File Management API Upload ALL Success

2025-12-12 18:52:51 +09:00
parent 11444579e3
commit 8110887088
17 changed files with 368 additions and 103 deletions
--- a/src/main/java/com/kamco/cd/kamcoback/config/GlobalExceptionHandler.java
+++ b/src/main/java/com/kamco/cd/kamcoback/config/GlobalExceptionHandler.java
@@ -2,6 +2,8 @@ package com.kamco.cd.kamcoback.config;

 import com.kamco.cd.kamcoback.auth.CustomUserDetails;
 import com.kamco.cd.kamcoback.common.exception.CustomApiException;
+import com.kamco.cd.kamcoback.common.exception.DuplicateFileException;
+import com.kamco.cd.kamcoback.common.exception.ValidationException;
 import com.kamco.cd.kamcoback.config.api.ApiLogFunction;
 import com.kamco.cd.kamcoback.config.api.ApiResponseDto;
 import com.kamco.cd.kamcoback.config.api.ApiResponseDto.ApiResponseCode;
@@ -42,6 +44,60 @@ public class GlobalExceptionHandler {
    this.errorLogRepository = errorLogRepository;
  }

+  @ResponseStatus(HttpStatus.CONFLICT)
+  @ExceptionHandler(DuplicateFileException.class)
+  public ApiResponseDto<String> handleDuplicateFileException(
+      DuplicateFileException e, HttpServletRequest request) {
+    log.warn("[DuplicateFileException] resource :{} ", e.getMessage());
+    ApiResponseCode code = ApiResponseCode.CONFLICT;
+    ErrorLogEntity errorLog =
+        saveErrorLogData(
+            request,
+            code,
+            HttpStatus.CONFLICT,
+            ErrorLogDto.LogErrorLevel.WARNING,
+            e.getStackTrace());
+
+    return ApiResponseDto.createException(
+        code, e.getMessage(), HttpStatus.CONFLICT, errorLog.getId());
+  }
+
+  @ResponseStatus(HttpStatus.UNPROCESSABLE_ENTITY)
+  @ExceptionHandler(ValidationException.class)
+  public ApiResponseDto<String> handleValidationException(
+      ValidationException e, HttpServletRequest request) {
+    log.warn("[ValidationException] resource :{} ", e.getMessage());
+    ApiResponseCode code = ApiResponseCode.UNPROCESSABLE_ENTITY;
+    ErrorLogEntity errorLog =
+        saveErrorLogData(
+            request,
+            code,
+            HttpStatus.UNPROCESSABLE_ENTITY,
+            ErrorLogDto.LogErrorLevel.WARNING,
+            e.getStackTrace());
+
+    return ApiResponseDto.createException(
+        code, e.getMessage(), HttpStatus.UNPROCESSABLE_ENTITY, errorLog.getId());
+  }
+
+  @ResponseStatus(HttpStatus.BAD_REQUEST)
+  @ExceptionHandler(IllegalArgumentException.class)
+  public ApiResponseDto<String> handleIllegalArgumentException(
+      IllegalArgumentException e, HttpServletRequest request) {
+    log.warn("[IllegalArgumentException] resource :{} ", e.getMessage());
+    ApiResponseCode code = ApiResponseCode.BAD_REQUEST;
+    ErrorLogEntity errorLog =
+        saveErrorLogData(
+            request,
+            code,
+            HttpStatus.BAD_REQUEST,
+            ErrorLogDto.LogErrorLevel.WARNING,
+            e.getStackTrace());
+
+    return ApiResponseDto.createException(
+        code, e.getMessage(), HttpStatus.BAD_REQUEST, errorLog.getId());
+  }
+
  @ResponseStatus(HttpStatus.UNPROCESSABLE_ENTITY)
  @ExceptionHandler(EntityNotFoundException.class)
  public ApiResponseDto<String> handlerEntityNotFoundException(
@@ -105,26 +161,7 @@ public class GlobalExceptionHandler {
        errorLog.getId());
  }

-  @ResponseStatus(HttpStatus.BAD_REQUEST)
-  @ExceptionHandler(IllegalArgumentException.class)
-  public ApiResponseDto<String> handlerIllegalArgumentException(
-      IllegalArgumentException e, HttpServletRequest request) {
-    log.warn("[handlerIllegalArgumentException] resource :{} ", e.getMessage());
-    String codeName = "BAD_REQUEST";
-    ErrorLogEntity errorLog =
-        saveErrorLogData(
-            request,
-            ApiResponseCode.getCode(codeName),
-            HttpStatus.valueOf(codeName),
-            ErrorLogDto.LogErrorLevel.WARNING,
-            e.getStackTrace());

-    return ApiResponseDto.createException(
-        ApiResponseCode.getCode(codeName),
-        ApiResponseCode.getMessage(codeName),
-        HttpStatus.valueOf(codeName),
-        errorLog.getId());
-  }

  @ResponseStatus(HttpStatus.UNPROCESSABLE_ENTITY)
  @ExceptionHandler(DataIntegrityViolationException.class)
--- a/src/main/java/com/kamco/cd/kamcoback/config/SecurityConfig.java
+++ b/src/main/java/com/kamco/cd/kamcoback/config/SecurityConfig.java
@@ -11,9 +11,13 @@ import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.security.web.firewall.HttpFirewall;
+import org.springframework.security.web.firewall.StrictHttpFirewall;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.web.cors.CorsConfigurationSource;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
@@ -30,19 +34,23 @@ public class SecurityConfig {
  public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

    http.cors(cors -> cors.configurationSource(corsConfigurationSource()))
-        .csrf(csrf -> csrf.disable()) // CSRF 보안 기능 비활성화
-        .sessionManagement(
-            sm ->
-                sm.sessionCreationPolicy(
-                    SessionCreationPolicy.STATELESS)) // 서버 세션 만들지 않음, 요청은 JWT 인증
-        .formLogin(form -> form.disable()) // react에서 로그인 요청 관리
-        .httpBasic(basic -> basic.disable()) // 기본 basic 인증 비활성화 JWT 인증사용
-        .logout(logout -> logout.disable()) // 기본 로그아웃 비활성화 JWT는 서버 상태가 없으므로 로그아웃 처리 필요 없음
-        .authenticationProvider(
-            customAuthenticationProvider) // 로그인 패스워드 비교방식 스프링 기본 Provider 사용안함 커스텀 사용
+        .csrf(csrf -> csrf.disable())
+        .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+        .formLogin(form -> form.disable())
+        .httpBasic(basic -> basic.disable())
+        .logout(logout -> logout.disable())
+        .authenticationProvider(customAuthenticationProvider)
        .authorizeHttpRequests(
            auth ->
                auth
+                    // 맵시트 영역 전체 허용 (우선순위 최상단)
+                    .requestMatchers("/api/mapsheet/**")
+                    .permitAll()
+
+                    // 업로드 명시적 허용
+                    .requestMatchers(HttpMethod.POST, "/api/mapsheet/upload")
+                    .permitAll()
+
                    // ADMIN만 접근
                    .requestMatchers("/api/test/admin")
                    .hasRole("ADMIN")
@@ -98,4 +106,19 @@ public class SecurityConfig {
    source.registerCorsConfiguration("/**", config); // CORS 정책을 등록
    return source;
  }
+
+  @Bean
+  public HttpFirewall httpFirewall() {
+    StrictHttpFirewall firewall = new StrictHttpFirewall();
+    firewall.setAllowUrlEncodedSlash(true);
+    firewall.setAllowUrlEncodedDoubleSlash(true);
+    firewall.setAllowUrlEncodedPercent(true);
+    firewall.setAllowSemicolon(true);
+    return firewall;
+  }
+
+  @Bean
+  public WebSecurityCustomizer webSecurityCustomizer() {
+    return (web) -> web.ignoring().requestMatchers(new AntPathRequestMatcher("/api/mapsheet/**"));
+  }
 }
--- a/src/main/java/com/kamco/cd/kamcoback/config/api/ApiResponseAdvice.java
+++ b/src/main/java/com/kamco/cd/kamcoback/config/api/ApiResponseAdvice.java
@@ -56,37 +56,38 @@ public class ApiResponseAdvice implements ResponseBodyAdvice<Object> {
      ServerHttpResponse response) {

    HttpServletRequest servletRequest = ((ServletServerHttpRequest) request).getServletRequest();
-    ContentCachingRequestWrapper contentWrapper = (ContentCachingRequestWrapper) servletRequest;
+    ContentCachingRequestWrapper contentWrapper = null;
+    if (servletRequest instanceof ContentCachingRequestWrapper wrapper) {
+      contentWrapper = wrapper;
+    }

    if (body instanceof ApiResponseDto<?> apiResponse) {
-      // ApiResponseDto에 설정된 httpStatus를 실제 HTTP 응답에 적용
      response.setStatusCode(apiResponse.getHttpStatus());

      String ip = ApiLogFunction.getClientIp(servletRequest);
-
      Long userid = null;

-      /**
-       * servletRequest.getUserPrincipal() instanceof UsernamePasswordAuthenticationToken auth 이 요청이
-       * JWT 인증을 통과한 요청인가? 그리고 Spring Security Authentication 객체가
-       * UsernamePasswordAuthenticationToken 타입인가? 체크
-       */
-      /**
-       * auth.getPrincipal() instanceof CustomUserDetails customUserDetails principal 안에 들어있는 객체가 내가
-       * 만든 CustomUserDetails 타입인가? 체크
-       */
      if (servletRequest.getUserPrincipal() instanceof UsernamePasswordAuthenticationToken auth
          && auth.getPrincipal() instanceof CustomUserDetails customUserDetails) {
-
-        // audit 에는 long 타입 user_id가 들어가지만 토큰 sub은 uuid여서 user_id 가져오기
        userid = customUserDetails.getMember().getId();
      }

-      String requestBody = ApiLogFunction.getRequestBody(servletRequest, contentWrapper);
-      requestBody = maskSensitiveFields(requestBody); // 로그 저장전에 중요정보 마스킹
+      String requestBody;
+      // 멀티파트 요청은 바디 로깅을 생략 (파일 바이너리로 인한 문제 예방)
+      MediaType reqContentType = null;
+      try {
+        String ct = servletRequest.getContentType();
+        reqContentType = ct != null ? MediaType.valueOf(ct) : null;
+      } catch (Exception ignored) {
+      }
+      if (reqContentType != null && MediaType.MULTIPART_FORM_DATA.includes(reqContentType)) {
+        requestBody = "(multipart omitted)";
+      } else {
+        requestBody = ApiLogFunction.getRequestBody(servletRequest, contentWrapper);
+        requestBody = maskSensitiveFields(requestBody);
+      }

      List<?> list = menuService.getFindAll();
-
      List<MenuDto.Basic> result =
          list.stream()
              .map(
@@ -111,7 +112,6 @@ public class ApiResponseAdvice implements ResponseBodyAdvice<Object> {
              servletRequest.getRequestURI(),
              requestBody,
              apiResponse.getErrorLogUid());
-      // tb_audit_log 테이블 저장
      auditLogRepository.save(log);
    }