fix(backoffice): retain admin as control plane login

docs/design/smilegate-tool-users/README.md

@@ -6,7 +6,7 @@
 
 ## 목표
 
-ADB의 `ADMIN.SG_TOOL_USER`를 백오피스 로그인 원본으로 사용한다. 가상 `sg-teamlead`와 `sg-member`를 만들고, 팀장만 변경 권한을 가진다.
+백오피스의 `admin` 계정은 환경설정으로 유지한다. ADB의 `ADMIN.SG_TOOL_USER`에는 백오피스에서 관리할 가상 도구 사용자 `sg-teamlead`와 `sg-member`를 보관한다.
 
 ## 데이터 모델
 
@@ -20,8 +20,8 @@ ADB의 `ADMIN.SG_TOOL_USER`를 백오피스 로그인 원본으로 사용한다.
 
 ## 권한 매핑
 
-- `TEAM_LEAD` → `ROLE_ADMIN`: 설정 변경 가능
+- `TEAM_LEAD`: 팀장용 관리 대상 데이터
-- `TEAM_MEMBER` → `ROLE_VIEWER`: 조회만 가능
+- `TEAM_MEMBER`: 팀원용 관리 대상 데이터
 
 ## 검증 기준
 

src/main/java/com/cloudhandson/vpdbackoffice/config/SecurityConfig.java

@@ -1,6 +1,5 @@
 package com.cloudhandson.vpdbackoffice.config;
 
-import org.springframework.beans.factory.ObjectProvider;
 import java.util.ArrayList;
 import java.util.List;
 import org.springframework.context.annotation.Bean;
@@ -10,12 +9,10 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
-import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.security.crypto.factory.PasswordEncoderFactories;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.jdbc.core.JdbcTemplate;
 
 @Configuration
 public class SecurityConfig {
@@ -78,49 +75,29 @@ public class SecurityConfig {
 
   @Bean
   UserDetailsService userDetailsService(
-      ObjectProvider<JdbcTemplate> jdbcTemplateProvider,
       BackofficeProperties properties,
       PasswordEncoder passwordEncoder
   ) {
-    JdbcTemplate jdbcTemplate = jdbcTemplateProvider.getIfAvailable();
+    var security = properties.security();
-    if (jdbcTemplate == null) {
+    String encodedPassword = security.adminPasswordHash() == null || security.adminPasswordHash().isBlank()
-      String encodedPassword = properties.security().adminPasswordHash() == null
+        ? passwordEncoder.encode(security.adminPassword())
-              || properties.security().adminPasswordHash().isBlank()
+        : security.adminPasswordHash();
-          ? passwordEncoder.encode(properties.security().adminPassword())
-          : properties.security().adminPasswordHash();
     List<UserDetails> users = new ArrayList<>();
-      users.add(User.withUsername(properties.security().adminUser())
+    users.add(User.withUsername(security.adminUser())
         .password(encodedPassword)
         .roles("ADMIN")
         .build());
-      if (properties.security().guestConfigured()) {
+    if (security.guestConfigured()) {
-        String encodedGuestPassword = properties.security().guestPasswordHash() == null
+      String encodedGuestPassword = security.guestPasswordHash() == null || security.guestPasswordHash().isBlank()
-                || properties.security().guestPasswordHash().isBlank()
+          ? passwordEncoder.encode(security.guestPassword())
-            ? passwordEncoder.encode(properties.security().guestPassword())
+          : security.guestPasswordHash();
-            : properties.security().guestPasswordHash();
+      users.add(User.withUsername(security.guestUser())
-        users.add(User.withUsername(properties.security().guestUser())
           .password(encodedGuestPassword)
           .roles("VIEWER")
           .build());
     }
     return new InMemoryUserDetailsManager(users);
   }
-    return username -> jdbcTemplate.query(
-        """
-        select user_id, password_hash, role_code
-          from sg_tool_user
-         where user_id = ?
-           and enabled_yn = 'Y'
-        """,
-        (resultSet, rowNum) -> User.withUsername(resultSet.getString("user_id"))
-            .password(resultSet.getString("password_hash"))
-            .roles("TEAM_LEAD".equals(resultSet.getString("role_code")) ? "ADMIN" : "VIEWER")
-            .build(),
-        username
-    ).stream().findFirst().orElseThrow(
-        () -> new UsernameNotFoundException("Unknown or disabled tool user")
-    );
-  }
 
   @Bean
   PasswordEncoder passwordEncoder() {