요청 파라미터 바인딩

rootProject.name = 'request-parameter-binding'

plugins { id 'java' }

java { toolchain { languageVersion = JavaLanguageVersion.of(25) } }

repositories { mavenCentral() }

dependencies {
    implementation platform('org.springframework.boot:spring-boot-dependencies:4.1.1')
    implementation 'org.springframework.boot:spring-boot-starter-webmvc'
    implementation 'org.springframework.boot:spring-boot-starter-validation'
    testImplementation platform('org.springframework.boot:spring-boot-dependencies:4.1.1')
    testImplementation 'org.springframework.boot:spring-boot-starter-webmvc-test'
    testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
}

tasks.withType(JavaCompile).configureEach {
    options.encoding = 'UTF-8'
    options.release = 25
    options.compilerArgs += ['-parameters']
}

tasks.named('test') { useJUnitPlatform() }

package board.post;

import java.time.LocalDate;
import java.util.List;

public record FindPostsQuery(String query, int page, int size, List<String> tags, LocalDate from) {
    public FindPostsQuery {
        tags = List.copyOf(tags);
    }
}

package board.post;

import java.util.List;

public record PostPage(List<Long> postIds) {
    public PostPage {
        postIds = List.copyOf(postIds);
    }

    public static PostPage empty() {
        return new PostPage(List.of());
    }
}

package board.post;

@FunctionalInterface
public interface PostSearch {
    PostPage find(FindPostsQuery query);
}

package board.post;

import java.time.LocalDate;

public record CreatePostCommand(String title, String content, LocalDate publishedOn) {}

package board.post;

public record SavedPost(long id) {}

package board.post;

public interface PostService {
    SavedPost register(CreatePostCommand command);
}

package board.web;

import board.post.FindPostsQuery;
import board.post.PostPage;
import board.post.PostSearch;
import jakarta.validation.constraints.Max;
import jakarta.validation.constraints.Min;
import java.time.LocalDate;
import java.util.List;
import org.springframework.format.annotation.DateTimeFormat;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/posts")
public final class PostSearchController {
    private final PostSearch search;

    public PostSearchController(PostSearch search) {
        this.search = search;
    }

    @GetMapping
    public PostPage find(
            @RequestParam(name = "query") String query,
            @RequestParam(name = "page", defaultValue = "0") @Min(0) int page,
            @RequestParam(name = "size", defaultValue = "20") @Min(1) @Max(100) int size,
            @RequestParam(name = "tag", defaultValue = "") List<String> tags,
            @RequestParam(name = "from", required = false)
                    @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate from) {
        return search.find(new FindPostsQuery(query, page, size, tags, from));
    }
}

package board.web;

import board.post.CreatePostCommand;
import jakarta.validation.constraints.*;
import java.time.LocalDate;
import org.springframework.format.annotation.DateTimeFormat;

public final class CreatePostForm {
    @NotBlank
    private String title;

    @NotBlank
    @Size(max = 720)
    private String content;

    @DateTimeFormat(iso = DateTimeFormat.ISO.DATE)
    private LocalDate publishedOn;

    public String getTitle() { return title; }

    public void setTitle(String title) { this.title = title; }

    public String getContent() { return content; }

    public void setContent(String content) { this.content = content; }

    public LocalDate getPublishedOn() { return publishedOn; }

    public void setPublishedOn(LocalDate publishedOn) { this.publishedOn = publishedOn; }

    public CreatePostCommand toCommand() {
        return new CreatePostCommand(title, content, publishedOn);
    }
}

package board.web;

import board.post.PostService;
import jakarta.validation.Valid;
import java.util.Arrays;
import org.springframework.stereotype.Controller;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.WebDataBinder;
import org.springframework.web.bind.annotation.*;
import org.springframework.web.servlet.support.ExtendedServletRequestDataBinder;

@Controller
public final class PostFormPageController {
    private final PostService service;

    public PostFormPageController(PostService service) {
        this.service = service;
    }

    @InitBinder("form")
    void configureFormBinder(WebDataBinder binder) {
        binder.setAllowedFields("title", "content", "publishedOn");
        if (binder instanceof ExtendedServletRequestDataBinder servletBinder) {
            servletBinder.setHeaderPredicate(name -> false);
        }
    }

    @PostMapping("/posts")
    public String register(
            @Valid @ModelAttribute("form") CreatePostForm form,
            BindingResult binding) {
        var suppressed = binding.getSuppressedFields();
        if (suppressed.length > 0) {
            Arrays.sort(suppressed);
            binding.reject("binding.disallowed", suppressed, "Disallowed form fields");
        }

        if (binding.hasErrors()) {
            return "post-form";
        }

        var saved = service.register(form.toCommand());
        return "redirect:/posts/" + saved.id();
    }
}

package board.web;

import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.http.MediaType.APPLICATION_FORM_URLENCODED;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
import static org.springframework.test.web.servlet.setup.MockMvcBuilders.standaloneSetup;

import board.post.*;
import jakarta.validation.Valid;
import java.time.LocalDate;
import java.util.ArrayList;
import java.util.List;
import org.junit.jupiter.api.Test;
import org.springframework.beans.NotWritablePropertyException;
import org.springframework.http.ResponseEntity;
import org.springframework.stereotype.Controller;
import org.springframework.test.web.servlet.*;
import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.*;
import org.springframework.web.bind.annotation.*;
import org.springframework.web.method.annotation.*;

class QueryAndFormBindingTest {
    @Test
    void 누락과_빈_값은_page_size의_기본값을_적용한다() throws Exception {
        var fixture = searchFixture();
        fixture.mvc().perform(posts()).andExpect(status().isOk());
        fixture.mvc().perform(posts().param("page", "").param("size", "").param("tag", ""))
                .andExpect(status().isOk());
        var expected = new FindPostsQuery("HTTP", 0, 20, List.of(), null);
        assertThat(fixture.queries()).containsExactly(expected, expected);
    }

    @Test
    void 반복과_쉼표_tag는_같은_List_계약으로_변환한다() throws Exception {
        var fixture = searchFixture();
        fixture.mvc().perform(posts().param("tag", "network", "spring"))
                .andExpect(status().isOk());
        fixture.mvc().perform(posts().param("tag", "network,spring"))
                .andExpect(status().isOk());
        assertThat(fixture.queries()).extracting(FindPostsQuery::tags)
                .containsExactly(List.of("network", "spring"), List.of("network", "spring"));
    }

    @Test
    void 필수_파라미터_누락은_handler_전_400이다() throws Exception {
        rejectedSearch(MissingServletRequestParameterException.class, get("/api/posts"));
    }

    @Test
    void 숫자와_날짜_변환_실패는_service_전_400이다() throws Exception {
        rejectedSearch(MethodArgumentTypeMismatchException.class,
                posts().param("page", "not-a-number"), posts().param("from", "2026-99-99"));
    }

    @Test
    void page와_size의_범위_위반은_method_validation_400이다() throws Exception {
        rejectedSearch(HandlerMethodValidationException.class,
                posts().param("page", "-1"), posts().param("size", "101"));
    }

    @Test
    void 유효한_폼은_command로_한번_매핑하고_service를_호출한다() throws Exception {
        var fixture = formFixture();
        fixture.mvc().perform(validForm().param("publishedOn", "2026-08-28"))
                .andExpect(status().is3xxRedirection())
                .andExpect(view().name("redirect:/posts/41"));
        assertThat(fixture.commands()).containsExactly(new CreatePostCommand(
                "Spring MVC", "binding", LocalDate.of(2026, 8, 28)));
    }

    @Test
    void 빈_필드는_BindingResult에_담겨_같은_뷰를_렌더링한다() throws Exception {
        var fixture = formFixture();
        var result = fixture.mvc().perform(form(" ", ""))
                .andExpect(status().isOk())
                .andExpect(view().name("post-form"))
                .andExpect(model().attributeHasFieldErrors("form", "title", "content"))
                .andReturn();
        var binding = bindingResult(result);
        assertThat(binding.getFieldError("title").getCode()).isEqualTo("NotBlank");
        assertThat(binding.getFieldError("content").getCode()).isEqualTo("NotBlank");
        assertThat(fixture.commands()).isEmpty();
    }

    @Test
    void 너무_긴_content는_BindingResult에_담긴다() throws Exception {
        fieldError(form("Spring MVC", "x".repeat(721)), "content", "Size");
    }

    @Test
    void publishedOn_변환_오류는_BindingResult에_담긴다() throws Exception {
        var request = validForm().param("publishedOn", "not-a-date");
        fieldError(request, "publishedOn", "typeMismatch");
    }

    @Test
    void 인접한_BindingResult가_없으면_MethodArgumentNotValidException이다() throws Exception {
        var controller = new NoBindingResultController();
        var mvc = standaloneSetup(controller).build();
        rejected(mvc, form("/no-binding-result", "", ""),
                MethodArgumentNotValidException.class);
        assertThat(controller.invocations).isZero();
    }

    @Test
    void ownerId와_admin은_suppressed되고_명시적으로_거부된다() throws Exception {
        var fixture = formFixture();
        var request = validForm().param("ownerId", "9001").param("admin", "true");
        var result = sameForm(fixture.mvc(), request);
        var binding = bindingResult(result);
        assertThat(binding.getSuppressedFields()).containsExactly("admin", "ownerId");
        assertThat(binding.getErrorCount()).isEqualTo(1);
        assertThat(binding.getGlobalError().getCode()).isEqualTo("binding.disallowed");
        assertThat(fixture.commands()).isEmpty();
    }

    @Test
    void ordinary_unknown_property는_allowlist_suppression과_다르다() throws Exception {
        var controller = new StrictUnknownFieldController();
        var mvc = standaloneSetup(controller).build();
        var request = form("/strict-form", "Spring MVC", "binding")
                .param("nickname", "unknown");
        rejected(mvc, request, NotWritablePropertyException.class);
        assertThat(controller.invocations).isZero();
    }

    private static SearchFixture searchFixture() {
        var calls = new ArrayList<FindPostsQuery>();
        PostSearch search = query -> {
            calls.add(query);
            return PostPage.empty();
        };
        return new SearchFixture(standaloneSetup(new PostSearchController(search)).build(), calls);
    }

    private static FormFixture formFixture() {
        var calls = new ArrayList<CreatePostCommand>();
        PostService service = command -> {
            calls.add(command);
            return new SavedPost(41L);
        };
        return new FormFixture(standaloneSetup(new PostFormPageController(service)).build(), calls);
    }

    private static MockHttpServletRequestBuilder posts() {
        return get("/api/posts").param("query", "HTTP");
    }

    private static MockHttpServletRequestBuilder form(String path, String title, String content) {
        return post(path).contentType(APPLICATION_FORM_URLENCODED)
                .param("title", title).param("content", content);
    }

    private static MockHttpServletRequestBuilder form(String title, String content) {
        return form("/posts", title, content);
    }

    private static MockHttpServletRequestBuilder validForm() {
        return form("Spring MVC", "binding");
    }

    private static void rejectedSearch(Class<?> type, MockHttpServletRequestBuilder... requests)
            throws Exception {
        for (var request : requests) {
            var fixture = searchFixture();
            rejected(fixture.mvc(), request, type);
            assertThat(fixture.queries()).isEmpty();
        }
    }

    private static void rejected(MockMvc mvc, MockHttpServletRequestBuilder request, Class<?> type)
            throws Exception {
        var result = mvc.perform(request).andExpect(status().isBadRequest()).andReturn();
        assertThat(result.getResolvedException()).isExactlyInstanceOf(type);
    }

    private static MvcResult sameForm(MockMvc mvc, MockHttpServletRequestBuilder request)
            throws Exception {
        return mvc.perform(request).andExpect(status().isOk())
                .andExpect(view().name("post-form")).andReturn();
    }

    private static void fieldError(MockHttpServletRequestBuilder request, String field, String code)
            throws Exception {
        var fixture = formFixture();
        var error = bindingResult(sameForm(fixture.mvc(), request)).getFieldError(field);
        assertThat(error).isNotNull();
        assertThat(error.getCode()).isEqualTo(code);
        assertThat(fixture.commands()).isEmpty();
    }

    private static BindingResult bindingResult(MvcResult result) {
        var modelAndView = result.getModelAndView();
        assertThat(modelAndView).isNotNull();
        return (BindingResult) modelAndView.getModel()
                .get(BindingResult.MODEL_KEY_PREFIX + "form");
    }

    private record SearchFixture(MockMvc mvc, List<FindPostsQuery> queries) {}
    private record FormFixture(MockMvc mvc, List<CreatePostCommand> commands) {}

    @Controller
    private static final class NoBindingResultController {
        private int invocations;

        @PostMapping("/no-binding-result")
        String register(@Valid @ModelAttribute("form") CreatePostForm form) {
            invocations++;
            return "unexpected";
        }
    }

    @Controller
    private static final class StrictUnknownFieldController {
        private int invocations;

        @InitBinder("form")
        void configure(WebDataBinder binder) {
            binder.setIgnoreUnknownFields(false);
        }

        @PostMapping("/strict-form")
        String register(@ModelAttribute("form") CreatePostForm form) {
            invocations++;
            return "unexpected";
        }

        @ExceptionHandler(NotWritablePropertyException.class)
        ResponseEntity<Void> rejectUnknownProperty() {
            return ResponseEntity.badRequest().build();
        }
    }
}