[PR] 결제 정책 확정 및 프론트 요청 사항 반영 - #679
Conversation
sooyoung0927
added
♻️ type: 리팩토링
|
Warning Review limit reached
Next review available in: 28 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
📝 WalkthroughWalkthrough결제 정책이 멤버십 잔여일과 시작 시각을 반영하도록 변경되고, 결제 성공 후 멤버십 시작일 계산이 세분화되었습니다. 개인 결제 목록 응답에 Changes결제 금액 및 멤버십 갱신
결제 목록 식별자 노출
Promtail 로그 수집
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@legend-momo-city/docker/promtail/promtail-config.yml`:
- Around line 13-14: Promtail’s docker_sd_configs currently accesses the host
Docker socket directly, creating excessive host-level privileges. Replace the
direct socket usage in the Promtail configuration and its docker-compose service
mount with a restricted socket-proxy endpoint or another non-socket collection
method, ensuring Promtail retains the required container discovery and log
collection behavior.
- Around line 5-6: Update the Promtail positions configuration to use a
persistent path such as /var/lib/promtail/positions.yaml instead of
/tmp/positions.yaml, then add the corresponding volume mount in the
docker-compose configuration so the positions file survives container restarts
and redeployments.
- Around line 11-19: Update the Promtail deployment references in
docker-compose.yml, docker-compose.monitor.yml, and docker-compose.backend.yml
from the unsupported grafana/promtail:latest image to Grafana Alloy, and adjust
the related configuration and service commands so log collection continues to
work. If retaining Promtail instead, replace the floating latest tag with an
explicitly approved pinned version and document the exception.
In
`@legend-momo-city/src/main/java/com/wanted/momocity/payment/application/policy/PaymentPolicy.java`:
- Around line 46-49: Update the upgrade-price calculation in PaymentPolicy’s
method around calculateRemainingDays and MEMBERSHIP_PERIOD_DAYS so zero or
sub-minimum amounts are handled before returning. Ensure upgrades with less than
24 hours remaining do not produce a 0원 payment, and enforce the PG minimum
payment amount of 100L or apply the project’s established restriction for
near-expiry upgrades.
- Around line 35-39: PaymentPolicy의 다운그레이드 거부 조건을 활성 구독에만 적용하도록 수정하세요.
targetPlan.isDowngradeFrom(currentPlan) 검사에 기존 플랜의 남은 기간 여부(hasRemainingTime)를
함께 반영해, 만료된 플랜에서는 결제가 진행되고 활성 플랜의 다운그레이드만 PaymentDowngradeNotAllowedException을
발생시키도록 하세요.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: a329a7ed-0f3b-4e18-bb18-e7684c5e50f1
📒 Files selected for processing (7)
legend-momo-city/docker/promtail/promtail-config.ymllegend-momo-city/src/main/java/com/wanted/momocity/payment/application/policy/PaymentPolicy.javalegend-momo-city/src/main/java/com/wanted/momocity/payment/application/service/PaymentCommandService.javalegend-momo-city/src/main/java/com/wanted/momocity/payment/application/service/PaymentConfirmService.javalegend-momo-city/src/main/java/com/wanted/momocity/payment/domain/model/PersonalPaymentItem.javalegend-momo-city/src/main/java/com/wanted/momocity/payment/infrastructure/persistence/PaymentRepositoryAdapter.javalegend-momo-city/src/main/java/com/wanted/momocity/payment/presentation/api/response/PersonalPaymentListResponse.java
| docker_sd_configs: | ||
| - host: unix:///var/run/docker.sock |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== Files ==\n'
git ls-files 'legend-momo-city/docker/promtail/promtail-config.yml' 'legend-momo-city/docker-compose.yml'
printf '\n== promtail-config.yml ==\n'
cat -n legend-momo-city/docker/promtail/promtail-config.yml
printf '\n== docker-compose.yml relevant lines ==\n'
sed -n '1,140p' legend-momo-city/docker-compose.yml | cat -nRepository: MoMoFighters/BACK-Fighters
Length of output: 4183
Docker 소켓 직접 마운트를 제거하세요. legend-momo-city/docker-compose.yml:65-68에서 Promtail에 /var/run/docker.sock를 직접 붙이고, legend-momo-city/docker/promtail/promtail-config.yml:13-15의 docker_sd_configs가 이를 사용합니다. Promtail이 침해되면 Docker API로 호스트 수준 권한까지 이어질 수 있으니, socket proxy로 허용 API를 제한하거나 다른 수집 방식으로 바꾸세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@legend-momo-city/docker/promtail/promtail-config.yml` around lines 13 - 14,
Promtail’s docker_sd_configs currently accesses the host Docker socket directly,
creating excessive host-level privileges. Replace the direct socket usage in the
Promtail configuration and its docker-compose service mount with a restricted
socket-proxy endpoint or another non-socket collection method, ensuring Promtail
retains the required container discovery and log collection behavior.
There was a problem hiding this comment.
이 파일은 로컬 테스트용이라 배포에는 안 쓰여
There was a problem hiding this comment.
@sooyoung0927, 로컬 테스트 전용이며 배포 경로에 포함되지 않는 점 확인했습니다. 따라서 운영 환경에 대한 보안 이슈로 보기는 어렵습니다.
다만 로컬 환경에서도 Promtail 컨테이너가 Docker 소켓에 대한 광범위한 권한을 갖는 구조인 점만 인지하고 사용하면 될 것 같습니다. 필요하다면 설정 파일 또는 Compose 서비스에 “로컬 전용”임을 주석으로 남겨 의도를 명확히 해두는 정도를 권장합니다.
🐇💭
✏️ Learnings added
Learnt from: sooyoung0927
Repo: MoMoFighters/BACK-Fighters PR: 679
File: legend-momo-city/docker/promtail/promtail-config.yml:13-14
Timestamp: 2026-07-19T11:02:54.298Z
Learning: `legend-momo-city/docker/promtail/promtail-config.yml` 및 해당 Promtail Docker Compose 구성은 운영 배포에 사용하지 않는 로컬 테스트 전용 설정이다. Docker 소켓 직접 마운트는 로컬 개발 편의를 위한 의도된 트레이드오프이므로, 운영 환경 보안 이슈로 판단하지 않는다.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
|
@CodeRabbitai full review |
|
✅ Action performedFull review finished. Your plan includes PR reviews subject to rate limits. More reviews will be available in 28 minutes. |
2 participants
작업내용
Summary by CodeRabbit
새 기능
개선 사항