Skip to content

fix: SSE 세션 구독 엔드포인트에 소유자 인가 검증 추가(#51) #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Boyeon-Shin merged 1 commit into from
Apr 23, 2026
Merged

fix: SSE 세션 구독 엔드포인트에 소유자 인가 검증 추가(#51) #58

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions src/main/java/io/wisoft/prepair/prepair_api/controller/InterviewController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,8 +91,11 @@ public ApiResponse<Void> submitVideoAnswer(
}

@GetMapping(value = "/questions/video-answers/{sessionId}/stream", produces = MediaType.TEXT_EVENT_STREAM_VALUE)
public SseEmitter subscribeSession(@PathVariable UUID sessionId) {
public SseEmitter subscribeSession(
@PathVariable UUID sessionId,
@RequestHeader("X-User-Id") UUID memberId
) {
questionService.validateSessionOwner(sessionId, memberId);
return sseEmitterManager.create(sessionId);
}
}

1 change: 1 addition & 0 deletions src/main/java/io/wisoft/prepair/prepair_api/repository/SessionRepository.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,5 @@
import org.springframework.data.jpa.repository.JpaRepository;

public interface SessionRepository extends JpaRepository<InterviewSession, UUID> {
boolean existsByIdAndMemberId(UUID id, UUID memberId);
}
6 changes: 6 additions & 0 deletions src/main/java/io/wisoft/prepair/prepair_api/service/question/QuestionService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,4 +78,10 @@ public List<InterviewQuestion> generateVideoQuestions(UUID memberId, VideoInterv
log.info("화상 면접 질문 생성 완료 - memberId: {}, sessionId: {}", memberId, session.getId());
return questions;
}

public void validateSessionOwner(UUID sessionId, UUID memberId) {
if(!sessionRepository.existsByIdAndMemberId(sessionId, memberId)) {
throw new BusinessException(ErrorCode.FORBIDDEN);
Comment on lines +82 to +84
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

데이터베이스 조회 작업의 일관성과 성능 최적화를 위해 @Transactional(readOnly = true) 어노테이션을 추가하고, 자바 코딩 컨벤션에 맞춰 if 문 뒤에 공백을 추가하는 것이 좋습니다. 또한, 동일 클래스의 getQuestion 메서드(45-48라인)와 일관성을 유지하기 위해 권한이 없거나 리소스가 없는 경우 FORBIDDEN 대신 RESOURCE_NOT_FOUND를 사용하는 것을 고려해 보세요. 이는 리소스의 존재 여부를 불필요하게 노출하지 않는 보안 관행과도 부합합니다.

    @Transactional(readOnly = true)
    public void validateSessionOwner(UUID sessionId, UUID memberId) {
        if (!sessionRepository.existsByIdAndMemberId(sessionId, memberId)) {
            throw new BusinessException(ErrorCode.RESOURCE_NOT_FOUND);

}
}
}
Loading