-
Notifications
You must be signed in to change notification settings - Fork 2
MOSU-kmc feat: 본인인증 연동 구현(이쿠죠잇!) #131
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
929aa6a
56991e6
d73cc38
4953906
ab21bb4
e2c3427
9d1d7d0
f8ab056
91573bb
b2806bb
ce1a980
bfe8dd9
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -39,4 +39,6 @@ out/ | |
|
|
||
| docker-compose/.env | ||
| docker-compose/.env.local | ||
| /logs/app.log | ||
|
|
||
| /logs/** | ||
| /libs/** | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| FROM openjdk:21-jdk | ||
| ARG JAR_FILE=build/libs/*.jar | ||
| ADD ${JAR_FILE} app.jar | ||
| ENTRYPOINT ["java", "-Duser.timezone=GMT+9", "-Djava.security.egd=file:/dev/./urandom", "-jar", "/app.jar"] | ||
| FROM amazoncorretto:21 | ||
| COPY build/libs/*SNAPSHOT.war app.war | ||
|
|
||
| ENTRYPOINT ["java", "-Duser.timezone=GMT+9", "-Djava.security.egd=file:/dev/./urandom", "-jar", "/app.war"] |
This file was deleted.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| package life.mosu.mosuserver.application.auth; | ||
|
|
||
| import jakarta.servlet.http.HttpServletRequest; | ||
| import life.mosu.mosuserver.application.auth.provider.AuthTokenManager; | ||
| import life.mosu.mosuserver.domain.profile.ProfileJpaRepository; | ||
| import life.mosu.mosuserver.domain.user.UserJpaEntity; | ||
| import life.mosu.mosuserver.global.exception.CustomRuntimeException; | ||
|
|
@@ -44,7 +44,7 @@ public LoginCommandResponse login(final LoginRequest request) { | |
| } | ||
|
|
||
| @Transactional | ||
| public Token reissueAccessToken(final HttpServletRequest servletRequest) { | ||
| return authTokenManager.reissueAccessToken(servletRequest); | ||
| public Token reissueAccessToken(final String refreshTokenHeader) { | ||
| return authTokenManager.reissueAccessToken(refreshTokenHeader); | ||
|
Comment on lines
+47
to
+48
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Verification agent 🧩 Analysis chainLGTM! Method signature improvement enhances testability and separation of concerns. The change from Verify that proper validation is implemented in the controller layer or argument resolver to ensure the refresh token string is valid before reaching this service method: 🏁 Script executed: #!/bin/bash
# Description: Verify that RefreshTokenHeaderArgumentResolver properly validates the refresh token
# Expected: Find validation logic in the argument resolver or controller
# Search for the RefreshTokenHeaderArgumentResolver implementation
ast-grep --pattern 'class RefreshTokenHeaderArgumentResolver {
$$$
}'
# Search for RefreshTokenHeader annotation usage and validation
rg -A 10 "@RefreshTokenHeader"Length of output: 1347 Missing I couldn’t find any implementation of Please add and wire up a
Likely locations to update:
🤖 Prompt for AI Agents |
||
| } | ||
| } | ||
This file was deleted.
This file was deleted.
This file was deleted.
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,32 @@ | ||||||||||||||||||||||||||||||||||||||||||||
| package life.mosu.mosuserver.application.auth.kmc; | ||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||
| import life.mosu.mosuserver.application.auth.kmc.tx.KmcContext; | ||||||||||||||||||||||||||||||||||||||||||||
| import life.mosu.mosuserver.application.auth.kmc.tx.KmcTxEventFactory; | ||||||||||||||||||||||||||||||||||||||||||||
| import life.mosu.mosuserver.global.tx.TxEvent; | ||||||||||||||||||||||||||||||||||||||||||||
| import life.mosu.mosuserver.global.tx.TxEventPublisher; | ||||||||||||||||||||||||||||||||||||||||||||
| import lombok.RequiredArgsConstructor; | ||||||||||||||||||||||||||||||||||||||||||||
| import org.springframework.stereotype.Service; | ||||||||||||||||||||||||||||||||||||||||||||
| import org.springframework.transaction.annotation.Transactional; | ||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||
| @Service | ||||||||||||||||||||||||||||||||||||||||||||
| @RequiredArgsConstructor | ||||||||||||||||||||||||||||||||||||||||||||
| public class KmcEventTxService { | ||||||||||||||||||||||||||||||||||||||||||||
| private final TxEventPublisher txEventPublisher; | ||||||||||||||||||||||||||||||||||||||||||||
| private final KmcTxEventFactory eventFactory; | ||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||
| @Transactional | ||||||||||||||||||||||||||||||||||||||||||||
| public void publishIssueEvent(String certNum, Long expiration) { | ||||||||||||||||||||||||||||||||||||||||||||
| TxEvent<?> event = eventFactory.create( | ||||||||||||||||||||||||||||||||||||||||||||
| KmcContext.ofSuccess(certNum, expiration) | ||||||||||||||||||||||||||||||||||||||||||||
| ); | ||||||||||||||||||||||||||||||||||||||||||||
| txEventPublisher.publish(event); | ||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+17
to
+23
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Add parameter validation for certification number The method doesn't validate input parameters, which could lead to runtime issues if null or empty values are passed. Add parameter validation: @Transactional
public void publishIssueEvent(String certNum, Long expiration) {
+ if (certNum == null || certNum.trim().isEmpty()) {
+ throw new IllegalArgumentException("Certificate number cannot be null or empty");
+ }
+ if (expiration == null || expiration <= 0) {
+ throw new IllegalArgumentException("Expiration must be positive");
+ }
+
TxEvent<?> event = eventFactory.create(
KmcContext.ofSuccess(certNum, expiration)
);
txEventPublisher.publish(event);
}📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||
| @Transactional | ||||||||||||||||||||||||||||||||||||||||||||
| public void publishFailureEvent(String certNum) { | ||||||||||||||||||||||||||||||||||||||||||||
| TxEvent<?> event = eventFactory.create( | ||||||||||||||||||||||||||||||||||||||||||||
| KmcContext.ofFailure(certNum) | ||||||||||||||||||||||||||||||||||||||||||||
| ); | ||||||||||||||||||||||||||||||||||||||||||||
| txEventPublisher.publish(event); | ||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+25
to
+32
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Add parameter validation for failure events Similar to the success case, the failure event method should validate the certification number parameter. @Transactional
public void publishFailureEvent(String certNum) {
+ if (certNum == null || certNum.trim().isEmpty()) {
+ throw new IllegalArgumentException("Certificate number cannot be null or empty");
+ }
+
TxEvent<?> event = eventFactory.create(
KmcContext.ofFailure(certNum)
);
txEventPublisher.publish(event);
}📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,24 @@ | ||||||||||||||||||||||||||||||||||||||||||||||||
| package life.mosu.mosuserver.application.auth.kmc.tx; | ||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||
| import life.mosu.mosuserver.domain.auth.signup.SignUpToken; | ||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||
| public record KmcContext( | ||||||||||||||||||||||||||||||||||||||||||||||||
| String certNum, | ||||||||||||||||||||||||||||||||||||||||||||||||
| Long expiration, | ||||||||||||||||||||||||||||||||||||||||||||||||
| Boolean isSuccess | ||||||||||||||||||||||||||||||||||||||||||||||||
| ) { | ||||||||||||||||||||||||||||||||||||||||||||||||
| public static KmcContext ofSuccess(String certNum, Long expiration) { | ||||||||||||||||||||||||||||||||||||||||||||||||
| return new KmcContext(certNum, expiration, true); | ||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||
| public static KmcContext ofFailure(String certNum) { | ||||||||||||||||||||||||||||||||||||||||||||||||
| return new KmcContext(certNum, 0L, false); | ||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+10
to
+16
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Add parameter validation to factory methods The factory methods don't validate input parameters, which could lead to invalid contexts being created. Add validation to factory methods: public static KmcContext ofSuccess(String certNum, Long expiration) {
+ if (certNum == null || certNum.trim().isEmpty()) {
+ throw new IllegalArgumentException("Certificate number cannot be null or empty");
+ }
+ if (expiration == null || expiration <= 0) {
+ throw new IllegalArgumentException("Expiration must be positive");
+ }
return new KmcContext(certNum, expiration, true);
}
public static KmcContext ofFailure(String certNum) {
+ if (certNum == null || certNum.trim().isEmpty()) {
+ throw new IllegalArgumentException("Certificate number cannot be null or empty");
+ }
return new KmcContext(certNum, 0L, false);
}📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||
| public SignUpToken toSignUpToken() { | ||||||||||||||||||||||||||||||||||||||||||||||||
| return SignUpToken.of( | ||||||||||||||||||||||||||||||||||||||||||||||||
| this.certNum, | ||||||||||||||||||||||||||||||||||||||||||||||||
| this.expiration | ||||||||||||||||||||||||||||||||||||||||||||||||
| ); | ||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+18
to
+24
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Consider validating success state before token conversion The Add success state validation: public SignUpToken toSignUpToken() {
+ if (!isSuccess) {
+ throw new IllegalStateException("Cannot create SignUpToken from failed KMC context");
+ }
return SignUpToken.of(
this.certNum,
this.expiration
);
}
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| package life.mosu.mosuserver.application.auth.kmc.tx; | ||
|
|
||
| import life.mosu.mosuserver.global.tx.TxEvent; | ||
|
|
||
| public class KmcIssueTxEvent extends TxEvent<KmcContext> { | ||
|
|
||
| public KmcIssueTxEvent(boolean success, KmcContext context) { | ||
| super(success, context); | ||
| } | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| package life.mosu.mosuserver.application.auth.kmc.tx; | ||
|
|
||
| import life.mosu.mosuserver.global.tx.TxEvent; | ||
| import life.mosu.mosuserver.global.tx.TxEventFactory; | ||
| import org.springframework.stereotype.Component; | ||
|
|
||
| @Component | ||
| public class KmcTxEventFactory implements TxEventFactory<KmcContext> { | ||
|
|
||
| @Override | ||
| public TxEvent<?> create(KmcContext context) { | ||
| return new KmcIssueTxEvent(context.isSuccess(), context); | ||
| } | ||
| } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Verification agent
🧩 Analysis chain
Verify JSP dependency versions for security.
The JSP and servlet dependencies should be checked for known security vulnerabilities, especially since they're handling user authentication flows.
🌐 Web query:
💡 Result:
There are known security vulnerabilities affecting both javax.servlet:jstl:1.2 and, indirectly, some versions of org.apache.tomcat.embed:tomcat-embed-jasper, which you should consider when using them with Spring Boot 3.4.5.
javax.servlet:jstl:1.2
org.apache.tomcat.embed:tomcat-embed-jasper
Key Recommendations
Caveats & Limitations
In summary: javax.servlet:jstl:1.2 is insecure and should be replaced; keep Tomcat and related embed packages updated to a patched version matching Spring Boot 3.4.5, watching for any new disclosures.
Citations:
Update JSP/Servlet dependencies to secure versions
Please replace the outdated JSTL artifact and pin your embedded Tomcat to a patched release:
• File:
build.gradle(lines 43–47)• Replace
javax.servlet:jstl:1.2(XXE/RCE risk) with a maintained implementation• Pin
tomcat-embed-jasperto a Tomcat version patched for CVE-2025-24813 (and other recent CVEs)Suggested diff:
(Optional) If you’re migrating fully to Jakarta EE 9+, consider:
🤖 Prompt for AI Agents