[feature] 홍보게시판 CRUD를 동아리 관리자에게 개방 - #2003
Merged
Merged
Conversation
- 생성/수정/삭제/이미지 업로드 엔드포인트를 DEVELOPER 전용에서 CLUB_ADMIN까지 허용 - CLUB_ADMIN은 요청의 clubId를 무시하고 토큰의 동아리로 강제 - 타 동아리 게시글 수정/삭제/업로드 시 USER_UNAUTHORIZED(403) - 심사 전(state != AVAILABLE) 동아리 관리자는 생성/수정 불가 (PROMOTION_CLUB_NOT_APPROVED 902-2) - DEVELOPER는 기존과 동일하게 모든 동아리 게시글 관리 가능 - 호출처가 사라진 existsActiveById 제거, CustomUserDetails.isDeveloper() 추가 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
seongwon030
changed the title
Contributor
|
Warning
|
| Layer / File(s) | Summary |
|---|---|
홍보 게시글 권한 검증 backend/src/main/java/moadong/club/controller/PromotionArticleController.java, backend/src/main/java/moadong/club/service/PromotionArticleService.java, backend/src/main/java/moadong/club/entity/PromotionArticle.java, backend/src/main/java/moadong/user/payload/CustomUserDetails.java, backend/src/main/java/moadong/global/exception/ErrorCode.java, backend/src/test/java/moadong/club/controller/PromotionArticleControllerTest.java, backend/src/test/java/moadong/club/service/PromotionArticleServiceTest.java |
현재 사용자를 서비스에 전달합니다. CLUB_ADMIN은 본인 동아리 게시글만 처리합니다. CLUB_ADMIN은 AVAILABLE 동아리에서만 생성 및 수정할 수 있습니다. 테스트는 역할, 소유권, 동아리 상태를 검증합니다. |
홍보 이미지 업로드 권한 검증 backend/src/main/java/moadong/media/controller/PromotionImageController.java, backend/src/main/java/moadong/media/service/PromotionImageUploadService.java, backend/src/main/java/moadong/club/repository/PromotionArticleRepository.java, backend/src/test/java/moadong/media/service/PromotionImageUploadServiceTest.java |
이미지 업로드에 현재 사용자를 전달합니다. 서비스는 활성 게시글을 조회한 뒤 개발자 또는 본인 동아리 관리자인지 검증합니다. 기존 existsActiveById 확인 경로를 제거하고 findActiveById를 사용합니다. |
Estimated code review effort: 3 (Moderate) | ~25 minutes
Merge Risk: ⚪ Minimal · up to 77789
Promotion article management and image uploads now allow club administrators only for their own club while preserving developer-wide access; unauthorized cross-club actions and unapproved-club article changes are rejected.
Sequence Diagram(s)
sequenceDiagram
participant Client
participant PromotionArticleController
participant PromotionArticleService
participant PromotionArticleRepository
Client->>PromotionArticleController: 홍보 게시글 요청
PromotionArticleController->>PromotionArticleService: 사용자와 요청 전달
PromotionArticleService->>PromotionArticleRepository: 동아리 및 게시글 조회
PromotionArticleService->>PromotionArticleRepository: 권한 검증 후 저장 또는 삭제
PromotionArticleService-->>PromotionArticleController: 처리 결과 반환
sequenceDiagram
participant Client
participant PromotionImageController
participant PromotionImageUploadService
participant PromotionArticleRepository
Client->>PromotionImageController: 홍보 이미지 업로드 요청
PromotionImageController->>PromotionImageUploadService: 사용자와 게시글 ID 전달
PromotionImageUploadService->>PromotionArticleRepository: 활성 게시글 조회
PromotionImageUploadService-->>PromotionImageController: 권한 검증 후 업로드 결과 반환
Suggested reviewers: zepelown
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage | Docstring coverage is 4.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 50 functions across 10 files. | Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (4 passed)
| Check name | Status | Explanation |
|---|---|---|
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Description Check | ✅ Passed | Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | ✅ Passed | 제목은 홍보게시판 CRUD를 CLUB_ADMIN에게 개방하는 주요 변경 사항을 정확하고 간결하게 설명합니다. |
- Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
- Create stacked PR
- Commit on current branch
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Commit unit tests in branch
promo-board-crud-club-admin
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Test Results363 tests 363 ✅ 38s ⏱️ Results for commit 777891d. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
hasRole('DEVELOPER')→hasAnyRole('DEVELOPER', 'CLUB_ADMIN')으로 개방clubId는 무시하고 토큰의 동아리로 강제 (거절 대신 덮어쓰기). 타 동아리 게시글 수정/삭제/업로드 시USER_UNAUTHORIZED(403)state != AVAILABLE인 동아리의 관리자는 생성/수정 불가. 새 에러코드PROMOTION_CLUB_NOT_APPROVED(902-2, 403) 추가설계 결정: clubId를 역할별로 다르게 정하는 이유
바디 clubId가 다를 때 거절(403) 대신 덮어쓰기를 택한 트레이드오프
clubId가 필수값인데 CLUB_ADMIN에게는 무시되는 어색함이 남음.Changes
PromotionArticleController,PromotionImageController:@CurrentUser주입, 권한 완화PromotionArticleService:resolveClubId/validateOwnership/validateClubApproved추가PromotionImageUploadService: 존재 여부 대신 게시글 조회 후 소유권 검사 (existsActiveById제거)CustomUserDetails.isDeveloper()추가,PromotionArticle.update는 확정된clubId를 인자로 받음Notes
clubId는 여전히@NotBlank라 관리자 클라이언트도 값을 보내야 함 (무시됨). CLUB_ADMIN에 한해 선택값으로 바꾸는 건 후속 작업 후보Test plan
./gradlew unitTest전체 통과 (PromotionArticleServiceTest17건,PromotionImageUploadServiceTest5건,PromotionArticleControllerTest1건 포함)./gradlew test전체에서는 Firebase 빈 부재로 Spring 컨텍스트 테스트 20건이 로컬에서 실패하며 본 변경과 무관