Skip to content

fix: 근로자 공개 링크 API 3개에 /api/v1 접두사 누락 수정 #149

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BcKmini merged 1 commit into from
Aug 12, 2026
Merged

fix: 근로자 공개 링크 API 3개에 /api/v1 접두사 누락 수정 #149

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/main/java/com/fowoco/server/common/config/SecurityConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,8 +109,8 @@ public SecurityFilterChain applicationSecurityFilterChain(
"/api/v1/auth/password-resets"
).permitAll()
.requestMatchers("/error").permitAll()
.requestMatchers(HttpMethod.GET, "/public/worker-links/**").permitAll()
.requestMatchers(HttpMethod.POST, "/public/worker-links/**").permitAll()
.requestMatchers(HttpMethod.GET, "/api/v1/public/worker-links/**").permitAll()
.requestMatchers(HttpMethod.POST, "/api/v1/public/worker-links/**").permitAll()
.requestMatchers(HttpMethod.GET, "/api/v1/**")
.hasAnyRole("ADMIN", "HR", "VIEWER")
.requestMatchers(HttpMethod.HEAD, "/api/v1/**")
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/com/fowoco/server/workerlink/api/WorkerLinkDocumentController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ public WorkerLinkDocumentController(WorkerLinkDocumentService workerLinkDocument
@ApiResponse(responseCode = "429", description = "요청 과다")
})
@PostMapping(
path = "/public/worker-links/{token}/documents",
path = "/api/v1/public/worker-links/{token}/documents",
consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
produces = MediaType.APPLICATION_JSON_VALUE
)
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/com/fowoco/server/workerlink/api/WorkerLinkViewController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@

@Tag(name = "Worker Link (Public)", description = "근로자 공개 안내·제출")
@RestController
@RequestMapping("/public/worker-links/{token}")
@RequestMapping("/api/v1/public/worker-links/{token}")
public class WorkerLinkViewController {

private final WorkerLinkViewService workerLinkViewService;
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/com/fowoco/server/workerlink/api/WorkerResponseController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ public WorkerResponseController(WorkerResponseService workerResponseService) {
@ApiResponse(responseCode = "429", description = "요청 과다")
})
@PostMapping(
path = "/public/worker-links/{token}/responses",
path = "/api/v1/public/worker-links/{token}/responses",
consumes = MediaType.APPLICATION_JSON_VALUE,
produces = MediaType.APPLICATION_JSON_VALUE
)
Expand Down
12 changes: 6 additions & 6 deletions src/test/java/com/fowoco/server/common/security/PostgreSqlRestrictedRoleHttpE2ETest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
class PostgreSqlRestrictedRoleHttpE2ETest {

private static final String COOKIE_NAME = "fowoco_refresh_token";
private static final String PROBE_PATH = "/public/worker-links/rls-test/probes";
private static final String PROBE_PATH = "/api/v1/public/worker-links/rls-test/probes";
private static final List<String> RLS_TABLES = List.of(
"company",
"user_account",
Expand Down Expand Up @@ -259,7 +259,7 @@ void refreshRejectsUnknownExpiredAndRevokedTokensWithOneSafeContract()
@Test
void workerLinkBootstrapAcceptsOnlyActiveRegisteredLinks() throws Exception {
HttpResponse<String> active = get(
"/public/worker-links/"
"/api/v1/public/worker-links/"
+ PostgreSqlRestrictedRoleHttpDataFixture.ACTIVE_WORKER_LINK_TOKEN,
null
);
Expand All @@ -277,7 +277,7 @@ void workerLinkBootstrapAcceptsOnlyActiveRegisteredLinks() throws Exception {
);

HttpResponse<String> responseWrite = postJson(
"/public/worker-links/"
"/api/v1/public/worker-links/"
+ PostgreSqlRestrictedRoleHttpDataFixture.ACTIVE_WORKER_LINK_TOKEN
+ "/responses",
"""
Expand All @@ -298,16 +298,16 @@ void workerLinkBootstrapAcceptsOnlyActiveRegisteredLinks() throws Exception {
);

assertThat(get(
"/public/worker-links/"
"/api/v1/public/worker-links/"
+ PostgreSqlRestrictedRoleHttpDataFixture.EXPIRED_WORKER_LINK_TOKEN,
null
).statusCode()).isEqualTo(410);
assertThat(get(
"/public/worker-links/"
"/api/v1/public/worker-links/"
+ PostgreSqlRestrictedRoleHttpDataFixture.REVOKED_WORKER_LINK_TOKEN,
null
).statusCode()).isEqualTo(410);
assertThat(get("/public/worker-links/unregistered-rls-http-token", null).statusCode())
assertThat(get("/api/v1/public/worker-links/unregistered-rls-http-token", null).statusCode())
.isEqualTo(410);
}

Expand Down
20 changes: 10 additions & 10 deletions src/test/java/com/fowoco/server/workerlink/WorkerLinkSecurityIntegrationTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ void fullFlow_issueViewUploadRespond_succeeds() throws Exception {
assertThat(rawToken).isNotBlank();
assertThat(workerUrl).isEqualTo("http://localhost:5173/worker-portal/" + rawToken);

HttpResponse<String> viewResponse = getJson("/public/worker-links/" + rawToken, null);
HttpResponse<String> viewResponse = getJson("/api/v1/public/worker-links/" + rawToken, null);
assertThat(viewResponse.statusCode()).isEqualTo(200);
assertThat(viewResponse.headers().firstValue("Cache-Control")).contains("no-store");
assertThat(JsonPath.<String>read(viewResponse.body(), "$.guidance"))
Expand Down Expand Up @@ -160,7 +160,7 @@ void fullFlow_issueViewUploadRespond_succeeds() throws Exception {
assertThat(retryUploadId).isEqualTo(firstUploadId);

HttpResponse<String> responseSubmit = postJson(
"/public/worker-links/" + rawToken + "/responses",
"/api/v1/public/worker-links/" + rawToken + "/responses",
"""
{"response_type":"DOCUMENT_SUBMITTED","upload_ids":["%s"],"idempotency_key":"key-1"}
""".formatted(uploadId),
Expand Down Expand Up @@ -263,7 +263,7 @@ void activeWorkerLinkWithoutDraftReturnsContentNotReady() throws Exception {
String taskId = createApprovedTask(hrToken, workerId);
String workerUrl = issueWorkerLink(hrToken, taskId, "content-not-ready-key");

HttpResponse<String> response = getJson("/public/worker-links/" + workerUrl, null);
HttpResponse<String> response = getJson("/api/v1/public/worker-links/" + workerUrl, null);

assertThat(response.statusCode()).isEqualTo(409);
assertThat(JsonPath.<String>read(response.body(), "$.code"))
Expand All @@ -278,7 +278,7 @@ void hrCanListAndMarkWorkerResponsesReviewed() throws Exception {
String workerUrl = issueWorkerLink(hrToken, taskId, "response-management-key");

HttpResponse<String> submitResponse = postJson(
"/public/worker-links/" + workerUrl + "/responses",
"/api/v1/public/worker-links/" + workerUrl + "/responses",
"""
{"response_type":"QUESTION","message":"여권의 어느 면을 제출하나요?","idempotency_key":"question-key"}
""",
Expand Down Expand Up @@ -360,7 +360,7 @@ void hrCanInspectAndAdoptSubmittedFilesThenResumeTask() throws Exception {
String contractFileId = JsonPath.read(contractUpload.body(), "$.upload_id");

HttpResponse<String> submitResponse = postJson(
"/public/worker-links/" + rawToken + "/responses",
"/api/v1/public/worker-links/" + rawToken + "/responses",
"""
{
"response_type":"DOCUMENT_SUBMITTED",
Expand Down Expand Up @@ -873,12 +873,12 @@ void issueRejectsOtherCompanyTask() throws Exception {

@Test
void viewReturns410ForNonExistentToken() throws Exception {
HttpResponse<String> viewResponse = getJson("/public/worker-links/nonexistenttoken12345", null);
HttpResponse<String> viewResponse = getJson("/api/v1/public/worker-links/nonexistenttoken12345", null);
assertThat(viewResponse.statusCode()).isEqualTo(410);
}
@Test
void documentsEndpointAllowsIdempotencyKeyHeaderInCors() throws Exception {
HttpRequest request = HttpRequest.newBuilder(uri("/public/worker-links/test-token/documents"))
HttpRequest request = HttpRequest.newBuilder(uri("/api/v1/public/worker-links/test-token/documents"))
.header("Origin", "http://localhost:3000")
.header("Access-Control-Request-Method", "POST")
.header("Access-Control-Request-Headers", "Idempotency-Key")
Expand Down Expand Up @@ -1008,7 +1008,7 @@ private HttpResponse<String> uploadFile(String token, String filename, String mi
writeFieldPart(out, "clientRequestId", UUID.randomUUID().toString());
out.write(("--" + BOUNDARY + "--\r\n").getBytes(StandardCharsets.UTF_8));

HttpRequest request = HttpRequest.newBuilder(uri("/public/worker-links/" + token + "/documents"))
HttpRequest request = HttpRequest.newBuilder(uri("/api/v1/public/worker-links/" + token + "/documents"))
.header(HttpHeaders.CONTENT_TYPE, "multipart/form-data; boundary=" + BOUNDARY)
.POST(HttpRequest.BodyPublishers.ofByteArray(out.toByteArray()))
.build();
Expand All @@ -1028,7 +1028,7 @@ private HttpResponse<String> uploadFileAsType(
writeFieldPart(out, "documentType", documentType);
out.write(("--" + BOUNDARY + "--\r\n").getBytes(StandardCharsets.UTF_8));

HttpRequest request = HttpRequest.newBuilder(uri("/public/worker-links/" + token + "/documents"))
HttpRequest request = HttpRequest.newBuilder(uri("/api/v1/public/worker-links/" + token + "/documents"))
.header(HttpHeaders.CONTENT_TYPE, "multipart/form-data; boundary=" + BOUNDARY)
.POST(HttpRequest.BodyPublishers.ofByteArray(out.toByteArray()))
.build();
Expand All @@ -1043,7 +1043,7 @@ private HttpResponse<String> uploadFileWithFixedClientRequestId(
writeFieldPart(out, "clientRequestId", clientRequestId);
out.write(("--" + BOUNDARY + "--\r\n").getBytes(StandardCharsets.UTF_8));

HttpRequest request = HttpRequest.newBuilder(uri("/public/worker-links/" + token + "/documents"))
HttpRequest request = HttpRequest.newBuilder(uri("/api/v1/public/worker-links/" + token + "/documents"))
.header(HttpHeaders.CONTENT_TYPE, "multipart/form-data; boundary=" + BOUNDARY)
.POST(HttpRequest.BodyPublishers.ofByteArray(out.toByteArray()))
.build();
Expand Down