-
Notifications
You must be signed in to change notification settings - Fork 0
[feat] 작곡가 생성 API 추가 #94
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| package com.daramg.server.composer.dto | ||
|
|
||
| import com.daramg.server.composer.domain.Continent | ||
| import com.daramg.server.composer.domain.Era | ||
| import com.daramg.server.composer.domain.Gender | ||
| import jakarta.validation.constraints.NotBlank | ||
| import jakarta.validation.constraints.NotNull | ||
|
|
||
| data class ComposerCreateDto( | ||
| @get:NotBlank val koreanName: String, | ||
| @get:NotBlank val englishName: String, | ||
| val nativeName: String? = null, | ||
| @get:NotNull val gender: Gender, | ||
| val nationality: String? = null, | ||
| val birthYear: Short? = null, | ||
| val deathYear: Short? = null, | ||
| val bio: String? = null, | ||
| val era: Era? = null, | ||
| val continent: Continent? = null, | ||
| ) |
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -1,14 +1,14 @@ | ||||||
| package com.daramg.server.composer.presentation; | ||||||
|
|
||||||
| import com.daramg.server.composer.application.ComposerService; | ||||||
| import com.daramg.server.composer.dto.ComposerCreateDto; | ||||||
| import com.daramg.server.composer.dto.ComposerLikeResponseDto; | ||||||
| import com.daramg.server.user.domain.User; | ||||||
| import jakarta.validation.Valid; | ||||||
| import lombok.RequiredArgsConstructor; | ||||||
| import org.springframework.http.HttpStatus; | ||||||
| import org.springframework.http.ResponseEntity; | ||||||
| import org.springframework.web.bind.annotation.PathVariable; | ||||||
| import org.springframework.web.bind.annotation.PostMapping; | ||||||
| import org.springframework.web.bind.annotation.RequestMapping; | ||||||
| import org.springframework.web.bind.annotation.RestController; | ||||||
| import org.springframework.web.bind.annotation.*; | ||||||
|
|
||||||
| @RestController | ||||||
| @RequiredArgsConstructor | ||||||
|
|
@@ -17,6 +17,12 @@ public class ComposerController { | |||||
|
|
||||||
| private final ComposerService composerService; | ||||||
|
|
||||||
| @PostMapping | ||||||
| @ResponseStatus(HttpStatus.CREATED) | ||||||
| public void createComposer(@Valid @RequestBody ComposerCreateDto dto, User user) { | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The Recommendation: Use the
Suggested change
|
||||||
| composerService.createComposer(dto, user); | ||||||
| } | ||||||
|
|
||||||
| @PostMapping("/{composerId}/like") | ||||||
| public ResponseEntity<ComposerLikeResponseDto> toggleComposerLike(@PathVariable Long composerId, User user) { | ||||||
| ComposerLikeResponseDto response = composerService.toggleLike(composerId, user); | ||||||
|
|
||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The
createComposermethod uses a hardcoded user ID (user.getId() != 1L) for administrative checks, which is a critical security vulnerability. This brittle approach allows for easy privilege escalation, as the first registered user (ID 1) would gain admin privileges, potentially enabling an attacker to bypass authorization. It is highly recommended to implement a robust Role-Based Access Control (RBAC) system, such as adding anisAdmin()method to theUserentity or utilizing Spring Security's@PreAuthorizeannotation, instead of relying on hardcoded user IDs.