feat: 게스트 공유링크 소유 검증 - #94
Merged
Merged
Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthrough게스트 ID와 사용자 ID를 피드백·답글 조회 API에 전달합니다. 서비스는 공유 링크의 활성·만료 상태와 영상 일치 여부를 검증합니다. 게스트 접근 거부 오류와 조회용 Changes게스트 접근 검증
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Guest
participant FeedbackController
participant FeedbackService
participant ShareLink
Guest->>FeedbackController: guestId와 videoId로 조회 요청
FeedbackController->>FeedbackService: userId, guestId, videoId 전달
FeedbackService->>ShareLink: 공유 링크 조회
ShareLink-->>FeedbackService: 활성 상태와 연결된 Video 반환
FeedbackService-->>FeedbackController: 피드백 목록 반환
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/main/java/com/slatto/domain/feedback/service/FeedbackService.java`:
- Around line 185-188: 익명 목록 조회 시 guestId 없이 접근하는 경로를 차단하십시오.
src/main/java/com/slatto/domain/feedback/service/FeedbackService.java 185-188의
userId 검증에서 guestId가 null이면 GUEST_ACCESS_DENIED를 발생시키고, guestId가 있으면
validateGuestAccess를 호출하십시오. 동일하게
src/main/java/com/slatto/domain/feedback/service/FeedbackDetailService.java
112-115의 익명 접근 검증도 수정하십시오.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 69f499b2-b10f-43cb-90cf-5e5a3aaac481
📒 Files selected for processing (6)
src/main/java/com/slatto/domain/feedback/controller/FeedbackController.javasrc/main/java/com/slatto/domain/feedback/controller/FeedbackDetailController.javasrc/main/java/com/slatto/domain/feedback/service/FeedbackDetailService.javasrc/main/java/com/slatto/domain/feedback/service/FeedbackService.javasrc/main/java/com/slatto/domain/sharelink/exception/ShareLinkErrorCode.javasrc/main/java/com/slatto/global/config/SecurityConfig.java
Comment on lines
+185
to
+188
| // 2. 게스트가 조회하는 경우 이 영상에 접근 자격이 있는지 검증 | ||
| if (userId == null && guestId != null) { | ||
| validateGuestAccess(guestId, videoId); | ||
| } |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
익명 목록 조회를 차단하십시오.
SecurityConfig는 두 GET 경로를 permitAll()로 엽니다. 현재 조건은 userId와 guestId가 모두 null이면 검증을 건너뜁니다. 따라서 요청자는 guestId 없이 다른 영상의 피드백과 답글 목록을 조회할 수 있습니다.
userId == null이면 guestId가 반드시 존재하도록 확인하십시오. guestId가 없으면 GUEST_ACCESS_DENIED를 발생시키십시오.
src/main/java/com/slatto/domain/feedback/service/FeedbackService.java#L185-L188:guestId == null인 익명 요청을 거부한 후validateGuestAccess를 호출하십시오.src/main/java/com/slatto/domain/feedback/service/FeedbackDetailService.java#L112-L115:guestId == null인 익명 요청을 거부한 후validateGuestAccess를 호출하십시오.
수정 예시
- if (userId == null && guestId != null) {
- validateGuestAccess(guestId, videoId);
+ if (userId == null) {
+ if (guestId == null) {
+ throw new BaseException(ShareLinkErrorCode.GUEST_ACCESS_DENIED);
+ }
+ validateGuestAccess(guestId, videoId);
}📍 Affects 2 files
src/main/java/com/slatto/domain/feedback/service/FeedbackService.java#L185-L188(this comment)src/main/java/com/slatto/domain/feedback/service/FeedbackDetailService.java#L112-L115
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/main/java/com/slatto/domain/feedback/service/FeedbackService.java` around
lines 185 - 188, 익명 목록 조회 시 guestId 없이 접근하는 경로를 차단하십시오.
src/main/java/com/slatto/domain/feedback/service/FeedbackService.java 185-188의
userId 검증에서 guestId가 null이면 GUEST_ACCESS_DENIED를 발생시키고, guestId가 있으면
validateGuestAccess를 호출하십시오. 동일하게
src/main/java/com/slatto/domain/feedback/service/FeedbackDetailService.java
112-115의 익명 접근 검증도 수정하십시오.
chazy-d
approved these changes
Aug 1, 2026
young0206
approved these changes
Aug 2, 2026
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔗 관련 이슈 (Related Issue)
📝 작업 내용
Guest → ShareLink → Video체인으로 영상 일치 여부 확인isUsable())ShareLinkErrorCode에GUEST_ACCESS_DENIED(403) 추가변경 파일
FeedbackService,FeedbackDetailServiceFeedbackController,FeedbackDetailControllerSecurityConfigShareLinkErrorCode테스트 완료 (로컬 Swagger)
✅ PR 체크리스트
Summary by CodeRabbit
새 기능
버그 수정