refactor(server): update auth, user, and recruit member domains with … #277
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -34,6 +34,7 @@ ext { | |
| dotenvVersion = '5.2.2' | ||
| querydslVersion = '6.10.1' | ||
| jjwtVersion = '0.13.0' | ||
| googleApiClientVersion = '2.6.0' | ||
| } | ||
|
|
||
| /* ===== Vulnerability Pins (정확한 CVE 기반 대응) ===== */ | ||
|
|
@@ -104,7 +105,7 @@ dependencies { | |
| testRuntimeOnly 'org.junit.platform:junit-platform-launcher' | ||
|
|
||
| //Google API Client | ||
| implementation "com.google.api-client:google-api-client:${googleApiClientVersion}" | ||
| } | ||
|
|
||
| dependencyManagement { | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,23 +1,31 @@ | ||
| package inha.gdgoc.domain.admin.user.controller; | ||
|
|
||
| import inha.gdgoc.domain.admin.user.dto.request.UpdateRoleRequest; | ||
| import inha.gdgoc.domain.admin.user.dto.request.UpdateUserRoleTeamRequest; | ||
| import inha.gdgoc.domain.admin.user.dto.response.UserSummaryResponse; | ||
| import inha.gdgoc.domain.admin.user.service.UserAdminService; | ||
| import inha.gdgoc.global.config.jwt.TokenProvider.CustomUserDetails; | ||
| import inha.gdgoc.global.dto.response.ApiResponse; | ||
| import inha.gdgoc.global.dto.response.PageMeta; | ||
| import io.swagger.v3.oas.annotations.Operation; | ||
| import io.swagger.v3.oas.annotations.security.SecurityRequirement; | ||
| import jakarta.validation.Valid; | ||
| import lombok.RequiredArgsConstructor; | ||
| import org.springframework.data.domain.Page; | ||
| import org.springframework.data.domain.PageRequest; | ||
| import org.springframework.data.domain.Pageable; | ||
| import org.springframework.data.domain.Sort; | ||
| import org.springframework.http.ResponseEntity; | ||
| import org.springframework.security.access.prepost.PreAuthorize; | ||
| import org.springframework.security.core.annotation.AuthenticationPrincipal; | ||
| import org.springframework.web.bind.annotation.DeleteMapping; | ||
| import org.springframework.web.bind.annotation.GetMapping; | ||
| import org.springframework.web.bind.annotation.PatchMapping; | ||
| import org.springframework.web.bind.annotation.PathVariable; | ||
| import org.springframework.web.bind.annotation.RequestBody; | ||
| import org.springframework.web.bind.annotation.RequestMapping; | ||
| import org.springframework.web.bind.annotation.RequestParam; | ||
| import org.springframework.web.bind.annotation.RestController; | ||
|
|
||
| @RequiredArgsConstructor | ||
| @RestController | ||
|
|
@@ -28,7 +36,7 @@ public class UserAdminController { | |
| "@accessGuard.check(authentication," | ||
| + " T(inha.gdgoc.global.security.AccessGuard$AccessCondition).atLeast(" | ||
| + "T(inha.gdgoc.domain.user.enums.UserRole).LEAD)," | ||
| + " T(inha.gdgoc.global.security.AccessGuard$AccessCondition).of(" | ||
| + "T(inha.gdgoc.domain.user.enums.UserRole).CORE," | ||
| + " T(inha.gdgoc.domain.user.enums.TeamType).HR))"; | ||
| private static final String LEAD_OR_HIGHER_RULE = | ||
|
|
@@ -38,7 +46,6 @@ public class UserAdminController { | |
|
|
||
| private final UserAdminService userAdminService; | ||
|
|
||
| @Operation(summary = "사용자 요약 목록 조회", security = {@SecurityRequirement(name = "BearerAuth")}) | ||
| @PreAuthorize(LEAD_OR_HR_RULE) | ||
| @GetMapping | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,8 @@ | ||
| package inha.gdgoc.domain.admin.user.dto.request; | ||
|
|
||
| import inha.gdgoc.domain.user.enums.UserRole; | ||
| import jakarta.validation.constraints.NotNull; | ||
|
|
||
| public record UpdateRoleRequest( | ||
| @NotNull UserRole role | ||
| ) {} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| package inha.gdgoc.domain.admin.user.dto.request; | ||
|
|
||
| import inha.gdgoc.domain.user.enums.TeamType; | ||
| import inha.gdgoc.domain.user.enums.UserRole; | ||
|
|
||
| public record UpdateUserRoleTeamRequest( | ||
| UserRole role, | ||
| TeamType team | ||
| ) {} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| package inha.gdgoc.domain.admin.user.dto.response; | ||
|
|
||
| import inha.gdgoc.domain.user.enums.TeamType; | ||
| import inha.gdgoc.domain.user.enums.UserRole; | ||
|
|
@@ -11,4 +11,4 @@ public record UserSummaryResponse( | |
| String email, | ||
| UserRole userRole, | ||
| TeamType team | ||
| ) {} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,7 @@ | ||
| package inha.gdgoc.domain.admin.user.service; | ||
|
|
||
| import inha.gdgoc.domain.admin.user.dto.request.UpdateUserRoleTeamRequest; | ||
| import inha.gdgoc.domain.admin.user.dto.response.UserSummaryResponse; | ||
| import inha.gdgoc.domain.user.entity.User; | ||
| import inha.gdgoc.domain.user.enums.TeamType; | ||
| import inha.gdgoc.domain.user.enums.UserRole; | ||
|
|
@@ -26,8 +26,6 @@ public class UserAdminService { | |
|
|
||
| private final UserRepository userRepository; | ||
|
|
||
| @Transactional(readOnly = true) | ||
| public Page<UserSummaryResponse> listUsers(String q, Pageable pageable) { | ||
| Pageable fixed = rewriteSort(pageable); | ||
|
|
@@ -36,7 +34,9 @@ public Page<UserSummaryResponse> listUsers(String q, Pageable pageable) { | |
|
|
||
| private Pageable rewriteSort(Pageable pageable) { | ||
| Sort original = pageable.getSort(); | ||
| if (original.isUnsorted()) { | ||
| return pageable; | ||
| } | ||
|
|
||
| Sort composed = Sort.unsorted(); | ||
| boolean hasUserRoleOrder = false; | ||
|
|
@@ -50,6 +50,7 @@ private Pageable rewriteSort(Pageable pageable) { | |
| " WHEN u.userRole = 'ORGANIZER' THEN 4 " + | ||
| " WHEN u.userRole = 'ADMIN' THEN 5 " + | ||
| " ELSE -1 END)"; | ||
|
|
||
| for (Sort.Order o : original) { | ||
| String prop = o.getProperty(); | ||
| Sort.Direction dir = o.getDirection(); | ||
|
|
@@ -73,11 +74,10 @@ private Pageable rewriteSort(Pageable pageable) { | |
| composed = composed.and(JpaSort.unsafe(Sort.Direction.DESC, roleRankCase)); | ||
| composed = composed.and(Sort.by("name").ascending()); | ||
| } | ||
|
|
||
| return PageRequest.of(pageable.getPageNumber(), pageable.getPageSize(), composed); | ||
| } | ||
|
|
||
| @Transactional | ||
| public void updateRoleAndTeam(CustomUserDetails editor, Long targetUserId, UpdateUserRoleTeamRequest req) { | ||
| User editorUser = getEditor(editor); | ||
|
|
@@ -90,10 +90,8 @@ public void updateRoleAndTeam(CustomUserDetails editor, Long targetUserId, Updat | |
| UserRole newRole = (req.role() != null ? req.role() : targetCurrentRole); | ||
| TeamType requestedTeam = (req.team() != null ? req.team() : target.getTeam()); | ||
|
|
||
| TeamType newTeam = isTeamAssignableRole(newRole) ? requestedTeam : null; | ||
|
|
||
| if (!(editorRole.rank() > targetCurrentRole.rank())) { | ||
| throw new BusinessException(GlobalErrorCode.FORBIDDEN_USER, "동급/상위 사용자의 정보는 변경할 수 없습니다."); | ||
| } | ||
|
|
@@ -124,7 +122,6 @@ public void updateRoleAndTeam(CustomUserDetails editor, Long targetUserId, Updat | |
| } | ||
|
|
||
| if (editor.getTeam() == TeamType.HR) { | ||
| if (editorUser.getId().equals(target.getId())) { | ||
| if (req.team() != null && !Objects.equals(req.team(), target.getTeam())) { | ||
| throw new BusinessException(GlobalErrorCode.FORBIDDEN_USER, "HR-LEAD도 자기 자신의 팀은 변경할 수 없습니다."); | ||
|
|
@@ -159,12 +156,13 @@ public void updateUserRoleWithRules(CustomUserDetails me, Long targetUserId, Use | |
|
|
||
| UserRole current = target.getUserRole(); | ||
|
|
||
| boolean isHrCore = (meRole == UserRole.CORE) && (meTeam == TeamType.HR); | ||
| if (isHrCore) { | ||
| if (current == UserRole.GUEST && newRole == UserRole.MEMBER) { | ||
| target.changeRole(UserRole.MEMBER); | ||
| if (!isTeamAssignableRole(UserRole.MEMBER)) { | ||
| target.changeTeam(null); | ||
| } | ||
| userRepository.save(target); | ||
| return; | ||
| } | ||
|
|
@@ -178,7 +176,9 @@ public void updateUserRoleWithRules(CustomUserDetails me, Long targetUserId, Use | |
| } | ||
|
|
||
| target.changeRole(newRole); | ||
| if (!isTeamAssignableRole(newRole)) { | ||
| target.changeTeam(null); | ||
| } | ||
| userRepository.save(target); | ||
| } | ||
|
|
||
|
|
@@ -203,18 +203,22 @@ public void deleteUserWithRules(CustomUserDetails me, Long targetUserId) { | |
| } | ||
|
|
||
| switch (editorRole) { | ||
| case ADMIN -> { | ||
| } | ||
| case ORGANIZER -> { | ||
| if (targetRole == UserRole.ADMIN) { | ||
| throw new BusinessException(GlobalErrorCode.FORBIDDEN_USER, "ADMIN 사용자는 삭제할 수 없습니다."); | ||
| } | ||
| } | ||
| case LEAD -> { | ||
| if (editorTeam == null) { | ||
| throw new BusinessException(GlobalErrorCode.FORBIDDEN_USER, "LEAD 토큰에 팀 정보가 없습니다."); | ||
| } | ||
| if (!(targetRole == UserRole.MEMBER || targetRole == UserRole.CORE)) { | ||
| throw new BusinessException(GlobalErrorCode.FORBIDDEN_USER, "LEAD는 MEMBER/CORE만 삭제할 수 있습니다."); | ||
| } | ||
| if (editorTeam != TeamType.HR) { | ||
| if (targetTeam != editorTeam) { | ||
| throw new BusinessException(GlobalErrorCode.FORBIDDEN_USER, "다른 팀 사용자는 삭제할 수 없습니다."); | ||
| } | ||
| } | ||
|
|
@@ -225,19 +229,21 @@ public void deleteUserWithRules(CustomUserDetails me, Long targetUserId) { | |
| userRepository.delete(target); | ||
| } | ||
|
|
||
| private User getEditor(CustomUserDetails editor) { | ||
| return userRepository.findById(editor.getUserId()) | ||
| .orElseThrow(() -> new BusinessException(GlobalErrorCode.UNAUTHORIZED_USER)); | ||
| } | ||
|
|
||
| private void targetChange(User target, UserRole newRole, TeamType newTeam) { | ||
| target.changeRole(newRole); | ||
| if (!isTeamAssignableRole(newRole)) { | ||
| newTeam = null; | ||
| } | ||
| target.changeTeam(newTeam); | ||
| userRepository.save(target); | ||
| } | ||
|
|
||
| private boolean isTeamAssignableRole(UserRole role) { | ||
| return role == UserRole.CORE || role == UserRole.LEAD; | ||
| } | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: GDGoCINHA/24-2_GDGoC_Server
Length of output: 53
🏁 Script executed:
# Check the full deploy-dev.yml file to see all env vars defined cat -n .github/workflows/deploy-dev.ymlRepository: GDGoCINHA/24-2_GDGoC_Server
Length of output: 3598
🏁 Script executed:
# Check deploy-prod.yml for comparison cat -n .github/workflows/deploy-prod.ymlRepository: GDGoCINHA/24-2_GDGoC_Server
Length of output: 3669
🏁 Script executed:
Repository: GDGoCINHA/24-2_GDGoC_Server
Length of output: 110
🏁 Script executed:
# Check if application-prod.yml references ACCESS_COOKIE_* variables cat src/main/resources/application-prod.ymlRepository: GDGoCINHA/24-2_GDGoC_Server
Length of output: 2010
ACCESS_COOKIE_*환경 변수가 두 배포 워크플로우에서 누락되었습니다.application-prod.yml에서ACCESS_COOKIE_SECURE,ACCESS_COOKIE_SAME_SITE,ACCESS_COOKIE_DOMAIN을 참조하고 있으나,deploy-dev.yml과deploy-prod.yml모두에서.env에 포함되지 않았습니다.REFRESH_COOKIE_*환경 변수는 명시적으로 추가되었지만, 동일한 수준의 쿠키 설정인ACCESS_COOKIE_*는 누락되어 있어 설정 관리의 일관성이 부족합니다. 애플리케이션은 기본값(secure: false, same-site: Lax)으로 정상 작동하겠지만, 명시적 관리를 위해 두 워크플로우에 모두ACCESS_COOKIE_SECURE,ACCESS_COOKIE_SAME_SITE,ACCESS_COOKIE_DOMAIN을 추가해 주세요.🤖 Prompt for AI Agents