feat(auth): dev 전용 access token 발급 endpoint 추가#87
Conversation
FE 개발자가 시드(yarn prisma:seed) accountId로 OIDC 흐름을 거치지 않고
GraphQL Playground에서 곧장 마이페이지 API를 시험할 수 있도록 dev 전용 헬퍼 추가.
## 변경 사항
- AuthService.issueDevAccessToken(accountId)
- findAccountForJwt로 활성 USER 검증 (NotFound / Forbidden 분기)
- 기존 signAccessToken을 재사용하여 access token 생성
- AuthController.devIssueToken (POST /auth/dev/issue-token)
- NODE_ENV=production이면 ForbiddenException으로 즉시 차단
- body.accountId 누락/형식 오류 시 BadRequestException
- 응답: { accessToken, tokenType: 'Bearer', expiresInSeconds }
## 회귀 테스트
- auth.service.spec.ts: 정상 발급 / NotFound / Forbidden 3건
- auth.controller.spec.ts: production 차단 / 누락 / 형식오류 / 정상 4건
전체 875 tests 통과 (+7).
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Coverage report
Test suite run success875 tests passing in 77 suites. Report generated by 🧪jest coverage report action from fe6b876 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fe6b876070
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (account.status !== 'ACTIVE') { | ||
| throw new ForbiddenException('Account is not active.'); | ||
| } | ||
|
|
||
| const accessToken = this.signAccessToken(accountId); |
There was a problem hiding this comment.
issueDevAccessToken only verifies account.status and then signs an access token, so /auth/dev/issue-token will also mint tokens for active SELLER/ADMIN IDs if provided. Because JwtBearerStrategy.validate propagates the real account_type into req.user and seller authorization relies on that type, this allows bypassing the seller credential flow in non-production environments by guessing a seller accountId. If this endpoint is intended for FE mypage testing, it should explicitly enforce account.account_type === USER before signing.
Useful? React with 👍 / 👎.
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
1 participant
Summary
FE 개발자가 시드(yarn prisma:seed) 데이터의 accountId 로 OIDC 흐름을 거치지 않고
GraphQL Playground에서 곧장 마이페이지 API를 시험할 수 있도록 dev 전용 헬퍼 추가.
본 PR은 마이페이지 FE 온보딩 작업 플랜의 Stage A-4.
변경 사항
Service: AuthService.issueDevAccessToken(accountId)
Controller: POST /auth/dev/issue-token
사용 예시
응답의 accessToken을 GraphQL Playground Headers에 입력:
{ "Authorization": "Bearer <accessToken>" }회귀 테스트
Breaking 여부
Test plan