Main

src/main/java/inha/gdgoc/domain/auth/controller/AuthController.java

@@ -1,15 +1,5 @@
 package inha.gdgoc.domain.auth.controller;
 
-import static inha.gdgoc.domain.auth.controller.message.AuthMessage.ACCESS_TOKEN_REFRESH_SUCCESS;
-import static inha.gdgoc.domain.auth.controller.message.AuthMessage.CODE_CREATION_SUCCESS;
-import static inha.gdgoc.domain.auth.controller.message.AuthMessage.LOGIN_WITH_PASSWORD_SUCCESS;
-import static inha.gdgoc.domain.auth.controller.message.AuthMessage.LOGOUT_SUCCESS;
-import static inha.gdgoc.domain.auth.controller.message.AuthMessage.OAUTH_LOGIN_SIGNUP_SUCCESS;
-import static inha.gdgoc.domain.auth.controller.message.AuthMessage.PASSWORD_CHANGE_SUCCESS;
-import static inha.gdgoc.domain.auth.controller.message.AuthMessage.PASSWORD_RESET_VERIFICATION_SUCCESS;
-import static inha.gdgoc.domain.auth.exception.AuthErrorCode.UNAUTHORIZED_USER;
-import static inha.gdgoc.domain.auth.exception.AuthErrorCode.USER_NOT_FOUND;
-
 import inha.gdgoc.domain.auth.dto.request.CodeVerificationRequest;
 import inha.gdgoc.domain.auth.dto.request.PasswordResetRequest;
 import inha.gdgoc.domain.auth.dto.request.SendingCodeRequest;
@@ -24,29 +14,32 @@
 import inha.gdgoc.domain.auth.service.MailService;
 import inha.gdgoc.domain.auth.service.RefreshTokenService;
 import inha.gdgoc.domain.user.entity.User;
+import inha.gdgoc.domain.user.enums.TeamType;
+import inha.gdgoc.domain.user.enums.UserRole;
 import inha.gdgoc.domain.user.repository.UserRepository;
 import inha.gdgoc.global.config.jwt.TokenProvider;
 import inha.gdgoc.global.dto.response.ApiResponse;
+import inha.gdgoc.global.exception.GlobalErrorCode;
 import jakarta.servlet.http.HttpServletResponse;
-import java.security.InvalidKeyException;
-import java.security.NoSuchAlgorithmException;
-import java.util.Map;
-import java.util.Optional;
-
 import jakarta.validation.Valid;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.Authentication;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.web.bind.annotation.CookieValue;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.bind.annotation.*;
+
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.util.Map;
+import java.util.Optional;
+
+import static inha.gdgoc.domain.auth.controller.message.AuthMessage.*;
+import static inha.gdgoc.domain.auth.exception.AuthErrorCode.UNAUTHORIZED_USER;
+import static inha.gdgoc.domain.auth.exception.AuthErrorCode.USER_NOT_FOUND;
 
 @Slf4j
 @RequestMapping("/api/v1/auth")
@@ -61,19 +54,14 @@ public class AuthController {
     private final AuthCodeService authCodeService;
 
     @GetMapping("/oauth2/google/callback")
-    public ResponseEntity<ApiResponse<Map<String, Object>, Void>> handleGoogleCallback(
-            @RequestParam String code,
-            HttpServletResponse response
-    ) {
+    public ResponseEntity<ApiResponse<Map<String, Object>, Void>> handleGoogleCallback(@RequestParam String code, HttpServletResponse response) {
         Map<String, Object> data = authService.processOAuthLogin(code, response);
 
         return ResponseEntity.ok(ApiResponse.ok(OAUTH_LOGIN_SIGNUP_SUCCESS, data));
     }
 
     @PostMapping("/refresh")
-    public ResponseEntity<?> refreshAccessToken(
-            @CookieValue(value = "refresh_token", required = false) String refreshToken
-    ) {
+    public ResponseEntity<?> refreshAccessToken(@CookieValue(value = "refresh_token", required = false) String refreshToken) {
         log.info("리프레시 토큰 요청 받음. 토큰 존재 여부: {}", refreshToken != null);
 
         if (refreshToken == null) {
@@ -84,19 +72,15 @@ public ResponseEntity<?> refreshAccessToken(
             String newAccessToken = refreshTokenService.refreshAccessToken(refreshToken);
             AccessTokenResponse accessTokenResponse = new AccessTokenResponse(newAccessToken);
 
-            return ResponseEntity.ok(
-                    ApiResponse.ok(ACCESS_TOKEN_REFRESH_SUCCESS, accessTokenResponse, null));
+            return ResponseEntity.ok(ApiResponse.ok(ACCESS_TOKEN_REFRESH_SUCCESS, accessTokenResponse, null));
         } catch (Exception e) {
             log.error("리프레시 토큰 처리 중 오류: {}", e.getMessage(), e);
             throw new AuthException(AuthErrorCode.INVALID_REFRESH_TOKEN);
         }
     }
 
     @PostMapping("/login")
-    public ResponseEntity<ApiResponse<LoginResponse, Void>> login(
-            @Valid @RequestBody UserLoginRequest req,
-            HttpServletResponse response
-    ) throws NoSuchAlgorithmException, InvalidKeyException {
+    public ResponseEntity<ApiResponse<LoginResponse, Void>> login(@Valid @RequestBody UserLoginRequest req, HttpServletResponse response) throws NoSuchAlgorithmException, InvalidKeyException {
         String email = req.email().trim();
         LoginResponse loginResponse = authService.loginWithPassword(email, req.password(), response);
         return ResponseEntity.ok(ApiResponse.ok(LOGIN_WITH_PASSWORD_SUCCESS, loginResponse));
@@ -109,9 +93,7 @@ public ResponseEntity<ApiResponse<Void, Void>> logout() {
         Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
 
         // 1) 익명 방어
-        if (authentication == null
-            || !authentication.isAuthenticated()
-            || "anonymousUser".equals(authentication.getName())) {
+        if (authentication == null || !authentication.isAuthenticated() || "anonymousUser".equals(authentication.getName())) {
             throw new AuthException(UNAUTHORIZED_USER);
         }
 
@@ -142,12 +124,9 @@ public ResponseEntity<ApiResponse<Void, Void>> logout() {
     }
 
     @PostMapping("/password-reset/request")
-    public ResponseEntity<ApiResponse<Void, Void>> responseResponseEntity(
-            @RequestBody SendingCodeRequest sendingCodeRequest
-    ) {
+    public ResponseEntity<ApiResponse<Void, Void>> responseResponseEntity(@RequestBody SendingCodeRequest sendingCodeRequest) {
         // TODO 서비스로 넘기기
-        if (userRepository.existsByNameAndEmail(sendingCodeRequest.name(),
-                sendingCodeRequest.email())) {
+        if (userRepository.existsByNameAndEmail(sendingCodeRequest.name(), sendingCodeRequest.email())) {
             String code = mailService.sendAuthCode(sendingCodeRequest.email());
             authCodeService.saveAuthCode(sendingCodeRequest.email(), code);
 
@@ -157,9 +136,7 @@ public ResponseEntity<ApiResponse<Void, Void>> responseResponseEntity(
     }
 
     @PostMapping("/password-reset/verify")
-    public ResponseEntity<ApiResponse<CodeVerificationResponse, Void>> verifyCode(
-            @RequestBody CodeVerificationRequest request
-    ) {
+    public ResponseEntity<ApiResponse<CodeVerificationResponse, Void>> verifyCode(@RequestBody CodeVerificationRequest request) {
         // TODO 서비스 단 DTO 추가
         boolean verified = authCodeService.verify(request.email(), request.code());
         CodeVerificationResponse response = new CodeVerificationResponse(verified);
@@ -168,9 +145,7 @@ public ResponseEntity<ApiResponse<CodeVerificationResponse, Void>> verifyCode(
     }
 
     @PostMapping("/password-reset/confirm")
-    public ResponseEntity<ApiResponse<Void, Void>> resetPassword(
-            @RequestBody PasswordResetRequest passwordResetRequest
-    ) throws NoSuchAlgorithmException, InvalidKeyException {
+    public ResponseEntity<ApiResponse<Void, Void>> resetPassword(@RequestBody PasswordResetRequest passwordResetRequest) throws NoSuchAlgorithmException, InvalidKeyException {
         // TODO 서비스 단으로
         Optional<User> user = userRepository.findByEmail(passwordResetRequest.email());
         if (user.isEmpty()) {
@@ -183,4 +158,42 @@ public ResponseEntity<ApiResponse<Void, Void>> resetPassword(
 
         return ResponseEntity.ok(ApiResponse.ok(PASSWORD_CHANGE_SUCCESS));
     }
+
+    /**
+     * 요구 권한(role) 이상이면 200, 아니면 403
+     * 미인증이면 401
+
+     * 예) /api/v1/auth/LEAD, /api/v1/auth/ORGANIZER, /api/v1/auth/ADMIN
+     */
+    @GetMapping("/{role}")
+    public ResponseEntity<ApiResponse<Void, ?>> checkRoleOrTeam(@AuthenticationPrincipal TokenProvider.CustomUserDetails me, @PathVariable UserRole role, @RequestParam(value = "team", required = false) TeamType requiredTeam) {
+        // 1) 인증 체크
+        if (me == null) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                    .body(ApiResponse.error(GlobalErrorCode.UNAUTHORIZED_USER.getStatus()
+                            .value(), GlobalErrorCode.UNAUTHORIZED_USER.getMessage(), null));
+        }
+
+        // 2) role check
+        final boolean roleOk = UserRole.hasAtLeast(me.getRole(), role);
+
+        // 3) team check if team parameter exists
+        boolean teamOk = false;
+        if (requiredTeam != null) {
+            if (UserRole.hasAtLeast(me.getRole(), UserRole.ORGANIZER)) {
+                teamOk = true;
+            } else {
+                teamOk = (me.getTeam() != null && me.getTeam() == requiredTeam);
+            }
+        }
+
+        // 4) OR 조건으로 최종 판정
+        if (roleOk || teamOk) {
+            return ResponseEntity.ok(ApiResponse.ok("ROLE_OR_TEAM_CHECK_PASSED", null));
+        }
+
+        return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                .body(ApiResponse.error(GlobalErrorCode.FORBIDDEN_USER.getStatus()
+                        .value(), GlobalErrorCode.FORBIDDEN_USER.getMessage(), null));
+    }
 }

src/main/java/inha/gdgoc/domain/core/attendance/controller/CoreAttendanceController.java

@@ -51,12 +51,14 @@ public ResponseEntity<ApiResponse<DateListResponse, Void>> listDates() {
         return ResponseEntity.ok(ApiResponse.ok(CoreAttendanceMessage.DATE_LIST_RETRIEVED_SUCCESS, new DateListResponse(service.getDates())));
     }
 
+    @PreAuthorize("hasAnyRole('ORGANIZER', 'ADMIN')")
     @PostMapping
     public ResponseEntity<ApiResponse<DateListResponse, Void>> createDate(@Valid @RequestBody CreateDateRequest request) {
         service.addDate(request.getDate());
         return ResponseEntity.ok(ApiResponse.ok(CoreAttendanceMessage.DATE_CREATED_SUCCESS, new DateListResponse(service.getDates())));
     }
 
+    @PreAuthorize("hasAnyRole('ORGANIZER', 'ADMIN')")
     @DeleteMapping("/{date}")
     public ResponseEntity<ApiResponse<DateListResponse, Void>> deleteDate(@PathVariable @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate date) {
         service.deleteDate(date.toString());
@@ -66,7 +68,7 @@ public ResponseEntity<ApiResponse<DateListResponse, Void>> deleteDate(@PathVaria
     /* ===== 팀 목록 (리드=본인 팀만 / 관리자=전체) ===== */
     @GetMapping("/teams")
     public ResponseEntity<ApiResponse<List<TeamResponse>, PageMeta>> getTeams(@AuthenticationPrincipal CustomUserDetails me) {
-        List<TeamResponse> list = (me.getRole() == UserRole.LEAD) ? service.getTeamsForLead(requiredTeamFrom(me)) : service.getTeamsForOrganizerOrAdmin();
+        List<TeamResponse> list = (me.getRole() == UserRole.LEAD && me.getTeam() != TeamType.HR) ? service.getTeamsForLead(requiredTeamFrom(me)) : service.getTeamsForOrganizerOrAdmin();
 
         var page = new PageImpl<>(list, PageRequest.of(0, Math.max(1, list.size()), Sort.by(Sort.Direction.DESC, "createdAt")), list.size());
         return ResponseEntity.ok(ApiResponse.ok(CoreAttendanceMessage.TEAM_LIST_RETRIEVED_SUCCESS, list, PageMeta.of(page)));
@@ -77,7 +79,7 @@ public ResponseEntity<ApiResponse<List<TeamResponse>, PageMeta>> getTeams(@Authe
     @GetMapping("/{date}/members")
     public ResponseEntity<ApiResponse<List<Map<String, Object>>, Void>> membersOfMeeting(@AuthenticationPrincipal CustomUserDetails me, @PathVariable @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate date, @RequestParam(required = false) TeamType team // 관리자만 사용, 리드는 무시
     ) {
-        TeamType effectiveTeam = (me.getRole() == UserRole.LEAD) ? requiredTeamFrom(me) : team;
+        TeamType effectiveTeam = (me.getRole() == UserRole.LEAD && me.getTeam() != TeamType.HR) ? requiredTeamFrom(me) : team;
         var list = service.getMembersWithPresence(date.toString(), effectiveTeam);
         // list 원소 예시: { "userId": "123", "name": "홍길동", "present": true, "lastModifiedAt": "..." }
         return ResponseEntity.ok(ApiResponse.ok(CoreAttendanceMessage.TEAM_LIST_RETRIEVED_SUCCESS, list));
@@ -86,11 +88,11 @@ public ResponseEntity<ApiResponse<List<Map<String, Object>>, Void>> membersOfMee
     /* ===== 특정 날짜 출석 일괄 저장 (멱등 스냅샷) ===== */
     // Body: { "userIds": ["1","2",...], "present": true }  → presentUserIds만 보내는 구조로도 쉽게 변환 가능
     @PutMapping("/{date}/attendance")
-    public ResponseEntity<ApiResponse<Map<String, Object>, Void>> saveAttendanceSnapshot(@AuthenticationPrincipal CustomUserDetails me, @PathVariable @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate date, @RequestParam(required = false) TeamType team,   // 관리자만 사용, 리드는 무시
-                                                                                         @RequestBody @Valid SetAttendanceRequest req) {
+    public ResponseEntity<ApiResponse<Map<String, Object>, Void>> saveAttendanceSnapshot(@AuthenticationPrincipal CustomUserDetails me, @PathVariable @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate date, @RequestBody @Valid SetAttendanceRequest req) {
         var userIds = req.safeUserIds();
 
-        if (me.getRole() == UserRole.LEAD) {
+        // LEAD → 본인 팀 검증
+        if (me.getRole() == UserRole.LEAD && me.getTeam() != TeamType.HR) {
             TeamType myTeam = requiredTeamFrom(me);
             var validation = service.filterUserIdsNotInTeam(myTeam, userIds);
             if (validation.validIds().isEmpty()) {
@@ -100,32 +102,42 @@ public ResponseEntity<ApiResponse<Map<String, Object>, Void>> saveAttendanceSnap
             return okUpdated(updated, validation.invalidIds());
         }
 
-        // ORGANIZER / ADMIN
-        TeamType effectiveTeam = (team != null) ? team : service.inferTeamFromUserIds(userIds)
-                .orElseThrow(() -> new IllegalArgumentException("userIds로 팀을 추론할 수 없습니다."));
-
-        var validation = service.filterUserIdsNotInTeam(effectiveTeam, userIds);
-        if (validation.validIds().isEmpty()) {
-            return okUpdated(0L, validation.invalidIds());
-        }
-        long updated = service.setAttendance(date.toString(), validation.validIds(), req.presentValue());
-        return okUpdated(updated, validation.invalidIds());
+        // ORGANIZER / ADMIN → 팀 추론/검증 없이 바로 업서트
+        long updated = service.setAttendance(date.toString(), userIds, req.presentValue());
+        return okUpdated(updated, List.of());
     }
 
     /* ===== 날짜 요약(JSON) ===== */
     @GetMapping("/{date}/summary")
     public ResponseEntity<ApiResponse<DaySummaryResponse, Void>> summary(@AuthenticationPrincipal CustomUserDetails me, @PathVariable @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate date, @RequestParam(required = false) TeamType team) {
-        DaySummaryResponse body = (me.getRole() == UserRole.LEAD) ? service.summary(date.toString(), requiredTeamFrom(me)) : service.summary(date.toString(), team);
+        DaySummaryResponse body = (me.getRole() == UserRole.LEAD && me.getTeam() != TeamType.HR) ? service.summary(date.toString(), requiredTeamFrom(me)) : service.summary(date.toString(), team);
         return ResponseEntity.ok(ApiResponse.ok(CoreAttendanceMessage.SUMMARY_RETRIEVED_SUCCESS, body));
     }
 
     /* ===== 날짜 요약(CSV) ===== */
     @GetMapping(value = "/{date}/summary.csv", produces = "text/csv; charset=UTF-8")
     public ResponseEntity<String> summaryCsv(@AuthenticationPrincipal CustomUserDetails me, @PathVariable @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate date, @RequestParam(required = false) TeamType team) {
-        TeamType effective = (me.getRole() == UserRole.LEAD) ? requiredTeamFrom(me) : team;
-        String csv = service.buildSummaryCsv(date.toString(), effective); // 서비스에 구현
+        TeamType effective = (me.getRole() == UserRole.LEAD && me.getTeam() != TeamType.HR) ? requiredTeamFrom(me) : team;
+        String csv = service.buildSummaryCsv(date.toString(), effective);
         return ResponseEntity.ok()
                 .header("Content-Disposition", "attachment; filename=\"attendance-" + date + ".csv\"")
                 .body(csv);
     }
+
+    @GetMapping(value = "/summary.csv", produces = "text/csv; charset=UTF-8")
+    public ResponseEntity<String> summaryCsvAll(
+            @AuthenticationPrincipal CustomUserDetails me,
+            @RequestParam(required = false) TeamType team
+    ) {
+        // LEAD & not HR → 자신의 팀만
+        TeamType effective = (me.getRole() == UserRole.LEAD && me.getTeam() != TeamType.HR)
+                ? requiredTeamFrom(me)
+                : team;
+
+        String csv = service.buildFullMatrixCsv(effective);
+        return ResponseEntity.ok()
+                .header("Content-Disposition", "attachment; filename=\"attendance-summary.csv\"")
+                .body(csv);
+    }
+
 }

src/main/java/inha/gdgoc/domain/core/attendance/repository/AttendanceRecordRepository.java

@@ -26,11 +26,12 @@ public interface AttendanceRecordRepository extends JpaRepository<AttendanceReco
     /* 배치 업서트(ON CONFLICT) — meeting_id 기준 */
     @Modifying
     @Query(value = """
-                INSERT INTO public.attendance_records (meeting_id, user_id, present, updated_at)
-                SELECT :meetingId, u, :present, NOW()
-                FROM unnest(:userIds) AS u
-                ON CONFLICT (meeting_id, user_id)
-                DO UPDATE SET present = EXCLUDED.present, updated_at = NOW()
+            INSERT INTO public.attendance_records (meeting_id, user_id, present, updated_at)
+            SELECT :meetingId, uid, :present, NOW()
+            FROM unnest(CAST(:userIds AS bigint[])) AS uid
+            ON CONFLICT (meeting_id, user_id)
+            DO UPDATE SET present = EXCLUDED.present, updated_at = NOW()
             """, nativeQuery = true)
-    int upsertBatchByMeetingId(@Param("meetingId") Long meetingId, @Param("userIds") List<Long> userIds, @Param("present") boolean present);
+    int upsertBatchByMeetingId(@Param("meetingId") Long meetingId, @Param("userIds") Long[] userIds,  // 👈 배열
+                               @Param("present") boolean present);
 }