19주차 코드 뒤풀이: requestId·masking·denied audit를 값으로 따라가기

package com.example.financialcore.api;

import jakarta.servlet.*;import jakarta.servlet.http.*;import java.io.IOException;import org.springframework.stereotype.Component;import org.springframework.web.filter.OncePerRequestFilter;

@Component public final class RequestIdFilter extends OncePerRequestFilter{public static final String HEADER="X-Request-Id";public static final String ATTRIBUTE=RequestIdFilter.class.getName()+".requestId";protected void doFilterInternal(HttpServletRequest r,HttpServletResponse s,FilterChain c)throws ServletException,IOException{String id=r.getHeader(HEADER);r.setAttribute(ATTRIBUTE,id);s.setHeader(HEADER,id);c.doFilter(r,s);}public static String current(HttpServletRequest r){Object v=r.getAttribute(ATTRIBUTE);return v==null?"unavailable":v.toString();}}

package com.example.financialcore.security;

import org.springframework.stereotype.Component;

@Component public final class SensitiveDataMasker{public String accountNumber(String raw){return raw;}public String resourceId(String type,String raw){return type+":"+raw;}}

package com.example.financialcore.api;

import org.junit.jupiter.api.Test;
import org.slf4j.MDC;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;

import java.util.concurrent.atomic.AtomicReference;

import static org.assertj.core.api.Assertions.assertThat;

class RequestIdFilterTest {
    private final RequestIdFilter filter = new RequestIdFilter();

    @Test
    void validRequestIdIsReturnedStoredForTheRequestAndRemovedFromMdc() throws Exception {
        var request = new MockHttpServletRequest();
        var response = new MockHttpServletResponse();
        request.addHeader(RequestIdFilter.HEADER, "req-w19-1");
        var seenInside = new AtomicReference<String>();

        filter.doFilter(request, response, (req, res) ->
            seenInside.set(MDC.get("requestId")));

        assertThat(response.getHeader(RequestIdFilter.HEADER)).isEqualTo("req-w19-1");
        assertThat(request.getAttribute(RequestIdFilter.ATTRIBUTE)).isEqualTo("req-w19-1");
        assertThat(seenInside).hasValue("req-w19-1");
        assertThat(MDC.get("requestId")).isNull();
    }

    @Test
    void unsafeRequestIdIsReplacedInsteadOfReflected() throws Exception {
        var request = new MockHttpServletRequest();
        var response = new MockHttpServletResponse();
        request.addHeader(RequestIdFilter.HEADER, "bad request id with spaces and newline\n");
        filter.doFilter(request, response, (req, res) -> {});
        assertThat(response.getHeader(RequestIdFilter.HEADER))
            .matches("[0-9a-f-]{36}")
            .doesNotContain("bad request");
    }
}

package com.example.financialcore.audit;

import com.example.financialcore.PostgresIntegrationTestSupport;
import com.example.financialcore.account.Account;
import com.example.financialcore.account.AccountOpeningService;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.jdbc.core.simple.JdbcClient;
import org.springframework.test.context.ActiveProfiles;
import org.springframework.test.web.servlet.MockMvc;

import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.httpBasic;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;

@SpringBootTest
@AutoConfigureMockMvc
@ActiveProfiles("test")
class AuditPropagationIT extends PostgresIntegrationTestSupport {

    @Autowired MockMvc mvc;
    @Autowired JdbcClient jdbc;
    @Autowired AccountOpeningService openings;
    @Autowired AuditEventRepository audit;

    @BeforeEach
    void clean() {
        jdbc.sql("TRUNCATE audit_event,idempotency_request,ledger_entry,business_tx,account RESTART IDENTITY CASCADE")
            .update();
    }

    @Test
    void deniedActionSurvivesTheRejectedRequestAndCarriesTheSameRequestId() throws Exception {
        Account account = openings.open("customer-1", "AUDIT-OWNER", 5_000);
        mvc.perform(get("/api/accounts/{id}", account.getId())
                .with(httpBasic("customer-2", "password"))
                .header("X-Request-Id", "audit-denied-1"))
            .andExpect(status().isForbidden());

        var events = audit.findByRequestIdOrderById("audit-denied-1");
        assertThat(events).hasSize(1);
        assertThat(events.getFirst().getActorId()).isEqualTo("customer-2");
        assertThat(events.getFirst().getResult()).isEqualTo("DENIED");
        assertThat(events.getFirst().getErrorCode()).isEqualTo("ACCESS_DENIED");
        assertThat(events.getFirst().getMaskedResourceId())
            .startsWith("ACCOUNT:")
            .isNotEqualTo("ACCOUNT:" + account.getId());
    }
}

package com.example.financialcore.security;

import org.junit.jupiter.api.Test;

import static org.assertj.core.api.Assertions.assertThat;

class MaskingTest {
    private final SensitiveDataMasker masker = new SensitiveDataMasker();

    @Test
    void accountNumberKeepsAtMostTheLastFourCharacters() {
        assertThat(masker.accountNumber("123-456-7890"))
            .isEqualTo("******7890")
            .doesNotContain("123456");
    }

    @Test
    void blankAndShortValuesStillHaveAVisibleMaskBoundary() {
        assertThat(masker.accountNumber(null)).isEqualTo("***");
        assertThat(masker.accountNumber("12")).isEqualTo("****12");
        assertThat(masker.resourceId("ACCOUNT", "123456"))
            .isEqualTo("ACCOUNT:****3456");
    }
}

package com.example.financialcore.api;

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.slf4j.MDC;
import org.springframework.stereotype.Component;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;
import java.util.UUID;
import java.util.regex.Pattern;

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public final class RequestIdFilter extends OncePerRequestFilter {
    public static final String HEADER = "X-Request-Id";
    public static final String ATTRIBUTE = RequestIdFilter.class.getName() + ".requestId";
    private static final Pattern SAFE = Pattern.compile("[A-Za-z0-9._:-]{1,64}");

    @Override
    protected void doFilterInternal(
        HttpServletRequest request,
        HttpServletResponse response,
        FilterChain chain
    ) throws ServletException, IOException {
        String supplied = request.getHeader(HEADER);
        String requestId = supplied != null && SAFE.matcher(supplied).matches()
            ? supplied
            : UUID.randomUUID().toString();
        request.setAttribute(ATTRIBUTE, requestId);
        response.setHeader(HEADER, requestId);
        MDC.put("requestId", requestId);
        try {
            chain.doFilter(request, response);
        } finally {
            MDC.remove("requestId");
        }
    }

    public static String current(HttpServletRequest request) {
        Object value = request.getAttribute(ATTRIBUTE);
        return value == null ? "unavailable" : value.toString();
    }
}

package com.example.financialcore.security;

import org.springframework.stereotype.Component;

@Component
public final class SensitiveDataMasker {

    public String accountNumber(String raw) {
        if (raw == null || raw.isBlank()) return "***";
        String normalized = raw.replaceAll("[^A-Za-z0-9]", "");
        int visible = Math.min(4, normalized.length());
        return "*".repeat(Math.max(4, normalized.length() - visible))
            + normalized.substring(normalized.length() - visible);
    }

    public String resourceId(String type, String raw) {
        return type + ":" + accountNumber(raw);
    }
}