Skip to content

test: RecordService 단위 테스트 추가 + updateRecord IDOR 수정 - #214

Merged
unam98 merged 1 commit into
devfrom
tests/record-service-unit-tests
Aug 5, 2026
Merged

test: RecordService 단위 테스트 추가 + updateRecord IDOR 수정#214
unam98 merged 1 commit into
devfrom
tests/record-service-unit-tests

Conversation

@unam98

@unam98 unam98 commented Aug 5, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Collaborator

배경

테스트 커버리지 확장 3단계. RecordService(러닝 기록 생성/조회/수정/삭제) 전체 메서드에 대해 단위 테스트 작성. 테스트 작성 중 CourseService.updateCourse와 동일한 패턴의 IDOR 버그를 발견해 함께 수정.

테스트 (18개, @nested로 메서드별 구성)

  • createRecord: courseId/publicCourseId 각각으로 생성, 코스/공개코스/유저 없음, 시간 형식 오류
  • getRecordByUser: 정상 매핑, publicCourseId 매핑, 건강 데이터 포함/미포함, 건강 데이터 조회 실패해도 전체 요청은 안 깨지는 방어 로직 검증, 빈 목록
  • updateRecord: 정상 수정, 기록 없음, 소유자 아니면 거부
  • deleteRecords: 정상 삭제, 존재하지 않는 id 포함, 소유자 아닌 기록 포함, 유저 없음

발견해서 수정한 버그

updateRecord IDOR: userId 파라미터를 받으면서 소유권 검증을 안 해 다른 사람 기록의 제목도 수정 가능했음. 같은 서비스의 deleteRecords는 이미 PermissionDeniedException으로 소유권을 검증하고 있어서, 동일 패턴(record.getRunnectUser().getId().equals(userId))으로 맞춰 수정. ErrorStatus.PERMISSION_DENIED_RECORD_UPDATE_EXCEPTION 신규 추가.

검증

  • 로컬에서 18개 전부 통과
  • 로컬 DB/Redis 띄우고 ./gradlew build 전체(기존 ServerApplicationTests 포함) 통과 확인

Summary by CodeRabbit

  • Bug Fixes
    • Record updates are now restricted to the record owner.
    • Unauthorized update attempts return a clear “Forbidden” error.
    • Expanded validation coverage for record creation, retrieval, updating, and deletion scenarios.

@alh0409
test: RecordService 단위 테스트 추가 + updateRecord IDOR 수정
dd4eb9e 
createRecord/getRecordByUser/updateRecord/deleteRecords 전체 메서드에 대해
정상 케이스 + 예외 케이스 + 경계값 검증 (18개).

테스트 작성 중 CourseService.updateCourse와 동일한 패턴의 버그 발견해 수정:
- updateRecord: userId 파라미터를 받지만 소유권 검증을 하지 않아 다른 사람의
  기록 제목도 수정 가능했음 (IDOR). deleteRecords는 이미 소유권을 검증하고
  있어서(PermissionDeniedException), 동일 패턴으로 맞춰서 수정.
  ErrorStatus.PERMISSION_DENIED_RECORD_UPDATE_EXCEPTION 추가.

getRecordByUser의 건강 데이터 조회 실패 시 전체 요청은 실패하지 않고
healthData만 null로 우아하게 처리되는 방어 로직도 별도로 검증함.
@unam98 unam98 self-assigned this Aug 5, 2026
@coderabbitai

coderabbitai Bot commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 14f82414-12c2-431c-b6d5-beb5005a937e

📥 Commits

Reviewing files that changed from the base of the PR and between 5754c13 and dd4eb9e.

📒 Files selected for processing (3)
  • src/main/java/org/runnect/server/common/constant/ErrorStatus.java
  • src/main/java/org/runnect/server/record/service/RecordService.java
  • src/test/java/org/runnect/server/record/service/RecordServiceTest.java
📝 Walkthrough

Walkthrough

RecordService.updateRecord now verifies record ownership before applying changes. A dedicated 403 FORBIDDEN status reports unauthorized updates. New tests cover service creation, retrieval, update, and deletion behavior.

Changes

Record authorization and service coverage

Layer / File(s) Summary
RecordService test coverage
src/test/java/org/runnect/server/record/service/RecordServiceTest.java		 Adds Mockito fixtures and tests for record creation, retrieval, health data handling, and bulk deletion.
Record update ownership enforcement
src/main/java/org/runnect/server/common/constant/ErrorStatus.java, src/main/java/org/runnect/server/record/service/RecordService.java, src/test/java/org/runnect/server/record/service/RecordServiceTest.java		 Adds a forbidden error status, checks record ownership during updates, and tests successful and rejected updates.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the added RecordService unit tests and the updateRecord IDOR fix, which match the main changes.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch tests/record-service-unit-tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@unam98
unam98 merged commit 69fd6e4 into dev Aug 5, 2026
2 checks passed
@unam98
unam98 deleted the tests/record-service-unit-tests branch August 5, 2026 10:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@unam98 unam98

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@unam98 @alh0409