chore: develop → main 릴리즈 (FE 보고 버그 3건 수정) by chanwoo7 · Pull Request #143 · CaQuick/caquick-be

chanwoo7 · 2026-06-11T11:41:12Z

Summary

FE 보고 버그 3건 수정(#142)을 main으로 승격합니다. 직전 릴리즈(#139) 이후 develop 델타는 이 3건뿐 — DB 마이그레이션 0, SDL(.graphql) 변경 0, 신규 런타임 의존성 0.

중요 — main 머지 ≠ 자동 배포. deploy.yml은 workflow_dispatch(수동). 이 PR 머지는 코드 동결이며, 실제 배포는 이후 별도 수동 실행 + 아래 사전 확인이 필요합니다.

Scope (#142)

fix(auth): 카카오 OIDC scope provider별 분리 (KOE205) — 표준 email/profile 대신 카카오 동의항목 ID(account_email/profile_nickname/profile_image) 사용. OIDC_KAKAO_SCOPE/OIDC_GOOGLE_SCOPE env로 덮어쓰기 가능.
fix(auth): 가입 시 자동 nickname sanitize — 공백/특수문자 제거 + _{accountId} suffix로 길이/유니크 보장(가입 실패 회귀 차단).
fix(user): 프로필 이미지 URL 검증 — 발급한 S3 publicUrl(이 버킷·해당 계정 prefix)인지 검증. path-traversal(../, %2e) 방어 포함.

FE 영향 / 운영 (배포 전 확인)

항목	내용	필요 액션
카카오 로그인 (task1)	코드 scope 수정 완료	콘솔: OpenID Connect ON + Redirect URI(`/auth/oidc/kakao/callback`) 확인. 동의항목(profile_nickname/profile_image/account_email)은 활성화 완료. account_email 미가용 시 `OIDC_KAKAO_SCOPE` env로 제외
가입 초기 nickname (task2)	형식이 `{정제된이름}_{accountId}`(placeholder) 로 변경	FE가 초기 nickname 노출 시 인지(온보딩 유도 권장)
프로필 이미지 (task3)	⚠️ `updateMyProfileImage`가 우리가 발급한 publicUrl만 허용(임의 URL 400)	FE는 `createProfileImageUploadUrl`가 돌려준 `publicUrl`을 그대로 전송해야 함 — 다른 값 보내면 거절

DB: 마이그레이션/스키마 변경 없음. 롤백 부담 없음.
런타임 의존성: 추가 없음.

Test plan / 배포 전 체크리스트

CI 통과 (check / pr-title / coverage-report / CodeQL)
카카오 콘솔: OpenID Connect ON + Redirect URI 등록 확인
FE 협의: task3(profile image는 발급 publicUrl만) 계약 확인
(배포 후) 스테이징/실제 카카오 로그인 1회 + 프로필 이미지 업로드 스모크

머지 / 배포 절차

이 PR CI 통과 후 머지 (배포 안 됨)
배포 전 위 체크리스트 완료
deploy.yml 수동 실행으로 배포

Summary by CodeRabbit

릴리스 노트

새로운 기능
- 소셜 로그인 가입 시 닉네임이 더 안정적으로 자동 생성됨
- 카카오 로그인 시 추가 권한 항목 요청
보안 개선
- 프로필 이미지 업로드 시 소유권 검증 추가로 보안 강화
테스트
- 닉네임 생성, 소셜 로그인 권한, 프로필 이미지 검증 테스트 추가

…·%2e 차단)

fix: FE 보고 버그 3건 (카카오 로그인 scope · 가입 nickname · 프로필 이미지 URL 검증)

coderabbitai · 2026-06-11T11:41:24Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 31a9bb48-a11d-46e0-8a09-73a227b4d879

📥 Commits

Reviewing files that changed from the base of the PR and between a6188be and b5000e7.

📒 Files selected for processing (10)

src/features/auth/helpers/initial-nickname.helper.spec.ts
src/features/auth/helpers/initial-nickname.helper.ts
src/features/auth/repositories/account.repository.spec.ts
src/features/auth/repositories/account.repository.ts
src/features/auth/services/oidc-client.service.spec.ts
src/features/auth/services/oidc-client.service.ts
src/features/user/services/user-profile.service.spec.ts
src/features/user/services/user-profile.service.ts
src/global/storage/s3.service.spec.ts
src/global/storage/s3.service.ts

📝 Walkthrough

Walkthrough

이 PR은 OIDC 가입 흐름에서 사용자 닉네임을 동적으로 생성하고, provider별 OIDC scope를 구성하며, S3 프로필 이미지 URL의 소유권을 검증하는 기능을 추가합니다.

Changes

OIDC 닉네임 생성 및 프로필 이미지 보안

Layer / File(s)	Summary
초기 닉네임 생성 헬퍼 `src/features/auth/helpers/initial-nickname.helper.ts`, `src/features/auth/helpers/initial-nickname.helper.spec.ts`	`buildInitialNickname` 헬퍼가 displayName/email을 정제하여 accountId suffix(`_{id}`)를 붙이고 50자로 제한합니다. 정규식 `^[A-Za-z0-9가-힣_]+$` 준수와 유니크성 보장을 테스트로 검증합니다.
AccountRepository 닉네임 생성 통합 `src/features/auth/repositories/account.repository.ts`, `src/features/auth/repositories/account.repository.spec.ts`	createUserProfile에서 buildInitialNickname을 호출하여 동적 nickname 생성으로 변경하고, 공백 제거 및 accountId suffix 포함을 검증하는 테스트 기대값을 업데이트합니다.
Provider별 OIDC scope 구성 `src/features/auth/services/oidc-client.service.ts`, `src/features/auth/services/oidc-client.service.spec.ts`	getScope 헬퍼를 추가하여 Google(기본값: `openid email profile`)과 Kakao(기본값: `openid account_email profile_nickname profile_image`)의 provider별 scope를 환경변수로 오버라이드 가능하게 구성합니다.
S3 프로필 이미지 URL 소유권 검증 `src/global/storage/s3.service.ts`, `src/global/storage/s3.service.spec.ts`	isOwnedProfileImageUrl 메서드를 추가하여 presigned URL이 계정의 프로필 이미지 경로에서 발급되었는지 검증합니다. HTTPS, 버킷 호스트, keyPrefix 일치를 확인하고 경로 탐색 및 인코딩된 dot를 방어합니다.
UserProfileService 프로필 이미지 가드 `src/features/user/services/user-profile.service.ts`, `src/features/user/services/user-profile.service.spec.ts`	updateMyProfileImage에서 S3 소유권 검증을 추가하여 비소유 URL을 `BadRequestException`으로 거절하고, 소유/비소유 URL 시나리오를 테스트합니다.

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	PR 제목이 develop → main 릴리즈임을 명확히 하지만, 실제 변경 내용(닉네임 sanitize, Kakao OIDC scope 분리, 프로필 이미지 검증)을 직접 반영하지 않습니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch develop

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-06-11T11:42:16Z

🧹 knip — dead-code 리포트

요약 항목 없음

전체 리포트

(knip 출력 없음 — 이슈 0이거나 실행 실패)

청소 후보(오탐 가능) · 기준 docs/guide/architecture-conventions.md

github-actions · 2026-06-11T11:42:18Z

🩺 NestJS Doctor — 87/100 (Good)

진단 237건 (error 0).

Category	warning	info
architecture	0	8
correctness	101	0
performance	21	13
schema	0	81
security	13	0

architecture / security 상위 항목

info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal type 'IAuditLogRepository'.
warning security/security/no-exposed-env-vars: Direct 'process.env.NODE_ENV' access in 'AuthController'. Use ConfigService instead.
warning security/security/require-guards-on-endpoints: Endpoint 'start' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'callback' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'refresh' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'logout' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'sellerLogin' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'sellerRefresh' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'sellerLogout' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'devIssueToken' has no @UseGuards() at class or method level.
info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal module '@/features/conversation/repositories/conversation.repository'.
info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal type 'ConversationRepository'.
info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal module '@/features/order/repositories/order.repository'.
info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal type 'OrderRepository'.
info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal module '@/features/product/repositories/product.repository'.

오탐 포함 가능 · 기준 docs/guide/architecture-conventions.md

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b5000e75f5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-06-11T11:43:44Z

+    }
+    return (
+      this.config.get<string>('OIDC_KAKAO_SCOPE')?.trim() ||
+      'openid account_email profile_nickname profile_image'


Delimit Kakao consent scopes with commas

For Kakao authorization requests that explicitly ask for additional consent items, Kakao's REST API docs show the scope value as comma-delimited (and note OIDC requests must include openid when scope is present), while openid-client will send this string unchanged as scope=openid%20account_email.... In that Kakao login path this can still be parsed as an invalid/single consent scope and reproduce the KOE205 failure this change is trying to fix; the Kakao default (and example override) should use commas, e.g. openid,account_email,profile_nickname,profile_image.

Useful? React with 👍 / 👎.

false positive. 카카오 OIDC scope는 OIDC 표준대로 공백 구분이 맞음(RFC 6749 + 카카오 OIDC 문서 'space-delimited' + 토큰 응답 scope도 공백: 'profile_image openid profile_nickname' + next-auth/openid-client 동일 사용). 콤마로 주면 openid-client가 %2C로 인코딩→카카오가 단일 무효 scope로 파싱→오히려 KOE205. 콤마 표기는 카카오 레거시 REST API 한정.

codecov · 2026-06-11T11:44:36Z

Codecov Report

❌ Patch coverage is 96.29630% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/global/storage/s3.service.ts	87.50%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

github-actions · 2026-06-11T11:44:44Z

Coverage report

St.^❔	Category	Percentage	Covered / Total
🟢	Statements	97.4%	3553/3648
🟢	Branches	93.8%	1135/1210
🟢	Functions	94.08%	651/692
🟢	Lines	97.66%	3256/3334

Test suite run success

1252 tests passing in 145 suites.

Report generated by 🧪jest coverage report action from b5000e7

chanwoo7 added 5 commits June 11, 2026 04:43

fix(auth): 카카오 OIDC scope를 provider별로 분리 (KOE205 invalid_scope 수정)

5d82e58

fix(auth): 가입 시 자동 nickname sanitize (공백/특수문자 제거 + 길이/유니크 보장)

5c2997f

fix(user): 프로필 이미지 URL이 발급된 S3 객체인지 검증 (임의 URL 저장 방지)

4e4df3e

fix(user): 프로필 이미지 URL 검증을 path-traversal 방어로 강화 (URL 파싱·정규화 pathname…

f1242f5

…·%2e 차단)

Merge pull request #142 from CaQuick/fix/fe-reported-auth-signup-profile

b5000e7

fix: FE 보고 버그 3건 (카카오 로그인 scope · 가입 nickname · 프로필 이미지 URL 검증)

chatgpt-codex-connector Bot reviewed Jun 11, 2026

View reviewed changes

chanwoo7 merged commit b4d5f2c into main Jun 11, 2026
15 checks passed

chanwoo7 deleted the develop branch June 11, 2026 11:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: develop → main 릴리즈 (FE 보고 버그 3건 수정)#143

chore: develop → main 릴리즈 (FE 보고 버그 3건 수정)#143
chanwoo7 merged 5 commits into
mainfrom
develop

chanwoo7 commented Jun 11, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jun 11, 2026

Uh oh!

chanwoo7 Jun 11, 2026

Uh oh!

codecov Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

chanwoo7 commented Jun 11, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Scope (#142)

FE 영향 / 운영 (배포 전 확인)

Test plan / 배포 전 체크리스트

머지 / 배포 절차

Summary by CodeRabbit

릴리스 노트

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Jun 11, 2026

🧹 knip — dead-code 리포트

Uh oh!

github-actions Bot commented Jun 11, 2026

🩺 NestJS Doctor — 87/100 (Good)

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jun 11, 2026

Choose a reason for hiding this comment

Uh oh!

chanwoo7 Jun 11, 2026

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Jun 11, 2026

Codecov Report

Uh oh!

github-actions Bot commented Jun 11, 2026

Coverage report

Test suite run success

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chanwoo7 commented Jun 11, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading