인프런 커뮤니티 질문&답변

@Configuration
@EnableWebSecurity(debug = true)
@Slf4j
@RequiredArgsConstructor
public class SecurityConfig {

    private final ObjectMapper objectMapper;
    private final UserRepository userRepository;

    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
       return web -> web.ignoring()
          .requestMatchers("/favicon.ico")
          .requestMatchers("/error");
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
       return http
          .csrf(AbstractHttpConfigurer::disable)
          .authorizeHttpRequests()
          .anyRequest().permitAll()
          .and()
          .addFilterBefore(customEmailPasswordFilter(), UsernamePasswordAuthenticationFilter.class)
          .exceptionHandling(e -> {
             e.accessDeniedHandler(new Http403Handler(objectMapper));
             e.authenticationEntryPoint(new Http401Handler(objectMapper));
          })
          .build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
       return PasswordEncoderFactories.createDelegatingPasswordEncoder();
    }

    @Bean
    public UserDetailsService userDetailsService(UserRepository userRepository) {
       return username -> {
          User user = userRepository.findByEmail(username)
             .orElseThrow(() -> new UsernameNotFoundException(username + "을 찾을 수 없습니다."));

          return new UserPrincipal(user);
       };
    }

    @Bean
    public CustomEmailPasswordFilter customEmailPasswordFilter() {
       CustomEmailPasswordFilter filter = new CustomEmailPasswordFilter(objectMapper);
       filter.setAuthenticationManager(authenticationManager());
       filter.setAuthenticationSuccessHandler(new LoginSuccessHandler());
       filter.setAuthenticationFailureHandler(new LoginFailureHandler(objectMapper));
       filter.setSecurityContextRepository(new HttpSessionSecurityContextRepository());
       return filter;
    }

    @Bean
    public AuthenticationManager authenticationManager() {
       DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
       provider.setUserDetailsService(userDetailsService(userRepository));
       provider.setPasswordEncoder(passwordEncoder());
       return new ProviderManager(provider);
    }
}

@Configuration
@EnableMethodSecurity
@RequiredArgsConstructor
public class MethodSecurityConfig {

    private final PostRepository postRepository;

    @Bean
    public MethodSecurityExpressionHandler methodSecurityExpressionHandler() {
       DefaultMethodSecurityExpressionHandler handler = new DefaultMethodSecurityExpressionHandler();
       handler.setPermissionEvaluator(new BoardPermissionEvaluator(postRepository));
       return handler;
    }
}

SecurityConfig 관련된 클래스들입니다.

테스트 코드입니다. 한 개는 @SpringBootTest 사용했고 한 개는 @WebMvcTest 사용했습니다. @WebMvcTest로 하면 @CustomMockUser 어노테이션이 없으면 통과가 되질 않습니다. 401 에러가 나면서요!

@ActiveProfiles("test")
@AutoConfigureMockMvc
@SpringBootTest
class AuthControllerTest {

    @Autowired
    private UserRepository userRepository;

    @Autowired
    private ObjectMapper objectMapper;

    @Autowired
    private MockMvc mockMvc;

    @BeforeEach
    void tearDown() {
       userRepository.deleteAllInBatch();
    }

    @DisplayName("회원가입 한다.")
    @Test
    void signUp() throws Exception {
       //given
       SignUpRequest request = SignUpRequest.builder()
          .name("zun")
          .email("zun@test.com")
          .password("12345")
          .nickname("zunny")
          .build();

       //expected
       mockMvc.perform(post("/api/auth/sign-up")
             .content(objectMapper.writeValueAsString(request))
             .contentType(APPLICATION_JSON)
          )
          .andExpect(status().isOk())
          .andDo(print());
    }

}

@ActiveProfiles("test")
@AutoConfigureMockMvc
@WebMvcTest(AuthController.class)
class AuthControllerTestWithWebMvcTest {

    @Autowired
    protected MockMvc mockMvc;

    @Autowired
    protected ObjectMapper objectMapper;

    @MockBean
    private AuthService authService;

    @MockBean
    private UserRepository userRepository;


    @DisplayName("회원가입 한다.")
    @CustomMockUser // 회원가입을 해야되는데 인증이 필요하다? -> 논리적으로 말이 안 됨 -> 올바른 테스트?
    @Test
    void signUp() throws Exception {
       // given
       SignUpRequest request = SignUpRequest.builder()
          .name("zun")
          .email("zun@test.com")
          .password("12345")
          .nickname("zunny")
          .build();

       // then
       mockMvc.perform(post("/api/auth/sign-up")
             .content(objectMapper.writeValueAsString(request))
             .contentType(APPLICATION_JSON)
             .with(csrf())
          )
          .andExpect(status().isOk())
          .andDo(print());
    }

}

님 빨리 github 링크도 주세요

아.. @WebMvcTest로 진행하게 되면 님이 만드신 스프링시큐리티 쪽 설정을 다 안들고 실행됩니다.
그래서 csrf나 스프링시큐리티 필터등이 기본 값으로 들어가 있을겁니다.

해결 1.

mockMvc.perform(post("/auth/signup")
                .with(SecurityMockMvcRequestPostProcessors.csrf()) // <-- 요 부분 추가
                .content(objectMapper.writeValueAsString(signup))
                .contentType(APPLICATION_JSON))

해결 2.

@AutoConfigureMockMvc(addFilters = false) // addFilters = false 추가

이렇게 함 해보세용

감사합니다.

헐헐 너무 감사합니다 :D