Merge pull request #170 from Team-StackUp/fix/revoke-shares-on-account-deletion

fix(backend): 회원 탈퇴 후 공유 피드백 링크가 계속 열려 있던 문제

Author: i3months

backend/src/main/java/com/stackup/stackup/session/application/UserDeletionShareRevokeListener.java

@@ -0,0 +1,42 @@
+package com.stackup.stackup.session.application;
+
+import com.stackup.stackup.session.domain.SessionFeedback;
+import com.stackup.stackup.session.domain.SessionFeedbackRepository;
+import com.stackup.stackup.user.application.event.UserDeletedEvent;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.context.event.EventListener;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Transactional;
+
+/**
+ * user 도메인 UserDeletedEvent 수신 → 해당 사용자의 모든 피드백 공유를 해제한다.
+ *
+ * 회원 탈퇴는 User row 만 soft delete 한다(세션·피드백은 남는다 — 데이터 보존 정책은
+ * 별도 결정 사항). 문제는 공유 링크 조회(PublicFeedbackController.getByToken)가
+ * feedback.deleted / session.deleted 만 보고 User.deleted 는 보지 않는다는 것 —
+ * 탈퇴해도 이미 발급된 공유 링크는 계속 살아 있었다. "탈퇴했는데 공유했던 면접
+ * 피드백을 아무나 볼 수 있다"는 최소한 막아야 하는 결함이라, 탈퇴 시점에 명시적으로
+ * 끊는다(UserDeletionRevokeListener 의 refresh token revoke 와 같은 패턴).
+ */
+@Component
+@RequiredArgsConstructor
+public class UserDeletionShareRevokeListener {
+
+    private static final Logger log = LoggerFactory.getLogger(UserDeletionShareRevokeListener.class);
+
+    private final SessionFeedbackRepository feedbackRepository;
+
+    @EventListener
+    @Transactional
+    public void on(UserDeletedEvent event) {
+        List<SessionFeedback> shared = feedbackRepository.findSharedByOwner(event.userId());
+        shared.forEach(SessionFeedback::disableShare);
+        if (!shared.isEmpty()) {
+            log.info("feedback shares revoked on user delete. userId={}, count={}",
+                event.userId(), shared.size());
+        }
+    }
+}

backend/src/main/java/com/stackup/stackup/session/domain/SessionFeedbackRepository.java

@@ -13,6 +13,9 @@ public interface SessionFeedbackRepository extends JpaRepository<SessionFeedback
 
     Optional<SessionFeedback> findByShareToken(String shareToken);
 
+    @Query("SELECT f FROM SessionFeedback f WHERE f.session.user.id = :userId AND f.shareToken IS NOT NULL")
+    List<SessionFeedback> findSharedByOwner(@Param("userId") Long userId);
+
     boolean existsBySession_Id(Long sessionId);
 
     @Query("""

backend/src/test/java/com/stackup/stackup/session/application/UserDeletionShareRevokeListenerTest.java

@@ -0,0 +1,51 @@
+package com.stackup.stackup.session.application;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.when;
+
+import com.stackup.stackup.session.domain.InterviewSession;
+import com.stackup.stackup.session.domain.JobCategory;
+import com.stackup.stackup.session.domain.SessionFeedback;
+import com.stackup.stackup.session.domain.SessionFeedbackRepository;
+import com.stackup.stackup.session.domain.SessionMode;
+import com.stackup.stackup.user.application.event.UserDeletedEvent;
+import com.stackup.stackup.user.domain.User;
+import java.util.List;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.test.util.ReflectionTestUtils;
+
+@ExtendWith(MockitoExtension.class)
+class UserDeletionShareRevokeListenerTest {
+
+    @Mock private SessionFeedbackRepository feedbackRepository;
+
+    @InjectMocks private UserDeletionShareRevokeListener listener;
+
+    @Test
+    void userDeleted_disablesAllSharedFeedbackOfThatUser() {
+        SessionFeedback shared = feedbackFixture();
+        shared.enableShare("token-123");
+        when(feedbackRepository.findSharedByOwner(7L)).thenReturn(List.of(shared));
+
+        listener.on(new UserDeletedEvent(7L));
+
+        // 회원 탈퇴 후에도 PublicFeedbackController.getByToken 은 User.deleted 를 보지 않고
+        // feedback.shareToken 만 본다 — 여기서 끊지 않으면 탈퇴한 사용자의 피드백을
+        // 누구나 링크로 계속 볼 수 있다.
+        assertThat(shared.getShareToken()).isNull();
+    }
+
+    private SessionFeedback feedbackFixture() {
+        User user = User.createGithubUser(1L, "u", null, null, "t");
+        ReflectionTestUtils.setField(user, "id", 7L);
+        InterviewSession session = InterviewSession.create(user, "t", null, SessionMode.TECHNICAL,
+            JobCategory.BACKEND, 5, 30, null, null);
+        ReflectionTestUtils.setField(session, "id", 99L);
+        return SessionFeedback.of(session, 80.0, 80.0, 80.0, 80.0,
+            "강점", "약점", null, null, null, null, null);
+    }
+}