20주차 코드 뒤풀이: BOLA·status matrix·cloud fail-closed를 값으로 따라가기

package com.example.financialcore.security;
import com.example.financialcore.account.AccountRepository;import org.springframework.context.ApplicationEventPublisher;import org.springframework.stereotype.Component;
@Component public class AccountAuthorization{public AccountAuthorization(AccountRepository a,ApplicationEventPublisher e){}public void requireOwner(String actorId,long accountId,String action,String requestId){}}

package com.example.financialcore.security;
import org.springframework.context.annotation.*;import org.springframework.security.config.Customizer;import org.springframework.security.config.annotation.web.builders.HttpSecurity;import org.springframework.security.core.userdetails.*;import org.springframework.security.provisioning.InMemoryUserDetailsManager;import org.springframework.security.web.SecurityFilterChain;
@Configuration public class SecurityConfiguration{@Bean @Profile({"default","local","test"}) UserDetailsService users(){return new InMemoryUserDetailsManager(User.withUsername("customer-1").password("{noop}password").roles("CUSTOMER").build(),User.withUsername("customer-2").password("{noop}password").roles("CUSTOMER").build());}@Bean @Profile({"default","local","test"}) SecurityFilterChain local(HttpSecurity h)throws Exception{return h.authorizeHttpRequests(a->a.anyRequest().permitAll()).csrf(c->c.disable()).httpBasic(Customizer.withDefaults()).build();}@Bean @Profile({"cloud","prod"}) SecurityFilterChain cloud(HttpSecurity h)throws Exception{return h.authorizeHttpRequests(a->a.anyRequest().permitAll()).csrf(c->c.disable()).httpBasic(Customizer.withDefaults()).build();}}

package com.example.financialcore.security;

import com.example.financialcore.PostgresIntegrationTestSupport;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.jdbc.core.simple.JdbcClient;
import org.springframework.test.context.ActiveProfiles;
import org.springframework.test.web.servlet.MockMvc;

import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.httpBasic;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;

@SpringBootTest
@AutoConfigureMockMvc
@ActiveProfiles("cloud")
class CloudFailClosedSecurityIT extends PostgresIntegrationTestSupport {
    @Autowired MockMvc mvc;
    @Autowired JdbcClient jdbc;

    @BeforeEach
    void clean() {
        jdbc.sql("TRUNCATE audit_event,idempotency_request,ledger_entry,business_tx,account RESTART IDENTITY CASCADE")
            .update();
    }

    @Test
    void healthIsPublicButBasicCannotOpenOrMutateTheCloudApi() throws Exception {
        mvc.perform(get("/actuator/health"))
            .andExpect(status().isOk());
        mvc.perform(post("/api/accounts")
                .with(httpBasic("customer-1", "password"))
                .contentType("application/json")
                .content("{\"accountNo\":\"CLOUD\",\"openingBalance\":1000}"))
            .andExpect(status().isForbidden())
            .andExpect(header().doesNotExist("WWW-Authenticate"));
        assertThat(jdbc.sql("SELECT COUNT(*) FROM account").query(Long.class).single()).isZero();
    }
}

package com.example.financialcore.security;

import com.example.financialcore.PostgresIntegrationTestSupport;
import com.example.financialcore.account.Account;
import com.example.financialcore.account.AccountOpeningService;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.jdbc.core.simple.JdbcClient;
import org.springframework.test.context.ActiveProfiles;
import org.springframework.test.web.servlet.MockMvc;

import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.httpBasic;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;

@SpringBootTest
@AutoConfigureMockMvc
@ActiveProfiles("test")
class ObjectAuthorizationIT extends PostgresIntegrationTestSupport {
    @Autowired MockMvc mvc;
    @Autowired JdbcClient jdbc;
    @Autowired AccountOpeningService openings;
    Account owned;
    Account receiver;

    @BeforeEach
    void clean() {
        jdbc.sql("TRUNCATE audit_event,idempotency_request,ledger_entry,business_tx,account RESTART IDENTITY CASCADE")
            .update();
        owned = openings.open("customer-1", "OWNED", 10_000);
        receiver = openings.open("customer-2", "RECEIVER", 5_000);
    }

    @Test
    void ownerCanReadButAnotherAuthenticatedCustomerCannot() throws Exception {
        mvc.perform(get("/api/accounts/{id}", owned.getId())
                .with(httpBasic("customer-1", "password")))
            .andExpect(status().isOk());
        mvc.perform(get("/api/accounts/{id}", owned.getId())
                .with(httpBasic("customer-2", "password"))
                .header("X-Request-Id", "bola-read"))
            .andExpect(status().isForbidden())
            .andExpect(jsonPath("$.errorCode").value("ACCESS_DENIED"));
    }

    @Test
    void anotherCustomerCannotTransferFromTheOwnersAccount() throws Exception {
        String body = "{\"transactionId\":\"BOLA-TX\",\"fromAccountId\":" + owned.getId()
            + ",\"toAccountId\":" + receiver.getId() + ",\"amount\":1000}";
        mvc.perform(post("/api/transfers")
                .with(httpBasic("customer-2", "password"))
                .header("X-Request-Id", "bola-transfer")
                .contentType("application/json").content(body))
            .andExpect(status().isForbidden())
            .andExpect(jsonPath("$.errorCode").value("ACCESS_DENIED"));
        assertThat(jdbc.sql("SELECT balance FROM account WHERE id=:id")
            .param("id", owned.getId()).query(Long.class).single()).isEqualTo(10_000);
        assertThat(jdbc.sql("SELECT COUNT(*) FROM business_tx WHERE tx_type='TRANSFER'")
            .query(Long.class).single()).isZero();
    }
}

package com.example.financialcore.security;

import com.example.financialcore.PostgresIntegrationTestSupport;
import com.example.financialcore.account.Account;
import com.example.financialcore.account.AccountOpeningService;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.jdbc.core.simple.JdbcClient;
import org.springframework.test.context.ActiveProfiles;
import org.springframework.test.web.servlet.MockMvc;

import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.httpBasic;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;

@SpringBootTest
@AutoConfigureMockMvc
@ActiveProfiles("test")
class SecurityStatusContractTest extends PostgresIntegrationTestSupport {
    @Autowired MockMvc mvc;
    @Autowired JdbcClient jdbc;
    @Autowired AccountOpeningService openings;
    Account account;

    @BeforeEach
    void clean() {
        jdbc.sql("TRUNCATE audit_event,idempotency_request,ledger_entry,business_tx,account RESTART IDENTITY CASCADE")
            .update();
        account = openings.open("customer-1", "STATUS", 1_000);
    }

    @Test
    void anonymous401OtherOwner403Invalid400AndOwner200AreDistinct() throws Exception {
        mvc.perform(get("/api/accounts/{id}", account.getId()))
            .andExpect(status().isUnauthorized());
        mvc.perform(get("/api/accounts/{id}", account.getId())
                .with(httpBasic("customer-2", "password")))
            .andExpect(status().isForbidden())
            .andExpect(jsonPath("$.errorCode").value("ACCESS_DENIED"));
        mvc.perform(post("/api/accounts")
                .with(httpBasic("customer-1", "password"))
                .contentType("application/json")
                .content("{\"accountNo\":\"INVALID\",\"openingBalance\":0}"))
            .andExpect(status().isBadRequest())
            .andExpect(jsonPath("$.errorCode").value("INVALID_REQUEST"));
        mvc.perform(get("/api/accounts/{id}", account.getId())
                .with(httpBasic("customer-1", "password")))
            .andExpect(status().isOk());
    }
}

package com.example.financialcore.security;

import com.example.financialcore.account.AccountRepository;
import com.example.financialcore.api.BusinessException;
import com.example.financialcore.api.ErrorCode;
import com.example.financialcore.audit.DeniedAuditEvent;
import org.springframework.context.ApplicationEventPublisher;
import org.springframework.stereotype.Component;

import java.util.Optional;

@Component
public class AccountAuthorization {
    private final AccountRepository accounts;
    private final ApplicationEventPublisher events;

    public AccountAuthorization(AccountRepository accounts, ApplicationEventPublisher events) {
        this.accounts = accounts;
        this.events = events;
    }

    public void requireOwner(String actorId, long accountId, String action, String requestId) {
        Optional<String> ownerId = accounts.findOwnerId(accountId);
        if (ownerId.isEmpty()) {
            throw new BusinessException(ErrorCode.ACCOUNT_NOT_FOUND, "account not found");
        }
        if (!ownerId.orElseThrow().equals(actorId)) {
            events.publishEvent(new DeniedAuditEvent(
                actorId, action, "ACCOUNT", Long.toString(accountId),
                ErrorCode.ACCESS_DENIED.name(), requestId));
            throw new BusinessException(ErrorCode.ACCESS_DENIED, "access denied");
        }
    }
}