Merge pull request #214 from Runnect/tests/record-service-unit-tests

test: RecordService 단위 테스트 추가 + updateRecord IDOR 수정

Author: unam98

src/main/java/org/runnect/server/common/constant/ErrorStatus.java

@@ -55,6 +55,7 @@ public enum ErrorStatus {
      */
     PERMISSION_DENIED_PUBLIC_COURSE_DELETE_EXCEPTION(HttpStatus.FORBIDDEN, "퍼블릭 코스를 삭제할 권한이 존재하지 않습니다."),
     PERMISSION_DENIED_RECORD_DELETE_EXCEPTION(HttpStatus.FORBIDDEN, "기록을 삭제할 권한이 존재하지 않습니다."),
+    PERMISSION_DENIED_RECORD_UPDATE_EXCEPTION(HttpStatus.FORBIDDEN, "기록을 수정할 권한이 존재하지 않습니다."),
     PERMISSION_DENIED_HEALTH_DATA_EXCEPTION(HttpStatus.FORBIDDEN, "건강 데이터에 대한 접근 권한이 없습니다"),
 
     /**

src/main/java/org/runnect/server/record/service/RecordService.java

@@ -138,6 +138,11 @@ public UpdateRecordResponseDto updateRecord(Long userId, Long recordId, UpdateRe
         Record record = recordRepository.findById(recordId)
                 .orElseThrow(()->new NotFoundException(ErrorStatus.NOT_FOUND_RECORD_EXCEPTION, ErrorStatus.NOT_FOUND_RECORD_EXCEPTION.getMessage()));
 
+        if (!record.getRunnectUser().getId().equals(userId)) {
+            throw new PermissionDeniedException(ErrorStatus.PERMISSION_DENIED_RECORD_UPDATE_EXCEPTION,
+                ErrorStatus.PERMISSION_DENIED_RECORD_UPDATE_EXCEPTION.getMessage());
+        }
+
         record.updateRecord(request.getTitle());
 
         return UpdateRecordResponseDto.of(UpdateRecordResponse.of(record.getId(), request.getTitle()));