Feature/#14 swagger setting

[Anna0626]

이슈: #14

Summary by CodeRabbit

• New Features

  • Added API documentation support with interactive Swagger/OpenAPI pages.
  • Included OpenAPI metadata and a bearer token security definition in the generated docs.

• Bug Fixes

  • Allowed documentation-related routes to load without authentication.
  • Kept all other endpoints protected as before.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds Springdoc OpenAPI starter dependencies to build.gradle, introduces a new SwaggerConfig class defining an OpenAPI bean with metadata, server URL, and Bearer JWT security scheme, and updates SecurityConfig to permit unauthenticated access to Swagger/OpenAPI documentation endpoints.

Changes

Swagger/OpenAPI Integration

Layer / File(s)	Summary
Springdoc dependencies and OpenAPI bean build.gradle, src/main/java/com/stology/be/global/config/SwaggerConfig.java	Adds Springdoc OpenAPI starter dependencies and a new SwaggerConfig class exposing an OpenAPI bean with title/description/version, a / server URL, and an HTTP Bearer JWT security scheme with a matching security requirement.
Security rules for Swagger endpoints src/main/java/com/stology/be/global/security/config/SecurityConfig.java	Expands the permitAll request matchers to include /swagger-ui/**, /swagger-resources/**, and /v3/api-docs/** alongside existing /login and /oauth2/** routes.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Sequence Diagram(s)

Not applicable — the changes are configuration additions without multi-component sequential flow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is related to the PR and reflects the Swagger/OpenAPI setup, though it is a bit terse and issue-number heavy.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/#14-swagger-setting

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

build.gradle (1)

31-32: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Redundant explicit dependency on springdoc-openapi-starter-webmvc-api.

springdoc-openapi-starter-webmvc-ui already declares springdoc-openapi-starter-webmvc-api as a direct dependency in its own POM, so it's pulled in transitively. Declaring both explicitly is unnecessary and can complicate future version bumps (two lines to keep in sync).

♻️ Proposed simplification

-    implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.1'
-    implementation 'org.springdoc:springdoc-openapi-starter-webmvc-api:3.0.1'
+    implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.1'

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@build.gradle` around lines 31 - 32, The dependency list in build.gradle is
redundant because springdoc-openapi-starter-webmvc-ui already brings in
springdoc-openapi-starter-webmvc-api transitively. Remove the explicit
springdoc-openapi-starter-webmvc-api declaration and keep only the
springdoc-openapi-starter-webmvc-ui dependency so dependency management stays
simpler; use the springdoc dependency entries in the Gradle file to locate the
change.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@build.gradle`:
- Around line 31-32: The springdoc dependencies in the build script are pinned
to a version that is not compatible with the current Spring Boot release. Update
the springdoc artifacts referenced in the build configuration to a release that
supports Spring Boot 4.1.0, or alternatively align the Spring Boot version to
the supported 4.0.x line; keep the change centered on the springdoc dependency
declarations so the build stays dependency-compatible.

In `@src/main/java/com/stology/be/global/security/config/SecurityConfig.java`:
- Line 24: Update SecurityConfig’s requestMatchers permit list to include the
Swagger UI/docs entrypoints that springdoc exposes, since the current
configuration can still block them with 401. Extend the existing permitAll
matcher in SecurityConfig so it explicitly allows /swagger-ui.html and
/v3/api-docs.yaml alongside the current /swagger-ui/** and /v3/api-docs/**
patterns.

---

Nitpick comments:
In `@build.gradle`:
- Around line 31-32: The dependency list in build.gradle is redundant because
springdoc-openapi-starter-webmvc-ui already brings in
springdoc-openapi-starter-webmvc-api transitively. Remove the explicit
springdoc-openapi-starter-webmvc-api declaration and keep only the
springdoc-openapi-starter-webmvc-ui dependency so dependency management stays
simpler; use the springdoc dependency entries in the Gradle file to locate the
change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 34b49e68-80a6-4948-a662-1250f0df0664

📥 Commits

Reviewing files that changed from the base of the PR and between 2be340e and 67828ef.

📒 Files selected for processing (3)

• build.gradle
• src/main/java/com/stology/be/global/config/SwaggerConfig.java
• src/main/java/com/stology/be/global/security/config/SecurityConfig.java

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: find the declared Spring Boot version/plugin in build.gradle
rg -n "org.springframework.boot|spring-boot" build.gradle

Repository: Stology/BE

Length of output: 764

---

🌐 Web query:

springdoc-openapi 3.0.1 Spring Boot 4.1 compatibility release notes support matrix

💡 Result:

The springdoc-openapi version 3.0.1 is not compatible with Spring Boot 4.1. The 3.0.1 release of springdoc-openapi was released on January 1, 2026 [1][2], and it specifically upgraded support for Spring Boot 4.0.1 [1][2]. Spring Boot 4.1 was released later, on June 10, 2026 [3][4]. To use Spring Boot 4.1, you should look for a more recent version of springdoc-openapi, as the library releases are typically aligned to support specific Spring Boot major and minor versions through subsequent updates [5]. According to historical release patterns, later versions of springdoc-openapi (such as those released after June 2026) include the necessary upgrades to support Spring Boot 4.1 [5]. You can verify the latest compatible version by checking the official springdoc-openapi releases page [5].

Citations:

• 1: https://github.com/springdoc/springdoc-openapi/blob/v3.0.1/CHANGELOG.md
• 2: https://github.com/springdoc/springdoc-openapi/releases/tag/v3.0.1
• 3: https://github.com/spring-projects/spring-boot/releases/tag/v4.1.0
• 4: https://www.infoq.com/news/2026/06/spring-boot-4-1/
• 5: https://github.com/springdoc/springdoc-openapi/releases

---

springdoc 3.0.1 doesn’t match Spring Boot 4.1.0
springdoc-openapi 3.0.1 targets Spring Boot 4.0.1, while this project uses Spring Boot 4.1.0. Bump springdoc to a 4.1-compatible release, or align Boot to the supported 4.0.x line, to avoid dependency/runtime issues.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@build.gradle` around lines 31 - 32, The springdoc dependencies in the build
script are pinned to a version that is not compatible with the current Spring
Boot release. Update the springdoc artifacts referenced in the build
configuration to a release that supports Spring Boot 4.1.0, or alternatively
align the Spring Boot version to the supported 4.0.x line; keep the change
centered on the springdoc dependency declarations so the build stays
dependency-compatible.

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the security config around the matcher list.
sed -n '1,220p' src/main/java/com/stology/be/global/security/config/SecurityConfig.java

printf '\n--- springdoc references ---\n'
rg -n "springdoc|swagger-ui|v3/api-docs|swagger-resources" -S .

printf '\n--- dependency files ---\n'
git ls-files | rg '(^pom\.xml$|^build\.gradle(\.kts)?$|^settings\.gradle(\.kts)?$|gradle\.properties$|libs\.versions\.toml$)'

Repository: Stology/BE

Length of output: 2413

---

🌐 Web query:

Springdoc OpenAPI starter webmvc ui 3.0.1 default endpoints /swagger-ui.html /swagger-ui/index.html /v3/api-docs.yaml

💡 Result:

In springdoc-openapi 3.0.1, the default endpoints for accessing the Swagger UI and OpenAPI documentation are as follows: - Swagger UI: The primary default URL is /swagger-ui.html [1][2]. - OpenAPI JSON documentation: The default URL is /v3/api-docs [1][2]. - OpenAPI YAML documentation: The default URL is /v3/api-docs.yaml [1]. While /swagger-ui/index.html is often mentioned in contexts related to the internal routing of the underlying webjars or as an alternative entry point in some configurations, /swagger-ui.html is the standard, documented default path for accessing the UI [1][2]. These endpoints are served on the application's main port and context path by default [1]. You can customize these paths using the following configuration properties in your application properties or YAML file: - To change the Swagger UI path: springdoc.swagger-ui.path=/your-custom-path/swagger-ui.html [3][1] - To change the OpenAPI JSON path: springdoc.api-docs.path=/your-custom-path/v3/api-docs [4][5] If you encounter issues or need to secure these endpoints, ensure that your security configuration (such as Spring Security) explicitly permits access to these paths [1].

Citations:

• 1: https://github.com/springdoc/springdoc-openapi/blob/main/README.md
• 2: https://github.com/springdoc/springdoc-openapi/blob/4aa45e65/springdoc-openapi-starter-common/src/main/java/org/springdoc/core/utils/Constants.java
• 3: https://springdoc.org/faq
• 4: https://github.com/springdoc/springdoc.github.io/blob/master/src/docs/asciidoc/core-properties.adoc
• 5: https://springdoc.org/v1/

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Look for any local springdoc path overrides.
rg -n "springdoc|swagger-ui|api-docs|swagger-ui.html" -S src main resources . --glob '!build/**' --glob '!out/**' --glob '!target/**'

# Read build.gradle for exact springdoc artifact versions.
sed -n '1,120p' build.gradle

Repository: Stology/BE

Length of output: 864

---

Add the Swagger UI/docs entrypoints to the permit list. springdoc-openapi-starter-webmvc-ui:3.0.1 exposes /swagger-ui.html, /v3/api-docs, and /v3/api-docs.yaml, so the current matchers can still return 401 before the UI or YAML docs load.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/main/java/com/stology/be/global/security/config/SecurityConfig.java` at
line 24, Update SecurityConfig’s requestMatchers permit list to include the
Swagger UI/docs entrypoints that springdoc exposes, since the current
configuration can still block them with 401. Extend the existing permitAll
matcher in SecurityConfig so it explicitly allows /swagger-ui.html and
/v3/api-docs.yaml alongside the current /swagger-ui/** and /v3/api-docs/**
patterns.