bug: human, file API 직원 권한 제한 (#27)

[cowtree28]

Summary

• 로그인한 민원인(PETITIONER)이 인적사항 CRUD/검색과 엑셀 업로드 API를 호출할 수 있던 문제를 수정하였습니다.

Related Issue

• Closes human, file API 직원 권한 제한 #27

Root Cause

• SecurityConfig의 인가 규칙이 auth/admin 경로에만 정의되어 있고 human/file 경로는 anyRequest().authenticated()에 걸려, 인증만 되면 권한과 무관하게 접근 가능했습니다. 전체 기능 통합 테스트 중 민원인 토큰으로 POST /api/human이 201로 성공하는 것을 확인했습니다.

Fix Description

• /api/human/, /api/files/ 경로를 hasAnyAuthority("ADMIN", "USER")로 제한했습니다.
• /api/certificates/** 접근 제어는 PR #22에서 진행 중이므로 이 PR 범위에서 제외했습니다 (충돌 방지).
• 전 도메인을 관통하는 통합 테스트(FullFlowApiTest)를 추가했습니다: 인적사항 CRUD/검색 흐름, 경력사항 조회/수정 흐름, 민원인 접근 차단(403) 검증.

Testing

• 버그 재현
• 버그 픽스 이후 체크
• 테스트 상세: 수정 전 민원인 토큰으로 POST /api/human → 201 재현, 수정 후 403 확인. 직원 토큰의 정상 흐름(등록→수정→검색→삭제)은 그대로 통과. 전체 테스트 33건 통과.

Risk & Impact

• Risk level: Low
• 영향 범위: human/file API 호출 시 권한 검사 추가. 직원·어드민 계정에는 영향 없음. 민원인용 화면이 이 API들을 쓰고 있었다면 403이 발생하나, 명세상 직원 전용 기능이므로 의도된 동작입니다.

Checklist

• 새로운 회귀(regression)가 발생하지 않았음
• 엣지 케이스를 고려했음
• 필요한 경우 로그 / 에러 처리 업데이트 완료

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Authorized staff and petitioner accounts can access human-record and file-related services.

• Bug Fixes

  • Improved access control for authenticated requests to protected services.

• Tests

  • Added end-to-end coverage for authentication, record management, certificate actions, file downloads, and role-based access restrictions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a84c547d-5a30-40e3-98aa-d15ce34b2cca

📥 Commits

Reviewing files that changed from the base of the PR and between dad35d4 and 452f590.

📒 Files selected for processing (2)

• src/main/java/commonly/commonlybe/global/config/SecurityConfig.java
• src/test/java/commonly/commonlybe/domain/fullflow/FullFlowApiTest.java

Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

The security configuration restricts /api/human/** and /api/files/** to ADMIN and USER authorities. A full-flow integration test covers staff operations, certificate flows, authentication, and petitioner access denial.

Changes

Staff API authorization

Layer / File(s)	Summary
Full-flow authentication setup src/test/java/commonly/commonlybe/domain/fullflow/FullFlowApiTest.java	The test creates staff and petitioner accounts and extracts access tokens from login responses.
Staff human and certificate workflows src/test/java/commonly/commonlybe/domain/fullflow/FullFlowApiTest.java	The test covers human-record CRUD and search, certificate lookup and updates, unavailable issuance details, and download responses.
Role-based endpoint enforcement src/main/java/commonly/commonlybe/global/config/SecurityConfig.java, src/test/java/commonly/commonlybe/domain/fullflow/FullFlowApiTest.java	ADMIN and USER can access the human and file APIs. Petitioner requests to create human records or upload files return HTTP 403.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 452f5

The change restricts human and file APIs to staff authorities, with petitioner access returning 403 and staff flows remaining successful; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The authorization change is in scope. However, FullFlowApiTest also covers certificate lookup, update, and download behavior, although certificate authorization is explicitly deferred to PR #22.	Remove certificate-specific test coverage from this PR, or explain why those tests are required for the human and file API authorization change. Keep certificate authorization work in PR #22.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the human and file API employee-authority restriction and references issue #27.
Linked Issues check	✅ Passed	The PR grants ADMIN and USER access to /api/human/** and /api/files/** and adds integration coverage that denies PETITIONER access. It does not modify certificate authorization, as required by issue #…

Full details: Linked Issues check

Explanation

The PR grants ADMIN and USER access to /api/human/** and /api/files/** and adds integration coverage that denies PETITIONER access. It does not modify certificate authorization, as required by issue #27.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bug/27-staff-only-authorization

---

_{Comment @coderabbitai help to get the list of available commands.}