Open
Conversation
📝 WalkthroughSummary by CodeRabbit릴리스 노트
Walkthrough전역 ObjectMapper(JavaTimeModule, LocalDateTime 포맷 적용) 빈이 추가되고, CORS 설정이 WebMvcConfigurer → CorsConfigurationSource 방식으로 이전되었습니다. ErrorResponse에 변경 사항
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 시
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Tip Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (2)
src/main/java/kusuri12/teens_be/global/security/config/CorsConfig.java (2)
25-25:setAllowedHeaders설정이 일부 표준 헤더를 누락했을 수 있습니다.현재
Authorization,Content-Type,x-auth-token만 허용되어 있습니다. 프론트엔드에서Accept,Origin,X-Requested-With등의 헤더를 사용하는 경우 CORS preflight 요청이 실패할 수 있습니다. 필요한 경우 헤더 목록을 확장하거나setAllowedHeaders(List.of("*"))를 고려해 보세요.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/main/java/kusuri12/teens_be/global/security/config/CorsConfig.java` at line 25, Update the CORS allowed headers in CorsConfig by expanding the values passed to configuration.setAllowedHeaders so preflight requests include common headers like "Accept", "Origin", and "X-Requested-With" (or replace the explicit list with List.of("*") if you intend to allow all headers); locate the call to configuration.setAllowedHeaders in class CorsConfig and modify that invocation to include the additional header strings or the wildcard as appropriate.
18-21: 하드코딩된 origin 값은 환경별 설정으로 외부화하는 것을 권장합니다.현재 localhost 기반의 origin이 하드코딩되어 있습니다. 개발/스테이징/프로덕션 환경에서 다른 origin을 사용해야 할 경우,
application.yml에서 설정 값을 주입받도록 변경하면 배포 유연성이 향상됩니다.♻️ 환경 설정 외부화 예시
+import org.springframework.beans.factory.annotation.Value; +import java.util.Arrays; + `@Configuration` public class CorsConfig { + `@Value`("${cors.allowed-origins}") + private String allowedOrigins; + `@Bean` public CorsConfigurationSource corsConfigurationSource() { CorsConfiguration configuration = new CorsConfiguration(); - configuration.setAllowedOrigins(List.of( - "http://localhost:3000", - "http://localhost:5173" - )); + configuration.setAllowedOrigins(Arrays.asList(allowedOrigins.split(",")));🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/main/java/kusuri12/teens_be/global/security/config/CorsConfig.java` around lines 18 - 21, 하드코딩된 CORS origins를 환경설정으로 외부화하세요: CorsConfig 클래스에서 직접 호출 중인 configuration.setAllowedOrigins(...) 대신 application.yml에 예를 들어 cors.allowed-origins 리스트를 추가하고 CorsConfig에서 `@Value` 또는 `@ConfigurationProperties로` 해당 값을 주입받아 사용하도록 변경합니다; 주입 실패 시 개발 편의성을 위한 기본값(예: localhost 항목)을 제공하도록 하고, 주입된 List<String>을 그대로 configuration.setAllowedOrigins(...)에 전달하도록 구현하세요.
📜 Review details
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (7)
src/main/java/kusuri12/teens_be/global/config/JacksonConfig.javasrc/main/java/kusuri12/teens_be/global/error/exception/ErrorResponse.javasrc/main/java/kusuri12/teens_be/global/error/handler/GlobalExceptionHandler.javasrc/main/java/kusuri12/teens_be/global/security/config/CorsConfig.javasrc/main/java/kusuri12/teens_be/global/security/config/SecurityConfig.javasrc/main/java/kusuri12/teens_be/global/security/config/WebConfig.javasrc/main/java/kusuri12/teens_be/test/JacksonConfigTest.java
💤 Files with no reviewable changes (1)
- src/main/java/kusuri12/teens_be/global/security/config/WebConfig.java
🧰 Additional context used
🧬 Code graph analysis (5)
src/main/java/kusuri12/teens_be/global/config/JacksonConfig.java (1)
src/main/java/kusuri12/teens_be/global/config/RedisConfig.java (1)
customSerializer(46-62)
src/main/java/kusuri12/teens_be/global/error/handler/GlobalExceptionHandler.java (4)
src/main/java/kusuri12/teens_be/global/error/exception/TeensException.java (2)
Getter(6-25)TeensException(11-14)src/main/java/kusuri12/teens_be/global/security/filter/GlobalExceptionFilter.java (1)
Slf4j(16-37)src/main/java/kusuri12/teens_be/global/error/exception/ResponseWithErrorCode.java (1)
Component(13-38)src/main/java/kusuri12/teens_be/domain/user/exception/UserErrorCode.java (1)
Override(26-29)
src/main/java/kusuri12/teens_be/global/security/config/SecurityConfig.java (1)
src/main/java/kusuri12/teens_be/global/security/config/WebConfig.java (2)
Configuration(7-16)Override(9-15)
src/main/java/kusuri12/teens_be/global/security/config/CorsConfig.java (1)
src/main/java/kusuri12/teens_be/global/security/config/WebConfig.java (2)
Configuration(7-16)Override(9-15)
src/main/java/kusuri12/teens_be/global/error/exception/ErrorResponse.java (5)
src/main/java/kusuri12/teens_be/global/error/exception/ErrorCode.java (1)
ErrorCode(5-12)src/main/java/kusuri12/teens_be/global/error/exception/GlobalErrorCode.java (1)
AllArgsConstructor(6-47)src/main/java/kusuri12/teens_be/global/error/exception/ResponseWithErrorCode.java (1)
Component(13-38)src/main/java/kusuri12/teens_be/domain/user/exception/UserErrorCode.java (2)
AllArgsConstructor(7-35)Override(26-29)src/main/java/kusuri12/teens_be/domain/information/exception/InfoErrorCode.java (2)
AllArgsConstructor(7-35)Override(21-24)
🔇 Additional comments (7)
src/main/java/kusuri12/teens_be/global/security/config/SecurityConfig.java (1)
24-24: LGTM!
CorsConfigurationSource주입 및 사용이 올바르게 구현되었습니다. 이전Customizer.withDefaults()방식에서 명시적인CorsConfigurationSource사용으로 변경되어 CORS 설정의 명확성과 유연성이 향상되었습니다.Also applies to: 34-34, 54-54
src/main/java/kusuri12/teens_be/global/security/config/CorsConfig.java (1)
1-35: WebConfig.java가 존재하지 않습니다. CORS 설정 충돌 우려는 해당 사항이 없습니다.웹 저장소 검색 결과,
WebConfig.java파일은 존재하지 않습니다. 현재 구조는CorsConfig.java에서 CORS 설정을 정의하고,SecurityConfig.java에서 이를 주입받아 사용하고 있으므로 CORS 설정 충돌은 발생하지 않습니다.Likely an incorrect or invalid review comment.
src/main/java/kusuri12/teens_be/global/error/handler/GlobalExceptionHandler.java (5)
52-57: 검증 실패 응답에 에러 코드 포함 👍클라이언트가 유효성 오류를 일관되게 처리할 수 있어졌습니다.
72-77: 요청 본문 파싱 오류 응답에 코드 포함 👍에러 응답의 스키마 일관성이 좋아졌습니다.
85-93: TeensException 응답 코드 전달 반영 👍도메인 예외 응답에도 동일한 코드 체계를 적용한 점 좋습니다.
105-110: 인증 실패 응답에 코드 포함 👍보안 오류 응답을 클라이언트가 구분하기 쉬워졌습니다.
122-127: 예상치 못한 예외 응답에 코드 포함 👍서버 오류 응답까지 동일 포맷을 유지합니다.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/main/java/kusuri12/teens_be/global/config/JacksonConfig.java`:
- Around line 29-41: The comment and the DateTimeFormatter in JacksonConfig
mismatch: the code creates DateTimeFormatter formatter =
DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss") but the preceding comment
claims ISO-8601; either update the comment to reflect the actual pattern or
change the formatter to an ISO-8601 pattern (e.g., "yyyy-MM-dd'T'HH:mm:ss" or
include offset) so the comment and implementation match; locate this in
JacksonConfig where mapper, module, and formatter are defined and make the
comment and pattern consistent.
- Around line 21-47: The comment incorrectly states ISO-8601 while the
LocalDateTime formatter uses "yyyy-MM-dd HH:mm:ss"; fix this by either updating
the comment to describe the actual custom format or switch the DateTimeFormatter
to an ISO-8601 pattern (e.g., using DateTimeFormatter.ISO_LOCAL_DATE_TIME) so
the comment matches behavior; additionally avoid instantiating ObjectMapper
directly in objectMapper() — inject a Jackson2ObjectMapperBuilder (or accept it
as a parameter) and build/configure the mapper (register JavaTimeModule, disable
WRITE_DATES_AS_TIMESTAMPS, configure FAIL_ON_UNKNOWN_PROPERTIES,
setSerializationInclusion, and register the LocalDateTime
serializer/deserializer) so Spring Boot auto-configuration/customizers are
respected.
In `@src/main/java/kusuri12/teens_be/global/error/exception/ErrorResponse.java`:
- Around line 9-13: The filter path builds an ErrorResponse without setting the
code field, causing code to be null; update the ResponseWithErrorCode logic that
constructs the ErrorResponse to populate the code from the ErrorCode (or
errorCode.getCode()) the same way GlobalExceptionHandler does so ErrorResponse
(record ErrorResponse) always includes .code(...); locate the ErrorResponse
creation in ResponseWithErrorCode and add the code assignment using the existing
ErrorCode value.
In `@src/main/java/kusuri12/teens_be/global/security/config/SecurityConfig.java`:
- Line 65: The requestMatchers("/test/**").permitAll() rule in SecurityConfig
opens test endpoints to unauthenticated access and must not be shipped to
production; remove or guard it by moving the rule into a test-only configuration
class (e.g., create TestSecurityConfig) annotated with `@Profile`("!prod") or wrap
it with a profile/feature-flag check so it only applies in non-prod
environments, or at minimum add a clear TODO/FIXME comment in SecurityConfig
next to requestMatchers("/test/**").permitAll() indicating it must be removed
before prod deployment.
In `@src/main/java/kusuri12/teens_be/test/JacksonConfigTest.java`:
- Around line 10-16: The controller JacksonConfigTest (annotated
`@RestController`) exposing the /test/time endpoint should not be public in
production; restrict it by either adding a runtime guard annotation such as
`@Profile`("local") or `@ConditionalOnProperty` (to limit activation to local/dev),
or move the class into src/test/java so it’s only present in tests; update the
class declaration and/or project layout accordingly and ensure the timeTest
method and its mapping remain unchanged.
---
Nitpick comments:
In `@src/main/java/kusuri12/teens_be/global/security/config/CorsConfig.java`:
- Line 25: Update the CORS allowed headers in CorsConfig by expanding the values
passed to configuration.setAllowedHeaders so preflight requests include common
headers like "Accept", "Origin", and "X-Requested-With" (or replace the explicit
list with List.of("*") if you intend to allow all headers); locate the call to
configuration.setAllowedHeaders in class CorsConfig and modify that invocation
to include the additional header strings or the wildcard as appropriate.
- Around line 18-21: 하드코딩된 CORS origins를 환경설정으로 외부화하세요: CorsConfig 클래스에서 직접 호출
중인 configuration.setAllowedOrigins(...) 대신 application.yml에 예를 들어
cors.allowed-origins 리스트를 추가하고 CorsConfig에서 `@Value` 또는 `@ConfigurationProperties로`
해당 값을 주입받아 사용하도록 변경합니다; 주입 실패 시 개발 편의성을 위한 기본값(예: localhost 항목)을 제공하도록 하고, 주입된
List<String>을 그대로 configuration.setAllowedOrigins(...)에 전달하도록 구현하세요.
src/main/java/kusuri12/teens_be/global/config/JacksonConfig.java
Outdated
Show resolved
Hide resolved
src/main/java/kusuri12/teens_be/global/error/exception/ErrorResponse.java
Show resolved
Hide resolved
src/main/java/kusuri12/teens_be/global/security/config/SecurityConfig.java
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Actionable comments posted: 3
📜 Review details
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
.gitignoresrc/main/java/kusuri12/teens_be/global/config/JacksonConfig.javasrc/main/java/kusuri12/teens_be/global/error/exception/ResponseWithErrorCode.javasrc/main/java/kusuri12/teens_be/global/security/config/SecurityConfig.javasrc/main/java/kusuri12/teens_be/test/JacksonConfigTest.javasrc/main/resources/application.yml
✅ Files skipped from review due to trivial changes (1)
- .gitignore
🚧 Files skipped from review as they are similar to previous changes (1)
- src/main/java/kusuri12/teens_be/test/JacksonConfigTest.java
🧰 Additional context used
🧬 Code graph analysis (1)
src/main/java/kusuri12/teens_be/global/config/JacksonConfig.java (1)
src/main/java/kusuri12/teens_be/global/config/RedisConfig.java (1)
customSerializer(46-62)
🔇 Additional comments (2)
src/main/java/kusuri12/teens_be/global/error/exception/ResponseWithErrorCode.java (1)
21-24: 변경 내용 확인 완료 (LGTM).
에러 코드가 응답에 포함되도록 빌더에 추가한 점이 PR 목표와 일치합니다.src/main/java/kusuri12/teens_be/global/security/config/SecurityConfig.java (1)
32-55: 이 리뷰 코멘트는 불필요합니다.CorsConfigurationSource빈은CorsConfig클래스에서@Profile애너테이션 없이@Bean으로 정의되어 있으므로, 모든 프로파일에서 생성됩니다.SecurityConfig가@Profile("prob")로 활성화될 때 해당 빈이 정상적으로 주입되며 기동 실패 위험은 없습니다.Likely an incorrect or invalid review comment.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/main/java/kusuri12/teens_be/global/config/JacksonConfig.java`:
- Line 7: Remove the unused import of SimpleModule from the JacksonConfig class:
locate the import statement for
com.fasterxml.jackson.databind.module.SimpleModule and delete it so only the
used JavaTimeModule import remains; ensure no other references to SimpleModule
exist in the class (e.g., in any method like a
jackson2ObjectMapperBuilderCustomizer) before committing.
In `@src/main/java/kusuri12/teens_be/global/security/config/SecurityConfig.java`:
- Around line 26-35: The SecurityConfig class is currently restricted to
`@Profile`("prob") which can leave the app without any SecurityFilterChain when
another profile is active; remove the `@Profile`("prob") annotation (or ensure the
class is registered for all relevant profiles) so the SecurityFilterChain bean
in SecurityConfig is always created, reconnecting JwtTokenFilter,
GlobalExceptionFilter and the CorsConfigurationSource into the filter chain;
alternatively provide equivalent SecurityFilterChain beans for other profiles
that wire the same JwtTokenFilter and GlobalExceptionFilter to guarantee
authentication/authorization/CORS are always enforced.
In `@src/main/resources/application.yml`:
- Around line 34-35: The profiles.active default in application.yml is unsafe
because it falls back to prob when PROFILE_ACTIVE is missing; either set a safe
default or make the variable required: change the property profiles.active to
use ${PROFILE_ACTIVE:prod} to default to prod, or remove the fallback so it
reads profiles.active: ${PROFILE_ACTIVE} and make the deployment fail-fast by
updating .github/workflows/deploy.yml to check for the existence of .env (or
that PROFILE_ACTIVE is set) and exit with an error if missing; update
application.yml (profiles.active) and the deploy workflow accordingly.
---
Duplicate comments:
In `@src/main/java/kusuri12/teens_be/global/config/JacksonConfig.java`:
- Around line 21-45: Replace direct new ObjectMapper() in
JacksonConfig.objectMapper() with a Jackson2ObjectMapperBuilder-based creation
to preserve Spring Boot auto-configuration and customizer compatibility: use
Jackson2ObjectMapperBuilder to configure the JavaTimeModule, DateTimeFormatter
(for LocalDateTimeSerializer/Deserializer), disable WRITE_DATES_AS_TIMESTAMPS,
set FAIL_ON_UNKNOWN_PROPERTIES to false, set serialization inclusion to
NON_NULL, register the module, then call builder.build() to return the
ObjectMapper; keep the same settings and module logic but construct the mapper
via Jackson2ObjectMapperBuilder instead of new ObjectMapper().
src/main/java/kusuri12/teens_be/global/config/JacksonConfig.java
Outdated
Show resolved
Hide resolved
src/main/java/kusuri12/teens_be/global/security/config/SecurityConfig.java
Show resolved
Hide resolved
There was a problem hiding this comment.
📜 Review details
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
src/main/java/kusuri12/teens_be/global/config/JacksonConfig.javasrc/main/java/kusuri12/teens_be/global/security/config/SecurityConfig.javasrc/main/resources/application.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- src/main/resources/application.yml
🧰 Additional context used
🧬 Code graph analysis (2)
src/main/java/kusuri12/teens_be/global/config/JacksonConfig.java (1)
src/main/java/kusuri12/teens_be/global/config/RedisConfig.java (2)
customSerializer(46-62)Configuration(18-63)
src/main/java/kusuri12/teens_be/global/security/config/SecurityConfig.java (2)
src/main/java/kusuri12/teens_be/global/security/config/CorsConfig.java (1)
Configuration(11-35)src/main/java/kusuri12/teens_be/global/security/config/WebConfig.java (2)
Configuration(7-16)Override(9-15)
🔇 Additional comments (2)
src/main/java/kusuri12/teens_be/global/config/JacksonConfig.java (1)
20-44: LGTM! ObjectMapper 설정이 적절합니다.LocalDateTime 포맷 지정, 타임스탬프 비활성화, 알 수 없는 속성 무시, null 필드 제외 등 필요한 설정이 잘 구성되어 있습니다. RedisConfig의 ObjectMapper 설정과도 일관성을 유지하고 있습니다.
src/main/java/kusuri12/teens_be/global/security/config/SecurityConfig.java (1)
34-34: LGTM! CorsConfigurationSource 주입 방식이 적절합니다.
CorsConfigurationSource를 생성자 주입으로 받아SecurityFilterChain에 연결하는 방식은 Spring Security에서 권장하는 CORS 설정 방법입니다.CorsConfig에서 정의된 빈과 잘 연동됩니다.Also applies to: 54-54
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@src/main/java/kusuri12/teens_be/global/security/config/SecurityConfig.java`:
- Line 29: The SecurityConfig class is annotated with `@Profile`("prod") which
prevents the SecurityFilterChain bean from being loaded in non-prod
environments, effectively disabling authentication/authorization, JWT and CORS
filters; remove the `@Profile`("prod") annotation from SecurityConfig or add a
default SecurityFilterChain bean (same or minimal) that applies to all profiles
so that the SecurityFilterChain (the bean defined in SecurityConfig) is always
registered, or alternatively provide separate SecurityFilterChain beans for each
profile (dev/test/local) to ensure JWT filters and CORS remain active across
environments.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📌 주요 변경 사항 (Description)
🔗 관련 이슈 (Related Issue)
🛠 작업 유형 (Type of Change)