Project Access Control & Authorization

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• src/main/java/org/example/coding_convention/config/SecurityConfig.java
• src/main/java/org/example/coding_convention/project_member/model/ProjectMember.java
• src/main/java/org/example/coding_convention/project/service/ProjectService.java
• src/main/java/org/example/coding_convention/project_member/service/ProjectMemberService.java
• src/main/resources/data.sql

Project Access Control & Authorization in PhanesEditor ensures that only authorized users can participate in, view, or modify collaborative projects. The system distinguishes between global authentication (handled via JWT and Spring Security) and project-specific authorization, which is dictated by a user's membership and assigned role within a specific project.

The core of this system is the "Project Member" validation logic. Every real-time interaction—including WebSocket-based chatting and collaborative code editing—is gated by a check to see if the requesting user belongs to the project's member list. This prevents unauthorized access to sensitive project data and ensures a secure environment for real-time collaboration.

Sources: README.md:27-31, README.md:46-52

System Architecture & Security Layers

The access control system operates in two primary layers: Global Authentication and Project-Level Authorization.

Global Authentication

The system uses Spring Security to manage global access. It supports multiple authentication methods, including local login and OAuth2 (Google, Kakao). Authenticated sessions are managed via JWT (JSON Web Tokens), which are validated through JwtAuthFilter.

Sources: src/main/java/org/example/coding_convention/config/SecurityConfig.java:68-81, src/main/java/org/example/coding_convention/config/SecurityConfig.java:108-109

Project-Level Authorization

Once a user is authenticated, the system enforces project-level restrictions. Access to project files, chat history, and real-time synchronization is granted only if a record exists in the project_member table linking the user to the project.

Sources: README.md:46-52, src/main/resources/data.sql:101-108

The diagram shows the sequential check from global authentication to project-specific membership validation.
Sources: README.md:46-52, src/main/java/org/example/coding_convention/config/SecurityConfig.java:83-101

Project Membership and Roles

Membership is defined by the ProjectMember entity, which associates a User with a Project and assigns a specific Status.

Member Roles (Status)

The system defines two primary roles for project members:

1. ADMIN: Typically the project creator. Admins have the authority to manage members.
2. USER: Standard members who can participate in chat and edit files.

Sources: src/main/java/org/example/coding_convention/project_member/model/ProjectMember.java:24-27

Membership Data Model

Field	Type	Description
idx	INT	Primary key for the membership record
user_id	INT	Foreign key referencing the Users table
project_id	INT	Foreign key referencing the Project table
status	VARCHAR(20)	Member role: ADMIN or USER

Sources: src/main/resources/data.sql:101-108, src/main/java/org/example/coding_convention/project_member/model/ProjectMember.java:16-36

Access Control Logic in Service Layer

Authorization logic is primarily executed during project creation and member invitation.

Automatic Admin Assignment

When a new project is saved via ProjectService, the creating user is automatically registered as the project's first member with the ADMIN status.

// Logic within ProjectService.java
String status = "ADMIN";
ProjectMemberDto.ProjectMemberReq memberDto = ProjectMemberDto.ProjectMemberReq.builder()
        .projectId(projectIdx.getIdx())
        .userId(userIdx.getIdx())
        .status(status)
        .build();
projectMemberRepository.save(memberDto.toEntity());

Sources: src/main/java/org/example/coding_convention/project/service/ProjectService.java:49-56

Member Invitation

Additional users are added to the project by creating new ProjectMember records. The ProjectMemberService handles saving these associations after looking up the user by their nickname.

Sources: src/main/java/org/example/coding_convention/project_member/service/ProjectMemberService.java:18-22

WebSocket & Real-time Security

A critical design point of PhanesEditor is the protection of real-time communication channels.

• Connection Validation: Upon establishing a WebSocket connection, the server validates the project ID and the user's information.
• Message Filtering: The backend ensures that chat messages and code synchronization events are only broadcast to users verified as project members.
• Unauthorized Block: If a non-member attempts to join a project's WebSocket channel, the connection is blocked or the request is rejected.

Sources: README.md:47-50, README.md:63-65

The sequence diagram illustrates the membership verification process performed during WebSocket handshake/connection.
Sources: README.md:47-50, README.md:63-65

Conclusion

Project Access Control & Authorization in this repository is built on a robust two-tier security model. By combining global JWT-based authentication with a granular project membership database, the system ensures that collaborative features like real-time code editing and group chatting remain exclusive to authorized project participants. This structure provides the necessary security foundation for a multi-user, web-based IDE.