Merge pull request #372 from EAT-SSU/fix/#371-mask-sensitive-data-in-logs

fix: 인증 응답 로그 마스킹 처리

Author: pooreumjung

src/main/java/ssu/eatssu/domain/admin/dto/LoginRequest.java

@@ -1,4 +1,7 @@
 package ssu.eatssu.domain.admin.dto;
 
-public record LoginRequest(String loginId, String password) {
+import ssu.eatssu.global.log.annotation.LogMask;
+
+public record LoginRequest(String loginId,
+                           @LogMask String password) {
 }

src/main/java/ssu/eatssu/global/log/ControllerLogAspect.java

@@ -31,6 +31,8 @@
 @RequiredArgsConstructor
 public class ControllerLogAspect {
 
+    private static final String RESPONSE_BODY_SKIPPED = "[response-body-skipped]";
+
     private final ObjectMapper objectMapper;
     private final SlackErrorNotifier slackErrorNotifier;
 
@@ -87,15 +89,7 @@ public Object logApi(ProceedingJoinPoint joinPoint) throws Throwable {
             Object result = joinPoint.proceed();
             long time = System.currentTimeMillis() - start;
 
-            String resultJson;
-            try {
-                resultJson = objectMapper.writeValueAsString(result);
-                if (resultJson.length() > 600) {
-                    resultJson = resultJson.substring(0, 600) + "...(truncated)";
-                }
-            } catch (Exception e) {
-                resultJson = String.valueOf(result);
-            }
+            String resultJson = getResponseLog(uri, result);
 
             log.info("RESPONSE {} {} ({} ms) result={}", method, uri, time, resultJson);
             return result;
@@ -110,6 +104,26 @@ public Object logApi(ProceedingJoinPoint joinPoint) throws Throwable {
         }
     }
 
+    String getResponseLog(String uri, Object result) {
+        if (isAuthApi(uri)) {
+            return RESPONSE_BODY_SKIPPED;
+        }
+
+        try {
+            String resultJson = objectMapper.writeValueAsString(result);
+            if (resultJson.length() > 600) {
+                return resultJson.substring(0, 600) + "...(truncated)";
+            }
+            return resultJson;
+        } catch (Exception e) {
+            return String.valueOf(result);
+        }
+    }
+
+    private boolean isAuthApi(String uri) {
+        return uri != null && uri.startsWith("/oauths/");
+    }
+
     private String getCauseMessage(Throwable e) {
         if (e instanceof BaseException baseException) {
             return baseException.getStatus().getMessage();
@@ -138,7 +152,7 @@ private String getDeviceTypeFromSecurityContext() {
         return "unknown";
     }
 
-    private Map<String, Object> toSafeMap(Object arg) {
+    Map<String, Object> toSafeMap(Object arg) {
         Map<String, Object> result = new HashMap<>();
         for (Field field : arg.getClass().getDeclaredFields()) {
             field.setAccessible(true);

src/test/java/ssu/eatssu/global/log/ControllerLogAspectTest.java

@@ -0,0 +1,55 @@
+package ssu.eatssu.global.log;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+import ssu.eatssu.domain.admin.dto.LoginRequest;
+import ssu.eatssu.domain.user.dto.Tokens;
+import ssu.eatssu.global.handler.response.BaseResponse;
+
+import java.util.Map;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class ControllerLogAspectTest {
+
+    private final ControllerLogAspect controllerLogAspect = new ControllerLogAspect(new ObjectMapper(), null);
+
+    @Test
+    void shouldSkipResponseBodyForOauthApi() throws Exception {
+        // given
+        BaseResponse<Tokens> response = BaseResponse.success(new Tokens("access-token", "refresh-token"));
+
+        // when
+        String result = controllerLogAspect.getResponseLog("/oauths/kakao", response);
+
+        // then
+        assertThat(result).isEqualTo("[response-body-skipped]");
+        assertThat(result).doesNotContain("access-token", "refresh-token");
+    }
+
+    @Test
+    void shouldLogResponseBodyForNonOauthApi() throws Exception {
+        // given
+        BaseResponse<String> response = BaseResponse.success("ok");
+
+        // when
+        String result = controllerLogAspect.getResponseLog("/meals", response);
+
+        // then
+        assertThat(result).contains("ok");
+    }
+
+    @Test
+    void shouldMaskAnnotatedRequestFields() throws Exception {
+        // given
+        LoginRequest request = new LoginRequest("admin", "password");
+
+        // when
+        Map<String, Object> result = controllerLogAspect.toSafeMap(request);
+
+        // then
+        assertThat(result).containsEntry("loginId", "admin");
+        assertThat(result).containsEntry("password", "***");
+    }
+
+}