Feat/#11 #12
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| name: Deploy Auth to ECS | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| workflow_dispatch: | ||
|
|
||
| env: | ||
| AWS_REGION: ap-northeast-2 | ||
| AWS_ACCOUNT_ID: 727452759104 | ||
| ECR_REPOSITORY: momentlit/auth | ||
| ECS_CLUSTER: default | ||
| ECS_SERVICE: momentlit-auth-service | ||
| IMAGE_TAG: latest | ||
|
|
||
| jobs: | ||
| deploy: | ||
| name: Build and Deploy Auth | ||
| runs-on: ubuntu-latest | ||
|
Comment on lines
+17
to
+20
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win GitHub 토큰 권한을 읽기 전용으로 제한하세요.
수정 예시 on:
push:
branches:
- main
workflow_dispatch:
+permissions:
+ contents: read
+
env:🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
|
|
||
| steps: | ||
| - name: Checkout source code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Configure AWS credentials | ||
| uses: aws-actions/configure-aws-credentials@v5 | ||
| with: | ||
| aws-region: ${{ env.AWS_REGION }} | ||
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | ||
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | ||
|
|
||
| - name: Login to Amazon ECR | ||
| uses: aws-actions/amazon-ecr-login@v2 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Build and push Docker image | ||
| run: | | ||
| IMAGE_URI=${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG} | ||
|
|
||
| docker buildx build \ | ||
| --platform linux/amd64 \ | ||
| --provenance=false \ | ||
| -t $IMAGE_URI \ | ||
| . \ | ||
| --push | ||
|
|
||
| - name: Force new ECS deployment | ||
| run: | | ||
| aws ecs update-service \ | ||
| --cluster $ECS_CLUSTER \ | ||
| --service $ECS_SERVICE \ | ||
| --force-new-deployment \ | ||
| --region $AWS_REGION | ||
|
|
||
| - name: Wait for ECS service stable | ||
| run: | | ||
| aws ecs wait services-stable \ | ||
| --cluster $ECS_CLUSTER \ | ||
| --services $ECS_SERVICE \ | ||
| --region $AWS_REGION | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| package com.example.auth.global.client; | ||
|
|
||
| import com.example.auth.global.client.dto.response.KakaoTokenResponse; | ||
| import com.example.auth.global.client.dto.response.KakaoUserInfoResponse; | ||
| import java.net.URI; | ||
| import org.springframework.beans.factory.annotation.Value; | ||
| import org.springframework.http.MediaType; | ||
| import org.springframework.stereotype.Component; | ||
| import org.springframework.util.LinkedMultiValueMap; | ||
| import org.springframework.util.MultiValueMap; | ||
| import org.springframework.util.StringUtils; | ||
| import org.springframework.web.client.RestClient; | ||
| import org.springframework.web.util.UriComponentsBuilder; | ||
|
|
||
| @Component | ||
| public class KakaoOauthClient { | ||
|
|
||
| private final RestClient restClient; | ||
| private final String clientId; | ||
| private final String clientSecret; | ||
| private final String redirectUri; | ||
| private final String authorizationUri; | ||
| private final String tokenUri; | ||
| private final String userInfoUri; | ||
| private final String scope; | ||
|
|
||
| public KakaoOauthClient( | ||
| @Value("${oauth.kakao.client-id}") String clientId, | ||
| @Value("${oauth.kakao.client-secret}") String clientSecret, | ||
| @Value("${oauth.kakao.redirect-uri}") String redirectUri, | ||
| @Value("${oauth.kakao.authorization-uri}") String authorizationUri, | ||
| @Value("${oauth.kakao.token-uri}") String tokenUri, | ||
| @Value("${oauth.kakao.user-info-uri}") String userInfoUri, | ||
| @Value("${oauth.kakao.scope}") String scope | ||
| ) { | ||
| this.restClient = RestClient.create(); | ||
| this.clientId = clientId; | ||
| this.clientSecret = clientSecret; | ||
| this.redirectUri = redirectUri; | ||
| this.authorizationUri = authorizationUri; | ||
| this.tokenUri = tokenUri; | ||
| this.userInfoUri = userInfoUri; | ||
| this.scope = scope; | ||
| } | ||
|
|
||
| public URI createAuthorizationUri(String state) { | ||
| UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(authorizationUri) | ||
| .queryParam("response_type", "code") | ||
| .queryParam("client_id", clientId) | ||
| .queryParam("redirect_uri", redirectUri); | ||
|
|
||
| if (StringUtils.hasText(scope)) { | ||
| builder.queryParam("scope", scope); | ||
| } | ||
|
|
||
| if (StringUtils.hasText(state)) { | ||
| builder.queryParam("state", state); | ||
| } | ||
|
|
||
| return builder.build() | ||
| .encode() | ||
| .toUri(); | ||
| } | ||
|
|
||
| public KakaoTokenResponse requestToken(String code) { | ||
| MultiValueMap<String, String> body = new LinkedMultiValueMap<>(); | ||
| body.add("grant_type", "authorization_code"); | ||
| body.add("client_id", clientId); | ||
| body.add("redirect_uri", redirectUri); | ||
| body.add("code", code); | ||
|
|
||
| if (StringUtils.hasText(clientSecret)) { | ||
| body.add("client_secret", clientSecret); | ||
| } | ||
|
|
||
| return restClient.post() | ||
| .uri(tokenUri) | ||
| .contentType(MediaType.APPLICATION_FORM_URLENCODED) | ||
| .body(body) | ||
| .retrieve() | ||
| .body(KakaoTokenResponse.class); | ||
| } | ||
|
|
||
| public KakaoUserInfoResponse requestUserInfo(String accessToken) { | ||
| return restClient.get() | ||
| .uri(userInfoUri) | ||
| .headers(headers -> headers.setBearerAuth(accessToken)) | ||
| .retrieve() | ||
| .body(KakaoUserInfoResponse.class); | ||
|
Comment on lines
+76
to
+89
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== locate target file =="
fd -a 'KakaoOauthClient.java|GlobalExceptionHandler.java|application.*\.(yml|yaml|properties)' . || true
echo "== target file outline =="
ast-grep outline src/main/java/com/example/auth/global/client/KakaoOauthClient.java --view expanded || true
echo "== target file relevant lines =="
cat -n src/main/java/com/example/auth/global/client/KakaoOauthClient.java | sed -n '1,140p'
echo "== search exception classes and global handler =="
rg -n "class KakaoOauthException|KakaoOauthException|RestClientException|GlobalExceptionHandler|ResponseEntity|\n.*Exception" src/main/java -S || true
echo "== search RestClient setup =="
rg -n "RequestHeaderExchangeFilterFunction|DefaultClientRequestAuthenticator|KakaoOauthClient|restClient|`@Component`|`@Service`" src/main/java/com/example -S || trueRepository: MomentLit/Auth Length of output: 8229 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== global exception handler =="
cat -n src/main/java/com/example/auth/global/exception/GlobalExceptionHandler.java | sed -n '1,180p'
echo "== exception-related files =="
fd -a '.*(Exception|Error).*\.java$' src/main/java || true
for f in $(fd '.*(Exception|Error).*\.java$' src/main/java || true); do
echo "---- $f ----"
cat -n "$f" | sed -n '1,140p'
done
echo "== auth service relevant lines =="
cat -n src/main/java/com/example/auth/service/AuthService.java | sed -n '1,180p'
echo "== build files / dependencies =="
fd 'build.gradle|settings.gradle|pom.xml' . -x sh -c 'echo "---- $1 ----"; sed -n "1,220p" "$1"' sh {}Repository: MomentLit/Auth Length of output: 25098 🌐 Web query:
💡 Result: In the Spring Framework, the RestClient class handles HTTP error responses (status codes 4xx and 5xx) by throwing a RestClientException or one of its subclasses by default [1][2][3]. Specifically, if no custom status handler is defined, the client throws a RestClientResponseException when receiving a response with a status code of 400 or higher [4][5]. To customize this behavior, you can use the onStatus method on the ResponseSpec interface to define specific handlers for different HTTP status codes [1][6]. Key points for handling status errors: Default Behavior: By default, RestClient raises a RestClientException (specifically RestClientResponseException) for 4xx and 5xx status codes [2][5][7]. Customizing Handlers: You can override the default behavior by registering a status handler using the.onStatus(Predicate, ErrorHandler) method [4][8]. Predicate and Handler: The onStatus method accepts a predicate to match the status code and a handler function that defines how to process the request and response, often by throwing a custom exception [1][6]. Example of custom error handling: restClient.get.uri("https://example.com/api/resource").retrieve.onStatus(HttpStatusCode::is4xxClientError, (request, response) -> { throw new MyCustomException("Client error occurred: " + response.getStatusCode); }).body(String.class); Global Configuration: If you want to apply custom error handling to all requests, you can configure it at the builder level using.defaultStatusHandler(HttpStatusCode::isError, (request, response) ->...) when creating the RestClient instance [1][2]. RestClientResponseException provides access to the raw status code, headers, and the response body, allowing you to extract detailed information if you choose to catch the default exception rather than defining a custom handler [7]. Citations:
Kakao OAuth 콜백 시 Kakao API 실패를 502로 반환하도록 예외를 변환하세요.
🤖 Prompt for AI Agents |
||
| } | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
불변 이미지로 배포하고 새 task definition revision을 지정하세요.
latest를 덮어쓴 뒤 같은 task definition을 강제 재배포하면, 동시에 실행된 배포에서 다른 커밋의 이미지를 가져오거나 롤백 대상이 사라질 수 있습니다. 커밋 SHA 또는 ECR digest로 태그하고, 해당 URI를 반영한 task definition revision을 등록한 뒤 서비스에 지정하세요.Also applies to: 39-56
🤖 Prompt for AI Agents