Skip to content

fix: 세션 소유자 검증 시 존재 여부와 권한을 분리하여 처리 #59

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Boyeon-Shin merged 1 commit into from
Apr 24, 2026
Merged

fix: 세션 소유자 검증 시 존재 여부와 권한을 분리하여 처리 #59

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/main/java/io/wisoft/prepair/prepair_api/global/exception/ErrorCode.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,9 @@ public enum ErrorCode {
RESOURCE_NOT_FOUND(HttpStatus.NOT_FOUND, "리소스를 찾을 수 없습니다."),
DUPLICATE_RESOURCE(HttpStatus.CONFLICT, "이미 존재하는 리소스입니다."),

// Session
SESSION_NOT_FOUND(HttpStatus.NOT_FOUND, "세션을 찾을 수 없습니다."),

// Question
QUESTION_NOT_FOUND(HttpStatus.NOT_FOUND, "질문을 찾을 수 없습니다."),

Expand Down
1 change: 0 additions & 1 deletion src/main/java/io/wisoft/prepair/prepair_api/repository/SessionRepository.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,5 +5,4 @@
import org.springframework.data.jpa.repository.JpaRepository;

public interface SessionRepository extends JpaRepository<InterviewSession, UUID> {
boolean existsByIdAndMemberId(UUID id, UUID memberId);
}
4 changes: 3 additions & 1 deletion src/main/java/io/wisoft/prepair/prepair_api/service/question/QuestionService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,9 @@ public List<InterviewQuestion> generateVideoQuestions(UUID memberId, VideoInterv
}

public void validateSessionOwner(UUID sessionId, UUID memberId) {
if(!sessionRepository.existsByIdAndMemberId(sessionId, memberId)) {
InterviewSession session = sessionRepository.findById(sessionId)
.orElseThrow(() -> new BusinessException(ErrorCode.SESSION_NOT_FOUND));
if (!session.getMemberId().equals(memberId)) {
throw new BusinessException(ErrorCode.FORBIDDEN);
}
Comment on lines 82 to 87
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

해당 메서드는 데이터베이스 조회 작업을 수행하므로, 다른 조회 메서드들과의 일관성을 위해 @Transactional(readOnly = true) 어노테이션을 추가하는 것이 좋습니다. 또한, 검증된 세션 객체를 호출부에서 다시 사용할 가능성이 높으므로, void 대신 InterviewSession을 반환하도록 개선하면 중복 조회를 방지할 수 있습니다.

    @Transactional(readOnly = true)
    public InterviewSession validateSessionOwner(UUID sessionId, UUID memberId) {
        InterviewSession session = sessionRepository.findById(sessionId)
                .orElseThrow(() -> new BusinessException(ErrorCode.SESSION_NOT_FOUND));
        if (!session.getMemberId().equals(memberId)) {
            throw new BusinessException(ErrorCode.FORBIDDEN);
        }
        return session;

}
Expand Down
Loading