feat/superadmin

build.gradle

@@ -49,6 +49,7 @@ dependencies {
     // AWS SDK for S3 and Secrets Manager Integration
     implementation platform('io.awspring.cloud:spring-cloud-aws-dependencies:3.1.1')
     implementation 'io.awspring.cloud:spring-cloud-aws-starter-secrets-manager'
+    implementation(platform("software.amazon.awssdk:bom:2.21.46"))
     implementation 'software.amazon.awssdk:s3'
 
     implementation 'org.springframework.cloud:spring-cloud-starter-bootstrap'

src/main/java/com/joycrew/backend/controller/EmployeeQueryController.java

@@ -1,7 +1,6 @@
 package com.joycrew.backend.controller;
 
 import com.joycrew.backend.dto.PagedEmployeeResponse;
-import com.joycrew.backend.entity.enums.AccessStatus;
 import com.joycrew.backend.security.UserPrincipal;
 import com.joycrew.backend.service.EmployeeQueryService;
 import io.swagger.v3.oas.annotations.Operation;
@@ -21,35 +20,40 @@
 @Tag(name = "Employee Query", description = "API for searching employees")
 public class EmployeeQueryController {
 
-  private final EmployeeQueryService employeeQueryService;
+    private final EmployeeQueryService employeeQueryService;
 
-  @Operation(
-      summary = "Search employee list",
-      description = "Performs a unified search by name, email, or department. The current user is excluded from the search results.",
-      parameters = {
-          @Parameter(name = "keyword", description = "Search keyword", example = "John"),
-          @Parameter(name = "page", description = "Page number (0-based)", example = "0"),
-          @Parameter(name = "size", description = "Items per page", example = "20")
-      },
-      responses = {
-          @ApiResponse(
-              responseCode = "200",
-              description = "Employee list retrieved successfully",
-              content = @Content(
-                  mediaType = "application/json",
-                  schema = @Schema(implementation = PagedEmployeeResponse.class)
-              )
-          )
-      }
-  )
-  @GetMapping
-  public ResponseEntity<PagedEmployeeResponse> searchEmployees(
-      @RequestParam(required = false) String keyword,
-      @RequestParam(defaultValue = "0") int page,
-      @RequestParam(defaultValue = "20") int size,
-      @AuthenticationPrincipal UserPrincipal principal
-  ) {
-    PagedEmployeeResponse response = employeeQueryService.getEmployees(keyword, page, size, principal.getEmployee().getEmployeeId(), AccessStatus.ACTIVE);
-    return ResponseEntity.ok(response);
-  }
-}
+    @Operation(
+            summary = "Search employee list",
+            description = "Performs a unified search by name, email, or department. The current user is excluded from the search results.",
+            parameters = {
+                    @Parameter(name = "keyword", description = "Search keyword", example = "John"),
+                    @Parameter(name = "page", description = "Page number (0-based)", example = "0"),
+                    @Parameter(name = "size", description = "Items per page", example = "20")
+            },
+            responses = {
+                    @ApiResponse(
+                            responseCode = "200",
+                            description = "Employee list retrieved successfully",
+                            content = @Content(
+                                    mediaType = "application/json",
+                                    schema = @Schema(implementation = PagedEmployeeResponse.class)
+                            )
+                    )
+            }
+    )
+    @GetMapping
+    public ResponseEntity<PagedEmployeeResponse> searchEmployees(
+            @RequestParam(required = false) String keyword,
+            @RequestParam(defaultValue = "0") int page,
+            @RequestParam(defaultValue = "20") int size,
+            @AuthenticationPrincipal UserPrincipal principal
+    ) {
+        var me = principal.getEmployee();
+        PagedEmployeeResponse response = employeeQueryService.getEmployees(
+                keyword, page, size,
+                me.getEmployeeId(),
+                me.getRole() // 요청자 역할 전달
+        );
+        return ResponseEntity.ok(response);
+    }
+}

src/main/java/com/joycrew/backend/service/EmployeeQueryService.java

@@ -3,7 +3,7 @@
 import com.joycrew.backend.dto.EmployeeQueryResponse;
 import com.joycrew.backend.dto.PagedEmployeeResponse;
 import com.joycrew.backend.entity.Employee;
-import com.joycrew.backend.entity.enums.AccessStatus;
+import com.joycrew.backend.entity.enums.AdminLevel;
 import com.joycrew.backend.service.mapper.EmployeeMapper;
 import jakarta.persistence.EntityManager;
 import jakarta.persistence.PersistenceContext;
@@ -25,51 +25,57 @@ public class EmployeeQueryService {
   private final EntityManager em;
   private final EmployeeMapper employeeMapper;
 
-  public PagedEmployeeResponse getEmployees(String keyword, int page, int size, Long currentUserId, AccessStatus accessStatus) {
-    StringBuilder whereClause = new StringBuilder();
-    boolean hasKeyword = StringUtils.hasText(keyword);
+  // EmployeeQueryService.java
+  public PagedEmployeeResponse getEmployees(
+          String keyword, int page, int size, Long currentUserId, AdminLevel requesterRole
+  ) {
+    StringBuilder where = new StringBuilder("WHERE e.employeeId != :currentUserId ");
 
+    boolean hasKeyword = StringUtils.hasText(keyword);
     if (hasKeyword) {
-      whereClause.append("WHERE (LOWER(e.employeeName) LIKE :keyword ")
-          .append("OR LOWER(e.email) LIKE :keyword ")
-          .append("OR LOWER(d.name) LIKE :keyword) ");
+      where.append("AND (LOWER(e.employeeName) LIKE :keyword ")
+              .append("OR LOWER(e.email) LIKE :keyword ")
+              .append("OR LOWER(d.name) LIKE :keyword) ");
     }
 
-    whereClause.append(hasKeyword ? "AND " : "WHERE ");
-    whereClause.append("e.id != :currentUserId ");
-
-    String countJpql = "SELECT COUNT(e) FROM Employee e LEFT JOIN e.department d " + whereClause;
-    TypedQuery<Long> countQuery = em.createQuery(countJpql, Long.class);
-    countQuery.setParameter("currentUserId", currentUserId);
-    if (hasKeyword) {
-      countQuery.setParameter("keyword", "%" + keyword.toLowerCase() + "%");
+    boolean hideSuperAdmin = (requesterRole != AdminLevel.SUPER_ADMIN);
+    if (hideSuperAdmin) {
+      // JPQL에 SUPER_ADMIN 제외
+      where.append("AND e.role <> :superAdmin ");
     }
+
+    String countJpql = "SELECT COUNT(e) FROM Employee e LEFT JOIN e.department d " + where;
+    TypedQuery<Long> countQuery = em.createQuery(countJpql, Long.class)
+            .setParameter("currentUserId", currentUserId);
+    if (hasKeyword) countQuery.setParameter("keyword", "%" + keyword.toLowerCase() + "%");
+    if (hideSuperAdmin) countQuery.setParameter("superAdmin", AdminLevel.SUPER_ADMIN);
+
     long totalCount = countQuery.getSingleResult();
     int totalPages = (int) Math.ceil((double) totalCount / size);
 
-    String dataJpql = "SELECT e FROM Employee e " +
-        "JOIN FETCH e.company c " +
-        "LEFT JOIN FETCH e.department d " +
-        whereClause +
-        "ORDER BY e.employeeName ASC";
-    TypedQuery<Employee> dataQuery = em.createQuery(dataJpql, Employee.class);
-    dataQuery.setParameter("currentUserId", currentUserId);
-    if (hasKeyword) {
-      dataQuery.setParameter("keyword", "%" + keyword.toLowerCase() + "%");
-    }
+    String dataJpql =
+            "SELECT e FROM Employee e " +
+                    "JOIN FETCH e.company c " +
+                    "LEFT JOIN FETCH e.department d " +
+                    where +
+                    "ORDER BY e.employeeName ASC";
+    TypedQuery<Employee> dataQuery = em.createQuery(dataJpql, Employee.class)
+            .setParameter("currentUserId", currentUserId);
+    if (hasKeyword) dataQuery.setParameter("keyword", "%" + keyword.toLowerCase() + "%");
+    if (hideSuperAdmin) dataQuery.setParameter("superAdmin", AdminLevel.SUPER_ADMIN);
 
     dataQuery.setFirstResult(page * size);
     dataQuery.setMaxResults(size);
 
+    // ✅ 최종 안전망: 결과에서 SUPER_ADMIN 제거 (요청자가 SUPER_ADMIN이 아닐 때)
     List<EmployeeQueryResponse> employees = dataQuery.getResultList().stream()
-        .map(employeeMapper::toEmployeeQueryResponse)
-        .collect(Collectors.toList());
+            .filter(e -> !(hideSuperAdmin && e.getRole() == AdminLevel.SUPER_ADMIN))
+            .map(employeeMapper::toEmployeeQueryResponse)
+            .collect(Collectors.toList());
 
     return new PagedEmployeeResponse(
-        employees,
-        page,
-        totalPages,
-        page >= totalPages - 1
+            employees, page, totalPages, page >= totalPages - 1
     );
   }
-}
+
+}