[BE] feat: 리소스 접근 권한 검증 aop 구현

backend/src/main/java/reviewme/global/GlobalExceptionHandler.java

@@ -23,6 +23,7 @@
 import reviewme.global.exception.BadRequestException;
 import reviewme.global.exception.DataInconsistencyException;
 import reviewme.global.exception.FieldErrorResponse;
+import reviewme.global.exception.ForbiddenException;
 import reviewme.global.exception.NotFoundException;
 import reviewme.global.exception.UnauthorizedException;
 
@@ -45,6 +46,11 @@ public ProblemDetail handleUnauthorizedException(UnauthorizedException ex) {
         return ProblemDetail.forStatusAndDetail(HttpStatus.UNAUTHORIZED, ex.getErrorMessage());
     }
 
+    @ExceptionHandler(ForbiddenException.class)
+    public ProblemDetail handleForbiddenException(UnauthorizedException ex) {
+        return ProblemDetail.forStatusAndDetail(HttpStatus.FORBIDDEN, ex.getErrorMessage());
+    }
+
     @ExceptionHandler(DataInconsistencyException.class)
     public ProblemDetail handleDataConsistencyException(DataInconsistencyException ex) {
         return ProblemDetail.forStatusAndDetail(HttpStatus.INTERNAL_SERVER_ERROR, ex.getErrorMessage());

backend/src/main/java/reviewme/global/exception/ForbiddenException.java

@@ -0,0 +1,8 @@
+package reviewme.global.exception;
+
+public abstract class ForbiddenException extends ReviewMeException {
+
+    public ForbiddenException(String errorMessage) {
+        super(errorMessage);
+    }
+}

backend/src/main/java/reviewme/highlight/controller/HighlightController.java

@@ -6,10 +6,7 @@
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RestController;
-import reviewme.security.resolver.GuestReviewGroupSession;
-import reviewme.security.resolver.LoginMemberSession;
-import reviewme.security.resolver.dto.GuestReviewGroup;
-import reviewme.security.resolver.dto.LoginMember;
+import reviewme.security.aspect.RequireReviewGroupAccess;
 import reviewme.highlight.service.HighlightService;
 import reviewme.highlight.service.dto.HighlightsRequest;
 
@@ -20,14 +17,10 @@ public class HighlightController {
     private final HighlightService highlightService;
 
     @PostMapping("/v2/highlight")
+    @RequireReviewGroupAccess(target = "#request.reviewGroupId()")
     public ResponseEntity<Void> highlight(
-            @Valid @RequestBody HighlightsRequest request,
-            @LoginMemberSession(required = false) LoginMember loginMember,
-            @GuestReviewGroupSession(required = false) GuestReviewGroup guestReviewGroup
+            @Valid @RequestBody HighlightsRequest request
     ) {
-        /*
-        TODO : aop 인증 로직 필요 (존재하는 세션에 대해 reviewGroupId와 일치 여부 확인)
-        */
         highlightService.editHighlight(request);
         return ResponseEntity.ok().build();
     }

backend/src/main/java/reviewme/review/controller/ReviewController.java

@@ -11,10 +11,10 @@
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
-import reviewme.security.resolver.GuestReviewGroupSession;
 import reviewme.security.resolver.LoginMemberSession;
-import reviewme.security.resolver.dto.GuestReviewGroup;
 import reviewme.security.resolver.dto.LoginMember;
+import reviewme.security.aspect.RequireReviewAccess;
+import reviewme.security.aspect.RequireReviewGroupAccess;
 import reviewme.review.service.ReviewDetailLookupService;
 import reviewme.review.service.ReviewGatheredLookupService;
 import reviewme.review.service.ReviewListLookupService;
@@ -48,57 +48,40 @@ public ResponseEntity<Void> createReview(
     }
 
     @GetMapping("/v2/groups/{reviewGroupId}/reviews/received")
+    @RequireReviewGroupAccess(target = "#reviewGroupId")
     public ResponseEntity<ReceivedReviewPageResponse> findReceivedReviews(
             @PathVariable long reviewGroupId,
             @RequestParam(required = false) Long lastReviewId,
-            @RequestParam(required = false) Integer size,
-            @LoginMemberSession(required = false) LoginMember loginMember,
-            @GuestReviewGroupSession(required = false) GuestReviewGroup guestReviewGroup
+            @RequestParam(required = false) Integer size
     ) {
-        /*
-        TODO : aop 인증 로직 필요 (존재하는 세션에 대해 reviewGroupId와 일치 여부 확인)
-        */
-        ReceivedReviewPageResponse response = reviewListLookupService.getReceivedReviews(reviewGroupId, lastReviewId,
-                size);
+        ReceivedReviewPageResponse response = reviewListLookupService.getReceivedReviews(reviewGroupId, lastReviewId, size);
         return ResponseEntity.ok(response);
     }
 
     @GetMapping("/v2/reviews/{id}")
+    @RequireReviewAccess(target = "#id")
     public ResponseEntity<ReviewDetailResponse> findReceivedReviewDetail(
-            @PathVariable long id,
-            @LoginMemberSession(required = false) LoginMember loginMember,
-            @GuestReviewGroupSession(required = false) GuestReviewGroup guestReviewGroup
+            @PathVariable long id
     ) {
-        /*
-        TODO : aop 인증 로직 필요 (존재하는 세션에 대해 reviewId와 일치 여부 확인)
-        */
         ReviewDetailResponse response = reviewDetailLookupService.getReviewDetail(id);
         return ResponseEntity.ok(response);
     }
 
     @GetMapping("/v2/groups/{reviewGroupId}/reviews/summary")
+    @RequireReviewGroupAccess(target = "#reviewGroupId")
     public ResponseEntity<ReceivedReviewsSummaryResponse> findReceivedReviewOverview(
-            @PathVariable long reviewGroupId,
-            @LoginMemberSession(required = false) LoginMember loginMember,
-            @GuestReviewGroupSession(required = false) GuestReviewGroup guestReviewGroup
+            @PathVariable long reviewGroupId
     ) {
-        /*
-        TODO : aop 인증 로직 필요 (존재하는 세션에 대해 reviewGroupId와 일치 여부 확인)
-        */
         ReceivedReviewsSummaryResponse response = reviewSummaryService.getReviewSummary(reviewGroupId);
         return ResponseEntity.ok(response);
     }
 
     @GetMapping("/v2/groups/{reviewGroupId}/reviews/gather")
+    @RequireReviewGroupAccess(target = "#reviewGroupId")
     public ResponseEntity<ReviewsGatheredBySectionResponse> getReceivedReviewsBySectionId(
             @PathVariable long reviewGroupId,
-            @RequestParam("sectionId") long sectionId,
-            @LoginMemberSession(required = false) LoginMember loginMember,
-            @GuestReviewGroupSession(required = false) GuestReviewGroup guestReviewGroup
+            @RequestParam("sectionId") long sectionId
     ) {
-        /*
-        TODO : aop 인증 로직 필요 (존재하는 세션에 대해 reviewGroupId와 일치 여부 확인)
-        */
         ReviewsGatheredBySectionResponse response =
                 reviewGatheredLookupService.getReceivedReviewsBySectionId(reviewGroupId, sectionId);
         return ResponseEntity.ok(response);

backend/src/main/java/reviewme/review/service/ReviewDetailLookupService.java

@@ -25,7 +25,6 @@ public class ReviewDetailLookupService {
     public ReviewDetailResponse getReviewDetail(long reviewId) {
         Review review = reviewRepository.findById(reviewId)
                 .orElseThrow(() -> new ReviewNotFoundException(reviewId));
-
         ReviewGroup reviewGroup = reviewGroupRepository.findById(review.getReviewGroupId())
                 .orElseThrow(() -> new ReviewGroupNotFoundException(review.getReviewGroupId()));
 

backend/src/main/java/reviewme/review/service/ReviewListLookupService.java

@@ -7,8 +7,8 @@
 import org.springframework.transaction.annotation.Transactional;
 import reviewme.review.repository.ReviewRepository;
 import reviewme.review.service.dto.response.list.AuthoredReviewsResponse;
-import reviewme.review.service.dto.response.list.ReceivedReviewPageResponse;
 import reviewme.review.service.dto.response.list.ReceivedReviewPageElementResponse;
+import reviewme.review.service.dto.response.list.ReceivedReviewPageResponse;
 import reviewme.review.service.mapper.ReviewListMapper;
 import reviewme.reviewgroup.domain.ReviewGroup;
 import reviewme.reviewgroup.domain.exception.ReviewGroupNotFoundException;

backend/src/main/java/reviewme/review/service/exception/ReviewNotFoundException.java

@@ -7,7 +7,7 @@
 public class ReviewNotFoundException extends NotFoundException {
 
     public ReviewNotFoundException(long reviewId) {
-        super("리뷰를 찾을 수 없어요");
-        log.info("Review not found - reviewId: {}", reviewId);
+        super("리뷰를 찾을 수 없어요.");
+        log.info("Review not found. - reviewId: {}", reviewId);
     }
 }

backend/src/main/java/reviewme/reviewgroup/repository/ReviewGroupRepository.java

@@ -28,4 +28,8 @@ rg.id, rg.reviewee, rg.projectName, rg.reviewRequestCode, rg.createdAt, COUNT(r.
     List<ReviewGroupPageElementResponse> findByMemberIdWithLimit(long memberId, Long lastReviewGroupId, int limit);
 
     boolean existsByReviewRequestCode(String reviewRequestCode);
+
+    boolean existsByIdAndReviewRequestCode(long id, String reviewRequestCode);
+
+    boolean existsByIdAndMemberId(long id, long memberId);
 }

backend/src/main/java/reviewme/security/aspect/RequireReviewAccess.java

@@ -0,0 +1,13 @@
+package reviewme.security.aspect;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target(ElementType.METHOD)
+@Retention(RetentionPolicy.RUNTIME)
+public @interface RequireReviewAccess {
+
+    String target() default "#reviewId";
+}

backend/src/main/java/reviewme/security/aspect/RequireReviewGroupAccess.java

@@ -0,0 +1,13 @@
+package reviewme.security.aspect;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target(ElementType.METHOD)
+@Retention(RetentionPolicy.RUNTIME)
+public @interface RequireReviewGroupAccess {
+
+    String target() default "#reviewGroupId";
+}

backend/src/main/java/reviewme/security/aspect/ResourceAuthorizationUtils.java

@@ -0,0 +1,48 @@
+package reviewme.security.aspect;
+
+import jakarta.servlet.http.HttpSession;
+import java.util.Objects;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.reflect.MethodSignature;
+import org.springframework.core.convert.TypeDescriptor;
+import org.springframework.expression.Expression;
+import org.springframework.expression.ExpressionParser;
+import org.springframework.expression.spel.standard.SpelExpressionParser;
+import org.springframework.expression.spel.support.StandardEvaluationContext;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+import reviewme.security.aspect.exception.SpELEvaluationFailedException;
+
+public class ResourceAuthorizationUtils {
+
+    private static final ExpressionParser EXPRESSION_PARSER = new SpelExpressionParser();
+
+    public static <T> T getTarget(ProceedingJoinPoint joinPoint, String targetExpression, Class<T> targetType) {
+        Object[] args = joinPoint.getArgs();
+        MethodSignature signature = (MethodSignature) joinPoint.getSignature();
+        StandardEvaluationContext context = new StandardEvaluationContext();
+        String[] paramNames = signature.getParameterNames();
+        for (int i = 0; i < paramNames.length; i++) {
+            context.setVariable(paramNames[i], args[i]);
+        }
+
+        try {
+            Expression expression = EXPRESSION_PARSER.parseExpression(targetExpression);
+            TypeDescriptor actualTypeDescriptor = expression.getValueTypeDescriptor(context);
+            TypeDescriptor expectedTypeDescriptor = TypeDescriptor.valueOf(targetType);
+            if (actualTypeDescriptor == null || !expectedTypeDescriptor.isAssignableTo(actualTypeDescriptor)) {
+                throw new SpELEvaluationFailedException(signature.getMethod().getName(), targetExpression);
+            }
+            T targetValue = expression.getValue(context, targetType);
+            return Objects.requireNonNull(targetValue);
+        } catch (Exception e) {
+            throw new SpELEvaluationFailedException(signature.getMethod().getName(), targetExpression);
+        }
+    }
+
+    public static HttpSession getCurrentSession() {
+        return ((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes())
+                .getRequest()
+                .getSession(false);
+    }
+}

backend/src/main/java/reviewme/security/aspect/ReviewAuthorizationAspect.java

@@ -0,0 +1,69 @@
+package reviewme.security.aspect;
+
+import static reviewme.security.aspect.ResourceAuthorizationUtils.getCurrentSession;
+import static reviewme.security.aspect.ResourceAuthorizationUtils.getTarget;
+
+import jakarta.servlet.http.HttpSession;
+import lombok.RequiredArgsConstructor;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.springframework.stereotype.Component;
+import reviewme.auth.domain.GitHubMember;
+import reviewme.review.domain.Review;
+import reviewme.review.repository.ReviewRepository;
+import reviewme.review.service.exception.ReviewNotFoundException;
+import reviewme.reviewgroup.repository.ReviewGroupRepository;
+import reviewme.security.aspect.exception.ForbiddenReviewAccessException;
+import reviewme.security.session.SessionManager;
+
+@Aspect
+@Component
+@RequiredArgsConstructor
+public class ReviewAuthorizationAspect {
+
+    private final SessionManager sessionManager;
+    private final ReviewRepository reviewRepository;
+    private final ReviewGroupRepository reviewGroupRepository;
+
+    @Around("@annotation(requireReviewAccess)")
+    public Object checkReviewAccess(ProceedingJoinPoint joinPoint,
+                                    RequireReviewAccess requireReviewAccess) throws Throwable {
+        HttpSession session = getCurrentSession();
+        if (session == null) {
+            throw new ForbiddenReviewAccessException();
+        }
+
+        long reviewId = getTarget(joinPoint, requireReviewAccess.target(), Long.class);
+        Review review = reviewRepository.findById(reviewId)
+                .orElseThrow(() -> new ReviewNotFoundException(reviewId));
+        if (!(canMemberAccess(review, session) || canGuestAccess(review, session))) {
+            throw new ForbiddenReviewAccessException();
+        }
+
+        return joinPoint.proceed();
+    }
+
+    private boolean canMemberAccess(Review review, HttpSession session) {
+        GitHubMember gitHubMember = sessionManager.getGitHubMember(session);
+        if (gitHubMember == null) {
+            return false;
+        }
+
+        boolean isReviewGroupCreator = reviewGroupRepository.existsByIdAndMemberId(
+                review.getReviewGroupId(), gitHubMember.getMemberId()
+        );
+        boolean isReviewAuthor = review.getMemberId() != null && review.getMemberId() == gitHubMember.getMemberId();
+
+        return isReviewGroupCreator || isReviewAuthor;
+    }
+
+    private boolean canGuestAccess(Review review, HttpSession session) {
+        String reviewRequestCode = sessionManager.getReviewRequestCode(session);
+        if (reviewRequestCode == null) {
+            return false;
+        }
+
+        return reviewGroupRepository.existsByIdAndReviewRequestCode(review.getReviewGroupId(), reviewRequestCode);
+    }
+}

backend/src/main/java/reviewme/security/aspect/ReviewGroupAuthorizationAspect.java

@@ -0,0 +1,54 @@
+package reviewme.security.aspect;
+
+import static reviewme.security.aspect.ResourceAuthorizationUtils.getCurrentSession;
+import static reviewme.security.aspect.ResourceAuthorizationUtils.getTarget;
+
+import jakarta.servlet.http.HttpSession;
+import lombok.RequiredArgsConstructor;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.springframework.stereotype.Component;
+import reviewme.auth.domain.GitHubMember;
+import reviewme.security.aspect.exception.ForbiddenReviewGroupAccessException;
+import reviewme.reviewgroup.domain.ReviewGroup;
+import reviewme.reviewgroup.domain.exception.ReviewGroupNotFoundException;
+import reviewme.reviewgroup.repository.ReviewGroupRepository;
+import reviewme.security.session.SessionManager;
+
+@Aspect
+@Component
+@RequiredArgsConstructor
+public class ReviewGroupAuthorizationAspect {
+
+    private final SessionManager sessionManager;
+    private final ReviewGroupRepository reviewGroupRepository;
+
+    @Around("@annotation(requireReviewGroupAccess)")
+    public Object checkReviewGroupAccess(ProceedingJoinPoint joinPoint,
+                                         RequireReviewGroupAccess requireReviewGroupAccess) throws Throwable {
+        HttpSession session = getCurrentSession();
+        if (session == null) {
+            throw new ForbiddenReviewGroupAccessException();
+        }
+
+        long reviewGroupId = getTarget(joinPoint, requireReviewGroupAccess.target(), Long.class);
+        ReviewGroup reviewGroup = reviewGroupRepository.findById(reviewGroupId)
+                .orElseThrow(() -> new ReviewGroupNotFoundException(reviewGroupId));
+        if (!(canMemberAccess(reviewGroup, session) || canGuestAccess(reviewGroup, session))) {
+            throw new ForbiddenReviewGroupAccessException();
+        }
+
+        return joinPoint.proceed();
+    }
+
+    private boolean canMemberAccess(ReviewGroup reviewGroup, HttpSession session) {
+        GitHubMember gitHubMember = sessionManager.getGitHubMember(session);
+        return gitHubMember != null && reviewGroup.getMemberId() == gitHubMember.getMemberId();
+    }
+
+    private boolean canGuestAccess(ReviewGroup reviewGroup, HttpSession session) {
+        String reviewRequestCode = sessionManager.getReviewRequestCode(session);
+        return reviewGroup.getReviewRequestCode().equals(reviewRequestCode);
+    }
+}

backend/src/main/java/reviewme/security/aspect/exception/ForbiddenReviewAccessException.java

@@ -0,0 +1,13 @@
+package reviewme.security.aspect.exception;
+
+import lombok.extern.slf4j.Slf4j;
+import reviewme.global.exception.ForbiddenException;
+
+@Slf4j
+public class ForbiddenReviewAccessException extends ForbiddenException {
+
+    public ForbiddenReviewAccessException() {
+        super("리뷰에 접근할 권한이 없어요.");
+        log.info("Forbidden review access occurred.");
+    }
+}