[BE] feat: 스태프 권한 인증 기능 구현 (#478)

backend/src/main/java/com/festago/auth/annotation/Staff.java

@@ -0,0 +1,12 @@
+package com.festago.auth.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target(ElementType.PARAMETER)
+@Retention(RetentionPolicy.RUNTIME)
+public @interface Staff {
+
+}

backend/src/main/java/com/festago/auth/application/StaffAuthService.java

@@ -0,0 +1,43 @@
+package com.festago.auth.application;
+
+import com.festago.auth.domain.AuthPayload;
+import com.festago.auth.domain.Role;
+import com.festago.auth.dto.StaffLoginRequest;
+import com.festago.auth.dto.StaffLoginResponse;
+import com.festago.common.exception.ErrorCode;
+import com.festago.common.exception.UnauthorizedException;
+import com.festago.festival.domain.Festival;
+import com.festago.staff.domain.StaffCode;
+import com.festago.staff.repository.StaffCodeRepository;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+@Transactional
+public class StaffAuthService {
+
+    private final AuthProvider authProvider;
+    private final StaffCodeRepository staffCodeRepository;
+
+    public StaffAuthService(AuthProvider authProvider, StaffCodeRepository staffCodeRepository) {
+        this.authProvider = authProvider;
+        this.staffCodeRepository = staffCodeRepository;
+    }
+
+    @Transactional(readOnly = true)
+    public StaffLoginResponse login(StaffLoginRequest request) {
+        StaffCode staffCode = findStaffCode(request.code());
+        Festival festival = staffCode.getFestival();
+        String accessToken = authProvider.provide(createAuthPayload(festival));
+        return new StaffLoginResponse(festival.getId(), accessToken);
+    }
+
+    private StaffCode findStaffCode(String code) {
+        return staffCodeRepository.findByCodeWithFetch(code)
+            .orElseThrow(() -> new UnauthorizedException(ErrorCode.INCORRECT_STAFF_CODE));
+    }
+
+    private AuthPayload createAuthPayload(Festival festival) {
+        return new AuthPayload(festival.getId(), Role.STAFF);
+    }
+}

backend/src/main/java/com/festago/auth/config/LoginConfig.java

@@ -29,6 +29,7 @@ public LoginConfig(AuthExtractor authExtractor, AuthenticateContext context) {
     public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
         resolvers.add(new RoleArgumentResolver(Role.MEMBER, authenticateContext));
         resolvers.add(new RoleArgumentResolver(Role.ADMIN, authenticateContext));
+        resolvers.add(new RoleArgumentResolver(Role.STAFF, authenticateContext));
     }
 
     @Override
@@ -39,6 +40,9 @@ public void addInterceptors(InterceptorRegistry registry) {
         registry.addInterceptor(memberAuthInterceptor())
             .addPathPatterns("/member-tickets/**", "/members/**", "/auth/**", "/students/**")
             .excludePathPatterns("/auth/oauth2");
+        registry.addInterceptor(staffAuthInterceptor())
+            .addPathPatterns("/staff/**")
+            .excludePathPatterns("/staff/login");
     }
 
     @Bean
@@ -60,4 +64,14 @@ public AuthInterceptor memberAuthInterceptor() {
             .role(Role.MEMBER)
             .build();
     }
+
+    @Bean
+    public AuthInterceptor staffAuthInterceptor() {
+        return AuthInterceptor.builder()
+            .authExtractor(authExtractor)
+            .tokenExtractor(new HeaderTokenExtractor())
+            .authenticateContext(authenticateContext)
+            .role(Role.STAFF)
+            .build();
+    }
 }

backend/src/main/java/com/festago/auth/domain/Role.java

@@ -3,6 +3,7 @@
 import com.festago.auth.annotation.Admin;
 import com.festago.auth.annotation.Anonymous;
 import com.festago.auth.annotation.Member;
+import com.festago.auth.annotation.Staff;
 import com.festago.common.exception.ErrorCode;
 import com.festago.common.exception.InternalServerException;
 import java.lang.annotation.Annotation;
@@ -11,7 +12,7 @@ public enum Role {
     ANONYMOUS(Anonymous.class),
     MEMBER(Member.class),
     ADMIN(Admin.class),
-    ;
+    STAFF(Staff.class);
 
     private final Class<? extends Annotation> annotation;
 

backend/src/main/java/com/festago/auth/dto/StaffLoginRequest.java

@@ -0,0 +1,7 @@
+package com.festago.auth.dto;
+
+public record StaffLoginRequest(
+    String code
+) {
+
+}

backend/src/main/java/com/festago/auth/dto/StaffLoginResponse.java

@@ -0,0 +1,8 @@
+package com.festago.auth.dto;
+
+public record StaffLoginResponse(
+    Long festivalId,
+    String accessToken
+) {
+
+}

backend/src/main/java/com/festago/common/exception/ErrorCode.java

@@ -25,6 +25,9 @@ public enum ErrorCode {
     DUPLICATE_STUDENT_EMAIL("이미 인증된 이메일입니다."),
     TICKET_CANNOT_RESERVE_STAGE_START("공연의 시작 시간 이후로 예매할 수 없습니다."),
     INVALID_STUDENT_VERIFICATION_CODE("올바르지 않은 학생 인증 코드입니다."),
+    DUPLICATE_SCHOOL("이미 존재하는 학교 정보입니다."),
+    STAFF_CODE_EXIST("이미 스태프 코드가 존재합니다."),
+    INVALID_SCHOOL_DOMAIN("올바르지 않은 학교 도에인입니다."),
 
     // 401
     EXPIRED_AUTH_TOKEN("만료된 로그인 토큰입니다."),
@@ -33,7 +36,7 @@ public enum ErrorCode {
     NEED_AUTH_TOKEN("로그인이 필요한 서비스입니다."),
     INCORRECT_PASSWORD_OR_ACCOUNT("비밀번호가 틀렸거나, 해당 계정이 없습니다."),
     DUPLICATE_ACCOUNT_USERNAME("해당 계정이 존재합니다."),
-    DUPLICATE_SCHOOL("이미 존재하는 학교 정보입니다."),
+    INCORRECT_STAFF_CODE("올바르지 않은 스태프 코드입니다."),
 
     // 403
     NOT_ENOUGH_PERMISSION("해당 권한이 없습니다."),
@@ -59,7 +62,8 @@ public enum ErrorCode {
     INVALID_ROLE_NAME("해당하는 Role이 없습니다."),
     FOR_TEST_ERROR("테스트용 에러입니다."),
     FAIL_SEND_FCM_MESSAGE("FCM Message 전송에 실패했습니다."),
-    FCM_NOT_FOUND("유효하지 않은 MemberFCM 이 감지 되었습니다.");
+    FCM_NOT_FOUND("유효하지 않은 MemberFCM 이 감지 되었습니다."),
+    ;
 
     private final String message;
 

backend/src/main/java/com/festago/entry/application/EntryService.java

@@ -2,6 +2,7 @@
 
 import com.festago.common.exception.BadRequestException;
 import com.festago.common.exception.ErrorCode;
+import com.festago.common.exception.ForbiddenException;
 import com.festago.common.exception.NotFoundException;
 import com.festago.entry.domain.EntryCode;
 import com.festago.entry.domain.EntryCodePayload;
@@ -51,11 +52,18 @@ private MemberTicket findMemberTicket(Long memberTicketId) {
             .orElseThrow(() -> new NotFoundException(ErrorCode.MEMBER_TICKET_NOT_FOUND));
     }
 
-    public TicketValidationResponse validate(TicketValidationRequest request) {
+    public TicketValidationResponse validate(TicketValidationRequest request, Long festivalId) {
         EntryCodePayload entryCodePayload = entryCodeManager.extract(request.code());
         MemberTicket memberTicket = findMemberTicket(entryCodePayload.getMemberTicketId());
+        checkPermission(festivalId, memberTicket);
         memberTicket.changeState(entryCodePayload.getEntryState());
         publisher.publishEvent(new EntryProcessEvent(memberTicket.getOwner().getId()));
         return TicketValidationResponse.from(memberTicket);
     }
+
+    private static void checkPermission(Long festivalId, MemberTicket memberTicket) {
+        if (!memberTicket.belongsFestival(festivalId)) {
+            throw new ForbiddenException(ErrorCode.NOT_ENOUGH_PERMISSION);
+        }
+    }
 }

backend/src/main/java/com/festago/festival/application/FestivalService.java

@@ -10,13 +10,15 @@
 import com.festago.festival.dto.FestivalDetailResponse;
 import com.festago.festival.dto.FestivalResponse;
 import com.festago.festival.dto.FestivalsResponse;
+import com.festago.festival.dto.event.FestivalCreateEvent;
 import com.festago.festival.repository.FestivalRepository;
 import com.festago.school.domain.School;
 import com.festago.school.repository.SchoolRepository;
 import com.festago.stage.domain.Stage;
 import com.festago.stage.repository.StageRepository;
 import java.time.LocalDate;
 import java.util.List;
+import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -27,12 +29,15 @@ public class FestivalService {
     private final FestivalRepository festivalRepository;
     private final StageRepository stageRepository;
     private final SchoolRepository schoolRepository;
+    private final ApplicationEventPublisher publisher;
+
 
     public FestivalService(FestivalRepository festivalRepository, StageRepository stageRepository,
-                           SchoolRepository schoolRepository) {
+                           SchoolRepository schoolRepository, ApplicationEventPublisher publisher) {
         this.festivalRepository = festivalRepository;
         this.stageRepository = stageRepository;
         this.schoolRepository = schoolRepository;
+        this.publisher = publisher;
     }
 
     public FestivalResponse create(FestivalCreateRequest request) {
@@ -41,6 +46,7 @@ public FestivalResponse create(FestivalCreateRequest request) {
         Festival festival = request.toEntity(school);
         validate(festival);
         Festival newFestival = festivalRepository.save(festival);
+        publisher.publishEvent(new FestivalCreateEvent(newFestival.getId()));
         return FestivalResponse.from(newFestival);
     }
 

backend/src/main/java/com/festago/festival/dto/event/FestivalCreateEvent.java

@@ -0,0 +1,7 @@
+package com.festago.festival.dto.event;
+
+public record FestivalCreateEvent(
+    Long festivalId
+) {
+
+}

backend/src/main/java/com/festago/presentation/StaffController.java

@@ -0,0 +1,50 @@
+package com.festago.presentation;
+
+import com.festago.auth.annotation.Staff;
+import com.festago.auth.application.StaffAuthService;
+import com.festago.auth.dto.StaffLoginRequest;
+import com.festago.auth.dto.StaffLoginResponse;
+import com.festago.entry.application.EntryService;
+import com.festago.entry.dto.TicketValidationRequest;
+import com.festago.entry.dto.TicketValidationResponse;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/staff")
+@Tag(name = "스태프 요청")
+public class StaffController {
+
+    private final StaffAuthService staffAuthService;
+    private final EntryService entryService;
+
+
+    public StaffController(StaffAuthService staffAuthService, EntryService entryService) {
+        this.staffAuthService = staffAuthService;
+        this.entryService = entryService;
+    }
+
+    @PostMapping("/login")
+    @Operation(description = "스태프 코드로 로그인한다.", summary = "스태프 로그인")
+    public ResponseEntity<StaffLoginResponse> login(@RequestBody StaffLoginRequest request) {
+        StaffLoginResponse response = staffAuthService.login(request);
+        return ResponseEntity.ok()
+            .body(response);
+    }
+
+    @PostMapping("/member-tickets/validation")
+    @Operation(description = "스태프가 티켓을 검사한다.", summary = "티켓 검사")
+    public ResponseEntity<TicketValidationResponse> validate(
+        @RequestBody @Valid TicketValidationRequest request,
+        @Staff Long festivalId) {
+        TicketValidationResponse response = entryService.validate(request, festivalId);
+        return ResponseEntity.ok()
+            .body(response);
+    }
+}

backend/src/main/java/com/festago/school/domain/School.java

@@ -1,6 +1,7 @@
 package com.festago.school.domain;
 
 import com.festago.common.domain.BaseTimeEntity;
+import com.festago.common.exception.BadRequestException;
 import com.festago.common.exception.ErrorCode;
 import com.festago.common.exception.InternalServerException;
 import jakarta.persistence.Column;
@@ -10,10 +11,14 @@
 import jakarta.persistence.Id;
 import jakarta.validation.constraints.NotNull;
 import jakarta.validation.constraints.Size;
+import java.util.regex.Pattern;
 
 @Entity
 public class School extends BaseTimeEntity {
 
+    private static final Pattern DOMAIN_REGEX = Pattern.compile("^[^.]+(\\.[^.]+)+$");
+    private static final char DOMAIN_DELIMITER = '.';
+
     @Id
     @GeneratedValue(strategy = GenerationType.IDENTITY)
     private Long id;
@@ -45,6 +50,7 @@ public School(Long id, String domain, String name) {
     private void validate(String domain, String name) {
         checkNotNull(domain, name);
         checkLength(domain, name);
+        validateDomain(domain);
     }
 
     private void checkNotNull(String domain, String name) {
@@ -68,6 +74,17 @@ private boolean overLength(String target, int maxLength) {
         return target.length() > maxLength;
     }
 
+    private void validateDomain(String domain) {
+        if (!DOMAIN_REGEX.matcher(domain).matches()) {
+            throw new BadRequestException(ErrorCode.INVALID_SCHOOL_DOMAIN);
+        }
+    }
+
+    public String findAbbreviation() {
+        int dotIndex = domain.indexOf(DOMAIN_DELIMITER);
+        return domain.substring(0, dotIndex);
+    }
+
     public Long getId() {
         return id;
     }

backend/src/main/java/com/festago/staff/application/RandomStaffCodeProvider.java

@@ -0,0 +1,24 @@
+package com.festago.staff.application;
+
+import static java.util.stream.Collectors.joining;
+
+import com.festago.festival.domain.Festival;
+import com.festago.staff.domain.StaffCode;
+import java.util.Random;
+import java.util.concurrent.ThreadLocalRandom;
+import org.springframework.stereotype.Component;
+
+@Component
+public class RandomStaffCodeProvider implements StaffCodeProvider {
+
+    @Override
+    public String provide(Festival festival) {
+        String abbreviation = festival.getSchool().findAbbreviation();
+        Random random = ThreadLocalRandom.current();
+        String code = random.ints(0, 10)
+            .mapToObj(String::valueOf)
+            .limit(StaffCode.RANDOM_CODE_LENGTH)
+            .collect(joining());
+        return abbreviation + code;
+    }
+}