merge: (#1045) permitAll 경로를 SecurityConfig로 일원화 - #1046
Open
yellowstarr0323 wants to merge 2 commits into
Open
Conversation
yellowstarr0323
requested review from
4mjeo,
ilyoil2,
kkm06100,
pji-min and
zios0707
as code owners
August 6, 2026 13:34
WalkthroughJWT 필터가 Authorization 헤더가 없는 요청을 인증 없이 통과시킵니다. permit-all 경로 목록을 제거하고 루트 경로를 Changes인증 및 보안 경로 변경
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant JwtAuthenticationFilter
participant SecurityContext
participant FilterChain
participant SecurityConfig
Client->>JwtAuthenticationFilter: HTTP 요청
alt Authorization 헤더 없음
JwtAuthenticationFilter->>FilterChain: 인증 없이 전달
else Authorization 헤더 있음
JwtAuthenticationFilter->>SecurityContext: 사용자 인증 설정
JwtAuthenticationFilter->>FilterChain: 인증된 요청 전달
end
FilterChain->>SecurityConfig: 인가 규칙 적용
Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
yellowstarr0323
force-pushed
the
fix/1045-unify-permit-all-paths
branch
from
August 6, 2026 13:34
c041276 to
607ef4d
Compare
📊 Main Service Coverage Report
|
yellowstarr0323
changed the title
Contributor
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@dms-main/main-infrastructure/src/main/kotlin/team/aliens/dms/global/security/SecurityConfig.kt`:
- Around line 36-38: 보안 체인 전체를 실행하는 통합 테스트를 추가해 SecurityConfig의 루트 경로 permitAll
설정을 검증하세요. Authorization 헤더 없이 보호된 경로에 요청하고 CustomAuthenticationEntryPoint를 통해
HTTP 401과 INVALID_TOKEN 응답이 반환되는지 확인하며, JwtAuthenticationFilterTest만 수정하지 마세요.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro Plus
Run ID: 9af633a5-05f9-4f10-99a5-2b22d541b16b
📒 Files selected for processing (5)
dms-main/main-infrastructure/src/main/kotlin/team/aliens/dms/global/filter/JwtAuthenticationFilter.ktdms-main/main-infrastructure/src/main/kotlin/team/aliens/dms/global/security/CustomAuthenticationEntryPoint.ktdms-main/main-infrastructure/src/main/kotlin/team/aliens/dms/global/security/SecurityConfig.ktdms-main/main-infrastructure/src/main/kotlin/team/aliens/dms/global/security/SecurityPaths.ktdms-main/main-infrastructure/src/test/kotlin/team/aliens/dms/global/filter/JwtAuthenticationFilterTest.kt
💤 Files with no reviewable changes (1)
- dms-main/main-infrastructure/src/main/kotlin/team/aliens/dms/global/security/SecurityPaths.kt
Comment on lines
+36
to
+38
| authorize | ||
| .requestMatchers("/").permitAll() | ||
|
|
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# SecurityConfig 및 인증 진입점의 통합 테스트 존재 여부를 확인합니다.
fd -a -t f '.*(SecurityConfig|CustomAuthenticationEntryPoint).*Test\.kt$' dms-main || true
rg -n -C 4 'SecurityConfig|CustomAuthenticationEntryPoint|INVALID_TOKEN|MockMvc|WebTestClient|"/"' \
dms-main -g '*Test.kt'Repository: team-aliens/DMS-Backend
Length of output: 161
🏁 Script executed:
#!/bin/bash
set -u
printf 'Files matching Security/Endpoint/SecurityConfig:\n'
fd -i 'SecurityConfig|AuthenticationEntryPoint|Jwt|Security|Test\.kt$' dms-main 2>/dev/null | sed -n '1,120p' || true
printf '\nSecurityConfig location/content context:\n'
fd -i 'SecurityConfig\.kt$' dms-main | while read -r f; do
echo "FILE $f"
wc -l "$f"
sed -n '1,140p' "$f"
done
printf '\nCustomAuthenticationEntryPoint matches:\n'
rg -n -C 5 'CustomAuthenticationEntryPoint|AuthenticationEntryPoint|INVALID_TOKEN|permitAll|authorize|jwtAuthenticationFilter' dms-main -g '*.kt' || true
printf '\nTest files mentioning MockMvc/WebTestClient/Jwt/Security:\n'
rg -n -C 4 'MockMvc|WebTestClient|JwtAuthentication|Authorization|INVALID_TOKEN|authorizeHttpRequests|permitAll|CustomAuthenticationEntryPoint' dms-main -g '*Test.kt' -g '*.kt' || trueRepository: team-aliens/DMS-Backend
Length of output: 50379
🏁 Script executed:
#!/bin/bash
set -u
printf 'Test files under main-infrastructure/src/test:\n'
fd -a -t f '%Test\.kt$' dms-main/main-infrastructure/src/test 2>/dev/null | sort | sed -n '1,120p'
printf '\nTests mentioning security authorization or paths:\n'
rg -n -C 3 'authorizeHttpRequests|permitAll|hasAuthority|Authorization|"/"|/students/profile|/students|CustomAuthenticationEntryPoint|INVALID_TOKEN|MockMvc|WebTestClient' \
dms-main/main-infrastructure/src/test -g '*Test.kt' || true
printf '\nInspect JwtAuthenticationFilterTest:\n'
fd -a -t f 'JwtAuthenticationFilterTest.kt' dms-main | while read -r f; do
echo "FILE $f"
wc -l "$f"
sed -n '1,220p' "$f"
doneRepository: team-aliens/DMS-Backend
Length of output: 9720
보안 체인 통합 테스트를 추가하세요.
SecurityConfig의 "/" permitAll 변경은 JwtAuthenticationFilterTest로는 검증되지 않습니다. 보안 체인 전체를 실행하는 테스트에서 Authorization 없이 필요한 경로에 요청하면 CustomAuthenticationEntryPoint가 401 및 INVALID_TOKEN 응답을 반환하는지 확인하세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@dms-main/main-infrastructure/src/main/kotlin/team/aliens/dms/global/security/SecurityConfig.kt`
around lines 36 - 38, 보안 체인 전체를 실행하는 통합 테스트를 추가해 SecurityConfig의 루트 경로 permitAll
설정을 검증하세요. Authorization 헤더 없이 보호된 경로에 요청하고 CustomAuthenticationEntryPoint를 통해
HTTP 401과 INVALID_TOKEN 응답이 반환되는지 확인하며, JwtAuthenticationFilterTest만 수정하지 마세요.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
작업 내용 설명
주요 변경 사항
체크리스트
관련 이슈
Summary by CodeRabbit
/)를 인증 없이 이용할 수 있습니다.INVALID_TOKEN으로 변경되었습니다.