Develop

Caddyfile

@@ -42,6 +42,11 @@ http://promptplace.kro.kr {
                 }
         }
 
+        # Redis keepalive는 Caddy 응답이 아니라 Express의 실제 PING까지 전달
+        handle /health/redis {
+                reverse_proxy app:3000
+        }
+
         # (선택) ALB 헬스체크 편의 엔드포인트
         @health path /health
         handle @health {
@@ -83,6 +88,11 @@ http://promptplace-dev.kro.kr {
         }
     }
 
+    # Redis keepalive는 app-dev의 실제 Redis PING까지 전달
+    handle /health/redis {
+        reverse_proxy app-dev:3000
+    }
+
     # 로드밸런서 헬스체크용
     @health path /health
     handle @health {
@@ -93,4 +103,4 @@ http://promptplace-dev.kro.kr {
         output stdout
         format console
     }
-}
+}

README.md

@@ -211,6 +211,11 @@ perf/#이슈번호        # 성능 개선
 - **GitHub Secrets**를 통한 보안 정보 관리
 - **Docker 컨테이너화** 준비 가능한 구조
 
+보안 관련 필수 운영 설정:
+
+- `PAYPLE_PAYOUT_WEBHOOK_ALLOWED_IPS`: Payple 고객센터에서 확인한 웹훅 원본 IP 또는 CIDR을 쉼표로 구분합니다. 누락되거나 잘못되면 지급 웹훅은 안전하게 `503`으로 거절됩니다.
+- S3 버킷은 Block Public Access를 켜고 `business-licenses/*` 공개 정책을 두지 않습니다. 사업자등록증 조회는 인증된 본인 또는 관리자 API가 발급한 5분 만료 presigned URL만 사용합니다.
+
 ## ⚡ 성능 최적화
 
 ### **데이터베이스 최적화**

prisma/migrations/20261005000000_store_business_license_object_keys/migration.sql

@@ -0,0 +1,8 @@
+-- 사업자등록증은 공개/직접 URL 대신 S3 객체 키만 저장한다.
+-- 기존 업로드 코드가 생성한 virtual-hosted S3 URL만 안전하게 변환한다.
+UPDATE `SettlementAccount`
+SET `business_license_url` = SUBSTRING(
+  `business_license_url`,
+  LOCATE('business-licenses/', `business_license_url`)
+)
+WHERE `business_license_url` LIKE 'https://%.amazonaws.com/business-licenses/%';

src/announcements/controllers/announcement.controller.ts

@@ -15,6 +15,8 @@ interface RawPaginationQuery {
   size?: string;
 }
 
+type FlatParamsRequest = Request<Record<string, string>>;
+
 //비회원 이용 가능 
 export const getAnnouncementList = async (
   req: Request<any, any, any, RawPaginationQuery>,
@@ -35,7 +37,7 @@ export const getAnnouncementList = async (
   }
 };
 
-export const getAnnouncement = async (req: Request, res: Response) => {
+export const getAnnouncement = async (req: FlatParamsRequest, res: Response) => {
   try {
     const result = await getAnnouncementService(req.params.announcementId);
     return res.success({
@@ -51,7 +53,7 @@ export const getAnnouncement = async (req: Request, res: Response) => {
   }
 };
 
-export const createAnnouncement = async (req: Request, res: Response) => {
+export const createAnnouncement = async (req: FlatParamsRequest, res: Response) => {
   if (!req.user) {
     res.fail({
       statusCode: 401,
@@ -76,7 +78,7 @@ export const createAnnouncement = async (req: Request, res: Response) => {
   }
 };
 
-export const patchAnnouncement = async (req: Request, res: Response) => {
+export const patchAnnouncement = async (req: FlatParamsRequest, res: Response) => {
   try {
     const result = await patchAnnouncementService(req.params.announcementId, req.body);
     return res.success({
@@ -92,7 +94,7 @@ export const patchAnnouncement = async (req: Request, res: Response) => {
   }
 };
 
-export const deleteAnnouncement = async (req: Request, res: Response) => {
+export const deleteAnnouncement = async (req: FlatParamsRequest, res: Response) => {
   try {
     const result = await deleteAnnouncementService(req.params.announcementId);
     return res.success({

src/index.ts

@@ -48,6 +48,9 @@ import morgan = require('morgan');
 const PORT = 3000;
 const app = express();
 
+// 앱 컨테이너 앞의 Caddy/ALB 사설망 hop만 신뢰해 req.ip를 원본 IP로 복원한다.
+app.set('trust proxy', ['loopback', 'linklocal', 'uniquelocal']);
+
 // Express 앱을 http 서버로 감싸기
 const server = http.createServer(app); 
 

src/inquiries/controllers/inquiry.controller.ts

@@ -10,6 +10,8 @@ import { GetInquiriesDto } from "../dtos/get-inquiries.dto";
 import { CreateReplyDto } from "../dtos/create-reply.dto";
 import { MessageRepository } from "../../messages/repositories/message.repository";
 
+type FlatParamsRequest = Request<Record<string, string>>;
+
 export class InquiryController {
   private inquiryService: InquiryService;
 
@@ -22,7 +24,7 @@ export class InquiryController {
   }
 
   public async createInquiry(
-    req: Request,
+    req: FlatParamsRequest,
     res: Response,
     next: NextFunction
   ): Promise<void> {
@@ -54,7 +56,7 @@ export class InquiryController {
   }
 
   public async getInquiryById(
-    req: Request,
+    req: FlatParamsRequest,
     res: Response,
     next: NextFunction
   ): Promise<void> {
@@ -78,7 +80,7 @@ export class InquiryController {
   }
 
   public async getReceivedInquiries(
-    req: Request,
+    req: FlatParamsRequest,
     res: Response,
     next: NextFunction
   ): Promise<void> {
@@ -110,7 +112,7 @@ export class InquiryController {
   }
 
   public async createInquiryReply(
-    req: Request,
+    req: FlatParamsRequest,
     res: Response,
     next: NextFunction
   ): Promise<void> {
@@ -144,7 +146,7 @@ export class InquiryController {
   }
 
   public async markInquiryAsRead(
-    req: Request,
+    req: FlatParamsRequest,
     res: Response,
     next: NextFunction
   ): Promise<void> {
@@ -168,7 +170,7 @@ export class InquiryController {
   }
 
   public async deleteInquiry(
-    req: Request,
+    req: FlatParamsRequest,
     res: Response,
     next: NextFunction
   ): Promise<void> {