Merge branch 'main' of https://github.com/gsainfoteam/server-for-2024…

…-newbies

.github/workflows/production.yaml

@@ -37,11 +37,11 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.REPOSITORY }}
           tags: |
+            type=sha
             type=ref,event=branch
             type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-            type=sha
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3

src/main/kotlin/me/gistory/newbies_server_24/configurations/JwtExceptionFilter.kt

@@ -0,0 +1,25 @@
+package me.gistory.newbies_server_24.configurations
+
+import jakarta.servlet.FilterChain
+import jakarta.servlet.http.HttpServletRequest
+import jakarta.servlet.http.HttpServletResponse
+import me.gistory.newbies_server_24.exceptions.UnauthorizedException
+import org.springframework.http.HttpStatus
+import org.springframework.web.filter.OncePerRequestFilter
+
+class JwtExceptionFilter : OncePerRequestFilter() {
+
+    override fun doFilterInternal(
+        request: HttpServletRequest,
+        response: HttpServletResponse,
+        filterChain: FilterChain
+    ) {
+        try {
+            filterChain.doFilter(request, response)
+        } catch (e: UnauthorizedException) {
+            response.status = HttpStatus.UNAUTHORIZED.value()
+            response.contentType = "application/json"
+            response.writer.write("{\"message\": \"Unauthorized\"}")
+        }
+    }
+}

src/main/kotlin/me/gistory/newbies_server_24/configurations/JwtFilter.kt

@@ -4,6 +4,7 @@ import jakarta.servlet.FilterChain
 import jakarta.servlet.ServletRequest
 import jakarta.servlet.ServletResponse
 import jakarta.servlet.http.HttpServletRequest
+import me.gistory.newbies_server_24.exceptions.UnauthorizedException
 import me.gistory.newbies_server_24.providers.TokenProvider
 import org.springframework.security.core.context.SecurityContextHolder
 import org.springframework.web.filter.GenericFilterBean
@@ -13,7 +14,7 @@ class JwtFilter(private val tokenProvider: TokenProvider) : GenericFilterBean()
         val request = req as HttpServletRequest
         val token = resolveToken(request)
         token?.let {
-            tokenProvider.validateToken(it)
+            if (!tokenProvider.validateToken(it)) throw UnauthorizedException()
             tokenProvider.getAuthentication(it).let { authentication ->
                 SecurityContextHolder.getContext().authentication = authentication
             }

src/main/kotlin/me/gistory/newbies_server_24/configurations/SecurityConfiguration.kt

@@ -4,7 +4,6 @@ import me.gistory.newbies_server_24.providers.TokenProvider
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 import org.springframework.http.HttpMethod
-import org.springframework.security.config.Customizer
 import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
 import org.springframework.security.config.http.SessionCreationPolicy
@@ -33,13 +32,14 @@ class SecurityConfiguration {
             }
             .authorizeHttpRequests { req ->
                 req.requestMatchers(HttpMethod.GET).permitAll()
-                req.requestMatchers("/swagger-ui/**" , "v3/api-docs/**", "/api-docs/**").permitAll()
+                req.requestMatchers("/swagger-ui/**", "v3/api-docs/**", "/api-docs/**").permitAll()
                 req.requestMatchers("/auth/login", "/auth/register", "auth/refresh").permitAll()
                 req.requestMatchers("/error").permitAll()
                 req.requestMatchers("/").permitAll()
                 req.anyRequest().authenticated()
             }
             .addFilterBefore(JwtFilter(tokenProvider), UsernamePasswordAuthenticationFilter::class.java)
+            .addFilterBefore(JwtExceptionFilter(), JwtFilter::class.java)
             .build()
 
 

src/main/kotlin/me/gistory/newbies_server_24/exceptions/UnauthorizedException.kt

@@ -0,0 +1,7 @@
+package me.gistory.newbies_server_24.exceptions
+
+import org.springframework.http.HttpStatus
+import org.springframework.web.bind.annotation.ResponseStatus
+
+@ResponseStatus(HttpStatus.UNAUTHORIZED)
+class UnauthorizedException : RuntimeException()