[Release] 수정 사항 반영 후 운영 서버 릴리즈 #169
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
[Refactor] 내부 자동화를 위한 관리자용 로그인 API 추가 (장기 refresh 토큰 기반)
[Fix] 품종 정보 필드 길이 수정
개요이 PR은 X-ADMIN-KEY 헤더를 통한 관리자 서비스 계정 로그인 기능을 추가하고, 관리자 역할(ROLE_ADMIN)을 도입하며, 관리자 API 접근을 제한하는 allowlist 필터를 적용합니다. 또한 Report 엔티티의 breed 칼럼 길이를 확장하고 관련 설정 및 테스트를 추가합니다. 변경사항
시퀀스 다이어그램sequenceDiagram
participant Client
participant AuthController
participant AuthServiceFacade
participant AdminLoginService
participant UserRepository
participant JwtUtil
Client->>AuthController: POST /login/admin<br/>(X-ADMIN-KEY: admin-key)
AuthController->>AuthController: adminKey 검증<br/>(configured adminApiKey와 비교)
alt 유효한 KEY
AuthController->>AuthServiceFacade: adminLogin()
AuthServiceFacade->>AdminLoginService: adminLogin()
AdminLoginService->>UserRepository: findById(adminUserId)
alt 사용자 존재
UserRepository-->>AdminLoginService: User
AdminLoginService->>JwtUtil: createAccessJwt<br/>(userId, ROLE_ADMIN, ttl)
JwtUtil-->>AdminLoginService: accessToken
AdminLoginService-->>AuthServiceFacade: AdminLoginResponse<br/>(userId, accessToken)
AuthServiceFacade-->>AuthController: AdminLoginResponse
AuthController-->>Client: 200 OK<br/>(AdminLoginResponse)
else 사용자 없음
UserRepository-->>AdminLoginService: Optional.empty()
AdminLoginService-->>AuthServiceFacade: CustomException<br/>(USER_NOT_FOUND)
AuthServiceFacade-->>AuthController: CustomException
AuthController-->>Client: 404 Not Found<br/>(USER_NOT_FOUND)
end
else 유효하지 않거나 누락된 KEY
AuthController-->>Client: 401 Unauthorized<br/>(UNAUTHORIZED)
end
코드 리뷰 예상 시간🎯 3 (보통) | ⏱️ ~25분 관련 가능성 있는 PR
추천 리뷰어
🚥 Pre-merge checks | ✅ 1 | ❌ 4❌ Failed checks (2 warnings, 2 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Test Results379 tests 379 ✅ 57s ⏱️ Results for commit 0d3a81b. |
📊 JaCoCo Coverage
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Fix all issues with AI agents
In
`@src/main/java/com/kuit/findyou/domain/auth/dto/response/AdminLoginResponse.java`:
- Around line 9-10: Update the Swagger description string for the accessToken
field in AdminLoginResponse: change the Schema description from "엑세스 토큰" to the
correct Korean spelling "액세스 토큰" for the field named accessToken in the
AdminLoginResponse DTO so generated API docs show the corrected text.
In
`@src/main/java/com/kuit/findyou/domain/auth/service/AdminLoginServiceImpl.java`:
- Around line 27-34: In adminLogin(), after retrieving the User via
userRepository.findById(adminUserId), validate that the user has an admin role
and is in an active (not deleted/disabled) state before issuing the token: check
User.getRole() equals Role.ADMIN and the appropriate status flag/method on User
(e.g., isActive(), isDeleted()==false, or getStatus()==Status.ACTIVE) and if
either check fails throw a suitable CustomException (e.g., INVALID_PERMISSION or
USER_INACTIVE); only then call jwtUtil.createAccessJwt(...) and return the
AdminLoginResponse. Ensure you reference adminUserId, adminLogin(), User,
userRepository, Role.ADMIN, jwtUtil.createAccessJwt, AdminLoginResponse and
CustomException when making the change.
In `@src/main/java/com/kuit/findyou/domain/report/model/Report.java`:
- Line 31: DB 컬럼의 breed 길이를 50으로 늘린 것과 검증/문서가 불일치합니다:
CreateWitnessReportRequest.breed 및 CreateMissingReportRequest.breed 필드에
javax.validation.constraints.Size(max = 50) 어노테이션을 추가하고, 응답 DTO들(예:
WitnessReportResponse, MissingReportResponse 등)의 해당 breed 필드에 스웨거
어노테이션(`@Schema`)에 maxLength = 50을 명시해 주세요; 대상 필드 이름(breed)과 DTO 클래스명을 기준으로 찾아 일관된
검증/스키마 제약을 적용하면 됩니다.
In
`@src/main/java/com/kuit/findyou/global/jwt/security/CustomAccessDeniedHandler.java`:
- Around line 24-27: The current CustomAccessDeniedHandler exposes
accessDeniedException.getMessage() in the BaseErrorResponse which may leak
internal auth/filter details; update the handler (in CustomAccessDeniedHandler)
to avoid returning the raw exception message by using a fixed external-facing
message (e.g., "Access denied") or map only allowed error keys to user-friendly
messages, and pass that safe message into new BaseErrorResponse(FORBIDDEN,
safeMessage) (or new BaseErrorResponse(FORBIDDEN) if you choose the
fixed-message overload) instead of the raw accessDeniedException.getMessage().
In `@src/main/java/com/kuit/findyou/global/jwt/util/JwtUtil.java`:
- Around line 64-71: The createAccessJwt method can produce immediately-expired
tokens if expireMs is zero/negative or invalid; add a validation guard at the
start of createAccessJwt(Long userId, Role role, long expireMs) to ensure
expireMs is a positive value (e.g., throw IllegalArgumentException or clamp to a
safe minimum like 1 minute) before using it to compute expiration, so the
Jwts.builder() call always receives a valid expiration interval.
src/main/java/com/kuit/findyou/domain/auth/dto/response/AdminLoginResponse.java
Show resolved
Hide resolved
src/main/java/com/kuit/findyou/domain/auth/service/AdminLoginServiceImpl.java
Show resolved
Hide resolved
src/main/java/com/kuit/findyou/global/jwt/security/CustomAccessDeniedHandler.java
Show resolved
Hide resolved
ksg1227
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related issue 🛠
Work Description 📝
Screenshot 📸
Uncompleted Tasks 😅
To Reviewers 📢
수정 사항들 운영 서버에 반영하고자 하니 확인 한 번 부탁드립니다~
Summary by CodeRabbit
릴리스 노트
New Features
Improvements
Tests
✏️ Tip: You can customize this high-level summary in your review settings.