[DDING-000] 이메일 전송 현황 조회 구현 #361
+455
−48
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| package ddingdong.ddingdongBE.domain.form.controller.dto.response; | ||
|
|
||
| import ddingdong.ddingdongBE.domain.form.service.dto.query.EmailSendStatusQuery; | ||
| import ddingdong.ddingdongBE.domain.form.service.dto.query.EmailSendStatusQuery.EmailSendStatusInfoQuery; | ||
| import ddingdong.ddingdongBE.domain.formapplication.entity.FormApplicationStatus; | ||
| import ddingdong.ddingdongBE.email.entity.EmailSendStatus; | ||
| import io.swagger.v3.oas.annotations.media.Schema; | ||
| import java.time.LocalDateTime; | ||
| import java.util.List; | ||
|
|
||
| public record EmailSendStatusResponse( | ||
| List<EmailSendStatusInfoResponse> emailSendStatusInfoResponses | ||
|
|
||
| ) { | ||
|
|
||
| public static EmailSendStatusResponse from(EmailSendStatusQuery emailSendStatusQuery) { | ||
| List<EmailSendStatusInfoResponse> responses = emailSendStatusQuery.emailSendStatusInfoQueries() | ||
| .stream() | ||
| .map(EmailSendStatusInfoResponse::from) | ||
| .toList(); | ||
| return new EmailSendStatusResponse(responses); | ||
| } | ||
|
|
||
| record EmailSendStatusInfoResponse( | ||
| @Schema(description = "지원자 이름", example = "고건") | ||
| String name, | ||
| @Schema(description = "학번", example = "60221300") | ||
| String studentNumber, | ||
| @Schema(description = "이메일 전송 일시", example = "2025.12.13 13:00") | ||
| LocalDateTime sendAt, // TODO: 재전송 시 Update 해주기 | ||
| @Schema(description = "이메일 전송 상태", example = "Sending") | ||
| EmailSendStatus emailSendStatus, | ||
| @Schema(description = "지원자 서류/면접 합불 상태", example = "FIRST_PASS") | ||
| FormApplicationStatus formApplicationStatus | ||
| ) { | ||
|
|
||
| public static EmailSendStatusInfoResponse from( | ||
| EmailSendStatusInfoQuery emailSendStatusInfoQuery) { | ||
| return new EmailSendStatusInfoResponse( | ||
| emailSendStatusInfoQuery.name(), | ||
| emailSendStatusInfoQuery.studentNumber(), | ||
| emailSendStatusInfoQuery.sendAt(), | ||
| emailSendStatusInfoQuery.emailSendStatus(), | ||
| emailSendStatusInfoQuery.formApplicationStatus() | ||
| ); | ||
| } | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,14 @@ | ||
| package ddingdong.ddingdongBE.domain.form.repository; | ||
|
|
||
| import ddingdong.ddingdongBE.domain.form.entity.FormEmailSendHistory; | ||
| import ddingdong.ddingdongBE.domain.formapplication.entity.FormApplication; | ||
| import ddingdong.ddingdongBE.domain.formapplication.entity.FormApplicationStatus; | ||
| import java.util.List; | ||
| import java.util.Optional; | ||
| import org.springframework.data.jpa.repository.JpaRepository; | ||
|
|
||
| public interface FormEmailSendHistoryRepository extends JpaRepository<FormEmailSendHistory, Long> { | ||
|
|
||
| List<FormEmailSendHistory> getAllByFormId(Long formId); | ||
|
|
||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| package ddingdong.ddingdongBE.domain.form.service.dto.query; | ||
|
|
||
| import ddingdong.ddingdongBE.domain.formapplication.entity.FormApplicationStatus; | ||
| import ddingdong.ddingdongBE.email.entity.EmailSendHistory; | ||
| import ddingdong.ddingdongBE.email.entity.EmailSendStatus; | ||
| import java.time.LocalDateTime; | ||
| import java.util.List; | ||
|
|
||
|
|
||
| public record EmailSendStatusQuery( | ||
| List<EmailSendStatusInfoQuery> emailSendStatusInfoQueries | ||
| ) { | ||
|
|
||
| public static EmailSendStatusQuery from(List<EmailSendHistory> emailSendHistories) { | ||
| List<EmailSendStatusInfoQuery> infos = emailSendHistories.stream() | ||
| .map(EmailSendStatusInfoQuery::from) | ||
| .toList(); | ||
|
|
||
| return new EmailSendStatusQuery(infos); | ||
| } | ||
|
|
||
| public record EmailSendStatusInfoQuery( | ||
| String name, | ||
| String studentNumber, | ||
| LocalDateTime sendAt, | ||
| EmailSendStatus emailSendStatus, | ||
| FormApplicationStatus formApplicationStatus | ||
| ) { | ||
|
|
||
| public static EmailSendStatusInfoQuery from(EmailSendHistory emailSendHistory) { | ||
| return new EmailSendStatusInfoQuery( | ||
| emailSendHistory.getFormApplication().getName(), | ||
| emailSendHistory.getFormApplication().getStudentNumber(), | ||
| emailSendHistory.getSentAt(), | ||
| emailSendHistory.getStatus(), | ||
| emailSendHistory.getFormEmailSendHistory().getFormApplicationStatus() | ||
| ); | ||
| } | ||
coderabbitai[bot] marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| } | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: COW-dev/ddingdong-be
Length of output: 137
🏁 Script executed:
Repository: COW-dev/ddingdong-be
Length of output: 4047
🏁 Script executed:
Repository: COW-dev/ddingdong-be
Length of output: 10990
🏁 Script executed:
Repository: COW-dev/ddingdong-be
Length of output: 3363
🏁 Script executed:
Repository: COW-dev/ddingdong-be
Length of output: 912
🏁 Script executed:
Repository: COW-dev/ddingdong-be
Length of output: 325
🏁 Script executed:
Repository: COW-dev/ddingdong-be
Length of output: 7661
🏁 Script executed:
Repository: COW-dev/ddingdong-be
Length of output: 46
🏁 Script executed:
Repository: COW-dev/ddingdong-be
Length of output: 1928
🏁 Script executed:
Repository: COW-dev/ddingdong-be
Length of output: 6785
🏁 Script executed:
Repository: COW-dev/ddingdong-be
Length of output: 1209
🏁 Script executed:
Repository: COW-dev/ddingdong-be
Length of output: 3292
폼 소유자 검증 누락으로 인한 IDOR 취약점 존재
경로가
/my/forms/{formId}인데 메서드 시그니처에 인증 사용자 정보가 없어 소유권 검증이 불가능합니다. 서비스 레이어에서도 ownership check가 없어서 다른 사용자가 formId만으로 임의의 폼의 이메일 전송 현황을 조회할 수 있습니다.같은 패턴의
getFormStatistics()(라인 95-99)는@AuthenticationPrincipal PrincipalDetails를 받아 userId를 기반으로validateEqualsClub()을 통해 소유권을 검증합니다. 이 엔드포인트도 동일한 방식으로 수정해야 합니다.✅ 수정 방안
`@GetMapping`("/my/forms/{formId}/emails/status") EmailSendStatusResponse getEmailSendStatus( - `@PathVariable`("formId") Long formId + `@PathVariable`("formId") Long formId, + `@AuthenticationPrincipal` PrincipalDetails principalDetails );그 후 서비스 레이어에서:
📝 Committable suggestion
🤖 Prompt for AI Agents