TokenDto reissueTokenDto(String bearerRefreshToken);
 
 }

server/src/main/java/com/ticketing/server/user/service/interfaces/UserService.java

@@ -14,4 +14,5 @@ public interface UserService {
 
 	User changePassword(@Valid ChangePasswordDTO changePasswordDto);
 
+	User findByEmail(String email);
 }

server/src/main/resources/application.yml

@@ -27,7 +27,7 @@ jasypt:
     bean: jasyptStringEncryptor
 
 jwt:
-  access-header: ACCESS_TOKEN
+  access-header: Authorization
   refresh-header: REFRESH_TOKEN
   prefix: Bearer
   secret-key: Zi1sYWItdGlja2V0aW5nLXByb2plY3Qtc3ByaW5nLWJvb3Qtc2VjdXJpdHktand0LXNlY3JldC1rZXktZi1sYWItdGlja2V0aW5nLXByb2plY3Qtc3ByaW5nLWJvb3Qtc2VjdXJpdHktand0LXNlY3JldC1rZXkK

server/src/main/resources/i18n/messages.properties

@@ -7,3 +7,4 @@ validation.not.empty.grade="\uC0AC\uC6A9\uC790 \uB4F1\uAE09\uC740 \uD544\uC218 \
 validation.not.empty.phone="\uD734\uB300\uBC88\uD638\uB294 \uD544\uC218 \uC785\uB2C8\uB2E4."
 validation.email="\uC774\uBA54\uC77C\uC774 \uC62C\uBC14\uB974\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4."
 validation.phone="\uD734\uB300\uBC88\uD638\uAC00 \uC62C\uBC14\uB974\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4."
+validation.password.not.change="\uB3D9\uC77C\uD55C \uD328\uC2A4\uC6CC\uB4DC\uB85C \uBCC0\uACBD\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4."

server/src/main/resources/i18n/messages_en.properties

@@ -7,3 +7,4 @@ validation.not.empty.grade="user grade is required."
 validation.not.empty.phone="phone is required."
 validation.email="email is not valid."
 validation.phone="phone is not valid."
+validation.password.not.change="password not change."

server/src/main/resources/i18n/messages_ko.properties

@@ -7,3 +7,4 @@ validation.not.empty.grade="\uC0AC\uC6A9\uC790 \uB4F1\uAE09\uC740 \uD544\uC218 \
 validation.not.empty.phone="\uD734\uB300\uBC88\uD638\uB294 \uD544\uC218 \uC785\uB2C8\uB2E4."
 validation.email="\uC774\uBA54\uC77C\uC774 \uC62C\uBC14\uB974\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4."
 validation.phone="\uD734\uB300\uBC88\uD638\uAC00 \uC62C\uBC14\uB974\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4."
+validation.password.not.change="\uB3D9\uC77C\uD55C \uD328\uC2A4\uC6CC\uB4DC\uB85C \uBCC0\uACBD\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4."

server/src/test/java/com/ticketing/server/global/security/jwt/JwtPropertiesTest.java

@@ -27,7 +27,7 @@ class JwtPropertiesTest {
 		// when
 		// then
 		assertAll(
-			() -> assertThat(jwtProperties.getAccessHeader()).isEqualTo("ACCESS_TOKEN")
+			() -> assertThat(jwtProperties.getAccessHeader()).isEqualTo("Authorization")
 			, () -> assertThat(jwtProperties.getRefreshHeader()).isEqualTo("REFRESH_TOKEN")
 			, () -> assertThat(jwtProperties.getPrefix()).isEqualTo("Bearer")
 			, () -> assertThat(jwtProperties.getAccessTokenValidityInSeconds()).isEqualTo(60)

server/src/test/java/com/ticketing/server/user/application/AuthControllerTest.java

@@ -27,7 +27,10 @@ import org.springframework.web.context.WebApplicationContext;
 
 @SpringBootTest
 @Transactional
-class UserControllerTest {
+class AuthControllerTest {
+
+	private static final String LOGIN_URL = "/api/auth/token";
+	private static final String REGISTER_URL = "/api/users";
 
 	@Autowired
 	WebApplicationContext context;
@@ -53,7 +56,7 @@ class UserControllerTest {
 		LoginRequest request = new LoginRequest("ticketing@gmail.com", "qwe123");
 
 		// when
-		ResultActions actions = mvc.perform(post("/api/user/login")
+		ResultActions actions = mvc.perform(post(LOGIN_URL)
 			.content(asJsonString(request))
 			.contentType(MediaType.APPLICATION_JSON));
 
@@ -69,7 +72,7 @@ class UserControllerTest {
 		LoginRequest request = new LoginRequest("ticketing@gmail.com", "qwe1234");
 
 		// when
-		ResultActions actions = mvc.perform(post("/api/user/login")
+		ResultActions actions = mvc.perform(post(LOGIN_URL)
 			.content(asJsonString(request))
 			.contentType(MediaType.APPLICATION_JSON));
 
@@ -91,7 +94,7 @@ class UserControllerTest {
 
 		SignUpRequest signUpRequest = new SignUpRequest("ticketing", "ticketing@gmail.com", "qwe123", "010-2240-7920");
 
-		mvc.perform(post("/api/user")
+		mvc.perform(post(REGISTER_URL)
 			.content(asJsonString(signUpRequest))
 			.contentType(MediaType.APPLICATION_JSON));
 	}

server/src/test/java/com/ticketing/server/user/service/AuthenticationServiceImplTest.java

@@ -70,7 +70,7 @@ class AuthenticationServiceImplTest {
 		when(jwtProperties.hasTokenStartsWith(refreshToken)).thenReturn(true);
 
 		// when
-		TokenDto tokenDto = authenticationService.reissueAccessToken(refreshToken);
+		TokenDto tokenDto = authenticationService.reissueTokenDto(refreshToken);
 
 		// then
 		assertAll(

server/src/test/java/com/ticketing/server/user/service/UserServiceImplTest.java

@@ -2,6 +2,7 @@ package com.ticketing.server.user.service;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.junit.jupiter.api.Assertions.assertAll;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.when;
 
@@ -92,7 +93,10 @@ class UserServiceImplTest {
 		User user = userService.delete(deleteUserDto);
 
 		// then
-		assertThat(user).isNotNull();
+		assertAll(
+			() -> assertThat(user.isDeleted()).isTrue(),
+			() -> assertThat(user.getDeletedAt()).isNotNull()
+		);
 	}
 
 	@Test

server/src/test/resources/application.yml

@@ -16,12 +16,16 @@ spring:
     hibernate:
       ddl-auto: create
 
+  mvc:
+    pathmatch:
+      matching-strategy: ant_path_matcher
+
 jasypt:
   encryptor:
     bean: jasyptStringEncryptor
 
 jwt:
-  access-header: ACCESS_TOKEN
+  access-header: Authorization
   refresh-header: REFRESH_TOKEN
   prefix: Bearer
   secret-key: Zi1sYWItdGlja2V0aW5nLXByb2plY3Qtc3ByaW5nLWJvb3Qtc2VjdXJpdHktand0LXNlY3JldC1rZXktZi1sYWItdGlja2V0aW5nLXByb2plY3Qtc3ByaW5nLWJvb3Qtc2VjdXJpdHktand0LXNlY3JldC1rZXkK