feat: 식단 품절 제보 및 승인/반려 기능 구현

build.gradle

@@ -106,6 +106,7 @@ tasks.named('bootBuildImage') {
 }
 
 tasks.named('test') {
+    maxHeapSize = '2g'
     useJUnitPlatform {
         excludeTags 'web-auth-http'
     }

src/main/java/in/koreatech/koin/admin/dining/controller/AdminDiningReportApi.java

@@ -0,0 +1,61 @@
+package in.koreatech.koin.admin.dining.controller;
+
+import static in.koreatech.koin.domain.user.model.UserType.ADMIN;
+import static in.koreatech.koin.global.code.ApiResponseCode.FORBIDDEN_ADMIN;
+import static in.koreatech.koin.global.code.ApiResponseCode.FORBIDDEN_USER_TYPE;
+import static in.koreatech.koin.global.code.ApiResponseCode.ILLEGAL_ARGUMENT;
+import static in.koreatech.koin.global.code.ApiResponseCode.NOT_FOUND_DINING_REPORT;
+import static in.koreatech.koin.global.code.ApiResponseCode.OK;
+import static in.koreatech.koin.global.code.ApiResponseCode.UNAUTHORIZED_USER;
+import static in.koreatech.koin.global.code.ApiResponseCode.WITHDRAWN_USER;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestParam;
+
+import in.koreatech.koin.admin.dining.dto.AdminDiningReportResponse;
+import in.koreatech.koin.domain.dining.dto.DiningReportPageResponse;
+import in.koreatech.koin.domain.dining.dto.DiningReportSummaryResponse;
+import in.koreatech.koin.global.auth.Auth;
+import in.koreatech.koin.global.code.ApiResponseCodes;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.security.SecurityRequirement;
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+@Tag(name = "(ADMIN) Dining: 식단 품절 제보 조회")
+@SecurityRequirement(name = "Jwt Authentication")
+public interface AdminDiningReportApi {
+
+    @ApiResponseCodes({OK, ILLEGAL_ARGUMENT, UNAUTHORIZED_USER, WITHDRAWN_USER, FORBIDDEN_USER_TYPE, FORBIDDEN_ADMIN})
+    @Operation(summary = "식단 품절 제보 목록 조회", description = """
+        - 인증된 ADMIN이 제보 요약을 조회합니다. 관리자 API는 조회 전용입니다.
+        - only_pending=true이면 PENDING 제보만 반환하며, 기본값 false이면 모든 상태를 조회합니다.
+        - 접수 시각·제보 ID 내림차순으로 반환하며, 조건에 맞는 제보가 없으면 빈 목록을 반환합니다.
+        """)
+    @GetMapping("/admin/dining/soldout-reports")
+    ResponseEntity<DiningReportPageResponse<DiningReportSummaryResponse>> getReports(
+        @Auth(permit = ADMIN) Integer adminId,
+        @Parameter(description = "대기 제보만 조회할지 여부", example = "false", schema = @Schema(defaultValue = "false"))
+        @RequestParam(name = "only_pending", defaultValue = "false") boolean onlyPending,
+        @Parameter(description = "페이지 번호. 1부터 시작하며 전체 페이지 범위로 보정합니다.", example = "1",
+            schema = @Schema(defaultValue = "1"))
+        @RequestParam(defaultValue = "1") Integer page,
+        @Parameter(description = "페이지당 제보 수. 1~50으로 보정합니다.", example = "10",
+            schema = @Schema(defaultValue = "10"))
+        @RequestParam(defaultValue = "10") Integer limit);
+
+    @ApiResponseCodes({
+        OK, ILLEGAL_ARGUMENT, UNAUTHORIZED_USER, WITHDRAWN_USER,
+        FORBIDDEN_USER_TYPE, FORBIDDEN_ADMIN, NOT_FOUND_DINING_REPORT
+    })
+    @Operation(summary = "식단 품절 제보 상세 조회",
+        description = "인증된 ADMIN이 사진·처리 이력·제보자 정보를 조회합니다. 관리자 API는 조회 전용입니다.")
+    @GetMapping("/admin/dining/soldout-reports/{reportId}")
+    ResponseEntity<AdminDiningReportResponse> getReport(
+        @Auth(permit = ADMIN) Integer adminId,
+        @Parameter(description = "조회할 제보 ID", example = "1", required = true)
+        @PathVariable Integer reportId);
+}

src/main/java/in/koreatech/koin/admin/dining/controller/AdminDiningReportController.java

@@ -0,0 +1,40 @@
+package in.koreatech.koin.admin.dining.controller;
+
+import static in.koreatech.koin.domain.user.model.UserType.ADMIN;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import in.koreatech.koin.admin.dining.dto.AdminDiningReportResponse;
+import in.koreatech.koin.domain.dining.dto.DiningReportPageResponse;
+import in.koreatech.koin.domain.dining.dto.DiningReportSummaryResponse;
+import in.koreatech.koin.domain.dining.service.DiningReportQueryService;
+import in.koreatech.koin.global.auth.Auth;
+import lombok.RequiredArgsConstructor;
+
+@RestController
+@RequiredArgsConstructor
+public class AdminDiningReportController implements AdminDiningReportApi {
+
+    private final DiningReportQueryService diningReportQueryService;
+
+    @GetMapping("/admin/dining/soldout-reports")
+    public ResponseEntity<DiningReportPageResponse<DiningReportSummaryResponse>> getReports(
+        @Auth(permit = ADMIN) Integer adminId,
+        @RequestParam(name = "only_pending", defaultValue = "false") boolean onlyPending,
+        @RequestParam(defaultValue = "1") Integer page,
+        @RequestParam(defaultValue = "10") Integer limit
+    ) {
+        return ResponseEntity.ok(diningReportQueryService.getAdminReports(onlyPending, page, limit));
+    }
+
+    @GetMapping("/admin/dining/soldout-reports/{reportId}")
+    public ResponseEntity<AdminDiningReportResponse> getReport(
+        @Auth(permit = ADMIN) Integer adminId, @PathVariable Integer reportId
+    ) {
+        return ResponseEntity.ok(diningReportQueryService.getAdminReport(reportId));
+    }
+}

src/main/java/in/koreatech/koin/admin/dining/dto/AdminDiningReportResponse.java

@@ -0,0 +1,101 @@
+package in.koreatech.koin.admin.dining.dto;
+
+import static com.fasterxml.jackson.databind.PropertyNamingStrategies.SnakeCaseStrategy;
+import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
+
+import java.time.LocalDateTime;
+import java.util.UUID;
+
+import org.springframework.util.StringUtils;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.databind.annotation.JsonNaming;
+
+import in.koreatech.koin.domain.dining.dto.DiningReportActor;
+import in.koreatech.koin.domain.dining.dto.DiningReportResponse;
+import in.koreatech.koin.domain.dining.model.DiningReport;
+import in.koreatech.koin.domain.dining.model.DiningReportProcessingType;
+import in.koreatech.koin.domain.dining.model.DiningReportStatus;
+import in.koreatech.koin.domain.user.model.User;
+import io.swagger.v3.oas.annotations.media.Schema;
+
+@JsonNaming(SnakeCaseStrategy.class)
+@JsonInclude(JsonInclude.Include.ALWAYS)
+@Schema(description = "관리자 조회용 제보 상세. 제보자 정보를 함께 반환합니다.", example = """
+    {
+      "report_id": 1,
+      "dining": {"id": 1, "date": "2026-10-02", "type": "LUNCH", "place": "A코너"},
+      "status": "APPROVED",
+      "processing_type": "MANUAL",
+      "reason": "담당자 승인",
+      "created_at": "2026-10-02 12:00:00",
+      "processed_at": "2026-10-02 12:01:00",
+      "processor": {"workspace_id": "T0123456789", "user_id": "U0123456789", "display_name": "홍길동"},
+      "image_url": "https://static.koreatech.in/upload/COOP/2026/10/2/e924c7d3-3757-4cd0-961b-e65c1f6cc8ad/soldout.jpg",
+      "processing_id": "550e8400-e29b-41d4-a716-446655440000",
+      "source_report_id": null,
+      "updated_at": "2026-10-02 12:01:00",
+      "reporter": {"id": 10, "name": "김코인"}
+    }
+    """)
+public record AdminDiningReportResponse(
+    @Schema(description = "제보 ID", example = "1", requiredMode = REQUIRED)
+    Integer reportId,
+    @Schema(description = "제보 대상 식단", requiredMode = REQUIRED)
+    DiningReportResponse.DiningReference dining,
+    @Schema(description = "제보 상태. PENDING은 대기, APPROVED는 승인, REJECTED는 반려입니다.",
+        example = "APPROVED", requiredMode = REQUIRED)
+    DiningReportStatus status,
+    @Schema(description = "MANUAL은 담당자 처리, SAME_DINING_APPROVED는 같은 식단 승인에 따른 자동 승인, "
+        + "COOP_PREPROCESSED는 영양사 품절에 따른 자동 반려입니다. 대기 중이면 null입니다.",
+        example = "MANUAL", nullable = true, requiredMode = REQUIRED)
+    DiningReportProcessingType processingType,
+    @Schema(description = "처리 사유. 대기 중이면 null입니다.", example = "담당자 승인", nullable = true, requiredMode = REQUIRED)
+    String reason,
+    @Schema(description = "접수 시각 (한국시간)", example = "2026-10-02 12:00:00",
+        implementation = String.class, type = "string", pattern = "^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$",
+        requiredMode = REQUIRED)
+    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss") LocalDateTime createdAt,
+    @Schema(description = "담당자 수동 처리 시각 (한국시간). 대기·자동 처리이면 null입니다.", example = "2026-10-02 12:01:00",
+        implementation = String.class, type = "string", pattern = "^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$",
+        nullable = true, requiredMode = REQUIRED)
+    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss") LocalDateTime processedAt,
+    @Schema(description = "담당자 수동 처리의 감사 정보. 대기·자동 처리이면 null입니다.", nullable = true, requiredMode = REQUIRED)
+    DiningReportActor processor,
+    @Schema(description = "접수한 공용 COOP 업로드의 원본 사진 URL",
+        example = "https://static.koreatech.in/upload/COOP/2026/10/2/"
+            + "e924c7d3-3757-4cd0-961b-e65c1f6cc8ad/soldout.jpg", format = "uri", requiredMode = REQUIRED)
+    String imageUrl,
+    @Schema(description = "함께 처리한 제보가 공유하는 처리 묶음 UUID. 대기 중이면 null입니다.",
+        example = "550e8400-e29b-41d4-a716-446655440000", type = "string", format = "uuid",
+        nullable = true, requiredMode = REQUIRED)
+    UUID processingId,
+    @Schema(description = "같은 식단의 자동 승인을 발생시킨 제보 ID. SAME_DINING_APPROVED일 때만 값이 있고 그 외에는 null입니다.",
+        example = "1", nullable = true, requiredMode = REQUIRED)
+    Integer sourceReportId,
+    @Schema(description = "마지막 상태 변경 시각 (한국시간)", example = "2026-10-02 12:01:00",
+        implementation = String.class, type = "string", pattern = "^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$",
+        requiredMode = REQUIRED)
+    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss") LocalDateTime updatedAt,
+    @Schema(description = "제보자 정보. 사용자 정보를 조회할 수 없으면 null입니다.", nullable = true, requiredMode = REQUIRED)
+    Reporter reporter
+) {
+    public static AdminDiningReportResponse from(DiningReport report, User user) {
+        DiningReportResponse detail = DiningReportResponse.from(report);
+        Reporter reporter = user == null ? null : new Reporter(user.getId(),
+            StringUtils.hasText(user.getName()) ? user.getName()
+                : StringUtils.hasText(user.getNickname()) ? user.getNickname() : "회원");
+        return new AdminDiningReportResponse(detail.reportId(), detail.dining(), detail.status(),
+            detail.processingType(), detail.reason(), detail.createdAt(), detail.processedAt(), detail.processor(),
+            detail.imageUrl(), detail.processingId(), detail.sourceReportId(), detail.updatedAt(), reporter);
+    }
+
+    public record Reporter(
+        @Schema(description = "제보자 사용자 ID", example = "10", requiredMode = REQUIRED)
+        Integer id,
+        @Schema(description = "제보자 이름. 이름이 없으면 닉네임 또는 회원을 반환합니다.", example = "김코인", requiredMode = REQUIRED)
+        String name
+    ) {
+    }
+}

src/main/java/in/koreatech/koin/domain/coop/dto/SoldOutRequest.java

@@ -16,7 +16,7 @@ public record SoldOutRequest(
 
     @Schema(description = "품절 여부", example = "true", requiredMode = REQUIRED)
     @NotNull(message = "품절 여부는 필수입니다.")
-    boolean soldOut
+    Boolean soldOut
 ) {
 
 }

src/main/java/in/koreatech/koin/domain/coop/service/CoopService.java

@@ -39,14 +39,14 @@
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Isolation;
 import org.springframework.transaction.annotation.Transactional;
 
 import net.lingala.zip4j.ZipFile;
 import net.lingala.zip4j.exception.ZipException;
 
 import in.koreatech.koin.admin.abtest.useragent.UserAgentInfo;
 import in.koreatech.koin.common.event.DiningImageUploadEvent;
-import in.koreatech.koin.common.event.DiningSoldOutEvent;
 import in.koreatech.koin.domain.coop.dto.CoopLoginRequest;
 import in.koreatech.koin.domain.coop.dto.CoopLoginResponse;
 import in.koreatech.koin.domain.coop.dto.CoopResponse;
@@ -57,18 +57,17 @@
 import in.koreatech.koin.domain.coop.exception.DuplicateExcelRequestException;
 import in.koreatech.koin.domain.coop.exception.StartDateAfterEndDateException;
 import in.koreatech.koin.domain.coop.model.Coop;
-import in.koreatech.koin.domain.coop.model.DiningSoldOutCache;
 import in.koreatech.koin.domain.coop.model.ExcelDownloadCache;
 import in.koreatech.koin.domain.coop.repository.CoopRepository;
 import in.koreatech.koin.domain.coop.repository.DiningNotifyCacheRepository;
-import in.koreatech.koin.domain.coop.repository.DiningSoldOutCacheRepository;
 import in.koreatech.koin.domain.coop.repository.ExcelDownloadCacheRepository;
 import in.koreatech.koin.domain.coopshop.model.CoopShopType;
 import in.koreatech.koin.domain.coopshop.service.CoopShopService;
 import in.koreatech.koin.domain.dining.model.Dining;
 import in.koreatech.koin.domain.dining.model.DiningType;
 import in.koreatech.koin.domain.dining.model.enums.ExcelDiningPosition;
 import in.koreatech.koin.domain.dining.repository.DiningRepository;
+import in.koreatech.koin.domain.dining.service.DiningReportService;
 import in.koreatech.koin.domain.user.model.User;
 import in.koreatech.koin.domain.user.repository.UserRepository;
 import in.koreatech.koin.domain.user.service.RefreshTokenService;
@@ -85,7 +84,7 @@ public class CoopService {
     private final Clock clock;
     private final ApplicationEventPublisher eventPublisher;
     private final DiningRepository diningRepository;
-    private final DiningSoldOutCacheRepository diningSoldOutCacheRepository;
+    private final DiningReportService diningReportService;
     private final ExcelDownloadCacheRepository excelDownloadCacheRepository;
     private final DiningNotifyCacheRepository diningNotifyCacheRepository;
     private final CoopRepository coopRepository;
@@ -105,22 +104,9 @@ public class CoopService {
     private static final int cornerColumnIndex = 1;
     private static final int mealAndColumnWidth = 4000;
 
-    @Transactional
+    @Transactional(isolation = Isolation.READ_COMMITTED)
     public void changeSoldOut(SoldOutRequest soldOutRequest) {
-        Dining dining = diningRepository.getById(soldOutRequest.menuId());
-
-        if (soldOutRequest.soldOut()) {
-            LocalDateTime now = LocalDateTime.now(clock);
-            dining.setSoldOut(now);
-            boolean isOpened = coopShopService.getIsOpened(now, CoopShopType.CAFETERIA, dining.getType(), false);
-            if (isOpened && diningSoldOutCacheRepository.findById(dining.getPlace()).isEmpty()) {
-                diningSoldOutCacheRepository.save(DiningSoldOutCache.from(dining.getPlace()));
-                eventPublisher.publishEvent(
-                    new DiningSoldOutEvent(dining.getId(), dining.getPlace(), dining.getType()));
-            }
-        } else {
-            dining.cancelSoldOut();
-        }
+        diningReportService.changeSoldOutByCoop(soldOutRequest.menuId(), soldOutRequest.soldOut());
     }
 
     @Transactional

src/main/java/in/koreatech/koin/domain/dining/auth/DiningReportBotInterceptor.java

@@ -0,0 +1,37 @@
+package in.koreatech.koin.domain.dining.auth;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+import java.security.MessageDigest;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import org.springframework.util.StringUtils;
+import org.springframework.web.servlet.HandlerInterceptor;
+
+import in.koreatech.koin.global.code.ApiResponseCode;
+import in.koreatech.koin.global.exception.CustomException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+@Component
+public class DiningReportBotInterceptor implements HandlerInterceptor {
+
+    private static final String SERVICE_TOKEN_HEADER = "X-Koin-Service-Token";
+
+    private final String botToken;
+
+    public DiningReportBotInterceptor(@Value("${dining.report.bot-token:}") String botToken) {
+        this.botToken = botToken;
+    }
+
+    @Override
+    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
+        String serviceToken = request.getHeader(SERVICE_TOKEN_HEADER);
+        if (!StringUtils.hasText(botToken) || !StringUtils.hasText(serviceToken)
+            || !MessageDigest.isEqual(botToken.getBytes(UTF_8), serviceToken.getBytes(UTF_8))) {
+            throw CustomException.of(ApiResponseCode.BOT_AUTHENTICATION_FAILED);
+        }
+        return true;
+    }
+}

src/main/java/in/koreatech/koin/domain/dining/config/DiningReportDeliveryProperties.java

@@ -0,0 +1,22 @@
+package in.koreatech.koin.domain.dining.config;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.stereotype.Component;
+import org.springframework.util.StringUtils;
+
+import lombok.Getter;
+import lombok.Setter;
+
+@Getter
+@Setter
+@Component
+@ConfigurationProperties(prefix = "dining.report.delivery")
+public class DiningReportDeliveryProperties {
+
+    private String workspaceId;
+    private String channelId;
+
+    public boolean isConfigured() {
+        return StringUtils.hasText(workspaceId) && StringUtils.hasText(channelId);
+    }
+}