Skip to content

[hotfix] #143 매칭 상세조회 시 본인 소유 매칭만 조회 가능하도록 검증 로직 추가 #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
2hyunjinn merged 4 commits into from
Jun 12, 2025
Merged

[hotfix] #143 매칭 상세조회 시 본인 소유 매칭만 조회 가능하도록 검증 로직 추가 #144

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0e388c5
[refactor] #143 MatchingValidator에 매칭 관련 검증 로직 추가
2hyunjinn Jun 12, 2025
e3cc085
[fix] #143 내가 신청한 매칭만 조회할 수 있도록 검증 로직 추가
2hyunjinn Jun 12, 2025
2b755c8
[test] #143 다른 사람이 신청한 매칭을 조회할 경우 예외 발생하는 테스트 코드 구현
2hyunjinn Jun 12, 2025
2a315f0
[chore] #143 != -> equals 로 변경
2hyunjinn Jun 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 4 additions & 7 deletions src/main/java/org/festimate/team/domain/matching/service/impl/MatchingServiceImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,12 @@
import java.util.Map;
import java.util.Optional;

import static org.festimate.team.domain.matching.validator.MatchingValidator.isMatchingDateValid;
import static org.festimate.team.domain.matching.validator.MatchingValidator.*;

@Service
@RequiredArgsConstructor
@Slf4j
@Transactional(readOnly = true)
public class MatchingServiceImpl implements MatchingService {
private final MatchingRepository matchingRepository;
private final PointService pointService;
Expand All @@ -48,32 +49,28 @@ public MatchingStatusResponse createMatching(Participant participant, Festival f
return MatchingStatusResponse.of(matching.getStatus(), matching.getMatchingId());
}

@Transactional(readOnly = true)
@Override
public MatchingListResponse getMatchingList(Participant participant) {
List<MatchingInfo> matchings = getMatchingListByParticipant(participant);
return MatchingListResponse.from(matchings);
}

@Transactional(readOnly = true)
@Override
public AdminMatchingResponse getMatchingSize(Participant participant) {
int allMatchingSize = matchingRepository.countAllByApplicant(participant);
int completeMatchingSize = matchingRepository.countCompletedByApplicant(participant);
return AdminMatchingResponse.from(completeMatchingSize, allMatchingSize);
}

@Transactional(readOnly = true)
@Override
public MatchingDetailInfo getMatchingDetail(Participant participant, Festival festival, Long matchingId) {
Matching matching = matchingRepository.findByMatchingId(matchingId)
.orElseThrow(() -> new FestimateException(ResponseError.TARGET_NOT_FOUND));
if (matching.getTargetParticipant() == null || matching.getTargetParticipant().getUser() == null) {
throw new FestimateException(ResponseError.TARGET_NOT_FOUND);
}
if (!matching.getFestival().getFestivalId().equals(festival.getFestivalId())) {
throw new FestimateException(ResponseError.FORBIDDEN_RESOURCE);
}
isFestivalMatchValid(matching, festival);
isApplicantParticipantValid(matching, participant);
return MatchingDetailInfo.from(matching);
}

Expand Down
17 changes: 16 additions & 1 deletion src/main/java/org/festimate/team/domain/matching/validator/MatchingValidator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,11 @@
package org.festimate.team.domain.matching.validator;

import lombok.extern.slf4j.Slf4j;
import org.festimate.team.global.response.ResponseError;
import org.festimate.team.domain.festival.entity.Festival;
import org.festimate.team.domain.matching.entity.Matching;
import org.festimate.team.domain.participant.entity.Participant;
import org.festimate.team.global.exception.FestimateException;
import org.festimate.team.global.response.ResponseError;
import org.springframework.stereotype.Component;

import java.time.LocalDateTime;
Expand All @@ -21,4 +24,16 @@ public static void isMatchingDateValid(final LocalDateTime requestMatchingTime,

log.info("matchingStartAt is valid.");
}

public static void isApplicantParticipantValid(final Matching matching, final Participant participant) {
if (matching.getApplicantParticipant() != participant) {
throw new FestimateException(ResponseError.FORBIDDEN_RESOURCE);
}
}
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Jun 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Participant comparison uses reference equality – will fail with detached/rehydrated entities

matching.getApplicantParticipant() != participant compares object references, not logical identity.
In a Hibernate/JPA context the same DB row can be represented by different Java instances (e.g., proxy ≠ DTO), causing a legitimate request to be rejected.

-import org.festimate.team.domain.participant.entity.Participant;
+import org.festimate.team.domain.participant.entity.Participant;
+import java.util.Objects;
…
-        if (matching.getApplicantParticipant() != participant) {
+        if (!Objects.equals(
+                matching.getApplicantParticipant().getParticipantId(),
+                participant.getParticipantId())) {
             throw new FestimateException(ResponseError.FORBIDDEN_RESOURCE);
         }

Compare by participantId (or equals) to avoid false negatives.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
public static void isApplicantParticipantValid(final Matching matching, final Participant participant) {
if (matching.getApplicantParticipant() != participant) {
throw new FestimateException(ResponseError.FORBIDDEN_RESOURCE);
}
}
import org.festimate.team.domain.participant.entity.Participant;
import java.util.Objects;
…
public static void isApplicantParticipantValid(final Matching matching, final Participant participant) {
- if (matching.getApplicantParticipant() != participant) {
+ if (!Objects.equals(
+ matching.getApplicantParticipant().getParticipantId(),
+ participant.getParticipantId())) {
throw new FestimateException(ResponseError.FORBIDDEN_RESOURCE);
}
}
🤖 Prompt for AI Agents 
In
src/main/java/org/festimate/team/domain/matching/validator/MatchingValidator.java
around lines 28 to 32, the participant comparison uses reference equality which
can fail for detached or rehydrated entities. Replace the reference comparison
with a logical identity check by comparing participant IDs or using the equals
method to ensure correct validation of participant identity.


public static void isFestivalMatchValid(final Matching matching, final Festival festival) {
if (!matching.getFestival().getFestivalId().equals(festival.getFestivalId())) {
throw new FestimateException(ResponseError.FORBIDDEN_RESOURCE);
}
}
}
32 changes: 32 additions & 0 deletions src/test/java/org/festimate/team/domain/matching/service/impl/MatchingServiceImplTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -273,6 +273,38 @@ void getMatchingDetail_invalidFestival_throwsException() {
.hasMessage(ResponseError.FORBIDDEN_RESOURCE.getMessage());
}

@Test
@DisplayName("매칭 상세 조회 - 다른 사람이 신청한 매칭을 조회할 경우 예외 발생")
void getMatchingDetail_invalidApplicant_throwsException() {
// given
User user = mockUser("사용자1", Gender.MAN, 1L);
User otherUser = mockUser("사용자2", Gender.MAN, 2L);
Festival festival = mockFestival(user, 1L, LocalDate.now().minusDays(1), LocalDate.now().plusDays(1));

Participant myParticipant = mockParticipant(user, festival, TypeResult.INFLUENCER, 1L);
Participant otherParticipant = mockParticipant(otherUser, festival, TypeResult.INFLUENCER, 2L);

Matching otherMatching = Matching.builder()
.festival(festival)
.applicantParticipant(otherParticipant)
.targetParticipant(Participant.builder()
.user(mockUser("상대방", Gender.WOMAN, 3L))
.build())
.status(MatchingStatus.COMPLETED)
.matchDate(LocalDateTime.now())
.build();

when(userService.getUserByIdOrThrow(user.getUserId())).thenReturn(user);
when(festivalService.getFestivalByIdOrThrow(festival.getFestivalId())).thenReturn(festival);
when(participantService.getParticipantOrThrow(user, festival)).thenReturn(myParticipant);
when(matchingRepository.findByMatchingId(1L)).thenReturn(Optional.of(otherMatching));

// when & then
assertThatThrownBy(() -> matchingService.getMatchingDetail(myParticipant, festival, 1L))
.isInstanceOf(FestimateException.class)
.hasMessage(ResponseError.FORBIDDEN_RESOURCE.getMessage());
}

@Test
@DisplayName("매칭 상세 조회 - 보류 중인 매칭을 조회할 경우 예외 발생")
void getMatchingDetail_pendingMatching_throwsException() {
Expand Down
Loading