[BE] feat: 스태프 권한 인증 기능 구현 (#478)

backend/build.gradle

@@ -1,6 +1,6 @@
 plugins {
     id 'java'
-    id 'org.springframework.boot' version '3.0.8'
+    id 'org.springframework.boot' version '3.1.4'
     id 'io.spring.dependency-management' version '1.1.0'
 }
 
@@ -42,7 +42,7 @@ dependencies {
     implementation "com.github.maricn:logback-slack-appender:1.4.0"
 
     // Mockito
-    testImplementation 'org.mockito:mockito-inline'
+    testImplementation 'org.mockito:mockito-inline:5.2.0'
 
     // Cucumber
     testImplementation 'io.cucumber:cucumber-java:7.13.0'

backend/src/main/java/com/festago/auth/annotation/Staff.java

@@ -0,0 +1,12 @@
+package com.festago.auth.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target(ElementType.PARAMETER)
+@Retention(RetentionPolicy.RUNTIME)
+public @interface Staff {
+
+}

backend/src/main/java/com/festago/auth/application/StaffAuthService.java

@@ -0,0 +1,38 @@
+package com.festago.auth.application;
+
+import com.festago.auth.domain.AuthPayload;
+import com.festago.auth.domain.Role;
+import com.festago.auth.dto.StaffLoginRequest;
+import com.festago.auth.dto.StaffLoginResponse;
+import com.festago.common.exception.ErrorCode;
+import com.festago.common.exception.UnauthorizedException;
+import com.festago.staff.domain.Staff;
+import com.festago.staff.repository.StaffRepository;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+@Transactional
+@RequiredArgsConstructor
+public class StaffAuthService {
+
+    private final AuthProvider authProvider;
+    private final StaffRepository staffRepository;
+
+    @Transactional(readOnly = true)
+    public StaffLoginResponse login(StaffLoginRequest request) {
+        Staff staff = findStaffCode(request.code());
+        String accessToken = authProvider.provide(createAuthPayload(staff));
+        return new StaffLoginResponse(staff.getId(), accessToken);
+    }
+
+    private Staff findStaffCode(String code) {
+        return staffRepository.findByCodeWithFetch(code)
+            .orElseThrow(() -> new UnauthorizedException(ErrorCode.INCORRECT_STAFF_CODE));
+    }
+
+    private AuthPayload createAuthPayload(Staff staff) {
+        return new AuthPayload(staff.getId(), Role.STAFF);
+    }
+}

backend/src/main/java/com/festago/auth/config/LoginConfig.java

@@ -26,6 +26,7 @@ public class LoginConfig implements WebMvcConfigurer {
     public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
         resolvers.add(new RoleArgumentResolver(Role.MEMBER, authenticateContext));
         resolvers.add(new RoleArgumentResolver(Role.ADMIN, authenticateContext));
+        resolvers.add(new RoleArgumentResolver(Role.STAFF, authenticateContext));
     }
 
     @Override
@@ -36,6 +37,9 @@ public void addInterceptors(InterceptorRegistry registry) {
         registry.addInterceptor(memberAuthInterceptor())
             .addPathPatterns("/member-tickets/**", "/members/**", "/auth/**", "/students/**")
             .excludePathPatterns("/auth/oauth2");
+        registry.addInterceptor(staffAuthInterceptor())
+            .addPathPatterns("/staff/**")
+            .excludePathPatterns("/staff/login");
     }
 
     @Bean
@@ -57,4 +61,14 @@ public AuthInterceptor memberAuthInterceptor() {
             .role(Role.MEMBER)
             .build();
     }
+
+    @Bean
+    public AuthInterceptor staffAuthInterceptor() {
+        return AuthInterceptor.builder()
+            .authExtractor(authExtractor)
+            .tokenExtractor(new HeaderTokenExtractor())
+            .authenticateContext(authenticateContext)
+            .role(Role.STAFF)
+            .build();
+    }
 }

backend/src/main/java/com/festago/auth/domain/Role.java

@@ -3,6 +3,7 @@
 import com.festago.auth.annotation.Admin;
 import com.festago.auth.annotation.Anonymous;
 import com.festago.auth.annotation.Member;
+import com.festago.auth.annotation.Staff;
 import com.festago.common.exception.ErrorCode;
 import com.festago.common.exception.InternalServerException;
 import java.lang.annotation.Annotation;
@@ -11,6 +12,7 @@ public enum Role {
     ANONYMOUS(Anonymous.class),
     MEMBER(Member.class),
     ADMIN(Admin.class),
+    STAFF(Staff.class),
     ;
 
     private final Class<? extends Annotation> annotation;

backend/src/main/java/com/festago/auth/dto/StaffLoginRequest.java

@@ -0,0 +1,10 @@
+package com.festago.auth.dto;
+
+import jakarta.validation.constraints.NotBlank;
+
+public record StaffLoginRequest(
+    @NotBlank(message = "code는 공백일 수 없습니다.")
+    String code
+) {
+
+}

backend/src/main/java/com/festago/auth/dto/StaffLoginResponse.java

@@ -0,0 +1,8 @@
+package com.festago.auth.dto;
+
+public record StaffLoginResponse(
+    Long staffId,
+    String accessToken
+) {
+
+}

backend/src/main/java/com/festago/common/exception/ErrorCode.java

@@ -25,6 +25,9 @@ public enum ErrorCode {
     DUPLICATE_STUDENT_EMAIL("이미 인증된 이메일입니다."),
     TICKET_CANNOT_RESERVE_STAGE_START("공연의 시작 시간 이후로 예매할 수 없습니다."),
     INVALID_STUDENT_VERIFICATION_CODE("올바르지 않은 학생 인증 코드입니다."),
+    DUPLICATE_SCHOOL("이미 존재하는 학교 정보입니다."),
+    STAFF_CODE_EXIST("이미 스태프 코드가 존재합니다."),
+    INVALID_SCHOOL_DOMAIN("올바르지 않은 학교 도메인입니다."),
 
 
     // 401
@@ -34,7 +37,7 @@ public enum ErrorCode {
     NEED_AUTH_TOKEN("로그인이 필요한 서비스입니다."),
     INCORRECT_PASSWORD_OR_ACCOUNT("비밀번호가 틀렸거나, 해당 계정이 없습니다."),
     DUPLICATE_ACCOUNT_USERNAME("해당 계정이 존재합니다."),
-    DUPLICATE_SCHOOL("이미 존재하는 학교 정보입니다."),
+    INCORRECT_STAFF_CODE("올바르지 않은 스태프 코드입니다."),
 
     // 403
     NOT_ENOUGH_PERMISSION("해당 권한이 없습니다."),
@@ -46,6 +49,7 @@ public enum ErrorCode {
     FESTIVAL_NOT_FOUND("존재하지 않는 축제입니다."),
     TICKET_NOT_FOUND("존재하지 않는 티켓입니다."),
     SCHOOL_NOT_FOUND("존재하지 않는 학교입니다."),
+    STAFF_NOT_FOUND("존재하지 않는 스태프입니다"),
 
     // 429
     TOO_FREQUENT_REQUESTS("너무 잦은 요청입니다. 잠시 후 다시 시도해주세요."),
@@ -63,7 +67,8 @@ public enum ErrorCode {
     INVALID_ROLE_NAME("해당하는 Role이 없습니다."),
     FOR_TEST_ERROR("테스트용 에러입니다."),
     FAIL_SEND_FCM_MESSAGE("FCM Message 전송에 실패했습니다."),
-    FCM_NOT_FOUND("유효하지 않은 MemberFCM 이 감지 되었습니다.");
+    FCM_NOT_FOUND("유효하지 않은 MemberFCM 이 감지 되었습니다."),
+    ;
 
     private final String message;
 

backend/src/main/java/com/festago/entry/application/EntryService.java

@@ -2,13 +2,16 @@
 
 import com.festago.common.exception.BadRequestException;
 import com.festago.common.exception.ErrorCode;
+import com.festago.common.exception.ForbiddenException;
 import com.festago.common.exception.NotFoundException;
 import com.festago.entry.domain.EntryCode;
 import com.festago.entry.domain.EntryCodePayload;
 import com.festago.entry.dto.EntryCodeResponse;
 import com.festago.entry.dto.TicketValidationRequest;
 import com.festago.entry.dto.TicketValidationResponse;
 import com.festago.entry.dto.event.EntryProcessEvent;
+import com.festago.staff.domain.Staff;
+import com.festago.staff.repository.StaffRepository;
 import com.festago.ticketing.domain.MemberTicket;
 import com.festago.ticketing.repository.MemberTicketRepository;
 import java.time.Clock;
@@ -25,6 +28,7 @@ public class EntryService {
 
     private final EntryCodeManager entryCodeManager;
     private final MemberTicketRepository memberTicketRepository;
+    private final StaffRepository staffRepository;
     private final ApplicationEventPublisher publisher;
     private final Clock clock;
 
@@ -45,11 +49,23 @@ private MemberTicket findMemberTicket(Long memberTicketId) {
             .orElseThrow(() -> new NotFoundException(ErrorCode.MEMBER_TICKET_NOT_FOUND));
     }
 
-    public TicketValidationResponse validate(TicketValidationRequest request) {
+    public TicketValidationResponse validate(TicketValidationRequest request, Long staffId) {
         EntryCodePayload entryCodePayload = entryCodeManager.extract(request.code());
         MemberTicket memberTicket = findMemberTicket(entryCodePayload.getMemberTicketId());
+        checkPermission(findStaff(staffId), memberTicket);
         memberTicket.changeState(entryCodePayload.getEntryState());
         publisher.publishEvent(new EntryProcessEvent(memberTicket.getOwner().getId()));
         return TicketValidationResponse.from(memberTicket);
     }
+
+    private Staff findStaff(Long staffId) {
+        return staffRepository.findById(staffId)
+            .orElseThrow(() -> new NotFoundException(ErrorCode.STAFF_NOT_FOUND));
+    }
+
+    private void checkPermission(Staff staff, MemberTicket memberTicket) {
+        if (!staff.canValidate(memberTicket)) {
+            throw new ForbiddenException(ErrorCode.NOT_ENOUGH_PERMISSION);
+        }
+    }
 }

backend/src/main/java/com/festago/festival/application/FestivalService.java

@@ -10,13 +10,15 @@
 import com.festago.festival.dto.FestivalDetailResponse;
 import com.festago.festival.dto.FestivalResponse;
 import com.festago.festival.dto.FestivalsResponse;
+import com.festago.festival.dto.event.FestivalCreateEvent;
 import com.festago.festival.repository.FestivalRepository;
 import com.festago.school.domain.School;
 import com.festago.school.repository.SchoolRepository;
 import com.festago.stage.domain.Stage;
 import com.festago.stage.repository.StageRepository;
 import java.time.LocalDate;
 import java.util.List;
+import org.springframework.context.ApplicationEventPublisher;
 import lombok.RequiredArgsConstructor;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
@@ -29,13 +31,15 @@ public class FestivalService {
     private final FestivalRepository festivalRepository;
     private final StageRepository stageRepository;
     private final SchoolRepository schoolRepository;
+    private final ApplicationEventPublisher publisher;
 
     public FestivalResponse create(FestivalCreateRequest request) {
         School school = schoolRepository.findById(request.schoolId())
             .orElseThrow(() -> new NotFoundException(ErrorCode.SCHOOL_NOT_FOUND));
         Festival festival = request.toEntity(school);
         validate(festival);
         Festival newFestival = festivalRepository.save(festival);
+        publisher.publishEvent(new FestivalCreateEvent(newFestival.getId()));
         return FestivalResponse.from(newFestival);
     }
 

backend/src/main/java/com/festago/festival/dto/event/FestivalCreateEvent.java

@@ -0,0 +1,7 @@
+package com.festago.festival.dto.event;
+
+public record FestivalCreateEvent(
+    Long festivalId
+) {
+
+}

backend/src/main/java/com/festago/presentation/StaffMemberTicketController.java → backend/src/main/java/com/festago/presentation/StaffController.java

@@ -1,6 +1,9 @@
 package com.festago.presentation;
 
-
+import com.festago.auth.annotation.Staff;
+import com.festago.auth.application.StaffAuthService;
+import com.festago.auth.dto.StaffLoginRequest;
+import com.festago.auth.dto.StaffLoginResponse;
 import com.festago.entry.application.EntryService;
 import com.festago.entry.dto.TicketValidationRequest;
 import com.festago.entry.dto.TicketValidationResponse;
@@ -15,17 +18,28 @@
 import org.springframework.web.bind.annotation.RestController;
 
 @RestController
-@RequestMapping("/staff/member-tickets")
+@RequestMapping("/staff")
 @Tag(name = "스태프 요청")
 @RequiredArgsConstructor
-public class StaffMemberTicketController {
+public class StaffController {
 
+    private final StaffAuthService staffAuthService;
     private final EntryService entryService;
 
-    @PostMapping("/validation")
+    @PostMapping("/login")
+    @Operation(description = "스태프 코드로 로그인한다.", summary = "스태프 로그인")
+    public ResponseEntity<StaffLoginResponse> login(@RequestBody @Valid StaffLoginRequest request) {
+        StaffLoginResponse response = staffAuthService.login(request);
+        return ResponseEntity.ok()
+            .body(response);
+    }
+
+    @PostMapping("/member-tickets/validation")
     @Operation(description = "스태프가 티켓을 검사한다.", summary = "티켓 검사")
-    public ResponseEntity<TicketValidationResponse> validate(@RequestBody @Valid TicketValidationRequest request) {
-        TicketValidationResponse response = entryService.validate(request);
+    public ResponseEntity<TicketValidationResponse> validate(
+        @RequestBody @Valid TicketValidationRequest request,
+        @Staff Long staffId) {
+        TicketValidationResponse response = entryService.validate(request, staffId);
         return ResponseEntity.ok()
             .body(response);
     }

backend/src/main/java/com/festago/school/domain/School.java

@@ -1,6 +1,7 @@
 package com.festago.school.domain;
 
 import com.festago.common.domain.BaseTimeEntity;
+import com.festago.common.exception.BadRequestException;
 import com.festago.common.exception.ErrorCode;
 import com.festago.common.exception.InternalServerException;
 import jakarta.persistence.Column;
@@ -10,13 +11,17 @@
 import jakarta.persistence.Id;
 import jakarta.validation.constraints.NotNull;
 import jakarta.validation.constraints.Size;
+import java.util.regex.Pattern;
 import lombok.AccessLevel;
 import lombok.NoArgsConstructor;
 
 @Entity
 @NoArgsConstructor(access = AccessLevel.PROTECTED)
 public class School extends BaseTimeEntity {
 
+    private static final Pattern DOMAIN_REGEX = Pattern.compile("^[^.]+(\\.[^.]+)+$");
+    private static final char DOMAIN_DELIMITER = '.';
+
     @Id
     @GeneratedValue(strategy = GenerationType.IDENTITY)
     private Long id;
@@ -45,6 +50,7 @@ public School(Long id, String domain, String name) {
     private void validate(String domain, String name) {
         checkNotNull(domain, name);
         checkLength(domain, name);
+        validateDomain(domain);
     }
 
     private void checkNotNull(String domain, String name) {
@@ -68,6 +74,17 @@ private boolean overLength(String target, int maxLength) {
         return target.length() > maxLength;
     }
 
+    private void validateDomain(String domain) {
+        if (!DOMAIN_REGEX.matcher(domain).matches()) {
+            throw new BadRequestException(ErrorCode.INVALID_SCHOOL_DOMAIN);
+        }
+    }
+
+    public String findAbbreviation() {
+        int dotIndex = domain.indexOf(DOMAIN_DELIMITER);
+        return domain.substring(0, dotIndex);
+    }
+
     public Long getId() {
         return id;
     }

backend/src/main/java/com/festago/staff/application/RandomStaffCodeProvider.java

@@ -0,0 +1,24 @@
+package com.festago.staff.application;
+
+import static java.util.stream.Collectors.joining;
+
+import com.festago.festival.domain.Festival;
+import com.festago.staff.domain.StaffCode;
+import java.util.Random;
+import java.util.concurrent.ThreadLocalRandom;
+import org.springframework.stereotype.Component;
+
+@Component
+public class RandomStaffCodeProvider implements StaffCodeProvider {
+
+    @Override
+    public StaffCode provide(Festival festival) {
+        String abbreviation = festival.getSchool().findAbbreviation();
+        Random random = ThreadLocalRandom.current();
+        String code = random.ints(0, 10)
+            .mapToObj(String::valueOf)
+            .limit(StaffCode.RANDOM_CODE_LENGTH)
+            .collect(joining());
+        return new StaffCode(abbreviation + code);
+    }
+}

backend/src/main/java/com/festago/staff/application/StaffCodeProvider.java

@@ -0,0 +1,9 @@
+package com.festago.staff.application;
+
+import com.festago.festival.domain.Festival;
+import com.festago.staff.domain.StaffCode;
+
+public interface StaffCodeProvider {
+
+    StaffCode provide(Festival festival);
+}