fix(security): enforce tenant-scoped admin deletion

[seonghobae]

Objective

Reconcile one high-risk semantic slice from stale descendant #268 directly on current protected main: administrative delete must authenticate tenant authority, require delete permission, use the existing tenant-scoped service mutation, and conceal missing/foreign jobs as the same 404 outcome.

Fresh exact state — 2026-08-10

• exact source head: 5da7462b0b98cabc429ea922888ebb8b5a0ccf1c;
• independently resolved protected main: 55d7ae8647208e301f282350f076eeddaba61d11;
• clean current-base slice: three changed files, three commits, zero commits behind protected main;
• exact-head CI 31399587866: success;
• exact-head Security Scan 31399587848: success;
• exact-head SAST Semgrep 31399587735: success;
• exact-head fuzz 31399587671: success;
• no unresolved review threads and no formal reviews at the latest direct refetch;
• automated checks/statuses are evidence, never qualifying independent approval.

Test-first evidence

RED

Test-only head 110bf80220b2783e73b496b4edfd54d119c17e06 added the focused WebFlux regression before changing production. Exact-head CI 31399317127 failed in Maven test compilation at AdminControllerDeleteTenantBoundaryTest: production exposed only AdminController(DocumentConversionService) and therefore had no tenant-authorization dependency. The exact checkout identity in the failed job was the RED SHA. Security Scan and SAST were already successful on that test-only head.

GREEN

Current AdminController injects TenantAccessService, requires job:delete from request tenant claims before any deletion, delegates only to the existing deleteJob(jobId, TenantContext) service boundary, and maps a missing or cross-tenant result to the same controlled 404. The legacy global deleteJob(jobId) path is no longer reachable from this administrative delete endpoint.

Focused tests prove:

• missing tenant authority returns 401 before mutation;
• missing delete permission returns 403 before mutation;
• missing/foreign jobs return 404 through the tenant-scoped mutation;
• owned deletion returns 204;
• the legacy global delete method is never called by the endpoint.

The authoritative exact-head mvn -B --no-transfer-progress verify CI lifecycle, synthetic-merge verification, security scan, Semgrep and fuzz are all GREEN.

Scope boundary

This deliberately does not copy #268's stale ancestry or claim the whole descendant is reconciled. Tenant-scoped admin list/retry, durable deletion receipts/recovery, immutable identity/generation fencing and privacy-safe audit remain separate semantics to preserve or reimplement deliberately. Issue #263's end-to-end accessible deletion/download/recovery journey also remains open.

Merge gate

Move to Ready for ordinary independent review. Keep this exact head unchanged. Merge or auto-merge may complete only after live repository protection still sees all required gates passing, zero valid unresolved findings, and any required qualifying independent non-author approval. Automated evidence is not approval.

Summary by CodeRabbit

• 버그 수정
  • 관리자 작업 삭제 시 테넌트 인증 및 삭제 권한을 검증합니다.
  • 인증 정보가 없으면 401, 권한이 없으면 403을 반환합니다.
  • 다른 테넌트의 작업이나 존재하지 않는 작업은 404로 처리합니다.
  • 소유한 작업을 성공적으로 삭제하면 204를 반환합니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9f6cbb90-135b-4104-ae22-7a01a0259d35

📥 Commits

Reviewing files that changed from the base of the PR and between 5da7462 and 0f8fe8d.

📒 Files selected for processing (1)

• src/test/java/com/clearfolio/viewer/controller/AdminControllerDeleteTenantBoundaryTest.java

🚧 Files skipped from review as they are similar to previous changes (1)

• src/test/java/com/clearfolio/viewer/controller/AdminControllerDeleteTenantBoundaryTest.java

---

📝 Walkthrough

Walkthrough

AdminController의 작업 삭제에 테넌트 인증과 JOB_DELETE 권한 검증을 추가했습니다. 삭제는 검증된 TenantContext로 수행하며, 인증 실패는 401, 권한 부족은 403, 삭제 대상이 없으면 404를 반환합니다.

Changes

테넌트 범위 작업 삭제

Layer / File(s)	Summary
삭제 엔드포인트 인증 및 범위 적용 src/main/java/com/clearfolio/viewer/controller/AdminController.java	TenantAccessService를 주입합니다. 요청 헤더에서 테넌트 컨텍스트와 JOB_DELETE 권한을 검증합니다. 검증된 TenantContext로 작업을 삭제하고, 대상이 없으면 404 NOT_FOUND를 반환합니다.
테넌트 경계 테스트 갱신 src/test/java/com/clearfolio/viewer/controller/AdminControllerDeleteTenantBoundaryTest.java, src/test/java/com/clearfolio/viewer/controller/AdminControllerTest.java	인증 헤더 누락, 권한 부족, 다른 테넌트 작업, 삭제 대상 없음, 소유 테넌트의 204 응답을 검증합니다. 테스트 mock과 생성자를 새 삭제 계약에 맞게 갱신합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant AdminController
  participant TenantAccessService
  participant DocumentConversionService
  Client->>AdminController: DELETE 요청 및 테넌트 헤더
  AdminController->>TenantAccessService: 테넌트와 JOB_DELETE 권한 검증
  TenantAccessService-->>AdminController: TenantContext
  AdminController->>DocumentConversionService: TenantContext와 jobId로 삭제
  DocumentConversionService-->>AdminController: 삭제 결과
  AdminController-->>Client: 204 또는 404 응답

Loading

Possibly related PRs

• ContextualWisdomLab/clearfolio#270: AdminController의 테넌트 범위 작업 삭제 권한과 관련된 변경을 다룹니다.
• ContextualWisdomLab/clearfolio#348: 다른 코드 경로에서 테넌트 기반 권한 검증을 추가합니다.
• ContextualWisdomLab/clearfolio#359: AdminController의 테넌트 접근 및 작업 삭제 권한 변경과 직접 연결됩니다.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 27.27% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 테넌트 범위 기반 관리자 삭제 보안 강제를 명확하게 설명하며 변경사항의 주요 목적과 일치합니다.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/admin-delete-tenant-boundary-main-20260810

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@src/test/java/com/clearfolio/viewer/controller/AdminControllerDeleteTenantBoundaryTest.java`:
- Line 44: 인증 거부 경로에서 특정 메서드뿐 아니라 conversionService의 모든 상호작용이 없음을 검증하세요.
AdminControllerDeleteTenantBoundaryTest.java의 44-44 및 57-57 위치에서 기존
verify(conversionService, never()).deleteJob(jobId) 검증을
verifyNoInteractions(conversionService)로 교체하세요.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b07a0b1a-75ec-497c-81de-af7d7fa6bd62

📥 Commits

Reviewing files that changed from the base of the PR and between 55d7ae8 and 5da7462.

📒 Files selected for processing (3)

• src/main/java/com/clearfolio/viewer/controller/AdminController.java
• src/test/java/com/clearfolio/viewer/controller/AdminControllerDeleteTenantBoundaryTest.java
• src/test/java/com/clearfolio/viewer/controller/AdminControllerTest.java

[seonghobae]

Superseded by current-main replacement #436. The replacement preserves this PR's three-file tenant-scoped administrative deletion semantic delta on protected main 961f44a19c4ced87f8062b3ab9842a9a08d05235, has fresh exact-head CI/Security/SAST/fuzz evidence, is Ready, and has auto-merge enabled subject to ordinary independent approval and branch protection. Closing this stale-base duplicate prevents parallel review and merge ambiguity; no predecessor evidence transfers.