Method Security — URL이 아닌 메서드 단위로 권한을 제어하는 방법

@Configuration
@EnableMethodSecurity  // Spring Security 6+
public class MethodSecurityConfig {
}

@Service
public class AdminService {

    @PreAuthorize("hasRole('ADMIN')")
    public void deleteUser(Long userId) {
        // ADMIN 권한이 없으면 AccessDeniedException 발생
        userRepository.deleteById(userId);
    }

    @PreAuthorize("hasAnyRole('ADMIN', 'MANAGER')")
    public List<UserDto> getAllUsers() {
        return userRepository.findAll().stream()
            .map(UserDto::from)
            .toList();
    }
}

// 자신의 정보만 수정 가능
@PreAuthorize("#userId == authentication.principal.id")
public void updateProfile(Long userId, ProfileRequest request) {
    // ...
}

// ADMIN이거나 본인만 접근 가능
@PreAuthorize("hasRole('ADMIN') or #userId == authentication.principal.id")
public UserDto getUser(Long userId) {
    return userRepository.findById(userId)
        .map(UserDto::from)
        .orElseThrow();
}

@PostAuthorize("returnObject.createdBy == authentication.name")
public Document getDocument(Long documentId) {
    return documentRepository.findById(documentId).orElseThrow();
    // 반환된 Document의 createdBy가 현재 사용자가 아니면 AccessDeniedException
}

// 위험! 메서드가 먼저 실행되므로 삭제가 먼저 수행됨
@PostAuthorize("returnObject.owner == authentication.name")
public Document deleteDocument(Long id) {
    // 삭제 후에 권한 검사 → 이미 삭제됨!
    return documentRepository.delete(id);
}

@Secured("ROLE_ADMIN")
public void adminOnly() { ... }

@Secured({"ROLE_ADMIN", "ROLE_MANAGER"})
public void adminOrManager() { ... }

// 입력 리스트에서 현재 사용자 소유의 항목만 필터링
@PreFilter("filterObject.owner == authentication.name")
public void deleteDocuments(List<Document> documents) {
    documentRepository.deleteAll(documents);
}

// 반환 리스트에서 현재 사용자 소유의 항목만 필터링
@PostFilter("filterObject.owner == authentication.name")
public List<Document> getAllDocuments() {
    return documentRepository.findAll();
}

// 커스텀 권한 검증 빈
@Component("authz")
public class AuthorizationChecker {

    private final TeamMemberRepository teamMemberRepository;

    public boolean isTeamMember(Long teamId, Long userId) {
        return teamMemberRepository.existsByTeamIdAndUserId(teamId, userId);
    }

    public boolean isDocumentOwner(Long documentId, String username) {
        return documentRepository.findById(documentId)
            .map(doc -> doc.getCreatedBy().equals(username))
            .orElse(false);
    }
}

// SpEL에서 커스텀 빈 참조
@PreAuthorize("@authz.isTeamMember(#teamId, authentication.principal.id)")
public void addMemberToTeam(Long teamId, MemberRequest request) {
    // ...
}

@PreAuthorize("@authz.isDocumentOwner(#documentId, authentication.name) " +
    "or hasRole('ADMIN')")
public void editDocument(Long documentId, DocumentRequest request) {
    // ...
}

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@PreAuthorize("hasRole('ADMIN')")
public @interface AdminOnly {
}

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@PreAuthorize("hasRole('ADMIN') or #userId == authentication.principal.id")
public @interface AdminOrSelf {
}

@Service
public class UserService {

    @AdminOnly
    public void deleteUser(Long userId) { ... }

    @AdminOrSelf
    public UserDto getUser(Long userId) { ... }
}

@Service
public class DocumentService {
    public void process(Long docId) {
        this.deleteDocument(docId);  // ← 프록시를 거치지 않음! 권한 검사 X
    }

    @PreAuthorize("hasRole('ADMIN')")
    public void deleteDocument(Long docId) { ... }
}