@Transactional
public void deleteProject(Long id) {
    // 1. S3 파일 삭제 (트랜잭션 범위 밖!)
    s3Template.deleteObject(fileKey);

    // 2. DB 삭제 (트랜잭션 범위 안)
    projectRepository.delete(project);
    // 만약 여기서 예외 발생 → DB 롤백, 하지만 S3는 이미 삭제됨! 💥
}

@Entity
@SQLDelete(sql = "UPDATE project SET deleted_at = NOW() WHERE id = ?")
@Where(clause = "deleted_at IS NULL")
public class Project extends BaseEntity {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    private String title;
    private String imageUrl;

    @Column(name = "deleted_at")
    private LocalDateTime deletedAt;
}

@Service
public class ProjectService {

    @Transactional
    public void deleteProject(Long id) {
        Project project = projectRepository.findById(id)
            .orElseThrow(() -> new NotFoundException("프로젝트를 찾을 수 없습니다."));

        // 1. DB에서 Soft Delete (deleted_at 업데이트)
        projectRepository.delete(project);  // 실제로는 UPDATE

        // 2. S3 삭제는 여기서 하지 않음!
    }
}

@Component
@RequiredArgsConstructor
public class OrphanFileCleanupScheduler {

    private final ProjectRepository projectRepository;
    private final S3Template s3Template;

    @Scheduled(cron = "0 0 3 * * *")  // 매일 새벽 3시
    public void cleanupOrphanFiles() {
        LocalDateTime threshold = LocalDateTime.now().minusDays(7);

        List<Project> deletedProjects = projectRepository
            .findAllByDeletedAtBefore(threshold);

        for (Project project : deletedProjects) {
            try {
                // S3 파일 삭제
                s3Template.deleteObject(project.getImageKey());

                // DB에서 완전 삭제
                projectRepository.hardDelete(project.getId());

                log.info("정리 완료: {}", project.getId());
            } catch (Exception e) {
                log.error("정리 실패: {}", project.getId(), e);
            }
        }
    }
}

@Getter
@AllArgsConstructor
public class ProjectDeletedEvent {
    private final String imageKey;
    private final Long projectId;
}

@Service
@RequiredArgsConstructor
public class ProjectService {

    private final ProjectRepository projectRepository;
    private final ApplicationEventPublisher eventPublisher;

    @Transactional
    public void deleteProject(Long id) {
        Project project = projectRepository.findById(id)
            .orElseThrow(() -> new NotFoundException("프로젝트를 찾을 수 없습니다."));

        String imageKey = project.getImageKey();

        // 1. DB 삭제 먼저!
        projectRepository.delete(project);

        // 2. 이벤트 발행 (아직 S3 삭제 안 함)
        eventPublisher.publishEvent(new ProjectDeletedEvent(imageKey, id));
    }
}

@Component
@RequiredArgsConstructor
@Slf4j
public class ProjectEventListener {

    private final S3Template s3Template;

    @TransactionalEventListener(phase = TransactionPhase.AFTER_COMMIT)
    public void handleProjectDeleted(ProjectDeletedEvent event) {
        try {
            // DB 커밋 성공 후에만 실행됨!
            s3Template.deleteObject(event.getImageKey());
            log.info("S3 파일 삭제 완료: {}", event.getImageKey());
        } catch (Exception e) {
            log.error("S3 파일 삭제 실패: {}", event.getImageKey(), e);
            // TODO: 실패 시 재시도 큐에 추가 또는 알림
        }
    }

    @TransactionalEventListener(phase = TransactionPhase.AFTER_ROLLBACK)
    public void handleProjectDeleteFailed(ProjectDeletedEvent event) {
        log.warn("프로젝트 삭제 실패 (롤백됨): {}", event.getProjectId());
        // S3 삭제가 실행되지 않음!
    }
}

@Service
@Transactional
public class ProjectService {

    public Project saveProject(ProjectRequest request) {
        // 1. 이미지 리사이징 (CPU 집약적) - 블로킹! 😰
        BufferedImage resized = ImageResizeUtil.resize(
            request.getImage(), 800, 600
        );

        // 2. S3 업로드 (I/O 집약적) - 블로킹! 😰
        String imageUrl = s3Template.upload(resized);

        // 3. DB 저장
        return projectRepository.save(project);
    }
}

@Configuration
@EnableAsync
public class AsyncConfig {

    @Bean(name = "imageTaskExecutor")
    public ThreadPoolTaskExecutor imageTaskExecutor() {
        ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
        executor.setCorePoolSize(10);
        executor.setMaxPoolSize(20);
        executor.setQueueCapacity(100);
        executor.setThreadNamePrefix("ImageAsync-");
        executor.setRejectedExecutionHandler(
            new ThreadPoolExecutor.CallerRunsPolicy()
        );
        executor.initialize();
        return executor;
    }
}

@Service
@RequiredArgsConstructor
@Slf4j
public class ImageAsyncService {

    private final S3Template s3Template;
    private final ProjectRepository projectRepository;

    @Async("imageTaskExecutor")
    public CompletableFuture<String> processAndUploadImage(
        MultipartFile image,
        Long projectId
    ) {
        try {
            // 1. 이미지 리사이징
            BufferedImage resized = ImageResizeUtil.resize(image, 800, 600);

            // 2. S3 업로드
            String imageUrl = s3Template.upload(
                resized,
                "projects/" + projectId
            );

            // 3. DB 업데이트
            projectRepository.updateImageUrl(projectId, imageUrl);

            log.info("이미지 처리 완료: {}", projectId);
            return CompletableFuture.completedFuture(imageUrl);

        } catch (Exception e) {
            log.error("이미지 처리 실패: {}", projectId, e);
            return CompletableFuture.failedFuture(e);
        }
    }
}

@Service
@RequiredArgsConstructor
public class ProjectService {

    private final ProjectRepository projectRepository;
    private final ImageAsyncService imageAsyncService;

    @Transactional
    public Project saveProject(ProjectRequest request) {
        // 1. 프로젝트 먼저 저장 (임시 이미지 URL)
        Project project = Project.builder()
            .title(request.getTitle())
            .description(request.getDescription())
            .imageUrl("processing...")  // 임시 값
            .build();

        Project saved = projectRepository.save(project);

        // 2. 비동기로 이미지 처리 (즉시 리턴!)
        imageAsyncService.processAndUploadImage(
            request.getImage(),
            saved.getId()
        );

        return saved;  // 3초 기다리지 않고 즉시 응답!
    }
}

@Service
@RequiredArgsConstructor
public class S3Service {

    private final AmazonS3 s3Client;

    @Value("${aws.s3.bucket}")
    private String bucketName;

    public PresignedUrlResponse generatePresignedUrl(String fileName) {
        String key = "uploads/original/" + UUID.randomUUID() + "-" + fileName;

        Date expiration = new Date();
        expiration.setTime(expiration.getTime() + 1000 * 60 * 10); // 10분

        GeneratePresignedUrlRequest request = new GeneratePresignedUrlRequest(
            bucketName, key
        )
        .withMethod(HttpMethod.PUT)
        .withExpiration(expiration);

        URL url = s3Client.generatePresignedUrl(request);

        return PresignedUrlResponse.builder()
            .uploadUrl(url.toString())
            .key(key)
            .build();
    }
}

@RestController
@RequestMapping("/api/webhooks")
@RequiredArgsConstructor
public class WebhookController {

    private final ProjectRepository projectRepository;

    @PostMapping("/image-processed")
    public ResponseEntity<Void> handleImageProcessed(
        @RequestBody ImageProcessedEvent event
    ) {
        // DB 업데이트
        projectRepository.updateImageByOriginalKey(
            event.getOriginalKey(),
            event.getResizedKey()
        );

        return ResponseEntity.ok().build();
    }
}

public class MarkdownUtil {

    private static final Parser parser = Parser.builder().build();
    private static final HtmlRenderer renderer = HtmlRenderer.builder().build();

    public static String toHtml(String markdown) {
        Node document = parser.parse(markdown);
        return renderer.render(document);  // 😰 필터링 없이 그대로 반환!
    }
}

import org.commonmark.node.Node;
import org.commonmark.parser.Parser;
import org.commonmark.renderer.html.HtmlRenderer;
import org.owasp.html.PolicyFactory;
import org.owasp.html.Sanitizers;

public class MarkdownUtil {

    private static final Parser parser = Parser.builder().build();
    private static final HtmlRenderer renderer = HtmlRenderer.builder().build();

    // OWASP Sanitizer 정책 설정
    private static final PolicyFactory POLICY = Sanitizers.FORMATTING
        .and(Sanitizers.BLOCKS)
        .and(Sanitizers.LINKS)
        .and(Sanitizers.IMAGES)
        .and(Sanitizers.STYLES);

    public static String toHtml(String markdown) {
        if (markdown == null || markdown.isBlank()) {
            return "";
        }

        // 1. Markdown → HTML 변환
        Node document = parser.parse(markdown);
        String rawHtml = renderer.render(document);

        // 2. HTML Sanitization 적용
        String cleanHtml = POLICY.sanitize(rawHtml);

        return cleanHtml;
    }
}

import org.owasp.html.HtmlPolicyBuilder;

public class CustomSanitizer {

    private static final PolicyFactory POLICY = new HtmlPolicyBuilder()
        // 허용할 태그
        .allowElements(
            "p", "br", "div", "span",
            "h1", "h2", "h3", "h4", "h5", "h6",
            "strong", "em", "b", "i", "u",
            "ul", "ol", "li",
            "blockquote", "code", "pre",
            "a", "img"
        )

        // <a> 태그 속성 제한
        .allowAttributes("href").onElements("a")
        .allowStandardUrlProtocols()  // http, https만 허용
        .requireRelNofollowOnLinks()  // 외부 링크에 rel="nofollow" 추가

        // <img> 태그 속성 제한
        .allowAttributes("src", "alt", "width", "height").onElements("img")

        // <code> 태그 속성
        .allowAttributes("class").matching(Pattern.compile("language-\\w+"))
            .onElements("code")

        // 위험한 프로토콜 차단
        .disallowUrlProtocols("javascript", "data", "vbscript")

        .toFactory();

    public static String sanitize(String html) {
        return POLICY.sanitize(html);
    }
}

@Test
void xss공격_방어_테스트() {
    String maliciousMarkdown = """
        # Hello

        <script>alert('XSS')</script>
        <img src="x" onerror="alert('XSS')">
        [Link](javascript:alert('XSS'))
        """;

    String result = MarkdownUtil.toHtml(maliciousMarkdown);

    // 스크립트 태그 제거 확인
    assertThat(result).doesNotContain("<script>");
    assertThat(result).doesNotContain("onerror");
    assertThat(result).doesNotContain("javascript:");

    // 정상 컨텐츠는 유지
    assertThat(result).contains("<h1>Hello</h1>");
}

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) {
        http.headers(headers -> headers
            .contentSecurityPolicy(csp -> csp
                .policyDirectives(
                    "default-src 'self'; " +
                    "script-src 'self'; " +
                    "style-src 'self' 'unsafe-inline'; " +
                    "img-src 'self' https:; " +
                    "font-src 'self';"
                )
            )
        );
        return http.build();
    }
}

@Configuration
@Profile("prod")
public class ProdSecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(Customizer.withDefaults())  // CSRF 활성화 (기본값)
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/", "/projects/**").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(Customizer.withDefaults());

        return http.build();
    }
}

@Configuration
@Profile("dev")
public class DevSecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/h2-console/**").permitAll()
                .anyRequest().permitAll()
            )
            // H2 Console을 위한 설정
            .csrf(csrf -> csrf
                .ignoringRequestMatchers(PathRequest.toH2Console())
            )
            .headers(headers -> headers
                .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)
            );

        return http.build();
    }
}

.csrf(csrf -> csrf
    .ignoringRequestMatchers(PathRequest.toH2Console())  // H2만 예외
)

@ExtendWith(MockitoExtension.class)
class ProjectServiceTest {

    @Mock
    private ProjectRepository projectRepository;

    @Mock
    private S3Template s3Template;

    @InjectMocks
    private ProjectService projectService;

    @Test
    @DisplayName("프로젝트 저장 시 S3에 이미지 업로드 후 DB에 저장한다")
    void saveProject_Success() {
        // Given
        ProjectRequest request = ProjectRequest.builder()
            .title("Test Project")
            .description("Test Description")
            .image(createMockMultipartFile())
            .build();

        String expectedImageUrl = "https://s3.amazonaws.com/bucket/image.jpg";

        // S3 업로드 Mock 설정
        when(s3Template.upload(any(BufferedImage.class), anyString()))
            .thenReturn(expectedImageUrl);

        Project savedProject = Project.builder()
            .id(1L)
            .title(request.getTitle())
            .imageUrl(expectedImageUrl)
            .build();

        when(projectRepository.save(any(Project.class)))
            .thenReturn(savedProject);

        // When
        Project result = projectService.saveProject(request);

        // Then
        assertThat(result.getId()).isEqualTo(1L);
        assertThat(result.getTitle()).isEqualTo("Test Project");
        assertThat(result.getImageUrl()).isEqualTo(expectedImageUrl);

        // S3 업로드가 1번 호출되었는지 검증
        verify(s3Template, times(1))
            .upload(any(BufferedImage.class), anyString());

        // Repository save가 1번 호출되었는지 검증
        verify(projectRepository, times(1))
            .save(any(Project.class));
    }

    @Test
    @DisplayName("S3 업로드 실패 시 예외가 발생한다")
    void saveProject_S3UploadFails() {
        // Given
        ProjectRequest request = createProjectRequest();

        when(s3Template.upload(any(), anyString()))
            .thenThrow(new S3Exception("Upload failed"));

        // When & Then
        assertThatThrownBy(() -> projectService.saveProject(request))
            .isInstanceOf(S3Exception.class)
            .hasMessage("Upload failed");

        // Repository save는 호출되지 않았는지 검증
        verify(projectRepository, never()).save(any());
    }

    @Test
    @DisplayName("프로젝트 삭제 시 S3 파일도 함께 삭제한다")
    void deleteProject_Success() {
        // Given
        Long projectId = 1L;
        String imageKey = "projects/1/image.jpg";

        Project project = Project.builder()
            .id(projectId)
            .title("Test")
            .imageKey(imageKey)
            .build();

        when(projectRepository.findById(projectId))
            .thenReturn(Optional.of(project));

        doNothing().when(s3Template).deleteObject(imageKey);
        doNothing().when(projectRepository).delete(project);

        // When
        projectService.deleteProject(projectId);

        // Then
        verify(s3Template, times(1)).deleteObject(imageKey);
        verify(projectRepository, times(1)).delete(project);
    }

    private MultipartFile createMockMultipartFile() {
        return new MockMultipartFile(
            "image",
            "test.jpg",
            "image/jpeg",
            "test image content".getBytes()
        );
    }
}

@SpringBootTest
@Testcontainers
@ActiveProfiles("test")
class ProjectServiceIntegrationTest {

    @Container
    static LocalStackContainer localstack = new LocalStackContainer(
        DockerImageName.parse("localstack/localstack:latest")
    ).withServices(LocalStackContainer.Service.S3);

    @Autowired
    private ProjectService projectService;

    @Autowired
    private ProjectRepository projectRepository;

    private AmazonS3 s3Client;
    private String bucketName = "test-bucket";

    @BeforeEach
    void setUp() {
        // LocalStack S3 클라이언트 생성
        s3Client = AmazonS3ClientBuilder
            .standard()
            .withEndpointConfiguration(
                new AwsClientBuilder.EndpointConfiguration(
                    localstack.getEndpointOverride(LocalStackContainer.Service.S3).toString(),
                    localstack.getRegion()
                )
            )
            .withCredentials(
                new AWSStaticCredentialsProvider(
                    new BasicAWSCredentials("test", "test")
                )
            )
            .build();

        // 테스트용 버킷 생성
        s3Client.createBucket(bucketName);
    }

    @Test
    @DisplayName("프로젝트 저장 시 실제 S3(LocalStack)에 파일이 업로드된다")
    void saveProject_UploadsToRealS3() throws IOException {
        // Given
        ProjectRequest request = ProjectRequest.builder()
            .title("Integration Test Project")
            .description("Real S3 upload test")
            .image(createTestImage())
            .build();

        // When
        Project saved = projectService.saveProject(request);

        // Then
        assertThat(saved.getId()).isNotNull();
        assertThat(saved.getImageUrl()).isNotEmpty();

        // S3에 실제로 파일이 존재하는지 확인
        String key = extractKeyFromUrl(saved.getImageUrl());
        boolean exists = s3Client.doesObjectExist(bucketName, key);
        assertThat(exists).isTrue();

        // DB에도 저장되었는지 확인
        Project found = projectRepository.findById(saved.getId()).orElseThrow();
        assertThat(found.getTitle()).isEqualTo("Integration Test Project");
    }

    @Test
    @DisplayName("프로젝트 삭제 시 S3 파일도 함께 삭제된다")
    void deleteProject_DeletesFromRealS3() throws IOException {
        // Given
        ProjectRequest request = createProjectRequest();
        Project saved = projectService.saveProject(request);
        String key = extractKeyFromUrl(saved.getImageUrl());

        // 파일이 존재하는지 확인
        assertThat(s3Client.doesObjectExist(bucketName, key)).isTrue();

        // When
        projectService.deleteProject(saved.getId());

        // Then
        // S3에서 파일이 삭제되었는지 확인
        assertThat(s3Client.doesObjectExist(bucketName, key)).isFalse();

        // DB에서도 삭제되었는지 확인
        assertThat(projectRepository.findById(saved.getId())).isEmpty();
    }
}