[FEAT] restaurant-service 배포환경 API 시나리오 테스트 추가 - #62
Merged
Merged
Conversation
10 tasks
github-actions
Bot
requested review from
Jinyoung-Kim96,
Sehi55,
githyj-jang,
ji-circle and
qldo
May 19, 2026 02:21
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 Walkthrough개요프로덕션 환경의 API Gateway를 통해 restaurant-service가 회원가입부터 체크인까지 완전히 동작하는지 검증하는 HTTP 기반 E2E 테스트 시나리오를 추가했다. 14단계의 순차 테스트로 인증, 식당 설정, 대기열 관리, 예약, 체크인 흐름을 커버한다. 변경 사항E2E 체크인 시나리오 테스트
예상 코드 리뷰 노력🎯 2 (Simple) | ⏱️ ~12분 관련 PR
검토 추천자
🐰 축하 시
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
src/test/mvp/prod-full-checkin-e2e.http (3)
491-491: ⚡ Quick winwaitingAccessToken 설정 여부 검증 권장
Line 491에서
X-Waiting-Token: {{waitingAccessToken}}을 사용하지만, STEP 10에서 대기열 상태가ACTIVE가 아니거나accessToken이 없으면 이 변수가 설정되지 않습니다.변수가 설정되지 않은 상태로 예약 생성을 시도하면 인증 오류가 발생할 수 있으므로, 응답 핸들러에서 변수 존재 여부를 검증하고 명확한 오류 메시지를 제공하는 것이 좋습니다.
♻️ 검증 로직 추가 제안
STEP 11의 응답 핸들러 시작 부분에 추가:
> {% const waitingAccessToken = client.global.get("waitingAccessToken"); if (!waitingAccessToken) { throw new Error("waitingAccessToken이 설정되지 않았습니다. STEP 10에서 status=ACTIVE 확인 후 재시도하세요."); } client.global.clear("reservationId"); // ... 나머지 로직 %}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/test/mvp/prod-full-checkin-e2e.http` at line 491, Add a presence check for the waitingAccessToken at the start of the STEP 11 response handler: retrieve it via client.global.get("waitingAccessToken"), and if falsy throw an explicit Error like "waitingAccessToken이 설정되지 않았습니다. STEP 10에서 status=ACTIVE 확인 후 재시도하세요." before proceeding to the existing logic (e.g., client.global.clear("reservationId") and the rest of the handler); this ensures the X-Waiting-Token header ({{waitingAccessToken}}) is validated and fails with a clear message when missing.
160-165: ⚡ Quick winJWT 디코딩 오류 처리 강화 권장
JWT payload 디코딩 시 토큰 형식이 올바르지 않으면 런타임 오류가 발생할 수 있습니다:
token.split(".")[1]이undefined일 경우 (토큰이 점으로 구분된 3개 파트가 아닐 때)atob()또는JSON.parse()가 실패할 경우권장사항:
- 토큰이 3개 파트로 구성되었는지 검증
- try-catch로 디코딩 오류를 처리하여 명확한 오류 메시지 제공
♻️ 개선 제안
let payloadBase64 = token.split(".")[1].replace(/-/g, "+").replace(/_/g, "/"); + +if (!payloadBase64) { + throw new Error("JWT 토큰 형식이 올바르지 않습니다."); +} + payloadBase64 += "=".repeat((4 - payloadBase64.length % 4) % 4); -const payload = JSON.parse(atob(payloadBase64)); +let payload; +try { + payload = JSON.parse(atob(payloadBase64)); +} catch (e) { + throw new Error("JWT payload 디코딩 실패: " + e.message); +}Also applies to: 212-217
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/test/mvp/prod-full-checkin-e2e.http` around lines 160 - 165, Validate the JWT format and add robust error handling around the decoding logic: check that token.split(".") yields exactly 3 parts before accessing index 1, then wrap the base64 normalization, atob decoding, and JSON.parse of payloadBase64 in a try-catch; on error, produce a clear error message (including the original token or reason) and avoid calling client.global.set("ownerId") when decoding fails. Target the block that builds payloadBase64, calls atob()/JSON.parse(), and client.global.set("ownerId") to implement these checks and the try-catch.
492-492: 💤 Low valueIdempotency-Key 고유성 개선 고려
Idempotency-Key가reservation-full-e2e-90212-{{$timestamp}}로 구성되어 있습니다. 고정된 접두사와 타임스탬프 조합은 동일한 밀리초 내에 여러 요청이 발생하거나 병렬 테스트 실행 시 충돌할 가능성이 있습니다.권장사항:
- UUID 또는 더 고유한 식별자 사용
- 또는 접두사에 사용자 식별 정보나 랜덤 값 추가
예:
reservation-full-e2e-{{userId}}-{{$timestamp}}-{{$randomInt}}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/test/mvp/prod-full-checkin-e2e.http` at line 492, The Idempotency-Key header uses a fixed prefix plus timestamp ("Idempotency-Key: reservation-full-e2e-90212-{{$timestamp}}") which can collide under parallel/millisecond requests; change the header generation to include a stronger unique component (for example use a UUID or add a random integer and/or userId) so each request is globally unique—update the Idempotency-Key line to something like "reservation-full-e2e-{{userId}}-{{$timestamp}}-{{$randomInt}}" or use a {{$uuid}} token source in the test harness so the header always contains a UUID.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/test/mvp/prod-full-checkin-e2e.http`:
- Around line 5-7: The SSH tunnel example in the commented block containing the
SSH command (ssh -N -i "...michelet-bastion-key.cer" -L 19000:10.0.11.237:19000
ubuntu@52.79.37.117) exposes sensitive infra details; replace the hardcoded
bastion IP, internal IP and local key path with clear placeholders (e.g.
<BASTION_IP>, <INTERNAL_IP>, <KEY_PATH>) and convert the comment into a generic
usage note pointing readers to environment-specific config or a separate secure
documentation/source of truth for real values.
- Around line 21-33: The test file contains hardcoded plaintext credentials
(`@ownerLoginId`, `@ownerPassword`, `@ownerName`, `@ownerEmail`, `@ownerPhone` and
`@userLoginId`, `@userPassword`, `@userName`, `@userEmail`, `@userPhone`); replace these
hardcoded values with references to environment variables or a separate ignored
config (e.g., use OWNER_LOGIN_ID, OWNER_PASSWORD, USER_LOGIN_ID, USER_PASSWORD,
etc.) and update any code/tests that read those tokens to fall back to safe
defaults only in local/dev. Also add a clear comment/marker that these are
test-only accounts and ensure the new config file is .gitignore'd or
secret-managed so no real credentials are committed.
- Line 10: The header comment string "### STEP 0 → STEP 1 → ... → STEP 12" is
inaccurate—update that comment in src/test/mvp/prod-full-checkin-e2e.http to
reflect the actual step range (STEP 0 → STEP 1 → ... → STEP 14) or change to a
generic descriptor like "STEP 0 → ... → STEP 14" so the documented range matches
the 15 steps present; locate and edit the exact comment line containing that
arrow sequence to correct the documentation.
---
Nitpick comments:
In `@src/test/mvp/prod-full-checkin-e2e.http`:
- Line 491: Add a presence check for the waitingAccessToken at the start of the
STEP 11 response handler: retrieve it via
client.global.get("waitingAccessToken"), and if falsy throw an explicit Error
like "waitingAccessToken이 설정되지 않았습니다. STEP 10에서 status=ACTIVE 확인 후 재시도하세요."
before proceeding to the existing logic (e.g.,
client.global.clear("reservationId") and the rest of the handler); this ensures
the X-Waiting-Token header ({{waitingAccessToken}}) is validated and fails with
a clear message when missing.
- Around line 160-165: Validate the JWT format and add robust error handling
around the decoding logic: check that token.split(".") yields exactly 3 parts
before accessing index 1, then wrap the base64 normalization, atob decoding, and
JSON.parse of payloadBase64 in a try-catch; on error, produce a clear error
message (including the original token or reason) and avoid calling
client.global.set("ownerId") when decoding fails. Target the block that builds
payloadBase64, calls atob()/JSON.parse(), and client.global.set("ownerId") to
implement these checks and the try-catch.
- Line 492: The Idempotency-Key header uses a fixed prefix plus timestamp
("Idempotency-Key: reservation-full-e2e-90212-{{$timestamp}}") which can collide
under parallel/millisecond requests; change the header generation to include a
stronger unique component (for example use a UUID or add a random integer and/or
userId) so each request is globally unique—update the Idempotency-Key line to
something like "reservation-full-e2e-{{userId}}-{{$timestamp}}-{{$randomInt}}"
or use a {{$uuid}} token source in the test harness so the header always
contains a UUID.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 20802c64-1472-49c7-a3b8-609a74e02925
📒 Files selected for processing (1)
src/test/mvp/prod-full-checkin-e2e.http
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 작업 내용
restaurant-service 배포환경 API 시나리오 테스트용 HTTP Client 파일을 추가
API Gateway를 통해 restaurant-service 주요 API와 체크인 E2E 흐름을 검증할 수 있도록 구성
🚀 주요 변경 사항
✅ 자체 체크리스트 (필수)
./gradlew build실행 결과 정상 (인증샷 첨부)📸 테스트 인증샷
💬 리뷰어 전달사항 (선택)
📎 참고 자료
Summary by CodeRabbit