MOSU-57 chore: API 연동을 위한 Redis 비밀번호 제거#65
Conversation
# Conflicts: # src/main/java/life/mosu/mosuserver/global/config/SecurityConfig.java # src/main/java/life/mosu/mosuserver/presentation/oauth/AccessTokenFilter.java
|
Caution Review failedThe pull request is closed. WalkthroughThis update introduces a new school lookup feature by adding service, controller, and DTO classes for retrieving school information. It also restores and integrates the Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant SchoolController
participant SchoolService
participant SchoolJpaRepository
Client->>SchoolController: GET /school
SchoolController->>SchoolService: getSchools()
SchoolService->>SchoolJpaRepository: findAll()
SchoolJpaRepository-->>SchoolService: List<SchoolJpaEntity>
SchoolService-->>SchoolController: List<SchoolResponse>
SchoolController-->>Client: ApiResponseWrapper<List<SchoolResponse>>
sequenceDiagram
participant Client
participant AccessTokenFilter
participant TokenExceptionFilter
participant SecurityContext
Client->>AccessTokenFilter: HTTP Request
AccessTokenFilter->>AccessTokenFilter: Check for Bearer token
AccessTokenFilter->>SecurityContext: Set authentication (if token valid)
AccessTokenFilter->>TokenExceptionFilter: (on error) Throw CustomRuntimeException
TokenExceptionFilter->>Client: HTTP Error Response (if exception)
Possibly related PRs
Suggested reviewers
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (8)
✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @wlgns12370, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request primarily focuses on enhancing API integration capabilities. It includes a minor configuration update to remove the Redis password requirement for local development environments, alongside the more substantial introduction of new API endpoints for school data and the activation of custom token-based authentication filters within the Spring Security chain.
Highlights
- Redis Configuration Adjustment: I've updated the
docker-compose.local.ymlfile to remove the Redis password requirement for thevelkeyservice, simplifying the local development setup. - API Authentication Filter Integration: I've activated and integrated
AccessTokenFilterandTokenExceptionFilterinto the Spring Security configuration. These filters are now part of the security chain, enabling token-based authentication and robust error handling for API requests. - New School Data API: I've introduced new REST API endpoints under
/schoolto expose school information. This includes the creation ofSchoolController,SchoolService, and associated data transfer objects (SchoolResponse,AddressResponse) to facilitate fetching and presenting school data.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request removes the Redis password from the docker-compose file and adds token filters to the security configuration. The removal of the Redis password should be carefully considered for security implications, and the order of token filters in the security configuration should be reviewed for optimal exception handling.
| image: ghcr.io/valkey-io/valkey:7.2 | ||
| container_name: mosu-velkey | ||
| command: [ "valkey-server", "--port", "${VELKEY_PORT}", "--requirepass","${REDIS_PASSWORD}"] | ||
| command: [ "valkey-server", "--port", "${VELKEY_PORT}" ] |
There was a problem hiding this comment.
Removing the Redis password from the docker-compose file might expose the Redis instance without authentication. Ensure that appropriate security measures are in place to protect the Redis instance, such as firewall rules or network isolation. If the Redis instance is only intended for local development, consider adding a comment explaining why the password is not required in this environment.
command: [ "valkey-server", "--port", "${VELKEY_PORT}" ] # No password required for local development
| .failureHandler(loginFailureHandler) | ||
| ) | ||
| .addFilterBefore(accessTokenFilter, UsernamePasswordAuthenticationFilter.class) | ||
| .addFilterBefore(tokenExceptionFilter, accessTokenFilter.getClass()) |
There was a problem hiding this comment.
Consider the order of filters. It's generally recommended to place the TokenExceptionFilter before the AccessTokenFilter so that any exceptions thrown during token validation are caught before attempting to process the token. This can prevent potential issues with unhandled exceptions.
| .addFilterBefore(tokenExceptionFilter, accessTokenFilter.getClass()) | |
| .addFilterBefore(tokenExceptionFilter, UsernamePasswordAuthenticationFilter.class) | |
| .addFilterBefore(accessTokenFilter, tokenExceptionFilter.getClass()) |
1 participant
✨ 구현한 기능
📢 논의하고 싶은 내용
🎸 기타
Summary by CodeRabbit
New Features
Security
Chores
velkeyservice.