⚠️ Potential issue

Make plugin install non-interactive to prevent CI hangs.

Without --batch, elasticsearch-plugin install can block waiting for confirmation during docker build.

Apply this diff:

-FROM elasticsearch:8.18.6
-RUN bin/elasticsearch-plugin install analysis-nori
+FROM elasticsearch:8.18.6
+RUN bin/elasticsearch-plugin install --batch analysis-nori

In Dockerfile.elasticsearch around lines 1 to 2, the RUN command uses
`elasticsearch-plugin install analysis-nori` which can prompt interactively
during docker builds and hang CI; modify the RUN invocation to pass the
non-interactive flag `--batch` to `elasticsearch-plugin install` so the plugin
installs without prompting (i.e., run the install with `--batch`).

💡 Verification agent

@Configuration
@Profile("es")
@EnableElasticsearchRepositories(basePackages = "novaminds.gradproj.global.search.repository")
class EsRepositoriesConfig {}

#!/bin/bash
rg -n -C2 '@EnableElasticsearchRepositories|EsIndexBootstrap|IngredientIndexingService|SearchQueryService' src/main/java
rg -n '@Profile\("es"\)' -C2 src/main/java/novaminds/gradproj/global/search

Gate Elasticsearch behind the "es" profile (make ES repos and ES-only beans conditional).

@EnableElasticsearchRepositories is enabled unconditionally in src/main/java/novaminds/gradproj/GradprojApplication.java (line 25). ES-related beans are unprofiled and will attempt ES wiring at startup: src/main/java/novaminds/gradproj/global/search/EsIndexBootstrap.java (class ~line 11), SearchQueryService.java (line 18), IngredientIndexingService.java (line 18), SearchController.java (lines 15–16).

Action: move @EnableElasticsearchRepositories into a @configuration annotated with @Profile("es") and make ES bootstrap/services conditional (either annotate them with @Profile("es") or use @ConditionalOnBean(ElasticsearchOperations.class) / @ConditionalOnProperty). Example:

@Configuration
@Profile("es")
@EnableElasticsearchRepositories(basePackages = "novaminds.gradproj.global.search.repository")
class EsRepositoriesConfig {}

In src/main/java/novaminds/gradproj/GradprojApplication.java around lines 22–25,
@EnableElasticsearchRepositories is declared unconditionally which causes ES
wiring to be attempted even when ES is not enabled; move the annotation into a
new @Configuration class annotated with @Profile("es") (e.g., create an
EsRepositoriesConfig with @Configuration, @Profile("es") and
@EnableElasticsearchRepositories(basePackages =
"novaminds.gradproj.global.search.repository")). Also make ES-related beans
conditional: update
src/main/java/novaminds/gradproj/global/search/EsIndexBootstrap.java,
SearchQueryService.java, IngredientIndexingService.java, and
SearchController.java to be either annotated with @Profile("es") or use
@ConditionalOnBean(ElasticsearchOperations.class) /
@ConditionalOnProperty("es.enabled") so they are only created when ES is active.

현재 구현은 애플리케이션 시작 시 인덱스가 존재하지 않을 때만 생성하도록 되어 있습니다. 만약 IngredientDocument의 매핑이 변경될 경우, 기존 인덱스가 삭제되지 않아 변경사항이 반영되지 않는 문제가 발생할 수 있습니다. 개발 환경에서는 애플리케이션 재시작 시 항상 최신 매핑을 보장하기 위해 기존 인덱스를 삭제하고 다시 생성하는 것이 더 안정적일 수 있습니다. 운영 환경에서는 무중단 인덱스 업데이트를 위해 Blue-Green 배포와 유사한 인덱스 alias를 활용하는 전략을 고려해야 합니다.

        if (idx.exists()) {
            idx.delete();
        }
        idx.create(); // @Setting(nori-setting.json) 반영
        idx.putMapping(idx.createMapping(IngredientDocument.class)); // @MultiField 매핑 반영

이 클래스는 정적 유틸리티 메서드만 포함하고 있습니다. 이런 유틸리티 클래스는 인스턴스화되거나 상속될 필요가 없으므로, final로 선언하고 private 생성자를 추가하여 의도를 명확히 하는 것이 좋습니다.

public final class SearchConverter {

    private SearchConverter() {
        // 유틸리티 클래스는 인스턴스화할 수 없습니다.
    }

/admin/reindex 엔드포인트는 전체 재료 데이터를 다시 인덱싱하는 무거운 작업이며, 시스템에 부하를 줄 수 있습니다. 따라서 아무나 호출할 수 없도록 관리자(Admin) 권한을 가진 사용자만 접근할 수 있도록 보안을 강화해야 합니다. Spring Security의 메서드 시큐리티를 사용하고 있다면 @PreAuthorize("hasRole('ADMIN')")과 같은 어노테이션을 추가하는 것을 고려해 보세요.

[P1] Restrict reindex endpoint to admin role

The reindex endpoint is mapped to /api/search/admin/reindex but does not enforce any role check, and SecurityConfig only guards paths starting with /admin/**. As written, any authenticated user can trigger a costly reindex operation. Add explicit authorization on this controller (e.g., @PreAuthorize("hasRole('ADMIN')")) or extend the security matcher so only administrators can call it.

Useful? React with 👍 / 👎.

⚠️ Potential issue

Protect the reindex endpoint (authorization + environment gating).

Unauthenticated/unauthorized reindexing is a security and operational risk. Restrict to admins and optionally expose only on local/dev.

+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.context.annotation.Profile;
 ...
-    @PostMapping("/admin/reindex")
+    @PostMapping("/admin/reindex")
+    @PreAuthorize("hasRole('ADMIN')")
+    @Profile({"local","dev"})
     public ApiResponse<String> reindexIngredients() {
         ingredientIndexingService.indexIngredients();
         return ApiResponse.onSuccess("인덱싱이 성공적으로 완료되었습니다.");
     }

If Spring Security isn’t configured, at minimum add a shared secret header check or remove this endpoint from release.

Committable suggestion skipped: line range outside the PR's diff.

페이지네이션 파라미터인 page와 size에 대한 유효성 검사가 없습니다. 사용자가 비정상적으로 큰 size 값을 요청할 경우 서버에 과도한 부하를 줄 수 있습니다. page는 0 이상, size는 적절한 범위(예: 1~100) 내의 값만 허용하도록 유효성 검사를 추가하는 것이 좋습니다. 아래와 같이 수정하고, 컨트롤러 클래스에 @org.springframework.validation.annotation.Validated 어노테이션을 추가하는 것을 권장합니다.

🛠️ Refactor suggestion

Validate and clamp pagination parameters.

Unbounded size can hurt ES. Guard against negative page and large sizes (e.g., max 100).

-    public ApiResponse<SearchResponseDTO.IngredientSearchList> searchIngredients(
-            @RequestParam("keyword") String keyword,
-            @RequestParam(defaultValue = "0") int page,
-            @RequestParam(defaultValue = "20") int size
-    ) {
-        SearchResponseDTO.IngredientSearchList searchResults = searchQueryService.searchIngredients(keyword, page, size);
+    public ApiResponse<SearchResponseDTO.IngredientSearchList> searchIngredients(
+            @RequestParam("keyword") String keyword,
+            @RequestParam(defaultValue = "0") int page,
+            @RequestParam(defaultValue = "20") int size
+    ) {
+        page = Math.max(0, page);
+        size = Math.max(1, Math.min(100, size));
+        var searchResults = searchQueryService.searchIngredients(keyword, page, size);
         return ApiResponse.onSuccess(searchResults);
     }

In
src/main/java/novaminds/gradproj/global/search/web/controller/SearchController.java
around lines 24-32, the pagination params are unvalidated; ensure page is
non-negative and size is clamped to a safe range (e.g., 1..100) before calling
searchQueryService. At the start of the method, normalize page = Math.max(0,
page) (or return 400 for negative if you prefer strictness) and size =
Math.max(1, Math.min(size, 100)); then pass the normalized values to
searchQueryService and return the response.