API 통계 도메인 구조 개편 및 조회 기능 확장:

- API 통계 엔티티/리포지토리 다층 나눔 (분/시/일/월)
- API 상세/요약 통계 및 기간별 누적 통계 DTO 추가
- 고객센터 연락처 조회 로직 추가 (@ModelAttribute) - 글로벌 푸터 적용
- @EMSDataSource 지원 엔티티-패키지 다중 검색 적용
- 기존 ApiStatisticsRepository 삭제, 분리된 구성으로 대체

build.gradle

@@ -30,9 +30,12 @@ dependencies {
 
 	implementation 'com.eactive.elink.common:elink-common-data:4.5.5'
 
-//    implementation 'io.swagger.core.v3:swagger-core:2.2.25'
-//    implementation 'io.swagger.parser.v3:swagger-parser:2.1.23'
-    implementation fileTree(dir: 'libs/swagger', include: ['*.jar'])
+    // OpenAPI 3.0/3.1 spec 지원 (Nexus/Maven 해석). 기존 libs/swagger fileTree 대체.
+    // swagger 최신 릴리스(2.2.52/2.1.45)도 SpecVersion 은 V30/V31 까지만 — OpenAPI 3.2 는
+    // 아직 swagger-core/parser 어느 버전도 미지원. 지원 추가 시 버전만 상향하면 됨. JDK8 호환.
+    implementation 'io.swagger.core.v3:swagger-core:2.2.52'      // io.swagger.v3.oas.models.*, io.swagger.v3.core.util.Json
+    implementation 'io.swagger.parser.v3:swagger-parser:2.1.45'  // io.swagger.parser.OpenAPIParser, io.swagger.v3.parser.*
+    implementation 'io.swagger:swagger-annotations:1.6.14'       // io.swagger.annotations.ApiModelProperty (CommissionSearch)
 
     implementation project(':elink-online-core-jpa')
     implementation project(':elink-portal-common')

script/portal/oracle/6_ptl_two_factor_auth_recipient_key.sql

@@ -0,0 +1,23 @@
+-- =============================================================================
+-- 2FA 인증코드 조회용 결정적 해시 키 컬럼 추가
+-- 대상: EMS 스키마 소유자(EMSAPP 등)로 접속하여 실행
+-- 엔티티: com.eactive.apim.portal.portaluser.entity.TwoFactorAuth
+--
+-- 배경: RECIPIENT(이메일/휴대폰) 컬럼에 PersonalDataEncryptConverter 암호화가
+--       적용되면서, 값 동등 조회(WHERE RECIPIENT = ?)와 중복정리가 깨져
+--       인증코드 검증이 "일치하지 않습니다"로 실패함.
+-- 해결: RECIPIENT 는 암호화 보관(감사/표시용)을 유지하고, 평문의 결정적 해시
+--       (HMAC-SHA256, 소문자 hex 64자)를 RECIPIENT_KEY 에 저장하여 조회/정리에 사용.
+--
+-- ※ hibernate.hbm2ddl.auto=validate 이므로, 신규 엔티티 배포(재기동) "전"에
+--    반드시 이 스크립트를 먼저 실행해야 기동 검증을 통과함.
+-- =============================================================================
+
+ALTER TABLE PTL_TWO_FACTOR_AUTH ADD (RECIPIENT_KEY VARCHAR2(64));
+
+-- 인증코드 조회/중복정리는 RECIPIENT_KEY 기준
+CREATE INDEX IX_PTL_TWO_FACTOR_AUTH_RKEY ON PTL_TWO_FACTOR_AUTH (RECIPIENT_KEY);
+
+COMMENT ON COLUMN PTL_TWO_FACTOR_AUTH.RECIPIENT_KEY IS '수신자 결정적 해시 조회키 (HMAC-SHA256 hex). RECIPIENT 암호화로 깨지는 동등조회/중복정리용';
+
+COMMIT;

src/main/java/com/eactive/apim/gateway/data/statistics/entity/ApiStatsDay.java

@@ -0,0 +1,72 @@
+package com.eactive.apim.gateway.data.statistics.entity;
+
+import java.io.Serializable;
+import java.time.LocalDate;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.Table;
+
+import lombok.Getter;
+import lombok.Setter;
+
+/**
+ * API Gateway 일별 처리 통계 (AGWAPP.API_STATS_DAY) — 읽기 전용.
+ *
+ * 월별 조회 시 "현재 월"은 아직 API_STATS_MONTH 에 집계되지 않으므로(월 집계 잡은 익월 1일 실행)
+ * 현재 월분은 이 DAY 테이블에서 조회한다.
+ * 스키마명은 소스에 하드코딩하지 않는다(gateway default_schema=AGWAPP).
+ */
+@Getter
+@Setter
+@Entity
+@Table(name = "API_STATS_DAY")
+@IdClass(ApiStatsDayId.class)
+public class ApiStatsDay implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @Column(name = "STAT_TIME", nullable = false)
+    private LocalDate statTime;
+
+    @Id
+    @Column(name = "API_NAME", nullable = false, length = 100)
+    private String apiName;
+
+    @Id
+    @Column(name = "GW_INSTANCE_ID", nullable = false, length = 50)
+    private String gwInstanceId;
+
+    @Id
+    @Column(name = "BIZ_DIV_CODE", nullable = false, length = 50)
+    private String bizDivCode = "NONE";
+
+    @Id
+    @Column(name = "CLIENT_ID", nullable = false, length = 100)
+    private String clientId = "NONE";
+
+    @Id
+    @Column(name = "INBOUND_ADAPTER", nullable = false, length = 100)
+    private String inboundAdapter = "NONE";
+
+    @Id
+    @Column(name = "OUTBOUND_ADAPTER", nullable = false, length = 100)
+    private String outboundAdapter = "NONE";
+
+    @Column(name = "TOTAL_CNT", nullable = false)
+    private Long totalCnt = 0L;
+
+    @Column(name = "SUCCESS_CNT", nullable = false)
+    private Long successCnt = 0L;
+
+    @Column(name = "TIMEOUT_CNT", nullable = false)
+    private Long timeoutCnt = 0L;
+
+    @Column(name = "SYSTEM_ERR_CNT", nullable = false)
+    private Long systemErrCnt = 0L;
+
+    @Column(name = "BIZ_ERR_CNT", nullable = false)
+    private Long bizErrCnt = 0L;
+}

src/main/java/com/eactive/apim/gateway/data/statistics/entity/ApiStatsDayId.java

@@ -0,0 +1,26 @@
+package com.eactive.apim.gateway.data.statistics.entity;
+
+import java.io.Serializable;
+import java.time.LocalDate;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * API 통계 일별 복합키
+ */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class ApiStatsDayId implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    private LocalDate statTime;
+    private String apiName;
+    private String gwInstanceId;
+    private String bizDivCode;
+    private String clientId;
+    private String inboundAdapter;
+    private String outboundAdapter;
+}

src/main/java/com/eactive/apim/gateway/data/statistics/entity/ApiStatsHour.java

@@ -0,0 +1,71 @@
+package com.eactive.apim.gateway.data.statistics.entity;
+
+import java.io.Serializable;
+import java.time.LocalDateTime;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.Table;
+
+import lombok.Getter;
+import lombok.Setter;
+
+/**
+ * API Gateway 시간별 처리 통계 (AGWAPP.API_STATS_HOUR).
+ *
+ * 스키마명은 소스에 하드코딩하지 않는다 — gateway datasource 의 hibernate.default_schema(AGWAPP)로 해석된다.
+ * 포털은 읽기 전용으로만 사용한다(집계 주체는 eapim-admin 스케줄러). 사용 컬럼(카운트)만 매핑한다.
+ */
+@Getter
+@Setter
+@Entity
+@Table(name = "API_STATS_HOUR")
+@IdClass(ApiStatsHourId.class)
+public class ApiStatsHour implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @Column(name = "STAT_TIME", nullable = false)
+    private LocalDateTime statTime;
+
+    @Id
+    @Column(name = "API_NAME", nullable = false, length = 100)
+    private String apiName;
+
+    @Id
+    @Column(name = "GW_INSTANCE_ID", nullable = false, length = 50)
+    private String gwInstanceId;
+
+    @Id
+    @Column(name = "BIZ_DIV_CODE", nullable = false, length = 50)
+    private String bizDivCode = "NONE";
+
+    @Id
+    @Column(name = "CLIENT_ID", nullable = false, length = 100)
+    private String clientId = "NONE";
+
+    @Id
+    @Column(name = "INBOUND_ADAPTER", nullable = false, length = 100)
+    private String inboundAdapter = "NONE";
+
+    @Id
+    @Column(name = "OUTBOUND_ADAPTER", nullable = false, length = 100)
+    private String outboundAdapter = "NONE";
+
+    @Column(name = "TOTAL_CNT", nullable = false)
+    private Long totalCnt = 0L;
+
+    @Column(name = "SUCCESS_CNT", nullable = false)
+    private Long successCnt = 0L;
+
+    @Column(name = "TIMEOUT_CNT", nullable = false)
+    private Long timeoutCnt = 0L;
+
+    @Column(name = "SYSTEM_ERR_CNT", nullable = false)
+    private Long systemErrCnt = 0L;
+
+    @Column(name = "BIZ_ERR_CNT", nullable = false)
+    private Long bizErrCnt = 0L;
+}

src/main/java/com/eactive/apim/gateway/data/statistics/entity/ApiStatsHourId.java

@@ -0,0 +1,26 @@
+package com.eactive.apim.gateway.data.statistics.entity;
+
+import java.io.Serializable;
+import java.time.LocalDateTime;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * API 통계 시간별 복합키
+ */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class ApiStatsHourId implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    private LocalDateTime statTime;
+    private String apiName;
+    private String gwInstanceId;
+    private String bizDivCode;
+    private String clientId;
+    private String inboundAdapter;
+    private String outboundAdapter;
+}

src/main/java/com/eactive/apim/gateway/data/statistics/entity/ApiStatsMonth.java

@@ -0,0 +1,70 @@
+package com.eactive.apim.gateway.data.statistics.entity;
+
+import java.io.Serializable;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.Table;
+
+import lombok.Getter;
+import lombok.Setter;
+
+/**
+ * API Gateway 월별 처리 통계 (AGWAPP.API_STATS_MONTH).
+ *
+ * STAT_TIME 은 YYYYMM 문자열. 스키마명은 소스에 하드코딩하지 않는다(gateway default_schema=AGWAPP).
+ * 포털은 읽기 전용으로만 사용한다. 사용 컬럼(카운트)만 매핑한다.
+ */
+@Getter
+@Setter
+@Entity
+@Table(name = "API_STATS_MONTH")
+@IdClass(ApiStatsMonthId.class)
+public class ApiStatsMonth implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @Column(name = "STAT_TIME", nullable = false, length = 6)
+    private String statTime;  // YYYYMM format
+
+    @Id
+    @Column(name = "API_NAME", nullable = false, length = 100)
+    private String apiName;
+
+    @Id
+    @Column(name = "GW_INSTANCE_ID", nullable = false, length = 50)
+    private String gwInstanceId;
+
+    @Id
+    @Column(name = "BIZ_DIV_CODE", nullable = false, length = 50)
+    private String bizDivCode = "NONE";
+
+    @Id
+    @Column(name = "CLIENT_ID", nullable = false, length = 100)
+    private String clientId = "NONE";
+
+    @Id
+    @Column(name = "INBOUND_ADAPTER", nullable = false, length = 100)
+    private String inboundAdapter = "NONE";
+
+    @Id
+    @Column(name = "OUTBOUND_ADAPTER", nullable = false, length = 100)
+    private String outboundAdapter = "NONE";
+
+    @Column(name = "TOTAL_CNT", nullable = false)
+    private Long totalCnt = 0L;
+
+    @Column(name = "SUCCESS_CNT", nullable = false)
+    private Long successCnt = 0L;
+
+    @Column(name = "TIMEOUT_CNT", nullable = false)
+    private Long timeoutCnt = 0L;
+
+    @Column(name = "SYSTEM_ERR_CNT", nullable = false)
+    private Long systemErrCnt = 0L;
+
+    @Column(name = "BIZ_ERR_CNT", nullable = false)
+    private Long bizErrCnt = 0L;
+}

src/main/java/com/eactive/apim/gateway/data/statistics/entity/ApiStatsMonthId.java

@@ -0,0 +1,25 @@
+package com.eactive.apim.gateway.data.statistics.entity;
+
+import java.io.Serializable;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * API 통계 월별 복합키
+ */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class ApiStatsMonthId implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    private String statTime;  // YYYYMM format
+    private String apiName;
+    private String gwInstanceId;
+    private String bizDivCode;
+    private String clientId;
+    private String inboundAdapter;
+    private String outboundAdapter;
+}

src/main/java/com/eactive/apim/gateway/data/statistics/entity/GwAuthClient.java

@@ -0,0 +1,41 @@
+package com.eactive.apim.gateway.data.statistics.entity;
+
+import java.io.Serializable;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+import lombok.Getter;
+import lombok.Setter;
+
+/**
+ * GW 인증 Client 정보 (AGWAPP.TSEAIAU01) — 읽기 전용.
+ *
+ * API 통계의 org 스코핑에 사용한다: 통계 테이블에는 org_id 가 없으므로
+ * TSEAIAU01.ORGID 로 org 의 CLIENTID 목록을 구해 API_STATS_*.CLIENT_ID 와 매칭한다.
+ * (admin ApiUseStatsService 도 API_STATS.CLIENT_ID = TSEAIAU01.CLIENTID 로 조인)
+ *
+ * 스키마명은 소스에 하드코딩하지 않는다(gateway default_schema=AGWAPP).
+ */
+@Getter
+@Setter
+@Entity
+@Table(name = "TSEAIAU01")
+public class GwAuthClient implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @Column(name = "CLIENTID", nullable = false, length = 256)
+    private String clientId;
+
+    @Column(name = "CLIENTNAME", length = 150)
+    private String clientName;
+
+    @Column(name = "ORGID", length = 38)
+    private String orgId;
+
+    @Column(name = "APPSTATUS", length = 1)
+    private String appStatus;
+}

src/main/java/com/eactive/apim/gateway/data/statistics/entity/GwSvcInfo.java

@@ -0,0 +1,33 @@
+package com.eactive.apim.gateway.data.statistics.entity;
+
+import java.io.Serializable;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+import lombok.Getter;
+import lombok.Setter;
+
+/**
+ * GW 인터페이스(서비스) 정보 (AGWAPP.TSEAIHE01) — 읽기 전용.
+ *
+ * API_STATS_*.API_NAME 은 인터페이스 ID(=EAISVCNAME)이며, 화면 표시용 실제 명칭은 EAISVCDESC 다.
+ * (admin ApiUseStatsService 도 API_STATS.API_NAME = TSEAIHE01.EAISVCNAME 으로 조인)
+ * 스키마명은 소스에 하드코딩하지 않는다(gateway default_schema=AGWAPP).
+ */
+@Getter
+@Setter
+@Entity
+@Table(name = "TSEAIHE01")
+public class GwSvcInfo implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @Column(name = "EAISVCNAME", nullable = false, length = 30)
+    private String svcName;   // 인터페이스 ID (= API_STATS.API_NAME)
+
+    @Column(name = "EAISVCDESC", length = 400)
+    private String svcDesc;   // 인터페이스 표시 명칭
+}

src/main/java/com/eactive/apim/gateway/data/statistics/repository/ApiStatsDayRepository.java

@@ -0,0 +1,66 @@
+package com.eactive.apim.gateway.data.statistics.repository;
+
+import com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsDetailDto;
+import com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsSummaryDto;
+import com.eactive.apim.gateway.data.statistics.entity.ApiStatsDay;
+import com.eactive.apim.gateway.data.statistics.entity.ApiStatsDayId;
+import java.time.LocalDate;
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+
+/**
+ * API_STATS_DAY(AGWAPP) 조회 리포지토리.
+ * 월별 조회의 "현재 월" 분(아직 API_STATS_MONTH 미집계)을 일 범위로 합산하는 데 사용한다.
+ */
+public interface ApiStatsDayRepository extends JpaRepository<ApiStatsDay, ApiStatsDayId> {
+
+    /**
+     * 전체 요약 (일자 범위, 지정 clientId 집합).
+     */
+    @Query("SELECT new com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsSummaryDto(" +
+           "COALESCE(SUM(s.totalCnt), 0), COALESCE(SUM(s.successCnt), 0), COALESCE(SUM(s.timeoutCnt), 0), " +
+           "COALESCE(SUM(s.systemErrCnt), 0), COALESCE(SUM(s.bizErrCnt), 0)) " +
+           "FROM ApiStatsDay s " +
+           "WHERE s.clientId IN :clientIds " +
+           "AND s.statTime BETWEEN :startDate AND :endDate")
+    ApiStatisticsSummaryDto findSummary(
+        @Param("clientIds") List<String> clientIds,
+        @Param("startDate") LocalDate startDate,
+        @Param("endDate") LocalDate endDate);
+
+    /**
+     * API별 통계 (API_NAME 단위 집계).
+     */
+    @Query("SELECT new com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsDetailDto(" +
+           "s.apiName, COALESCE(SUM(s.totalCnt), 0), COALESCE(SUM(s.successCnt), 0), " +
+           "COALESCE(SUM(s.timeoutCnt), 0), COALESCE(SUM(s.systemErrCnt), 0), COALESCE(SUM(s.bizErrCnt), 0)) " +
+           "FROM ApiStatsDay s " +
+           "WHERE s.clientId IN :clientIds " +
+           "AND s.statTime BETWEEN :startDate AND :endDate " +
+           "GROUP BY s.apiName " +
+           "ORDER BY SUM(s.totalCnt) DESC")
+    List<ApiStatisticsDetailDto> findDetail(
+        @Param("clientIds") List<String> clientIds,
+        @Param("startDate") LocalDate startDate,
+        @Param("endDate") LocalDate endDate);
+
+    /**
+     * 일자별 누적 통계 (월별 조회 하단 표에 사용 — 월별이라도 일별로 표기).
+     * 생성자 표현식 안의 FUNCTION 은 Hibernate 5.6 이 타입 해석을 못 하므로 Object[] 로 받는다.
+     * row: [0]=일자(String yyyy-MM-dd), [1]=total, [2]=success, [3]=timeout, [4]=systemErr, [5]=biz
+     */
+    @Query("SELECT FUNCTION('TO_CHAR', s.statTime, 'YYYY-MM-DD'), " +
+           "COALESCE(SUM(s.totalCnt), 0), COALESCE(SUM(s.successCnt), 0), " +
+           "COALESCE(SUM(s.timeoutCnt), 0), COALESCE(SUM(s.systemErrCnt), 0), COALESCE(SUM(s.bizErrCnt), 0) " +
+           "FROM ApiStatsDay s " +
+           "WHERE s.clientId IN :clientIds " +
+           "AND s.statTime BETWEEN :startDate AND :endDate " +
+           "GROUP BY FUNCTION('TO_CHAR', s.statTime, 'YYYY-MM-DD') " +
+           "ORDER BY FUNCTION('TO_CHAR', s.statTime, 'YYYY-MM-DD')")
+    List<Object[]> findPeriodByDay(
+        @Param("clientIds") List<String> clientIds,
+        @Param("startDate") LocalDate startDate,
+        @Param("endDate") LocalDate endDate);
+}

src/main/java/com/eactive/apim/gateway/data/statistics/repository/ApiStatsHourRepository.java

@@ -0,0 +1,56 @@
+package com.eactive.apim.gateway.data.statistics.repository;
+
+import com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsDetailDto;
+import com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsSummaryDto;
+import com.eactive.apim.gateway.data.statistics.entity.ApiStatsHour;
+import com.eactive.apim.gateway.data.statistics.entity.ApiStatsHourId;
+import java.time.LocalDateTime;
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+
+/**
+ * API_STATS_HOUR(AGWAPP) 조회 리포지토리.
+ *
+ * 통계 수치는 보존기간이 긴 API_STATS_DAY 를 사용하되, "오늘"은 아직 DAY 로 집계되지 않았으므로
+ * (일 집계 잡은 익일 실행) 오늘분만 HOUR 에서 합산해 DAY 결과에 더한다. 최신 집계 시각도 HOUR 로 산출.
+ */
+public interface ApiStatsHourRepository extends JpaRepository<ApiStatsHour, ApiStatsHourId> {
+
+    /**
+     * 전체 요약 (시각 범위, 지정 clientId 집합) — 오늘분 합산용.
+     */
+    @Query("SELECT new com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsSummaryDto(" +
+           "COALESCE(SUM(s.totalCnt), 0), COALESCE(SUM(s.successCnt), 0), COALESCE(SUM(s.timeoutCnt), 0), " +
+           "COALESCE(SUM(s.systemErrCnt), 0), COALESCE(SUM(s.bizErrCnt), 0)) " +
+           "FROM ApiStatsHour s " +
+           "WHERE s.clientId IN :clientIds " +
+           "AND s.statTime BETWEEN :startTime AND :endTime")
+    ApiStatisticsSummaryDto findSummary(
+        @Param("clientIds") List<String> clientIds,
+        @Param("startTime") LocalDateTime startTime,
+        @Param("endTime") LocalDateTime endTime);
+
+    /**
+     * API별 통계 (API_NAME 단위 집계) — 오늘분 합산용.
+     */
+    @Query("SELECT new com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsDetailDto(" +
+           "s.apiName, COALESCE(SUM(s.totalCnt), 0), COALESCE(SUM(s.successCnt), 0), " +
+           "COALESCE(SUM(s.timeoutCnt), 0), COALESCE(SUM(s.systemErrCnt), 0), COALESCE(SUM(s.bizErrCnt), 0)) " +
+           "FROM ApiStatsHour s " +
+           "WHERE s.clientId IN :clientIds " +
+           "AND s.statTime BETWEEN :startTime AND :endTime " +
+           "GROUP BY s.apiName " +
+           "ORDER BY SUM(s.totalCnt) DESC")
+    List<ApiStatisticsDetailDto> findDetail(
+        @Param("clientIds") List<String> clientIds,
+        @Param("startTime") LocalDateTime startTime,
+        @Param("endTime") LocalDateTime endTime);
+
+    /**
+     * 최신 집계 시각 (안내 문구용). 데이터 없으면 null.
+     */
+    @Query("SELECT MAX(s.statTime) FROM ApiStatsHour s WHERE s.clientId IN :clientIds")
+    LocalDateTime findLatestStatTime(@Param("clientIds") List<String> clientIds);
+}

src/main/java/com/eactive/apim/gateway/data/statistics/repository/ApiStatsMonthRepository.java

@@ -0,0 +1,54 @@
+package com.eactive.apim.gateway.data.statistics.repository;
+
+import com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsDetailDto;
+import com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsSummaryDto;
+import com.eactive.apim.gateway.data.statistics.entity.ApiStatsMonth;
+import com.eactive.apim.gateway.data.statistics.entity.ApiStatsMonthId;
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+
+/**
+ * API_STATS_MONTH(AGWAPP) 통계 조회 리포지토리 (월별 모드).
+ * STAT_TIME 은 YYYYMM 문자열이므로 문자열 범위 비교로 조회한다.
+ */
+public interface ApiStatsMonthRepository extends JpaRepository<ApiStatsMonth, ApiStatsMonthId> {
+
+    /**
+     * 전체 요약 (YYYYMM 범위, 지정 clientId 집합).
+     */
+    @Query("SELECT new com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsSummaryDto(" +
+           "COALESCE(SUM(s.totalCnt), 0), COALESCE(SUM(s.successCnt), 0), COALESCE(SUM(s.timeoutCnt), 0), " +
+           "COALESCE(SUM(s.systemErrCnt), 0), COALESCE(SUM(s.bizErrCnt), 0)) " +
+           "FROM ApiStatsMonth s " +
+           "WHERE s.clientId IN :clientIds " +
+           "AND s.statTime BETWEEN :startMonth AND :endMonth")
+    ApiStatisticsSummaryDto findSummary(
+        @Param("clientIds") List<String> clientIds,
+        @Param("startMonth") String startMonth,
+        @Param("endMonth") String endMonth);
+
+    /**
+     * API별 통계 (API_NAME 단위 집계).
+     */
+    @Query("SELECT new com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsDetailDto(" +
+           "s.apiName, COALESCE(SUM(s.totalCnt), 0), COALESCE(SUM(s.successCnt), 0), " +
+           "COALESCE(SUM(s.timeoutCnt), 0), COALESCE(SUM(s.systemErrCnt), 0), COALESCE(SUM(s.bizErrCnt), 0)) " +
+           "FROM ApiStatsMonth s " +
+           "WHERE s.clientId IN :clientIds " +
+           "AND s.statTime BETWEEN :startMonth AND :endMonth " +
+           "GROUP BY s.apiName " +
+           "ORDER BY SUM(s.totalCnt) DESC")
+    List<ApiStatisticsDetailDto> findDetail(
+        @Param("clientIds") List<String> clientIds,
+        @Param("startMonth") String startMonth,
+        @Param("endMonth") String endMonth);
+
+    /**
+     * 조회 가능한 월 목록 (YYYYMM, 최신순).
+     */
+    @Query("SELECT DISTINCT s.statTime FROM ApiStatsMonth s " +
+           "WHERE s.clientId IN :clientIds ORDER BY s.statTime DESC")
+    List<String> findAvailableMonths(@Param("clientIds") List<String> clientIds);
+}

src/main/java/com/eactive/apim/gateway/data/statistics/repository/GwAuthClientRepository.java

@@ -0,0 +1,25 @@
+package com.eactive.apim.gateway.data.statistics.repository;
+
+import com.eactive.apim.gateway.data.statistics.entity.GwAuthClient;
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+
+/**
+ * TSEAIAU01(AGWAPP 인증 Client) 조회 — API 통계 org 스코핑용.
+ * PTL_ORG.ID == TSEAIAU01.ORGID (1:N), TSEAIAU01.CLIENTID == API_STATS_*.CLIENT_ID.
+ */
+public interface GwAuthClientRepository extends JpaRepository<GwAuthClient, String> {
+
+    /**
+     * org 소속 클라이언트 목록 (앱 선택 드롭다운용).
+     */
+    List<GwAuthClient> findByOrgIdOrderByClientNameAsc(String orgId);
+
+    /**
+     * org 소속 CLIENTID 목록 (통계 필터용).
+     */
+    @Query("SELECT c.clientId FROM GwAuthClient c WHERE c.orgId = :orgId")
+    List<String> findClientIdsByOrgId(@Param("orgId") String orgId);
+}

src/main/java/com/eactive/apim/gateway/data/statistics/repository/GwSvcInfoRepository.java

@@ -0,0 +1,14 @@
+package com.eactive.apim.gateway.data.statistics.repository;
+
+import com.eactive.apim.gateway.data.statistics.entity.GwSvcInfo;
+import java.util.Collection;
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+/**
+ * TSEAIHE01(AGWAPP 인터페이스 정보) 조회 — API_NAME(인터페이스 ID) → 표시명(EAISVCDESC) 매핑용.
+ */
+public interface GwSvcInfoRepository extends JpaRepository<GwSvcInfo, String> {
+
+    List<GwSvcInfo> findBySvcNameIn(Collection<String> svcNames);
+}

src/main/java/com/eactive/apim/portal/apps/apis/controller/TestbedSpecController.java

@@ -2,15 +2,15 @@ package com.eactive.apim.portal.apps.apis.controller;
 
 import com.eactive.apim.portal.apispec.entity.ApiSpecInfo;
 import com.eactive.apim.portal.apispec.service.ApiSpecInfoService;
-import com.eactive.apim.portal.apps.apis.service.ApiService;
-import com.eactive.apim.portal.apps.apiservice.service.ApiSpecService;
+import com.eactive.apim.portal.djb.testbed.service.DjbTestbedSpecServerRewriter;
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.Optional;
+import javax.servlet.http.HttpServletRequest;
+import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.core.io.Resource;
-import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.util.FileCopyUtils;
@@ -22,35 +22,45 @@ import org.springframework.web.bind.annotation.RestController;
 
 @RestController
 @RequestMapping("/api/apis")
+@RequiredArgsConstructor
 @Slf4j
 public class TestbedSpecController {
 
-    @Autowired
-    private ApiSpecInfoService apiSpecInfoService;
+    private final ApiSpecInfoService apiSpecInfoService;
+    private final DjbTestbedSpecServerRewriter serverRewriter;
 
     private static final String DEFAULT_TOKEN_API_ID = "default-token-api-spec";
     private static final String DEFAULT_SPEC_PATH = "swagger/default-token-api-spec.json";
 
     @GetMapping(value = "/{id}/swagger.json", produces = MediaType.APPLICATION_JSON_VALUE)
-    public ResponseEntity<String> getSwagger(@PathVariable String id) {
+    public ResponseEntity<String> getSwagger(@PathVariable String id, HttpServletRequest request) {
+        String json = buildSpecJson(id, request);
+        return json == null ? ResponseEntity.notFound().build() : ResponseEntity.ok(json);
+    }
 
+    @GetMapping(value = "/{id}/swagger.yaml", produces = "application/x-yaml")
+    public ResponseEntity<String> getSwaggerYaml(@PathVariable String id, HttpServletRequest request) {
+        String json = buildSpecJson(id, request);
+        return json == null ? ResponseEntity.notFound().build() : ResponseEntity.ok(serverRewriter.toYaml(json));
+    }
+
+    /** default 토큰 spec 또는 저장 spec(서버 sentinel → 설정별 실주소 치환)을 JSON 으로 반환. 없으면 null. */
+    private String buildSpecJson(String id, HttpServletRequest request) {
         if (DEFAULT_TOKEN_API_ID.equals(id)) {
             try {
                 Resource resource = new ClassPathResource(DEFAULT_SPEC_PATH);
-                String content = new String(FileCopyUtils.copyToByteArray(resource.getInputStream()));
-                return ResponseEntity.ok().body(content);
+                String content = new String(FileCopyUtils.copyToByteArray(resource.getInputStream()), StandardCharsets.UTF_8);
+                return serverRewriter.rewriteServer(content, null, request);
             } catch (IOException e) {
                 log.error("Failed to read default token api spec file", e);
-                return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).build();
+                return null;
             }
         }
 
         Optional<ApiSpecInfo> spec = apiSpecInfoService.findById(id);
-
-        if (!spec.isPresent()) {
-            StringUtils.hasText(spec.get().getTestbedSpec());
+        if (!spec.isPresent() || !StringUtils.hasText(spec.get().getTestbedSpec())) {
+            return null;
         }
-        return ResponseEntity.ok().body(spec.get().getTestbedSpec());
-
+        return serverRewriter.rewriteServer(spec.get().getTestbedSpec(), spec.get(), request);
     }
 }

src/main/java/com/eactive/apim/portal/apps/apis/filter/APISender.java

@@ -1,5 +1,6 @@
 package com.eactive.apim.portal.apps.apis.filter;
 
+import com.eactive.apim.portal.djb.testbed.config.DjbTestbedGatewayProperty;
 import java.io.BufferedReader;
 import java.io.DataOutputStream;
 import java.io.IOException;
@@ -20,6 +21,20 @@ public class APISender {
 
     private static final Logger logger = LoggerFactory.getLogger(APISender.class);
 
+    // 테스트베드 프록시 연결/응답 타임아웃 — DjbTestbedGatewayProperty(djb.gateway.timeout, 단위: 초) 단일 기준.
+    private final DjbTestbedGatewayProperty gatewayProperty;
+
+    public APISender(DjbTestbedGatewayProperty gatewayProperty) {
+        this.gatewayProperty = gatewayProperty;
+    }
+
+    /** connect/read 타임아웃 적용. 반드시 connect(getOutputStream/getResponseCode) 이전에 호출. */
+    private void applyTimeout(HttpURLConnection connection) {
+        int t = gatewayProperty.timeoutMillis();
+        connection.setConnectTimeout(t);
+        connection.setReadTimeout(t);
+    }
+
     public String requestPost(String uri, String requestBody) throws IOException {
 
         HttpURLConnection connection = getHttpURLConnection(uri, requestBody);
@@ -58,6 +73,7 @@ public class APISender {
 
         URL endpoint = new URL(appendUriAndParams(uri, params));
         HttpURLConnection connection = (HttpURLConnection) endpoint.openConnection();
+        applyTimeout(connection);
         connection.setRequestMethod("GET");
         connection.setRequestProperty("Accept", "application/json");
         for (Map.Entry<String, String> entry : headers.entrySet()) {
@@ -82,6 +98,7 @@ public class APISender {
 
         URL endpoint = new URL(appendUriAndParams(uri, params));
         HttpURLConnection connection = (HttpURLConnection) endpoint.openConnection();
+        applyTimeout(connection);
         connection.setRequestMethod("POST");
 
         for (Map.Entry<String, String> entry : headers.entrySet()) {
@@ -125,10 +142,11 @@ public class APISender {
         return response.toString();
     }
 
-    private static HttpURLConnection getHttpURLConnection(String uri, String requestBody) throws IOException {
+    private HttpURLConnection getHttpURLConnection(String uri, String requestBody) throws IOException {
         URL endpoint = new URL(uri);
 
         HttpURLConnection connection = (HttpURLConnection) endpoint.openConnection();
+        applyTimeout(connection);
 
         connection.setRequestMethod("POST");
         connection.setRequestProperty("Content-Type", "application/json; charset=utf-8");

src/main/java/com/eactive/apim/portal/apps/apis/filter/ApiTesterFilter.java

@@ -4,6 +4,8 @@ package com.eactive.apim.portal.apps.apis.filter;
 import com.eactive.apim.portal.apps.apis.dto.ApiSpecInfoDto;
 import com.eactive.apim.portal.apps.apis.service.ApiService;
 import com.eactive.apim.portal.common.util.ApplicationContextUtil;
+import com.eactive.apim.portal.djb.testbed.config.DjbTestbedGatewayProperty;
+import com.eactive.apim.portal.djb.testbed.enums.DjbGatewayMode;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.net.URI;
@@ -20,6 +22,7 @@ import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import javax.servlet.annotation.WebFilter;
 import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -65,7 +68,23 @@ public class ApiTesterFilter implements Filter {
         ApiService apiSpecInfoDtoService = ApplicationContextUtil.getContext().getBean(ApiService.class);
         String url = httpServletRequest.getHeader("original-url");
 
-        if (url.contains("/api/v1/oauth/token")){
+        // original-url 헤더가 없으면 프록시 대상을 알 수 없음 → 400 (NPE 방지)
+        if (url == null || url.trim().isEmpty()) {
+            writeJson(response, HttpServletResponse.SC_BAD_REQUEST, "{\"error\":\"original-url 헤더가 없습니다.\"}");
+            return;
+        }
+
+        // 실제 프록시 호출(토큰/gw/mock)은 네트워크 오류·타임아웃도 응답 content-type(JSON)에 맞춰
+        // 반환하기 위해 try 로 감싼다.
+        try {
+
+        // 게이트웨이 모드에 따라 OAuth 토큰 발급 요청을 mock 또는 실 게이트웨이 forward 로 분기 (DJPGPT0001)
+        DjbTestbedGatewayProperty gatewayProperty = ApplicationContextUtil.getContext().getBean(DjbTestbedGatewayProperty.class);
+        DjbGatewayMode gatewayMode = gatewayProperty.resolveGatewayMode();
+        boolean tokenRequest = url.contains(DjbTestbedGatewayProperty.PORTAL_MOCK_TOKEN_PATH)
+                || url.contains(gatewayProperty.tokenPath());
+
+        if (tokenRequest) {
             StringBuilder sb = new StringBuilder();
             BufferedReader reader = httpServletRequest.getReader();
             String line;
@@ -74,7 +93,8 @@ public class ApiTesterFilter implements Filter {
             }
             String body = sb.toString();
 
-            // Parse request parameters
+            if (gatewayMode == DjbGatewayMode.PORTAL_MOCK) {
+                // PortalMock: 고정 mock 토큰 반환 (기존 동작 유지)
                 Map<String, String> params = new HashMap<>();
                 String[] pairs = body.split("&");
                 for (String pair : pairs) {
@@ -95,63 +115,154 @@ public class ApiTesterFilter implements Filter {
 
                 response.setContentType("application/json");
                 response.getWriter().println(token);
+            } else {
+                // GATEWAY: 실 게이트웨이 토큰 엔드포인트로 forward (token 발급만)
+                APISender apiSender = ApplicationContextUtil.getContext().getBean(APISender.class);
+                Map<String, String> headers = new HashMap<>();
+                headers.put("Content-Type", "application/x-www-form-urlencoded");
+                headers.put("Accept", "application/json");
+                String target = gatewayProperty.baseUrl() + gatewayProperty.tokenPath();
+                String tokenResponse = apiSender.requestPost(target, headers, new HashMap<>(), body);
+
+                response.setContentType("application/json");
+                response.getWriter().println(tokenResponse);
+            }
 
         } else {
             ApiSpecInfoDto apiSpecInfoDto = apiSpecInfoDtoService.selectDetailByURLAndMethod(parseUri(url), httpServletRequest.getMethod());
 
-            if (apiSpecInfoDto.getResponseType() == null || apiSpecInfoDto.getResponseType().equals("sample")) {
+            // URL/메서드에 해당하는 API 명세가 없으면 404 (NPE 방지)
+            if (apiSpecInfoDto == null) {
+                writeJson(response, HttpServletResponse.SC_NOT_FOUND,
+                        "{\"error\":\"해당 URL/메서드의 API 명세를 찾을 수 없습니다.\"}");
+                return;
+            }
+
+            String responseType = apiSpecInfoDto.getResponseType();
+
+            // sample(기본): 저장된 샘플 응답 반환 (실호출 없음)
+            if (responseType == null || responseType.equalsIgnoreCase("sample")) {
                 response.setContentType("application/json");
                 response.getWriter().println(apiSpecInfoDto.getSampleResponse());
-            } else {
-                String mockUrl = apiSpecInfoDto.getMockUrl();
-                String method = apiSpecInfoDto.getApiMethod();
-                Enumeration<String> headerNames = httpServletRequest.getHeaderNames();
+                return;
+            }
+
+            // gw / mock: 실주소로 forward. swagger 서버 표시(DjbTestbedSpecServerRewriter)와 동일하게 맞춘다.
+            //   - gw   : djb.gateway.base-url + path == original-url 전체 (spec servers[0].url + path)
+            //   - mock : ApiSpecInfo.mockUrl (기존 동작)
+            boolean gw = "gw".equalsIgnoreCase(responseType);
 
             Map<String, String> headers = new HashMap<>();
+            Enumeration<String> headerNames = httpServletRequest.getHeaderNames();
             while (headerNames.hasMoreElements()) {
                 String header = headerNames.nextElement();
                 headers.put(header, httpServletRequest.getHeader(header));
             }
-                Map<String, String[]> paramMap = new HashMap<>();
-
-                String originalUrl = headers.get("original-url");
-                //sprlit original url with ? get the second part then split with & put into paramMap
-
-                String[] originalUrlArr = originalUrl.split("\\?");
-                if (originalUrlArr.length > 1) {
-                    String[] paramArr = originalUrlArr[1].split("&");
-                    for (String param : paramArr) {
-                        String[] paramKeyValue = param.split("=");
-                        if (paramKeyValue.length > 1) {
-                            paramMap.put(paramKeyValue[0], new String[]{paramKeyValue[1]});
-                        }
-                    }
-                }
-
             headers.remove("original-url");
             headers.remove("original-api-id");
-                APISender apiSender = ApplicationContextUtil.getContext().getBean(APISender.class);
-
-                String responseStr = "";
-                if (method.equalsIgnoreCase("post")) {
-                    StringBuilder sb = new StringBuilder();
-                    BufferedReader reader = httpServletRequest.getReader();
-                    String line;
-                    while ((line = reader.readLine()) != null) {
-                        sb.append(line);
-                    }
-                    String body = sb.toString();
-                    responseStr = apiSender.requestPost(mockUrl, headers, paramMap, body);
 
+            String targetUri;
+            Map<String, String[]> paramMap;
+            if (gw) {
+                // original-url 이 이미 (게이트웨이주소 + path + query) 전체이므로 그대로 대상 URL 로 사용.
+                // 프록시 대상 호스트가 바뀌므로 Host 헤더는 제거해 대상 호스트로 자동 설정되게 한다.
+                headers.remove("host");
+                headers.remove("Host");
+                targetUri = url;
+                paramMap = new HashMap<>();
             } else {
-                    responseStr = apiSender.requestGet(mockUrl, headers, paramMap);
+                // mock: 저장된 mockUrl 로 forward하고, original-url 의 쿼리스트링을 재부착 (기존 동작 유지)
+                targetUri = apiSpecInfoDto.getMockUrl();
+                paramMap = extractQueryParams(url);
+            }
+
+            APISender apiSender = ApplicationContextUtil.getContext().getBean(APISender.class);
+            String responseStr;
+            if ("post".equalsIgnoreCase(apiSpecInfoDto.getApiMethod())) {
+                responseStr = apiSender.requestPost(targetUri, headers, paramMap, readBody(httpServletRequest));
+            } else {
+                responseStr = apiSender.requestGet(targetUri, headers, paramMap);
             }
             response.setContentType("application/json");
             response.getWriter().println(responseStr);
         }
+
+        } catch (java.net.SocketTimeoutException e) {
+            // 연결/응답 타임아웃 (djb.gateway.timeout 초과)
+            logger.warn("테스트베드 프록시 타임아웃: {}", e.getMessage());
+            writeJson(response, HttpServletResponse.SC_GATEWAY_TIMEOUT,
+                    "{\"error\":\"게이트웨이 응답 시간 초과(timeout)\",\"detail\":\"" + escapeJson(e.getMessage()) + "\"}");
+        } catch (IOException e) {
+            // 연결 실패 등 네트워크 오류
+            logger.error("테스트베드 프록시 호출 실패", e);
+            writeJson(response, HttpServletResponse.SC_BAD_GATEWAY,
+                    "{\"error\":\"게이트웨이 호출 실패\",\"detail\":\"" + escapeJson(e.getMessage()) + "\"}");
+        } catch (Exception e) {
+            // 그 외 예기치 못한 오류도 JSON 으로 반환
+            logger.error("테스트베드 프록시 처리 오류", e);
+            writeJson(response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
+                    "{\"error\":\"요청 처리 중 오류\",\"detail\":\"" + escapeJson(e.getMessage()) + "\"}");
         }
     }
 
+    /** 요청 본문 전체를 문자열로 읽는다. */
+    private String readBody(HttpServletRequest request) throws IOException {
+        StringBuilder sb = new StringBuilder();
+        BufferedReader reader = request.getReader();
+        String line;
+        while ((line = reader.readLine()) != null) {
+            sb.append(line);
+        }
+        return sb.toString();
+    }
+
+    /** original-url 의 쿼리스트링(?a=1&b=2)을 파라미터 맵으로 파싱. */
+    private Map<String, String[]> extractQueryParams(String originalUrl) {
+        Map<String, String[]> paramMap = new HashMap<>();
+        String[] parts = originalUrl.split("\\?");
+        if (parts.length > 1) {
+            for (String param : parts[1].split("&")) {
+                String[] kv = param.split("=");
+                if (kv.length > 1) {
+                    paramMap.put(kv[0], new String[]{kv[1]});
+                }
+            }
+        }
+        return paramMap;
+    }
+
+    /** 상태코드 + JSON 본문 응답. */
+    private void writeJson(ServletResponse response, int status, String json) throws IOException {
+        ((HttpServletResponse) response).setStatus(status);
+        response.setContentType("application/json");
+        response.getWriter().println(json);
+    }
+
+    /** JSON 문자열 값에 넣기 위한 최소 escape (예외 메시지 등). */
+    private String escapeJson(String s) {
+        if (s == null) {
+            return "";
+        }
+        StringBuilder sb = new StringBuilder();
+        for (int i = 0; i < s.length(); i++) {
+            char c = s.charAt(i);
+            switch (c) {
+                case '\\': sb.append("\\\\"); break;
+                case '"':  sb.append("\\\""); break;
+                case '\n': sb.append("\\n"); break;
+                case '\r': sb.append("\\r"); break;
+                case '\t': sb.append("\\t"); break;
+                default:
+                    if (c < 0x20) {
+                        sb.append(String.format("\\u%04x", (int) c));
+                    } else {
+                        sb.append(c);
+                    }
+            }
+        }
+        return sb.toString();
+    }
+
     @Override
     public void destroy() {
         // Do nothing

src/main/java/com/eactive/apim/portal/apps/community/partnership/controller/PartnershipApplicationController.java

@@ -40,6 +40,7 @@ public class PartnershipApplicationController {
 
         model.addAttribute("partnership", new PartnershipApplicationDTO());
         model.addAttribute("isInternalUser", UserTypeUtil.isCurrentUserInternal());
+        model.addAttribute("recentApplications", partnershipApplicationFacade.getMyRecentApplications());
         return "apps/community/mainPartnershipForm";
     }
 

src/main/java/com/eactive/apim/portal/apps/community/partnership/dto/PartnershipApplicationSummaryDTO.java

@@ -0,0 +1,23 @@
+package com.eactive.apim.portal.apps.community.partnership.dto;
+
+import java.time.LocalDateTime;
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * 작성폼 상단 "내가 작성한 최근 글" 아코디언에 노출하기 위한 조회 전용 DTO.
+ */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class PartnershipApplicationSummaryDTO {
+
+    private String id;
+
+    private String bizSubject;
+
+    private String bizDetail;
+
+    private LocalDateTime createdDate;
+}

src/main/java/com/eactive/apim/portal/apps/community/partnership/mapper/PartnershipApplicationMapper.java

@@ -2,8 +2,10 @@ package com.eactive.apim.portal.apps.community.partnership.mapper;
 
 
 import com.eactive.apim.portal.apps.community.partnership.dto.PartnershipApplicationDTO;
+import com.eactive.apim.portal.apps.community.partnership.dto.PartnershipApplicationSummaryDTO;
 import com.eactive.apim.portal.common.mapper.CommonMapper;
 import com.eactive.apim.portal.partnershipapplication.entity.PartnershipApplication;
+import java.util.List;
 import org.mapstruct.Mapper;
 import org.mapstruct.ReportingPolicy;
 import org.springframework.stereotype.Component;
@@ -16,4 +18,8 @@ import org.springframework.stereotype.Component;
 public interface PartnershipApplicationMapper {
 
     PartnershipApplication toEntity(PartnershipApplicationDTO dto);
+
+    PartnershipApplicationSummaryDTO toSummaryDto(PartnershipApplication entity);
+
+    List<PartnershipApplicationSummaryDTO> toSummaryDtoList(List<PartnershipApplication> entities);
 }

src/main/java/com/eactive/apim/portal/apps/community/partnership/repository/PartnershipApplicationRepository.java

@@ -2,6 +2,7 @@ package com.eactive.apim.portal.apps.community.partnership.repository;
 
 import com.eactive.apim.portal.partnershipapplication.entity.PartnershipApplication;
 import com.eactive.eai.rms.data.EMSDataSource;
+import java.util.List;
 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.data.jpa.repository.JpaSpecificationExecutor;
 import org.springframework.stereotype.Repository;
@@ -9,4 +10,10 @@ import org.springframework.stereotype.Repository;
 @Repository
 @EMSDataSource
 public interface PartnershipApplicationRepository extends JpaRepository<PartnershipApplication, String>, JpaSpecificationExecutor<PartnershipApplication> {
+
+    /**
+     * 특정 작성자(createdBy)가 등록한 최근 3건을 최신순으로 조회한다.
+     * createdBy 는 PersonalDataEncryptConverter 로 결정적 암호화되므로 평문 사용자 id 로 등가 조회가 가능하다.
+     */
+    List<PartnershipApplication> findTop3ByCreatedByOrderByCreatedDateDesc(String createdBy);
 }

src/main/java/com/eactive/apim/portal/apps/community/partnership/service/PartnershipApplicationFacade.java

@@ -1,9 +1,16 @@
 package com.eactive.apim.portal.apps.community.partnership.service;
 
 import com.eactive.apim.portal.apps.community.partnership.dto.PartnershipApplicationDTO;
+import com.eactive.apim.portal.apps.community.partnership.dto.PartnershipApplicationSummaryDTO;
 import java.io.IOException;
+import java.util.List;
 
 public interface PartnershipApplicationFacade {
 
     void createPartnershipApplication(PartnershipApplicationDTO partnershipApplicationDTO) throws IOException;
+
+    /**
+     * 현재 로그인 사용자가 작성한 최근 3건을 조회한다. 미인증이면 빈 목록.
+     */
+    List<PartnershipApplicationSummaryDTO> getMyRecentApplications();
 }

src/main/java/com/eactive/apim/portal/apps/community/partnership/service/PartnershipApplicationFacadeImpl.java

@@ -1,6 +1,7 @@
 package com.eactive.apim.portal.apps.community.partnership.service;
 
 import com.eactive.apim.portal.apps.community.partnership.dto.PartnershipApplicationDTO;
+import com.eactive.apim.portal.apps.community.partnership.dto.PartnershipApplicationSummaryDTO;
 import com.eactive.apim.portal.apps.community.partnership.mapper.PartnershipApplicationMapper;
 import com.eactive.apim.portal.common.user.PortalAuthenticatedUser;
 import com.eactive.apim.portal.common.util.SecurityUtil;
@@ -15,7 +16,9 @@ import lombok.RequiredArgsConstructor;
 import org.springframework.stereotype.Service;
 
 import java.io.IOException;
+import java.util.Collections;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 
 @Service
@@ -60,4 +63,14 @@ public class PartnershipApplicationFacadeImpl implements PartnershipApplicationF
         }
         portalAdminNotifier.notifyPortalAdmins(MessageCode.PARTNERSHIP_CREATED, params);
     }
+
+    @Override
+    public List<PartnershipApplicationSummaryDTO> getMyRecentApplications() {
+        PortalAuthenticatedUser user = SecurityUtil.getPortalAuthenticatedUser();
+        if (user == null) {
+            return Collections.emptyList();
+        }
+        List<PartnershipApplication> recent = partnershipApplicationService.findRecentByCreatedBy(user.getId());
+        return partnershipApplicationMapper.toSummaryDtoList(recent);
+    }
 }

src/main/java/com/eactive/apim/portal/apps/community/partnership/service/PartnershipApplicationService.java

@@ -2,6 +2,7 @@ package com.eactive.apim.portal.apps.community.partnership.service;
 
 import com.eactive.apim.portal.apps.community.partnership.repository.PartnershipApplicationRepository;
 import com.eactive.apim.portal.partnershipapplication.entity.PartnershipApplication;
+import java.util.List;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
@@ -21,4 +22,12 @@ public class PartnershipApplicationService {
     public void createPartnershipApplication(PartnershipApplication partnershipApplication) {
         partnershipApplicationRepository.save(partnershipApplication);
     }
+
+    /**
+     * 작성자 id 로 최근 등록 3건 조회(최신순).
+     */
+    @Transactional(readOnly = true)
+    public List<PartnershipApplication> findRecentByCreatedBy(String createdBy) {
+        return partnershipApplicationRepository.findTop3ByCreatedByOrderByCreatedDateDesc(createdBy);
+    }
 }

src/main/java/com/eactive/apim/portal/apps/community/qna/controller/InquiryController.java

@@ -7,6 +7,7 @@ import com.eactive.apim.portal.common.user.PortalAuthenticatedUser;
 import com.eactive.apim.portal.common.util.SecurityUtil;
 import com.eactive.apim.portal.common.util.UserTypeUtil;
 import com.eactive.apim.portal.djb.community.qna.comment.service.InquiryCommentFacade;
+import com.eactive.apim.portal.qna.entity.VisibilityScope;
 import java.io.IOException;
 import java.util.List;
 import java.util.Map;
@@ -16,11 +17,13 @@ import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.domain.Sort;
 import org.springframework.data.web.PageableDefault;
+import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
 import org.springframework.validation.BindingResult;
 import org.springframework.web.bind.annotation.*;
+import org.springframework.web.multipart.MultipartFile;
 import org.springframework.web.servlet.mvc.support.RedirectAttributes;
 
 import javax.validation.Valid;
@@ -56,6 +59,7 @@ public class InquiryController {
         model.addAttribute("inquiries", inquiries.getContent());
         model.addAttribute("page", inquiries);
         model.addAttribute("commentCounts", commentCounts);
+        model.addAttribute("visibilityCeiling", inquiryFacade.getVisibilityCeiling());
         return "apps/community/mainInquiryList";
     }
 
@@ -75,13 +79,25 @@ public class InquiryController {
         return "apps/community/mainInquiryDetail";
     }
 
+    /**
+     * 2-1. 조회수 증가 (sessionStorage dedup 통과 시 JS 가 POST 호출)
+     */
+    @PostMapping("/{id}/view")
+    public ResponseEntity<Void> increaseViewCount(@PathVariable String id) {
+        inquiryFacade.incrementViewCount(SecurityUtil.getPortalAuthenticatedUser(), id);
+        return ResponseEntity.ok().build();
+    }
+
     /**
      * 3. inquiry 등록 페이지
      */
     @GetMapping("/new")
     public String newInquiryForm(Model model) {
-        model.addAttribute("inquiry", new InquiryDTO());
+        InquiryDTO inquiry = new InquiryDTO();
+        inquiry.setVisibility(VisibilityScope.ORG.name()); // 기본 공개범위: 법인공개
+        model.addAttribute("inquiry", inquiry);
         model.addAttribute("isInternalUser", UserTypeUtil.isCurrentUserInternal());
+        addVisibilityOptions(model);
         return APPS_COMMUNITY_MAIN_INQUIRY_FORM;
     }
 
@@ -93,14 +109,23 @@ public class InquiryController {
         InquiryDTO inquiry = inquiryFacade.getMyInquiry(SecurityUtil.getPortalAuthenticatedUser(), id);
         model.addAttribute("inquiry", inquiry);
         model.addAttribute("isInternalUser", UserTypeUtil.isCurrentUserInternal());
+        addVisibilityOptions(model);
         return APPS_COMMUNITY_MAIN_INQUIRY_FORM;
     }
 
+    /** 공개범위 상한에 따른 폼 옵션 노출 플래그. PRIVATE 는 항상 허용. */
+    private void addVisibilityOptions(Model model) {
+        VisibilityScope ceiling = inquiryFacade.getVisibilityCeiling();
+        model.addAttribute("allowAll", ceiling.width() >= VisibilityScope.ALL.width());
+        model.addAttribute("allowOrg", ceiling.width() >= VisibilityScope.ORG.width());
+    }
+
     /**
      * 5. inquiry 등록 요청
      */
     @PostMapping
     public String createInquiry(@Valid @ModelAttribute InquiryDTO inquiryDTO, BindingResult bindingResult,
+                                @RequestParam(value = "image", required = false) MultipartFile image,
                                 RedirectAttributes redirectAttributes,
                                 Model model) throws IOException {
         if (bindingResult.hasErrors()) {
@@ -108,7 +133,7 @@ public class InquiryController {
             return APPS_COMMUNITY_MAIN_INQUIRY_FORM;
         }
 
-        inquiryFacade.createInquiry(inquiryDTO);
+        inquiryFacade.createInquiry(inquiryDTO, image);
 
         redirectAttributes.addFlashAttribute("success", "Q&A 작성이 완료되었습니다.");
         return REDIRECT_INQUIRY;
@@ -119,11 +144,12 @@ public class InquiryController {
      */
     @PostMapping("/edit")
     public String updateInquiry(@Valid @ModelAttribute InquiryDTO inquiryDTO, BindingResult bindingResult,
+                                @RequestParam(value = "image", required = false) MultipartFile image,
                                 RedirectAttributes redirectAttributes) throws IOException {
         if (bindingResult.hasErrors()) {
             return APPS_COMMUNITY_MAIN_INQUIRY_FORM;
         }
-        inquiryFacade.updateUserInquiry(SecurityUtil.getPortalAuthenticatedUser(), inquiryDTO.getId(), inquiryDTO);
+        inquiryFacade.updateUserInquiry(SecurityUtil.getPortalAuthenticatedUser(), inquiryDTO.getId(), inquiryDTO, image);
         redirectAttributes.addFlashAttribute("success", "Q&A 수정이 완료되었습니다.");
         return "redirect:/inquiry/detail?id=" + inquiryDTO.getId();
     }

src/main/java/com/eactive/apim/portal/apps/community/qna/dto/InquiryDTO.java

@@ -51,4 +51,22 @@ public class InquiryDTO {
 
     private String maskedInquirerName;
 
+    /** 목록 작성자 표기용 법인명(이름과 별도 줄 표기). */
+    private String inquirerOrgName;
+
+    /** 상세 작성자 표기용 "이름 (법인명)". */
+    private String inquirerDisplay;
+
+    /** 공개범위(ALL/ORG/PRIVATE). 미지정 시 서버에서 상한으로 clamp. */
+    private String visibility;
+
+    /** 공개범위 표기용 한글 라벨(전체공개/법인공개/비공개). */
+    private String visibilityLabel;
+
+    /** 조회수(표시용). */
+    private long viewCount;
+
+    /** 목록에서 비공개 게시물을 "비공개 게시물"로 흐리게 표기할지 여부(비-소유자). */
+    private boolean privatePlaceholder;
+
 }

src/main/java/com/eactive/apim/portal/apps/community/qna/mapper/InquiryMapper.java

@@ -14,6 +14,9 @@ import org.springframework.stereotype.Component;
 @Component
 public interface InquiryMapper {
 
+    // visibility(공개범위)는 facade 에서 상한 clamp 후 수동 세팅, viewCount 는 서버가 관리
+    @Mapping(target = "visibility", ignore = true)
+    @Mapping(target = "viewCount", ignore = true)
     Inquiry toEntity(InquiryDTO inquiry);
 
     @Mapping(target = "inquirerName", source = "inquirer.userName")

src/main/java/com/eactive/apim/portal/apps/community/qna/service/InquiryFacade.java

@@ -3,23 +3,30 @@ package com.eactive.apim.portal.apps.community.qna.service;
 import com.eactive.apim.portal.apps.community.qna.dto.InquiryDTO;
 import com.eactive.apim.portal.apps.community.qna.dto.InquirySearch;
 import com.eactive.apim.portal.common.user.PortalAuthenticatedUser;
+import com.eactive.apim.portal.qna.entity.VisibilityScope;
 import java.io.IOException;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
+import org.springframework.web.multipart.MultipartFile;
 
 public interface InquiryFacade {
 
     Page<InquiryDTO> getInquiries(InquirySearch search, Pageable pageable, PortalAuthenticatedUser user);
 
+    /** 문의 공개범위 상한(폼 옵션 노출 제어용). */
+    VisibilityScope getVisibilityCeiling();
+
     InquiryDTO getUserInquiry(PortalAuthenticatedUser user, String id);
 
     InquiryDTO getMyInquiry(PortalAuthenticatedUser user, String id);
 
     InquiryDTO getAccessibleInquiry(PortalAuthenticatedUser user, String id);
 
-    void createInquiry(InquiryDTO inquiryDTO) throws IOException;
+    void createInquiry(InquiryDTO inquiryDTO, MultipartFile image) throws IOException;
 
-    void updateUserInquiry(PortalAuthenticatedUser user, String id, InquiryDTO inquiryDTO) throws IOException;
+    void updateUserInquiry(PortalAuthenticatedUser user, String id, InquiryDTO inquiryDTO, MultipartFile image) throws IOException;
+
+    void incrementViewCount(PortalAuthenticatedUser user, String id);
 
     void deleteUserInquiry(PortalAuthenticatedUser user, String id);
 }

src/main/java/com/eactive/apim/portal/apps/community/qna/service/InquiryFacadeImpl.java

@@ -7,26 +7,41 @@ import com.eactive.apim.portal.common.user.PortalAuthenticatedUser;
 import com.eactive.apim.portal.common.util.SecurityUtil;
 import com.eactive.apim.portal.common.util.StringMaskingUtil;
 import com.eactive.apim.portal.djb.community.qna.comment.service.CommunityAdminNotifier;
+import com.eactive.apim.portal.file.entity.FileInfo;
+import com.eactive.apim.portal.file.exception.InvalidFileException;
+import com.eactive.apim.portal.file.service.FileService;
+import com.eactive.apim.portal.portalorg.entity.PortalOrg;
+import com.eactive.apim.portal.portaluser.entity.PortalUser;
 import com.eactive.apim.portal.portaluser.entity.PortalUserEnums;
 import com.eactive.apim.portal.qna.entity.Inquiry;
+import com.eactive.apim.portal.qna.entity.VisibilityScope;
 import com.eactive.apim.portal.template.entity.MessageCode;
 import lombok.RequiredArgsConstructor;
+import org.apache.commons.io.FilenameUtils;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.jpa.domain.Specification;
 import org.springframework.stereotype.Service;
+import org.springframework.web.multipart.MultipartFile;
 
 import java.io.IOException;
+import java.util.Arrays;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.Map;
+import java.util.Set;
 
 @Service
 @RequiredArgsConstructor
 public class InquiryFacadeImpl implements InquiryFacade {
 
+    private static final Set<String> IMAGE_EXTENSIONS =
+            new HashSet<>(Arrays.asList("jpg", "jpeg", "png", "gif"));
+
     private final InquiryService inquiryService;
     private final InquiryMapper inquiryMapper;
     private final CommunityAdminNotifier inquiryAdminNotifier;
+    private final FileService fileService;
 
     @Override
     public Page<InquiryDTO> getInquiries(InquirySearch search, Pageable pageable, PortalAuthenticatedUser user) {
@@ -40,6 +55,8 @@ public class InquiryFacadeImpl implements InquiryFacade {
 
         Page<Inquiry> inquiriesPage = inquiryService.getInquiries(spec, pageable);
 
+        VisibilityScope ceiling = inquiryService.getVisibilityCeiling();
+
         return inquiriesPage.map(inquiry -> {
             InquiryDTO dto = inquiryMapper.map(inquiry);
             if (dto != null && dto.getInquirer() != null) {
@@ -48,8 +65,20 @@ public class InquiryFacadeImpl implements InquiryFacade {
                         inquiry.getInquirer().getId(),
                         user.getId()
                 ));
+                PortalOrg org = inquiry.getInquirer().getPortalOrg();
+                if (org != null) {
+                    dto.setInquirerOrgName(org.getOrgName());
+                }
                 dto.getInquirer().setUserName(null); // 원본 데이터 제거
             }
+            // 비공개 게시물은 본인/같은 법인 관리자 외에는 "비공개 게시물"로만 노출
+            VisibilityScope effective = VisibilityScope.clampTo(inquiry.getVisibility(), ceiling);
+            dto.setVisibility(effective.name());
+            dto.setVisibilityLabel(effective.label());
+            if (effective == VisibilityScope.PRIVATE && !canReadPrivate(user, inquiry)) {
+                dto.setPrivatePlaceholder(true);
+                dto.setInquirySubject(null);
+            }
             return dto;
         });
     }
@@ -81,14 +110,32 @@ public class InquiryFacadeImpl implements InquiryFacade {
     @Override
     public InquiryDTO getAccessibleInquiry(PortalAuthenticatedUser user, String id) {
         Inquiry inquiry = inquiryService.getAccessibleInquiry(user, id);
-        return inquiryMapper.map(inquiry);
+        InquiryDTO dto = inquiryMapper.map(inquiry);
+        if (dto != null) {
+            VisibilityScope effective = inquiryService.effectiveVisibility(inquiry);
+            dto.setVisibility(effective.name());
+            dto.setVisibilityLabel(effective.label());
+        }
+        if (dto != null && inquiry.getInquirer() != null) {
+            // 상세 작성자 표기: "이름 (법인명)" — 본인은 owner-bypass 로 원문
+            String maskedName = StringMaskingUtil.maskName(
+                    inquiry.getInquirer().getUserName(),
+                    inquiry.getInquirer().getId(),
+                    user.getId());
+            dto.setInquirerDisplay(withOrgName(maskedName, inquiry.getInquirer()));
+        }
+        return dto;
     }
 
     @Override
-    public void createInquiry(InquiryDTO inquiryDTO) throws IOException {
+    public void createInquiry(InquiryDTO inquiryDTO, MultipartFile image) throws IOException {
         PortalAuthenticatedUser current = SecurityUtil.getPortalAuthenticatedUser();
         Inquiry inquiry = inquiryMapper.toEntity(inquiryDTO);
         inquiry.setInquirer(current);
+        inquiry.setVisibility(clampedVisibility(inquiryDTO.getVisibility()));
+        if (hasFile(image)) {
+            inquiry.setAttachFile(storeImage(null, image));
+        }
         inquiryService.createInquiry(inquiry);
 
         Map<String, Object> params = new HashMap<>();
@@ -99,17 +146,91 @@ public class InquiryFacadeImpl implements InquiryFacade {
     }
 
     @Override
-    public void updateUserInquiry(PortalAuthenticatedUser user, String id, InquiryDTO inquiryDTO) throws IOException {
+    public void updateUserInquiry(PortalAuthenticatedUser user, String id, InquiryDTO inquiryDTO, MultipartFile image) throws IOException {
         Inquiry existingInquiry = inquiryService.getMyInquiry(user, id);
-        inquiryDTO.setAttachFile(existingInquiry.getAttachFile());
 
         Inquiry inquiry = inquiryMapper.toEntity(inquiryDTO);
         inquiry.setInquirer(existingInquiry.getInquirer());
+        inquiry.setVisibility(clampedVisibility(inquiryDTO.getVisibility()));
+        // 이미지 교체 시 기존 fileId 로 업데이트, 없으면 기존 첨부 유지
+        if (hasFile(image)) {
+            inquiry.setAttachFile(storeImage(existingInquiry.getAttachFile(), image));
+        } else {
+            inquiry.setAttachFile(existingInquiry.getAttachFile());
+        }
         inquiryService.updateInquiry(id, inquiry);
     }
 
+    @Override
+    public void incrementViewCount(PortalAuthenticatedUser user, String id) {
+        // 접근 가능한 게시물만 조회수 증가
+        inquiryService.getAccessibleInquiry(user, id);
+        inquiryService.incrementViewCount(id);
+    }
+
+    @Override
+    public VisibilityScope getVisibilityCeiling() {
+        return inquiryService.getVisibilityCeiling();
+    }
+
     @Override
     public void deleteUserInquiry(PortalAuthenticatedUser user, String id) {
         inquiryService.deleteMyInquiry(user, id);
     }
+
+    // =====================================================================
+    // helpers
+    // =====================================================================
+
+    /** 요청 공개범위를 기본 ORG 로 두고 property 상한으로 clamp. */
+    private VisibilityScope clampedVisibility(String requested) {
+        VisibilityScope ceiling = inquiryService.getVisibilityCeiling();
+        VisibilityScope scope = VisibilityScope.fromString(requested, VisibilityScope.ORG);
+        return VisibilityScope.clampTo(scope, ceiling);
+    }
+
+    /** 비공개 게시물을 읽을 수 있는 사용자(작성자 본인 또는 같은 법인 관리자). */
+    private boolean canReadPrivate(PortalAuthenticatedUser user, Inquiry inquiry) {
+        PortalUser inquirer = inquiry.getInquirer();
+        if (inquirer == null || user == null) {
+            return false;
+        }
+        if (user.getId() != null && user.getId().equals(inquirer.getId())) {
+            return true;
+        }
+        return user.getRoleCode() == PortalUserEnums.RoleCode.ROLE_CORP_MANAGER
+                && isSameOrg(user, inquirer);
+    }
+
+    private boolean isSameOrg(PortalAuthenticatedUser user, PortalUser inquirer) {
+        PortalOrg userOrg = user.getPortalOrg();
+        PortalOrg inquirerOrg = inquirer.getPortalOrg();
+        return userOrg != null && inquirerOrg != null
+                && userOrg.getId() != null
+                && userOrg.getId().equals(inquirerOrg.getId());
+    }
+
+    /** "이름 (법인명)" 조합. 법인명이 없으면 이름만. */
+    private String withOrgName(String name, PortalUser inquirer) {
+        PortalOrg org = inquirer.getPortalOrg();
+        if (org != null && org.getOrgName() != null && !org.getOrgName().isEmpty()) {
+            return name + " (" + org.getOrgName() + ")";
+        }
+        return name;
+    }
+
+    private boolean hasFile(MultipartFile file) {
+        return file != null && !file.isEmpty();
+    }
+
+    /** 이미지 확장자 검증 후 단일 파일 저장, fileId 반환. */
+    private String storeImage(String existingFileId, MultipartFile image) throws IOException {
+        String ext = FilenameUtils.getExtension(image.getOriginalFilename());
+        if (ext == null || !IMAGE_EXTENSIONS.contains(ext.toLowerCase())) {
+            throw new InvalidFileException("이미지 파일(jpg, jpeg, png, gif)만 첨부할 수 있습니다.");
+        }
+        FileInfo fileInfo = fileService.createOrUpdateSingleFile(
+                existingFileId, image, image.getOriginalFilename(), true);
+        return fileInfo.getFileId();
+    }
 }

src/main/java/com/eactive/apim/portal/apps/community/qna/service/InquiryService.java

@@ -7,7 +7,9 @@ import com.eactive.apim.portal.common.user.PortalAuthenticatedUser;
 import com.eactive.apim.portal.portalorg.entity.PortalOrg;
 import com.eactive.apim.portal.portaluser.entity.PortalUser;
 import com.eactive.apim.portal.portaluser.entity.PortalUserEnums;
+import com.eactive.apim.portal.portalproperty.service.PortalPropertyService;
 import com.eactive.apim.portal.qna.entity.Inquiry;
+import com.eactive.apim.portal.qna.entity.VisibilityScope;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.jpa.domain.Specification;
@@ -19,10 +21,19 @@ import org.springframework.transaction.annotation.Transactional;
 public class InquiryService {
 
     public static final String PENDING = "PENDING";
-    private final InquiryRepository inquiryRepository;
 
-    public InquiryService(InquiryRepository inquiryRepository) {
+    /** 문의 공개범위 상한/기본값 property. */
+    private static final String PROP_GROUP = "Portal";
+    private static final String PROP_VISIBILITY_CEILING = "djb.inquiry.default-visibility";
+    private static final String PROP_VISIBILITY_DESC = "Q&A 문의 공개범위 상한/기본값 (ALL/ORG/PRIVATE)";
+
+    private final InquiryRepository inquiryRepository;
+    private final PortalPropertyService portalPropertyService;
+
+    public InquiryService(InquiryRepository inquiryRepository,
+                          PortalPropertyService portalPropertyService) {
         this.inquiryRepository = inquiryRepository;
+        this.portalPropertyService = portalPropertyService;
     }
 
     /**
@@ -75,6 +86,7 @@ public class InquiryService {
         inquiry.setInquirySubject(updatedInquiry.getInquirySubject());
         inquiry.setInquiryDetail(updatedInquiry.getInquiryDetail());
         inquiry.setAttachFile(updatedInquiry.getAttachFile());
+        inquiry.setVisibility(updatedInquiry.getVisibility());
         return inquiryRepository.save(inquiry);
     }
 
@@ -112,12 +124,27 @@ public class InquiryService {
         if (inquirer == null || user == null) {
             return false;
         }
+        // 작성자 본인은 공개범위와 무관하게 항상 접근 가능
         if (user.getId() != null && user.getId().equals(inquirer.getId())) {
             return true;
         }
-        if (user.getRoleCode() == PortalUserEnums.RoleCode.ROLE_USER) {
+        VisibilityScope effective = effectiveVisibility(inquiry);
+        switch (effective) {
+            case ALL:
+                // 전체공개: 로그인 사용자면 접근 가능(@Secured 로 이미 인증됨)
+                return true;
+            case ORG:
+                return isSameOrg(user, inquirer);
+            case PRIVATE:
+                // 비공개: 본인 외에는 같은 법인 관리자만 열람
+                return isSameOrg(user, inquirer)
+                        && user.getRoleCode() == PortalUserEnums.RoleCode.ROLE_CORP_MANAGER;
+            default:
                 return false;
         }
+    }
+
+    private boolean isSameOrg(PortalAuthenticatedUser user, PortalUser inquirer) {
         PortalOrg userOrg = user.getPortalOrg();
         PortalOrg inquirerOrg = inquirer.getPortalOrg();
         return userOrg != null && inquirerOrg != null
@@ -125,4 +152,30 @@ public class InquiryService {
                 && userOrg.getId().equals(inquirerOrg.getId());
     }
 
+    /**
+     * 게시물의 유효 공개범위 = 저장값을 property 상한으로 clamp 한 값.
+     * (property 가 항상 우선하므로 저장값이 옛 상한이라 넓더라도 재-clamp)
+     */
+    @Transactional(readOnly = true)
+    public VisibilityScope effectiveVisibility(Inquiry inquiry) {
+        return VisibilityScope.clampTo(inquiry.getVisibility(), getVisibilityCeiling());
+    }
+
+    /** PTL_PROPERTY 에 설정된 공개범위 상한(없으면 ORG). */
+    @Transactional(readOnly = true)
+    public VisibilityScope getVisibilityCeiling() {
+        String value = portalPropertyService.getOrCreateProperty(
+                PROP_GROUP, PROP_VISIBILITY_CEILING, VisibilityScope.ORG.name(), PROP_VISIBILITY_DESC);
+        return VisibilityScope.fromString(value, VisibilityScope.ORG);
+    }
+
+    /**
+     * 조회수 1 증가. sessionStorage dedup 을 통과한 POST 요청에서만 호출된다.
+     */
+    public void incrementViewCount(String id) {
+        Inquiry inquiry = getInquiry(id);
+        inquiry.increaseViewCount();
+        inquiryRepository.save(inquiry);
+    }
+
 }

src/main/java/com/eactive/apim/portal/apps/statistics/controller/ApiStatisticsController.java

@@ -20,7 +20,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.ResponseBody;
 
 /**
- * API 통계 Controller
+ * API 통계 Controller.
  */
 @Slf4j
 @Controller
@@ -31,7 +31,7 @@ public class ApiStatisticsController {
     private final ApiStatisticsService apiStatisticsService;
 
     /**
-     * 통계 페이지 진입
+     * 통계 페이지 진입.
      */
     @GetMapping
     public String statisticsPage(Model model) {
@@ -41,11 +41,12 @@ public class ApiStatisticsController {
         }
 
         String orgId = org.getId();
+        log.debug("[통계] 페이지 진입 - orgId={}", orgId);
 
         // 앱 목록 조회 (선택용)
         model.addAttribute("appList", apiStatisticsService.getAppListByOrg(orgId));
 
-        // 기본 조회 (7일 전 ~ 오늘, 전체 앱)
+        // 기본 조회 (일별, 7일 전 ~ 오늘, 전체 앱)
         ApiStatisticsSearchDto searchDto = new ApiStatisticsSearchDto();
         searchDto.setStartDate(LocalDate.now().minusDays(7));
         searchDto.setEndDate(LocalDate.now());
@@ -54,13 +55,19 @@ public class ApiStatisticsController {
         ApiStatisticsResultDto result = apiStatisticsService.getStatistics(orgId, searchDto);
         model.addAttribute("summary", result.getSummary());
         model.addAttribute("details", result.getDetails());
+        model.addAttribute("periods", result.getPeriods());
         model.addAttribute("searchDto", searchDto);
 
+        // 월별 선택 가능 월 + 집계 안내 문구 데이터
+        model.addAttribute("availableMonths", apiStatisticsService.getAvailableMonths(orgId));
+        model.addAttribute("statsAggregationMinute", apiStatisticsService.getAggregationMinute());
+        model.addAttribute("statsLatestTime", apiStatisticsService.getLatestStatTime(orgId));
+
         return "apps/statistics/apiStatistics";
     }
 
     /**
-     * 통계 조회 (AJAX)
+     * 통계 조회 (AJAX).
      */
     @PostMapping("/search")
     @ResponseBody
@@ -70,11 +77,12 @@ public class ApiStatisticsController {
             return ResponseEntity.status(401).build();
         }
 
-        // 날짜 범위 검증 (최대 40일)
-        if (!searchDto.isValidDateRange()) {
+        log.debug("[통계] 검색 요청(AJAX) - orgId={}, mode={}, clientId={}",
+            org.getId(), searchDto.getMode(), searchDto.getClientId());
+
+        if (!isValidRange(searchDto)) {
             return ResponseEntity.badRequest()
-                .body(java.util.Collections.singletonMap("error",
-                    "조회 기간은 최대 " + ApiStatisticsSearchDto.MAX_DATE_RANGE_DAYS + "일까지 가능합니다."));
+                .body(java.util.Collections.singletonMap("error", rangeErrorMessage(searchDto)));
         }
 
         String orgId = org.getId();
@@ -83,7 +91,9 @@ public class ApiStatisticsController {
     }
 
     /**
-     * CSV 다운로드
+     * CSV 다운로드.
+     *
+     * ※ UI에서 다운로드 버튼은 제거되었으나 백엔드 기능은 유지한다(직접 호출용).
      */
     @GetMapping("/download")
     public void downloadCsv(ApiStatisticsSearchDto searchDto, HttpServletResponse response) throws IOException {
@@ -93,9 +103,8 @@ public class ApiStatisticsController {
             return;
         }
 
-        // 날짜 범위 검증 (최대 40일)
-        if (!searchDto.isValidDateRange()) {
-            response.sendError(400, "조회 기간은 최대 " + ApiStatisticsSearchDto.MAX_DATE_RANGE_DAYS + "일까지 가능합니다.");
+        if (!isValidRange(searchDto)) {
+            response.sendError(400, rangeErrorMessage(searchDto));
             return;
         }
 
@@ -103,6 +112,16 @@ public class ApiStatisticsController {
         apiStatisticsService.downloadCsv(orgId, searchDto, response);
     }
 
+    private boolean isValidRange(ApiStatisticsSearchDto searchDto) {
+        return searchDto.isMonthly() ? searchDto.isValidMonth() : searchDto.isValidDateRange();
+    }
+
+    private String rangeErrorMessage(ApiStatisticsSearchDto searchDto) {
+        return searchDto.isMonthly()
+            ? "조회할 월이 올바르지 않습니다."
+            : "조회 기간은 최대 " + ApiStatisticsSearchDto.MAX_DATE_RANGE_DAYS + "일까지 가능합니다.";
+    }
+
     private PortalOrg getPortalOrg() {
         if (SecurityUtil.getPortalAuthenticatedUser() != null) {
             return SecurityUtil.getPortalAuthenticatedUser().getPortalOrg();

src/main/java/com/eactive/apim/portal/apps/statistics/dto/ApiStatisticsDetailDto.java

@@ -5,50 +5,52 @@ import lombok.Data;
 import lombok.NoArgsConstructor;
 
 /**
- * 개별 API 통계 상세 DTO
+ * 개별 API 통계 상세 DTO (API_NAME 단위 집계).
+ * 성공/타임아웃/실패(오류) 배타 구분. {@link ApiStatisticsSummaryDto} 참고.
  */
 @Data
 @NoArgsConstructor
 @AllArgsConstructor
 public class ApiStatisticsDetailDto {
 
-    private String apiId;
     private String apiName;
-    private Long attemptedCount;   // 호출 건
-    private Long completedCount;   // 성공 건
-    private Long failedCount;      // 실패 건
+    private Long totalCount;      // 호출 건
+    private Long successCount;    // 성공 건
+    private Long timeoutCount;    // 타임아웃 건
+    private Long errorCount;      // 실패(오류) 건
     private Double successRate;   // 성공율 (%)
-    private Double failureRate;    // 실패율 (%)
+    private Double timeoutRate;   // 타임아웃율 (%)
+    private Double errorRate;     // 실패(오류)율 (%)
 
     /**
-     * Repository 조회용 생성자
+     * Repository 조회용 생성자.
      */
-    public ApiStatisticsDetailDto(String apiId, String apiName, Long attemptedCount, Long completedCount) {
-        this.apiId = apiId;
+    public ApiStatisticsDetailDto(String apiName, Long totalCount, Long successCount,
+                                  Long timeoutCount, Long systemErrCount, Long bizErrCount) {
         this.apiName = apiName;
-        this.attemptedCount = attemptedCount != null ? attemptedCount : 0L;
-        this.completedCount = completedCount != null ? completedCount : 0L;
+        this.totalCount = ApiStatisticsSummaryDto.nz(totalCount);
+        this.successCount = ApiStatisticsSummaryDto.nz(successCount);
+        this.timeoutCount = ApiStatisticsSummaryDto.nz(timeoutCount);
+        this.errorCount = ApiStatisticsSummaryDto.nz(systemErrCount) + ApiStatisticsSummaryDto.nz(bizErrCount);
     }
 
     /**
-     * 실패건, 성공률, 실패율 계산
+     * 성공율/타임아웃율/실패율 계산.
      */
     public void calculateRates() {
-        if (attemptedCount == null) {
-            attemptedCount = 0L;
-        }
-        if (completedCount == null) {
-            completedCount = 0L;
-        }
+        this.totalCount = ApiStatisticsSummaryDto.nz(totalCount);
+        this.successCount = ApiStatisticsSummaryDto.nz(successCount);
+        this.timeoutCount = ApiStatisticsSummaryDto.nz(timeoutCount);
+        this.errorCount = ApiStatisticsSummaryDto.nz(errorCount);
 
-        this.failedCount = attemptedCount - completedCount;
-
-        if (attemptedCount > 0) {
-            this.successRate = Math.round((completedCount * 1000.0) / attemptedCount) / 10.0;
-            this.failureRate = Math.round((failedCount * 1000.0) / attemptedCount) / 10.0;
+        if (totalCount > 0) {
+            this.successRate = ApiStatisticsSummaryDto.rate(successCount, totalCount);
+            this.timeoutRate = ApiStatisticsSummaryDto.rate(timeoutCount, totalCount);
+            this.errorRate = ApiStatisticsSummaryDto.rate(errorCount, totalCount);
         } else {
             this.successRate = 0.0;
-            this.failureRate = 0.0;
+            this.timeoutRate = 0.0;
+            this.errorRate = 0.0;
         }
     }
 }

src/main/java/com/eactive/apim/portal/apps/statistics/dto/ApiStatisticsPeriodDto.java

@@ -0,0 +1,62 @@
+package com.eactive.apim.portal.apps.statistics.dto;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * 기간별(일별/월별) 누적 통계 DTO — API별 통계 하단 표에 사용.
+ *
+ * period 는 일별 모드에서 "yyyy-MM-dd", 월별 모드에서 "yyyy-MM" 형태의 라벨.
+ * 각 행은 해당 기간의 전체 앱/전체 API 합계이다.
+ */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class ApiStatisticsPeriodDto {
+
+    private String period;        // 기간 라벨 (yyyy-MM-dd 또는 yyyy-MM)
+    private Long totalCount;
+    private Long successCount;
+    private Long timeoutCount;
+    private Long errorCount;
+    private Double successRate;
+    private Double timeoutRate;
+    private Double errorRate;
+
+    /** 해당 일자에 실제 집계 데이터가 존재하는지 여부. false면 표에 '-'로 표기(0과 구분). */
+    private boolean hasData;
+
+    /**
+     * Repository 조회용 생성자 (실제 데이터 행 → hasData=true).
+     */
+    public ApiStatisticsPeriodDto(String period, Long totalCount, Long successCount,
+                                  Long timeoutCount, Long systemErrCount, Long bizErrCount) {
+        this.period = period;
+        this.totalCount = ApiStatisticsSummaryDto.nz(totalCount);
+        this.successCount = ApiStatisticsSummaryDto.nz(successCount);
+        this.timeoutCount = ApiStatisticsSummaryDto.nz(timeoutCount);
+        this.errorCount = ApiStatisticsSummaryDto.nz(systemErrCount) + ApiStatisticsSummaryDto.nz(bizErrCount);
+        this.hasData = true;
+    }
+
+    /**
+     * 성공율/타임아웃율/실패율 계산.
+     */
+    public void calculateRates() {
+        this.totalCount = ApiStatisticsSummaryDto.nz(totalCount);
+        this.successCount = ApiStatisticsSummaryDto.nz(successCount);
+        this.timeoutCount = ApiStatisticsSummaryDto.nz(timeoutCount);
+        this.errorCount = ApiStatisticsSummaryDto.nz(errorCount);
+
+        if (totalCount > 0) {
+            this.successRate = ApiStatisticsSummaryDto.rate(successCount, totalCount);
+            this.timeoutRate = ApiStatisticsSummaryDto.rate(timeoutCount, totalCount);
+            this.errorRate = ApiStatisticsSummaryDto.rate(errorCount, totalCount);
+        } else {
+            this.successRate = 0.0;
+            this.timeoutRate = 0.0;
+            this.errorRate = 0.0;
+        }
+    }
+}

src/main/java/com/eactive/apim/portal/apps/statistics/dto/ApiStatisticsResultDto.java

@@ -7,7 +7,8 @@ import lombok.Data;
 import lombok.NoArgsConstructor;
 
 /**
- * API 통계 조회 결과 DTO
+ * API 통계 조회 결과 DTO.
+ * summary: 전체 요약, details: API별, periods: 기간별(일/월) 누적.
  */
 @Data
 @NoArgsConstructor
@@ -16,13 +17,15 @@ public class ApiStatisticsResultDto {
 
     private ApiStatisticsSummaryDto summary;
     private List<ApiStatisticsDetailDto> details;
+    private List<ApiStatisticsPeriodDto> periods;
 
     /**
-     * 빈 결과 생성
+     * 빈 결과 생성.
      */
     public static ApiStatisticsResultDto empty() {
         return new ApiStatisticsResultDto(
             ApiStatisticsSummaryDto.empty(),
+            new ArrayList<>(),
             new ArrayList<>()
         );
     }

src/main/java/com/eactive/apim/portal/apps/statistics/dto/ApiStatisticsSearchDto.java

@@ -6,16 +6,25 @@ import lombok.Data;
 import org.springframework.format.annotation.DateTimeFormat;
 
 /**
- * API 통계 검색 조건 DTO
+ * API 통계 검색 조건 DTO.
+ *
+ * mode = DAILY 이면 startDate~endDate(날짜범위, API_STATS_HOUR),
+ * mode = MONTHLY 이면 month(YYYYMM 단일 선택)를 사용한다.
  */
 @Data
 public class ApiStatisticsSearchDto {
 
     /**
-     * 최대 조회 가능 일수
+     * 최대 조회 가능 일수 (일별 모드).
      */
     public static final int MAX_DATE_RANGE_DAYS = 40;
 
+    public enum Mode {
+        DAILY, MONTHLY
+    }
+
+    private Mode mode = Mode.DAILY;
+
     @DateTimeFormat(pattern = "yyyy-MM-dd")
     private LocalDate startDate;
 
@@ -23,7 +32,12 @@ public class ApiStatisticsSearchDto {
     private LocalDate endDate;
 
     /**
-     * 선택된 앱의 clientId (null 또는 빈값이면 전체 앱)
+     * 월별 조회 대상 월 (YYYYMM, 단일 선택).
+     */
+    private String month;
+
+    /**
+     * 선택된 앱의 clientId (null 또는 빈값이면 전체 앱).
      */
     private String clientId;
 
@@ -33,15 +47,19 @@ public class ApiStatisticsSearchDto {
         this.clientId = null;
     }
 
+    public boolean isMonthly() {
+        return mode == Mode.MONTHLY;
+    }
+
     /**
-     * 특정 앱이 선택되었는지 여부
+     * 특정 앱이 선택되었는지 여부.
      */
     public boolean hasSelectedApp() {
         return clientId != null && !clientId.trim().isEmpty();
     }
 
     /**
-     * 날짜 범위가 유효한지 검증 (최대 40일)
+     * 날짜(일별) 범위가 유효한지 검증 (최대 40일).
      */
     public boolean isValidDateRange() {
         if (startDate == null || endDate == null) {
@@ -55,12 +73,13 @@ public class ApiStatisticsSearchDto {
     }
 
     /**
-     * 조회 기간 일수 반환
+     * 월(월별) 선택값이 YYYYMM 형식인지 검증 (가용월 여부는 서비스/드롭다운에서 제한).
      */
-    public long getDateRangeDays() {
-        if (startDate == null || endDate == null) {
-            return 0;
+    public boolean isValidMonth() {
+        return isYyyymm(month);
     }
-        return ChronoUnit.DAYS.between(startDate, endDate);
+
+    private static boolean isYyyymm(String s) {
+        return s != null && s.matches("^\\d{6}$");
     }
 }

src/main/java/com/eactive/apim/portal/apps/statistics/dto/ApiStatisticsSummaryDto.java

@@ -5,54 +5,72 @@ import lombok.Data;
 import lombok.NoArgsConstructor;
 
 /**
- * API 전체 통계 요약 DTO
+ * API 전체 통계 요약 DTO.
+ *
+ * 집계 소스: AGWAPP.API_STATS_HOUR / API_STATS_MONTH.
+ * 성공/타임아웃/실패(오류)를 배타적으로 구분한다.
+ *  - 성공 = SUCCESS_CNT
+ *  - 타임아웃 = TIMEOUT_CNT
+ *  - 실패(오류) = SYSTEM_ERR_CNT + BIZ_ERR_CNT
+ *  - 호출수(total) = TOTAL_CNT
  */
 @Data
 @NoArgsConstructor
 @AllArgsConstructor
 public class ApiStatisticsSummaryDto {
 
-    private Long totalAttempted;   // 전체 호출 건
-    private Long totalCompleted;   // 전체 성공 건
-    private Long totalFailed;      // 전체 실패 건
+    private Long totalCount;      // 전체 호출 건 (TOTAL_CNT)
+    private Long successCount;    // 성공 건 (SUCCESS_CNT)
+    private Long timeoutCount;    // 타임아웃 건 (TIMEOUT_CNT)
+    private Long errorCount;      // 실패(오류) 건 (SYSTEM_ERR_CNT + BIZ_ERR_CNT)
     private Double successRate;   // 성공율 (%)
-    private Double failureRate;    // 실패율 (%)
+    private Double timeoutRate;   // 타임아웃율 (%)
+    private Double errorRate;     // 실패(오류)율 (%)
 
     /**
-     * Repository 조회용 생성자 (attempted, completed만)
+     * Repository 조회용 생성자 (SUM 집계값).
      */
-    public ApiStatisticsSummaryDto(Long totalAttempted, Long totalCompleted) {
-        this.totalAttempted = totalAttempted != null ? totalAttempted : 0L;
-        this.totalCompleted = totalCompleted != null ? totalCompleted : 0L;
+    public ApiStatisticsSummaryDto(Long totalCount, Long successCount, Long timeoutCount,
+                                   Long systemErrCount, Long bizErrCount) {
+        this.totalCount = nz(totalCount);
+        this.successCount = nz(successCount);
+        this.timeoutCount = nz(timeoutCount);
+        this.errorCount = nz(systemErrCount) + nz(bizErrCount);
     }
 
     /**
-     * 실패건, 성공률, 실패율 계산
+     * 성공률/타임아웃율/실패율 계산.
      */
     public void calculateRates() {
-        if (totalAttempted == null) {
-            totalAttempted = 0L;
-        }
-        if (totalCompleted == null) {
-            totalCompleted = 0L;
-        }
+        this.totalCount = nz(totalCount);
+        this.successCount = nz(successCount);
+        this.timeoutCount = nz(timeoutCount);
+        this.errorCount = nz(errorCount);
 
-        this.totalFailed = totalAttempted - totalCompleted;
-
-        if (totalAttempted > 0) {
-            this.successRate = Math.round((totalCompleted * 1000.0) / totalAttempted) / 10.0;
-            this.failureRate = Math.round((totalFailed * 1000.0) / totalAttempted) / 10.0;
+        if (totalCount > 0) {
+            this.successRate = rate(successCount, totalCount);
+            this.timeoutRate = rate(timeoutCount, totalCount);
+            this.errorRate = rate(errorCount, totalCount);
         } else {
             this.successRate = 0.0;
-            this.failureRate = 0.0;
+            this.timeoutRate = 0.0;
+            this.errorRate = 0.0;
         }
     }
 
+    static long nz(Long v) {
+        return v != null ? v : 0L;
+    }
+
+    static double rate(long part, long total) {
+        return Math.round((part * 1000.0) / total) / 10.0;
+    }
+
     /**
-     * 빈 통계 생성
+     * 빈 통계 생성.
      */
     public static ApiStatisticsSummaryDto empty() {
-        ApiStatisticsSummaryDto dto = new ApiStatisticsSummaryDto(0L, 0L);
+        ApiStatisticsSummaryDto dto = new ApiStatisticsSummaryDto(0L, 0L, 0L, 0L, 0L);
         dto.calculateRates();
         return dto;
     }

src/main/java/com/eactive/apim/portal/apps/statistics/repository/ApiStatisticsRepository.java

@@ -1,81 +0,0 @@
-package com.eactive.apim.portal.apps.statistics.repository;
-
-import com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsDetailDto;
-import com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsSummaryDto;
-import com.eactive.apim.portal.obp.entity.ObpGwMetric;
-import com.eactive.eai.data.jpa.BaseRepository;
-import com.eactive.eai.rms.data.EMSDataSource;
-import java.time.LocalDateTime;
-import java.util.List;
-import org.springframework.data.jpa.repository.Query;
-import org.springframework.data.repository.query.Param;
-
-/**
- * API 통계 Repository
- * ObpGwMetric 테이블에서 통계 데이터를 조회
- */
-@EMSDataSource
-public interface ApiStatisticsRepository extends BaseRepository<ObpGwMetric, String> {
-
-    /**
-     * 전체 통계 조회 (특정 기간, 특정 조직의 모든 앱)
-     */
-    @Query("SELECT new com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsSummaryDto(" +
-           "COALESCE(SUM(m.attemptedCount), 0), COALESCE(SUM(m.completedCount), 0)) " +
-           "FROM ObpGwMetric m " +
-           "WHERE m.orgId = :orgId " +
-           "AND m.timeslice BETWEEN :startTime AND :endTime")
-    ApiStatisticsSummaryDto findSummaryByOrgAndPeriod(
-        @Param("orgId") String orgId,
-        @Param("startTime") LocalDateTime startTime,
-        @Param("endTime") LocalDateTime endTime);
-
-    /**
-     * 전체 통계 조회 (특정 기간, 특정 앱)
-     */
-    @Query("SELECT new com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsSummaryDto(" +
-           "COALESCE(SUM(m.attemptedCount), 0), COALESCE(SUM(m.completedCount), 0)) " +
-           "FROM ObpGwMetric m " +
-           "WHERE m.orgId = :orgId " +
-           "AND m.clientId = :clientId " +
-           "AND m.timeslice BETWEEN :startTime AND :endTime")
-    ApiStatisticsSummaryDto findSummaryByOrgAndApp(
-        @Param("orgId") String orgId,
-        @Param("clientId") String clientId,
-        @Param("startTime") LocalDateTime startTime,
-        @Param("endTime") LocalDateTime endTime);
-
-    /**
-     * 개별 API 통계 조회 (특정 기간, 특정 조직의 모든 앱)
-     */
-    @Query("SELECT new com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsDetailDto(" +
-           "m.apiId, m.apiName, " +
-           "COALESCE(SUM(m.attemptedCount), 0), COALESCE(SUM(m.completedCount), 0)) " +
-           "FROM ObpGwMetric m " +
-           "WHERE m.orgId = :orgId " +
-           "AND m.timeslice BETWEEN :startTime AND :endTime " +
-           "GROUP BY m.apiId, m.apiName " +
-           "ORDER BY SUM(m.attemptedCount) DESC")
-    List<ApiStatisticsDetailDto> findDetailByOrgAndPeriod(
-        @Param("orgId") String orgId,
-        @Param("startTime") LocalDateTime startTime,
-        @Param("endTime") LocalDateTime endTime);
-
-    /**
-     * 개별 API 통계 조회 (특정 기간, 특정 앱)
-     */
-    @Query("SELECT new com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsDetailDto(" +
-           "m.apiId, m.apiName, " +
-           "COALESCE(SUM(m.attemptedCount), 0), COALESCE(SUM(m.completedCount), 0)) " +
-           "FROM ObpGwMetric m " +
-           "WHERE m.orgId = :orgId " +
-           "AND m.clientId = :clientId " +
-           "AND m.timeslice BETWEEN :startTime AND :endTime " +
-           "GROUP BY m.apiId, m.apiName " +
-           "ORDER BY SUM(m.attemptedCount) DESC")
-    List<ApiStatisticsDetailDto> findDetailByOrgAndApp(
-        @Param("orgId") String orgId,
-        @Param("clientId") String clientId,
-        @Param("startTime") LocalDateTime startTime,
-        @Param("endTime") LocalDateTime endTime);
-}

src/main/java/com/eactive/apim/portal/apps/statistics/repository/JobInfoRepository.java

@@ -0,0 +1,15 @@
+package com.eactive.apim.portal.apps.statistics.repository;
+
+import com.eactive.apim.portal.apps.statistics.repository.entity.JobInfo;
+import com.eactive.eai.rms.data.EMSDataSource;
+import java.util.Optional;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+/**
+ * TSEAIRM21(스케줄러 잡) 조회 — 통계 집계 크론 추출용.
+ */
+@EMSDataSource
+public interface JobInfoRepository extends JpaRepository<JobInfo, String> {
+
+    Optional<JobInfo> findByJobname(String jobname);
+}

src/main/java/com/eactive/apim/portal/apps/statistics/repository/entity/JobInfo.java

@@ -0,0 +1,28 @@
+package com.eactive.apim.portal.apps.statistics.repository.entity;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.Table;
+import lombok.Getter;
+import lombok.Setter;
+
+/**
+ * 스케줄러 잡 정보(EMSAPP.TSEAIRM21) — 통계 집계 크론 조회 전용.
+ *
+ * 안내 문구의 "매시 N분 집계" 값을 실제 크론(CRONEXP)에서 추출하기 위해 JOBNAME/CRONEXP 두 컬럼만 매핑한다.
+ * (읽기 전용. 잡 실행/스케줄 변경은 eapim-admin 소관)
+ */
+@Getter
+@Setter
+@Entity
+@Table(name = "TSEAIRM21")
+public class JobInfo {
+
+    @Id
+    @Column(name = "JOBNAME")
+    private String jobname;
+
+    @Column(name = "CRONEXP")
+    private String cronexp;
+}

src/main/java/com/eactive/apim/portal/apps/statistics/service/ApiStatisticsService.java

@@ -1,21 +1,37 @@
 package com.eactive.apim.portal.apps.statistics.service;
 
-import com.eactive.apim.portal.app.entity.Credential;
-import com.eactive.apim.portal.app.repository.CredentialRepository;
+import com.eactive.apim.gateway.data.statistics.repository.ApiStatsDayRepository;
+import com.eactive.apim.gateway.data.statistics.repository.ApiStatsHourRepository;
+import com.eactive.apim.gateway.data.statistics.repository.ApiStatsMonthRepository;
+import com.eactive.apim.gateway.data.statistics.repository.GwAuthClientRepository;
+import com.eactive.apim.gateway.data.statistics.repository.GwSvcInfoRepository;
 import com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsDetailDto;
+import com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsPeriodDto;
 import com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsResultDto;
 import com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsSearchDto;
 import com.eactive.apim.portal.apps.statistics.dto.ApiStatisticsSummaryDto;
-import com.eactive.apim.portal.apps.statistics.repository.ApiStatisticsRepository;
+import com.eactive.apim.portal.apps.statistics.repository.JobInfoRepository;
+import com.eactive.apim.portal.portalproperty.service.PortalPropertyService;
+import com.eactive.apim.gateway.data.statistics.entity.GwAuthClient;
+import com.eactive.apim.gateway.data.statistics.entity.GwSvcInfo;
 import java.io.IOException;
 import java.io.OutputStreamWriter;
 import java.io.PrintWriter;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
+import java.time.LocalDate;
 import java.time.LocalDateTime;
 import java.time.LocalTime;
+import java.time.YearMonth;
+import java.time.format.DateTimeFormatter;
+import java.util.ArrayList;
 import java.util.Collections;
+import java.util.Comparator;
+import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
 import javax.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -23,7 +39,10 @@ import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
 /**
- * API 통계 Service
+ * API 통계 Service.
+ *
+ * 데이터 소스: Gateway DB(AGWAPP) API_STATS_HOUR(일별) / API_STATS_MONTH(월별).
+ * 통계 테이블에 org_id 가 없으므로 org 소속 앱의 CLIENT_ID 목록으로 필터한다.
  */
 @Slf4j
 @Service
@@ -31,79 +50,419 @@ import org.springframework.transaction.annotation.Transactional;
 @Transactional(readOnly = true)
 public class ApiStatisticsService {
 
-    private final CredentialRepository credentialRepository;
-    private final ApiStatisticsRepository apiStatisticsRepository;
+    /** 시간별 집계 스케줄러 잡명 기본값 — PTL_PROPERTY(Portal/{@value #JOB_NAME_PROP})로 재정의 가능. */
+    private static final String DEFAULT_HOURLY_JOB_NAME = "ApiStatsHourlyAggregationJob";
+    private static final String PROP_GROUP = "Portal";
+    private static final String JOB_NAME_PROP = "stats.hourly.aggregation.job.name";
+
+    private static final DateTimeFormatter LATEST_FMT = DateTimeFormatter.ofPattern("yyyy-MM-dd HH시");
+    private static final DateTimeFormatter YYYYMM_FMT = DateTimeFormatter.ofPattern("yyyyMM");
+    private static final DateTimeFormatter DAY_FMT = DateTimeFormatter.ofPattern("yyyy-MM-dd");
+    /** 요일 한글 한 글자 (월요일=index 0). */
+    private static final String[] WEEKDAYS = {"월", "화", "수", "목", "금", "토", "일"};
+
+    private final GwAuthClientRepository gwAuthClientRepository;
+    private final GwSvcInfoRepository gwSvcInfoRepository;
+    private final ApiStatsHourRepository apiStatsHourRepository;
+    private final ApiStatsDayRepository apiStatsDayRepository;
+    private final ApiStatsMonthRepository apiStatsMonthRepository;
+    private final JobInfoRepository jobInfoRepository;
+    private final PortalPropertyService portalPropertyService;
 
     /**
-     * 로그인 사용자 법인의 앱 목록 조회 (전체)
+     * 로그인 사용자 법인의 앱 목록 조회 (전체). TSEAIAU01.ORGID 기준.
+     * 드롭다운 값(CLIENTID)이 API_STATS_*.CLIENT_ID 와 동일해야 하므로 게이트웨이 인증 클라이언트를 소스로 한다.
      */
-    public List<Credential> getAppListByOrg(String orgId) {
-        return credentialRepository.findAllByOrgid(orgId);
+    public List<GwAuthClient> getAppListByOrg(String orgId) {
+        return gwAuthClientRepository.findByOrgIdOrderByClientNameAsc(orgId);
     }
 
     /**
-     * 통계 조회
+     * 조회 대상 clientId 목록. 특정 앱 선택 시 org 소속 검증 후 해당 1건, 아니면 org 전체 앱.
+     * org→clientId 는 TSEAIAU01.ORGID(=PTL_ORG.ID) 로 조회한다.
+     */
+    private List<String> resolveClientIds(String orgId, ApiStatisticsSearchDto searchDto) {
+        List<String> orgClientIds = orgClientIds(orgId);
+        if (searchDto.hasSelectedApp()) {
+            String clientId = searchDto.getClientId();
+            return orgClientIds.contains(clientId) ? Collections.singletonList(clientId) : Collections.emptyList();
+        }
+        return orgClientIds;
+    }
+
+    /**
+     * 통계 조회 (일별/월별 모드 분기).
      */
     public ApiStatisticsResultDto getStatistics(String orgId, ApiStatisticsSearchDto searchDto) {
-        LocalDateTime startTime = searchDto.getStartDate().atStartOfDay();
-        LocalDateTime endTime = searchDto.getEndDate().atTime(LocalTime.MAX);
+        log.debug("[통계] 조회 시작 - orgId={}, mode={}, clientId={}, 일별[{}~{}], 월별[{}]",
+            orgId, searchDto.getMode(), searchDto.getClientId(),
+            searchDto.getStartDate(), searchDto.getEndDate(), searchDto.getMonth());
 
-        ApiStatisticsSummaryDto summary;
-        List<ApiStatisticsDetailDto> details;
-
-        if (searchDto.hasSelectedApp()) {
-            // 특정 앱 통계
-            String clientId = searchDto.getClientId();
-
-            // 해당 앱이 조직 소속인지 검증
-            if (!isAppBelongsToOrg(clientId, orgId)) {
+        List<String> clientIds = resolveClientIds(orgId, searchDto);
+        log.debug("[통계] org 스코핑 clientId {}건 - {}", clientIds.size(), clientIds);
+        if (clientIds.isEmpty()) {
+            log.debug("[통계] 대상 clientId 없음 - 빈 결과 반환 (orgId={})", orgId);
             return ApiStatisticsResultDto.empty();
         }
 
-            summary = apiStatisticsRepository.findSummaryByOrgAndApp(
-                orgId, clientId, startTime, endTime);
-            details = apiStatisticsRepository.findDetailByOrgAndApp(
-                orgId, clientId, startTime, endTime);
+        ApiStatisticsSummaryDto summary;
+        List<ApiStatisticsDetailDto> details;
+        List<ApiStatisticsPeriodDto> periods;
+
+        if (searchDto.isMonthly()) {
+            String month = searchDto.getMonth();
+            String currentYm = YearMonth.now().format(YYYYMM_FMT);
+            YearMonth ym = YearMonth.parse(month, YYYYMM_FMT);
+            boolean isCurrent = month.equals(currentYm);
+            LocalDate monthStart = ym.atDay(1);
+            LocalDate monthEnd = isCurrent ? LocalDate.now() : ym.atEndOfMonth();
+
+            if (isCurrent) {
+                // 현재 월: DAY(과거일) + HOUR(오늘) 합산. 하단 일별표도 동일 소스.
+                log.debug("[통계] 월별-현재월 {} → DAY+오늘(HOUR) {}~{}", month, monthStart, monthEnd);
+                RangeStats rs = combineDayAndToday(clientIds, monthStart, monthEnd);
+                summary = rs.summary;
+                details = rs.details;
+                periods = rs.periods;
             } else {
-            // 전체 앱 통계
-            summary = apiStatisticsRepository.findSummaryByOrgAndPeriod(
-                orgId, startTime, endTime);
-            details = apiStatisticsRepository.findDetailByOrgAndPeriod(
-                orgId, startTime, endTime);
+                // 과거 월: 요약/API별은 API_STATS_MONTH, 하단 일별표는 해당 월의 DAY 일자별
+                log.debug("[통계] 월별-과거월 {} → API_STATS_MONTH + 하단 DAY 일별", month);
+                summary = orEmpty(apiStatsMonthRepository.findSummary(clientIds, month, month));
+                details = nvl(apiStatsMonthRepository.findDetail(clientIds, month, month));
+                List<Object[]> monthlyDayRows = apiStatsDayRepository.findPeriodByDay(clientIds, monthStart, monthEnd);
+                periods = buildDailyPeriods(monthlyDayRows, monthStart, monthEnd);
+            }
+        } else {
+            // 일별 조회: DAY(과거일) + HOUR(오늘) 합산. (HOUR는 보존 짧음/오늘만, DAY는 과거 보존)
+            LocalDate start = searchDto.getStartDate();
+            LocalDate end = searchDto.getEndDate();
+            log.debug("[통계] 일별 조회 - DAY+오늘(HOUR), 범위 {}~{}", start, end);
+            RangeStats rs = combineDayAndToday(clientIds, start, end);
+            summary = rs.summary;
+            details = rs.details;
+            periods = rs.periods;
         }
 
-        // null 체크 및 빈 결과 처리
         if (summary == null) {
             summary = ApiStatisticsSummaryDto.empty();
         } else {
             summary.calculateRates();
         }
-
         if (details == null) {
             details = Collections.emptyList();
         } else {
             details.forEach(ApiStatisticsDetailDto::calculateRates);
         }
+        if (periods == null) {
+            periods = Collections.emptyList();
+        } else {
+            periods.forEach(ApiStatisticsPeriodDto::calculateRates);
+        }
 
-        return new ApiStatisticsResultDto(summary, details);
+        // API_NAME(인터페이스 ID) → 표시명(TSEAIHE01.EAISVCDESC) 매핑
+        applyDisplayNames(details);
+
+        log.debug("[통계] 조회 완료 - 총호출={}, 성공={}, 타임아웃={}, 실패={} / API별 {}건, 기간별 {}건",
+            summary.getTotalCount(), summary.getSuccessCount(), summary.getTimeoutCount(),
+            summary.getErrorCount(), details.size(), periods.size());
+
+        return new ApiStatisticsResultDto(summary, details, periods);
     }
 
     /**
-     * 앱이 해당 조직 소속인지 검증
+     * 일별 기간표 Object[] row → ApiStatisticsPeriodDto.
+     * row: [0]=일자(String), [1]=total, [2]=success, [3]=timeout, [4]=systemErr, [5]=biz
      */
-    private boolean isAppBelongsToOrg(String clientId, String orgId) {
-        return credentialRepository.findByClientidAndOrgid(clientId, orgId).isPresent();
+    private static ApiStatisticsPeriodDto toPeriodDto(Object[] row) {
+        return new ApiStatisticsPeriodDto(
+            row[0] != null ? row[0].toString() : null,
+            toLong(row[1]), toLong(row[2]), toLong(row[3]), toLong(row[4]), toLong(row[5]));
+    }
+
+    private static Long toLong(Object o) {
+        return (o instanceof Number) ? ((Number) o).longValue() : 0L;
     }
 
     /**
-     * CSV 다운로드
+     * 지정 날짜 범위 [start,end] 의 통계를 조립한다.
+     * 과거일은 API_STATS_DAY, "오늘"은 아직 DAY 미집계이므로 API_STATS_HOUR 에서 합산해 더한다.
+     */
+    private RangeStats combineDayAndToday(List<String> clientIds, LocalDate start, LocalDate end) {
+        LocalDate today = LocalDate.now();
+        boolean includesToday = !today.isBefore(start) && !today.isAfter(end);
+        LocalDate dayEnd = includesToday ? today.minusDays(1) : end;
+
+        ApiStatisticsSummaryDto summary = ApiStatisticsSummaryDto.empty();
+        List<ApiStatisticsDetailDto> details = new ArrayList<>();
+        Map<String, ApiStatisticsPeriodDto> byDate = new LinkedHashMap<>();
+
+        // 과거일: API_STATS_DAY [start .. dayEnd]
+        if (!start.isAfter(dayEnd)) {
+            summary = orEmpty(apiStatsDayRepository.findSummary(clientIds, start, dayEnd));
+            details = nvl(apiStatsDayRepository.findDetail(clientIds, start, dayEnd));
+            byDate = rowsToMap(apiStatsDayRepository.findPeriodByDay(clientIds, start, dayEnd));
+        }
+
+        // 오늘: API_STATS_HOUR (익일 DAY 집계 전)
+        if (includesToday) {
+            LocalDateTime ts = today.atStartOfDay();
+            LocalDateTime te = today.atTime(LocalTime.MAX);
+            ApiStatisticsSummaryDto todaySummary = orEmpty(apiStatsHourRepository.findSummary(clientIds, ts, te));
+            List<ApiStatisticsDetailDto> todayDetails = nvl(apiStatsHourRepository.findDetail(clientIds, ts, te));
+            summary = mergeSummaries(summary, todaySummary);
+            details = mergeDetails(details, todayDetails);
+            if (nz(todaySummary.getTotalCount()) > 0) {
+                ApiStatisticsPeriodDto todayRow = new ApiStatisticsPeriodDto();
+                todayRow.setPeriod(today.format(DAY_FMT));
+                todayRow.setTotalCount(todaySummary.getTotalCount());
+                todayRow.setSuccessCount(todaySummary.getSuccessCount());
+                todayRow.setTimeoutCount(todaySummary.getTimeoutCount());
+                todayRow.setErrorCount(todaySummary.getErrorCount());
+                todayRow.setHasData(true);
+                byDate.put(todayRow.getPeriod(), todayRow);
+            }
+            log.debug("[통계] 오늘분 HOUR 합산 - total={}", todaySummary.getTotalCount());
+        }
+
+        return new RangeStats(summary, details, fillDailyPeriods(byDate, start, end));
+    }
+
+    private static Map<String, ApiStatisticsPeriodDto> rowsToMap(List<Object[]> rows) {
+        Map<String, ApiStatisticsPeriodDto> byDate = new LinkedHashMap<>();
+        if (rows != null) {
+            for (Object[] r : rows) {
+                ApiStatisticsPeriodDto dto = toPeriodDto(r);
+                byDate.put(dto.getPeriod(), dto);
+            }
+        }
+        return byDate;
+    }
+
+    /**
+     * 일별 기간표를 지정 날짜 범위의 '모든 일자'로 채운다(데이터 없는 날은 hasData=false → 표에 '-').
+     * 각 행 라벨은 "yyyy-MM-dd (요일)".
+     */
+    private static List<ApiStatisticsPeriodDto> buildDailyPeriods(List<Object[]> rows, LocalDate start, LocalDate end) {
+        return fillDailyPeriods(rowsToMap(rows), start, end);
+    }
+
+    private static List<ApiStatisticsPeriodDto> fillDailyPeriods(Map<String, ApiStatisticsPeriodDto> byDate,
+                                                                 LocalDate start, LocalDate end) {
+        if (start == null || end == null) {
+            return new ArrayList<>(byDate.values());
+        }
+        List<ApiStatisticsPeriodDto> result = new ArrayList<>();
+        for (LocalDate d = start; !d.isAfter(end); d = d.plusDays(1)) {
+            String key = d.format(DAY_FMT);
+            String label = key + " (" + WEEKDAYS[d.getDayOfWeek().getValue() - 1] + ")";
+            ApiStatisticsPeriodDto dto = byDate.get(key);
+            if (dto == null) {
+                dto = new ApiStatisticsPeriodDto();
+                dto.setPeriod(label);
+                dto.setTotalCount(0L);
+                dto.setSuccessCount(0L);
+                dto.setTimeoutCount(0L);
+                dto.setErrorCount(0L);
+            } else {
+                dto.setPeriod(label);
+            }
+            result.add(dto);
+        }
+        return result;
+    }
+
+    private static <T> List<T> nvl(List<T> l) {
+        return l != null ? new ArrayList<>(l) : new ArrayList<>();
+    }
+
+    private static ApiStatisticsSummaryDto orEmpty(ApiStatisticsSummaryDto s) {
+        return s != null ? s : ApiStatisticsSummaryDto.empty();
+    }
+
+    private static long nz(Long v) {
+        return v != null ? v : 0L;
+    }
+
+    /**
+     * 두 요약(DAY + 오늘 HOUR)을 합산. rate 는 이후 calculateRates 에서 재계산.
+     */
+    private static ApiStatisticsSummaryDto mergeSummaries(ApiStatisticsSummaryDto a, ApiStatisticsSummaryDto b) {
+        ApiStatisticsSummaryDto m = new ApiStatisticsSummaryDto();
+        m.setTotalCount(nz(a.getTotalCount()) + nz(b.getTotalCount()));
+        m.setSuccessCount(nz(a.getSuccessCount()) + nz(b.getSuccessCount()));
+        m.setTimeoutCount(nz(a.getTimeoutCount()) + nz(b.getTimeoutCount()));
+        m.setErrorCount(nz(a.getErrorCount()) + nz(b.getErrorCount()));
+        return m;
+    }
+
+    /**
+     * API별 상세를 API_NAME 기준으로 합산(DAY + 오늘 HOUR). rate 는 이후 calculateRates 에서 재계산.
+     */
+    private static List<ApiStatisticsDetailDto> mergeDetails(List<ApiStatisticsDetailDto> a,
+                                                             List<ApiStatisticsDetailDto> b) {
+        Map<String, ApiStatisticsDetailDto> acc = new LinkedHashMap<>();
+        accumulate(acc, a);
+        accumulate(acc, b);
+        List<ApiStatisticsDetailDto> merged = new ArrayList<>(acc.values());
+        merged.sort(Comparator.comparing(ApiStatisticsDetailDto::getTotalCount, Comparator.reverseOrder()));
+        return merged;
+    }
+
+    private static void accumulate(Map<String, ApiStatisticsDetailDto> acc, List<ApiStatisticsDetailDto> list) {
+        if (list == null) {
+            return;
+        }
+        for (ApiStatisticsDetailDto d : list) {
+            ApiStatisticsDetailDto cur = acc.computeIfAbsent(d.getApiName(), k -> {
+                ApiStatisticsDetailDto n = new ApiStatisticsDetailDto();
+                n.setApiName(k);
+                n.setTotalCount(0L);
+                n.setSuccessCount(0L);
+                n.setTimeoutCount(0L);
+                n.setErrorCount(0L);
+                return n;
+            });
+            cur.setTotalCount(nz(cur.getTotalCount()) + nz(d.getTotalCount()));
+            cur.setSuccessCount(nz(cur.getSuccessCount()) + nz(d.getSuccessCount()));
+            cur.setTimeoutCount(nz(cur.getTimeoutCount()) + nz(d.getTimeoutCount()));
+            cur.setErrorCount(nz(cur.getErrorCount()) + nz(d.getErrorCount()));
+        }
+    }
+
+    /** combineDayAndToday 반환 홀더. */
+    private static final class RangeStats {
+        final ApiStatisticsSummaryDto summary;
+        final List<ApiStatisticsDetailDto> details;
+        final List<ApiStatisticsPeriodDto> periods;
+
+        RangeStats(ApiStatisticsSummaryDto summary, List<ApiStatisticsDetailDto> details,
+                   List<ApiStatisticsPeriodDto> periods) {
+            this.summary = summary;
+            this.details = details;
+            this.periods = periods;
+        }
+    }
+
+    /**
+     * API별 상세의 apiName(인터페이스 ID)을 TSEAIHE01.EAISVCDESC(표시명)로 치환.
+     * 매핑 없으면 인터페이스 ID 를 그대로 둔다.
+     */
+    private void applyDisplayNames(List<ApiStatisticsDetailDto> details) {
+        if (details == null || details.isEmpty()) {
+            return;
+        }
+        Set<String> ids = details.stream()
+            .map(ApiStatisticsDetailDto::getApiName)
+            .filter(n -> n != null && !n.trim().isEmpty())
+            .collect(Collectors.toSet());
+        if (ids.isEmpty()) {
+            return;
+        }
+        Map<String, String> descMap = gwSvcInfoRepository.findBySvcNameIn(ids).stream()
+            .filter(s -> s.getSvcDesc() != null && !s.getSvcDesc().trim().isEmpty())
+            .collect(Collectors.toMap(GwSvcInfo::getSvcName, GwSvcInfo::getSvcDesc, (x, y) -> x));
+        details.forEach(d -> {
+            String desc = descMap.get(d.getApiName());
+            if (desc != null && !desc.trim().isEmpty()) {
+                d.setApiName(desc);
+            }
+        });
+        log.debug("[통계] API 표시명 매핑 - 대상 {}건, 매칭 {}건", ids.size(), descMap.size());
+    }
+
+    /**
+     * 월별 모드에서 선택 가능한 월 목록(YYYYMM, 최신순).
+     */
+    public List<String> getAvailableMonths(String orgId) {
+        List<String> clientIds = orgClientIds(orgId);
+        List<String> months = clientIds.isEmpty()
+            ? new ArrayList<>()
+            : new ArrayList<>(apiStatsMonthRepository.findAvailableMonths(clientIds));
+
+        // 데이터가 없더라도 현재 년-월은 항상 선택 가능하도록 포함 (최신순 유지)
+        String currentYm = YearMonth.now().format(YYYYMM_FMT);
+        if (!months.contains(currentYm)) {
+            months.add(0, currentYm);
+        }
+        log.debug("[통계] 선택가능 월 {}건 (현재월 {} 포함) - orgId={}", months.size(), currentYm, orgId);
+        return months;
+    }
+
+    /**
+     * 최신 집계 시각 안내 문자열("yyyy-MM-dd HH시"). 데이터 없으면 null.
+     */
+    public String getLatestStatTime(String orgId) {
+        List<String> clientIds = orgClientIds(orgId);
+        if (clientIds.isEmpty()) {
+            return null;
+        }
+        LocalDateTime latest = apiStatsHourRepository.findLatestStatTime(clientIds);
+        String result = latest != null ? latest.format(LATEST_FMT) : null;
+        log.debug("[통계] 최신 집계 시각 - {} (orgId={})", result, orgId);
+        return result;
+    }
+
+    /**
+     * 시간별 집계 잡의 크론에서 분(minute)을 추출한다. 파싱 불가 시 null → 문구는 "매시 집계"로 폴백.
+     * Quartz 크론 필드: [sec] [min] [hour] ... → 인덱스 1이 분.
+     */
+    @Transactional
+    public Integer getAggregationMinute() {
+        try {
+            // 잡명은 PTL_PROPERTY(Portal/stats.hourly.aggregation.job.name)로 지정 가능(없으면 기본값 생성)
+            String jobName = portalPropertyService.getOrCreateProperty(
+                PROP_GROUP, JOB_NAME_PROP, DEFAULT_HOURLY_JOB_NAME,
+                "통계 시간별 집계 스케줄러 잡명(집계 주기 안내 문구용)");
+            Integer minute = jobInfoRepository.findByJobname(jobName)
+                .map(JobInfoCron::minuteOf)
+                .orElse(null);
+            log.debug("[통계] 집계 크론 분(N) = {} (job={})", minute, jobName);
+            return minute;
+        } catch (Exception e) {
+            log.warn("집계 크론 조회 실패 - 안내 문구 분 표기 생략", e);
+            return null;
+        }
+    }
+
+    private List<String> orgClientIds(String orgId) {
+        return gwAuthClientRepository.findClientIdsByOrgId(orgId).stream()
+            .filter(id -> id != null && !id.trim().isEmpty())
+            .collect(Collectors.toList());
+    }
+
+    /**
+     * 크론에서 분 필드를 추출하는 헬퍼.
+     */
+    private static final class JobInfoCron {
+        static Integer minuteOf(com.eactive.apim.portal.apps.statistics.repository.entity.JobInfo job) {
+            String cron = job.getCronexp();
+            if (cron == null) {
+                return null;
+            }
+            String[] fields = cron.trim().split("\\s+");
+            if (fields.length >= 2 && fields[1].matches("^\\d{1,2}$")) {
+                return Integer.parseInt(fields[1]);
+            }
+            return null;
+        }
+    }
+
+    /**
+     * CSV 다운로드.
+     *
+     * ※ UI에서 다운로드 버튼은 제거되었으나(요청사항), 백엔드 기능은 유지한다.
+     *   외부/직접 호출로 재사용될 수 있어 엔드포인트(/statistics/api/download)와 함께 남겨둔다.
      */
     public void downloadCsv(String orgId, ApiStatisticsSearchDto searchDto, HttpServletResponse response) throws IOException {
+        log.debug("[통계] CSV 다운로드 - orgId={}, mode={}", orgId, searchDto.getMode());
         ApiStatisticsResultDto result = getStatistics(orgId, searchDto);
 
-        String fileName = String.format("API_Statistics_%s_%s.csv",
-            searchDto.getStartDate().toString(),
-            searchDto.getEndDate().toString());
+        String rangeLabel = searchDto.isMonthly()
+            ? searchDto.getMonth()
+            : searchDto.getStartDate() + " ~ " + searchDto.getEndDate();
+
+        String fileName = String.format("API_Statistics_%s.csv",
+            rangeLabel.replace(" ", "").replace("~", "_"));
 
         response.setContentType("text/csv; charset=UTF-8");
         response.setHeader("Content-Disposition", "attachment; filename=\"" + URLEncoder.encode(fileName, StandardCharsets.UTF_8.name()) + "\"");
@@ -114,53 +473,52 @@ public class ApiStatisticsService {
         response.getOutputStream().write(0xBF);
 
         try (PrintWriter writer = new PrintWriter(new OutputStreamWriter(response.getOutputStream(), StandardCharsets.UTF_8), true)) {
-            // 조회 조건
-            writer.println("조회 기간," + searchDto.getStartDate() + " ~ " + searchDto.getEndDate());
+            writer.println("조회 기간," + rangeLabel);
 
             String appName = "전체 앱";
             if (searchDto.hasSelectedApp()) {
-                appName = credentialRepository.findById(searchDto.getClientId())
-                    .map(Credential::getClientname)
+                appName = gwAuthClientRepository.findById(searchDto.getClientId())
+                    .map(GwAuthClient::getClientName)
                     .orElse("선택된 앱");
             }
             writer.println("앱 구분," + appName);
             writer.println();
 
-            // 전체 통계
             ApiStatisticsSummaryDto summary = result.getSummary();
             writer.println("[전체 통계]");
-            writer.println("총 호출 건," + summary.getTotalAttempted());
-            writer.println("성공 건," + summary.getTotalCompleted() + "," + summary.getSuccessRate() + "%");
-            writer.println("실패 건," + summary.getTotalFailed() + "," + summary.getFailureRate() + "%");
+            writer.println("총 호출 건," + summary.getTotalCount());
+            writer.println("성공 건," + summary.getSuccessCount() + "," + summary.getSuccessRate() + "%");
+            writer.println("타임아웃 건," + summary.getTimeoutCount() + "," + summary.getTimeoutRate() + "%");
+            writer.println("실패 건," + summary.getErrorCount() + "," + summary.getErrorRate() + "%");
             writer.println();
 
-            // API별 통계 헤더
             writer.println("[API별 통계]");
-            writer.println("API명,호출 건,성공 건,성공율,실패 건,실패율");
-
-            // API별 통계 데이터
+            writer.println("API명,호출 건,성공 건,타임아웃 건,실패 건");
             for (ApiStatisticsDetailDto detail : result.getDetails()) {
-                writer.println(String.format("%s,%d,%d,%s%%,%d,%s%%",
+                writer.println(String.format("%s,%d,%d,%d,%d",
                     escapeCsv(detail.getApiName()),
-                    detail.getAttemptedCount(),
-                    detail.getCompletedCount(),
-                    detail.getSuccessRate(),
-                    detail.getFailedCount(),
-                    detail.getFailureRate()));
+                    detail.getTotalCount(),
+                    detail.getSuccessCount(),
+                    detail.getTimeoutCount(),
+                    detail.getErrorCount()));
             }
+            writer.println();
 
-            // 전체 합계 행
-            writer.println(String.format("전체,%d,%d,%s%%,%d,%s%%",
-                summary.getTotalAttempted(),
-                summary.getTotalCompleted(),
-                summary.getSuccessRate(),
-                summary.getTotalFailed(),
-                summary.getFailureRate()));
+            writer.println("[기간별 통계]");
+            writer.println("기간,호출 건,성공 건,타임아웃 건,실패 건");
+            for (ApiStatisticsPeriodDto period : result.getPeriods()) {
+                writer.println(String.format("%s,%d,%d,%d,%d",
+                    escapeCsv(period.getPeriod()),
+                    period.getTotalCount(),
+                    period.getSuccessCount(),
+                    period.getTimeoutCount(),
+                    period.getErrorCount()));
+            }
         }
     }
 
     /**
-     * CSV 값 이스케이프 (쉼표, 따옴표 처리)
+     * CSV 값 이스케이프 (쉼표, 따옴표 처리).
      */
     private String escapeCsv(String value) {
         if (value == null) return "";

src/main/java/com/eactive/apim/portal/common/breadcrumb/GlobalControllerAdvice.java

@@ -11,6 +11,7 @@ import org.springframework.web.bind.annotation.ModelAttribute;
 import com.eactive.apim.portal.config.PortalProperties;
 import com.eactive.apim.portal.apps.session.service.UserSessionService;
 import com.eactive.apim.portal.common.security.ClientGuardService;
+import com.eactive.apim.portal.portalproperty.service.PortalPropertyService;
 
 @ControllerAdvice
 public class GlobalControllerAdvice {
@@ -27,6 +28,9 @@ public class GlobalControllerAdvice {
     @Autowired
     private ClientGuardService clientGuardService;
 
+    @Autowired
+    private PortalPropertyService portalPropertyService;
+
     @Autowired
     private Environment environment;
 
@@ -93,4 +97,14 @@ public class GlobalControllerAdvice {
     public boolean clientGuardDevtools() {
         return clientGuardService.isDevtoolsGuardEnabled();
     }
+
+    /**
+     * 푸터 고객센터 연락처. PortalProperty(Portal/customer.center.contact)에서 조회.
+     * 전화번호가 아닐 수도 있으므로 값 그대로 출력하되 템플릿에서 th:text(HTML escape)로 렌더한다.
+     */
+    @ModelAttribute("customerCenterContact")
+    public String customerCenterContact() {
+        return portalPropertyService.getOrCreateProperty(
+            "Portal", "customer.center.contact", "1588-3388", "고객센터 연락처");
+    }
 }

src/main/java/com/eactive/apim/portal/config/BaseDatasourceConfiguration.java

@@ -109,7 +109,8 @@ public class BaseDatasourceConfiguration {
 
         return builder
                 .dataSource(dataSource)
-                .packages(prop.getEntityPackage())
+                // entity-package 는 콤마로 복수 지정 가능 (gateway 는 online-core + 포털 통계 엔티티 패키지)
+                .packages(prop.getEntityPackage().split("\\s*,\\s*"))
                 .persistenceUnit(persistenceUnit)
                 .properties(properties)
                 .build();

src/main/java/com/eactive/apim/portal/djb/community/qna/comment/controller/InquiryCommentController.java

@@ -43,7 +43,8 @@ public class InquiryCommentController {
     public ResponseEntity<InquiryCommentDTO> create(@PathVariable String inquiryId,
                                                     @Valid @RequestBody InquiryCommentCreateRequest request) {
         PortalAuthenticatedUser current = SecurityUtil.getPortalAuthenticatedUser();
-        InquiryCommentDTO created = inquiryCommentFacade.createUserComment(inquiryId, request.getContent(), current);
+        InquiryCommentDTO created = inquiryCommentFacade.createUserComment(
+                inquiryId, request.getContent(), request.getVisibility(), current);
         return ResponseEntity.ok(created);
     }
 

src/main/java/com/eactive/apim/portal/djb/community/qna/comment/dto/InquiryCommentCreateRequest.java

@@ -11,4 +11,7 @@ public class InquiryCommentCreateRequest {
     @NotBlank(message = "댓글 내용을 입력해주세요.")
     @Size(max = 2000, message = "댓글은 2000자를 초과할 수 없습니다.")
     private String content;
+
+    /** 공개범위(ALL=공개, PRIVATE=비공개). 미지정 시 공개. */
+    private String visibility;
 }

src/main/java/com/eactive/apim/portal/djb/community/qna/comment/dto/InquiryCommentDTO.java

@@ -26,4 +26,13 @@ public class InquiryCommentDTO {
     private LocalDateTime createdDate;
 
     private boolean deletable;
+
+    /** 공개범위(ALL/PRIVATE). */
+    private String visibility;
+
+    /** 비공개 댓글 여부 — 허용 독자에게는 "비공개" 태그로 표시. */
+    private boolean privateComment;
+
+    /** 비공개 댓글이지만 열람 권한이 없어 "비공개 댓글"로만 노출되는지 여부. */
+    private boolean privatePlaceholder;
 }

src/main/java/com/eactive/apim/portal/djb/community/qna/comment/service/InquiryCommentFacade.java

@@ -11,7 +11,7 @@ public interface InquiryCommentFacade {
 
     List<InquiryCommentDTO> getComments(String inquiryId, PortalAuthenticatedUser current);
 
-    InquiryCommentDTO createUserComment(String inquiryId, String content, PortalAuthenticatedUser current);
+    InquiryCommentDTO createUserComment(String inquiryId, String content, String visibility, PortalAuthenticatedUser current);
 
     void deleteOwnComment(String commentId, PortalAuthenticatedUser current);
 

src/main/java/com/eactive/apim/portal/djb/community/qna/comment/service/InquiryCommentFacadeImpl.java

@@ -3,15 +3,19 @@ package com.eactive.apim.portal.djb.community.qna.comment.service;
 import com.eactive.apim.portal.apps.community.qna.service.InquiryService;
 import com.eactive.apim.portal.common.exception.NotFoundException;
 import com.eactive.apim.portal.common.user.PortalAuthenticatedUser;
+import com.eactive.apim.portal.common.util.StringMaskingUtil;
 import com.eactive.apim.portal.djb.community.qna.comment.dto.InquiryCommentDTO;
 import com.eactive.apim.portal.djb.community.qna.comment.repository.InquiryCommentRepository;
 import com.eactive.apim.portal.djb.community.qna.comment.repository.UserInfoRepository;
 import com.eactive.apim.portal.djb.community.qna.constant.DjbInquiryStatus;
 import com.eactive.apim.portal.djb.community.qna.support.InquiryCommentPermissionChecker;
+import com.eactive.apim.portal.portalorg.entity.PortalOrg;
 import com.eactive.apim.portal.portaluser.entity.PortalUser;
+import com.eactive.apim.portal.portaluser.entity.PortalUserEnums;
 import com.eactive.apim.portal.portaluser.repository.PortalUserRepository;
 import com.eactive.apim.portal.qna.entity.Inquiry;
 import com.eactive.apim.portal.qna.entity.InquiryComment;
+import com.eactive.apim.portal.qna.entity.VisibilityScope;
 import com.eactive.apim.portal.template.entity.MessageCode;
 import com.eactive.apim.portal.user.entity.UserInfo;
 import lombok.RequiredArgsConstructor;
@@ -37,6 +41,7 @@ public class InquiryCommentFacadeImpl implements InquiryCommentFacade {
 
     private static final String ADMIN_N = "N";
     private static final String DEL_N = "N";
+    private static final String UNKNOWN_WRITER = "(알 수 없음)";
 
     private final InquiryService inquiryService;
     private final InquiryCommentService commentService;
@@ -51,21 +56,24 @@ public class InquiryCommentFacadeImpl implements InquiryCommentFacade {
     public List<InquiryCommentDTO> getComments(String inquiryId, PortalAuthenticatedUser current) {
         inquiryService.getAccessibleInquiry(current, inquiryId);
         List<InquiryComment> comments = commentService.findActiveByInquiryId(inquiryId);
-        Map<String, String> writerNames = resolveWriterNames(comments);
+        Map<String, Writer> writers = resolveWriters(comments);
         return comments.stream()
-                .map(c -> toDto(c, current, writerNames))
+                .map(c -> toDto(c, current, writers))
                 .collect(Collectors.toList());
     }
 
     @Override
-    public InquiryCommentDTO createUserComment(String inquiryId, String content, PortalAuthenticatedUser current) {
+    public InquiryCommentDTO createUserComment(String inquiryId, String content, String visibility, PortalAuthenticatedUser current) {
         Inquiry inquiry = inquiryService.getAccessibleInquiry(current, inquiryId);
         permissionChecker.assertWritable(inquiry);
-        InquiryComment saved = commentService.create(inquiry, content, ADMIN_N);
+        // 댓글은 공개(ALL)/비공개(PRIVATE) 2단계만 지원
+        VisibilityScope scope = VisibilityScope.PRIVATE == VisibilityScope.fromString(visibility, VisibilityScope.ALL)
+                ? VisibilityScope.PRIVATE : VisibilityScope.ALL;
+        InquiryComment saved = commentService.create(inquiry, content, ADMIN_N, scope);
         publishAdminNotification(inquiry, saved, current);
-        Map<String, String> writerNames = new HashMap<>();
-        writerNames.put(current.getId(), current.getUserName());
-        return toDto(saved, current, writerNames);
+        Map<String, Writer> writers = new HashMap<>();
+        writers.put(current.getId(), currentWriter(current));
+        return toDto(saved, current, writers);
     }
 
     @Override
@@ -102,7 +110,7 @@ public class InquiryCommentFacadeImpl implements InquiryCommentFacade {
         adminNotifier.notifyPortalAdmins(MessageCode.INQUIRY_COMMENT_CREATED, params);
     }
 
-    private Map<String, String> resolveWriterNames(List<InquiryComment> comments) {
+    private Map<String, Writer> resolveWriters(List<InquiryComment> comments) {
         Set<String> ids = new HashSet<>();
         for (InquiryComment c : comments) {
             String createdBy = c.getCreatedBy();
@@ -110,11 +118,11 @@ public class InquiryCommentFacadeImpl implements InquiryCommentFacade {
                 ids.add(createdBy);
             }
         }
-        Map<String, String> map = new HashMap<>();
+        Map<String, Writer> map = new HashMap<>();
         for (String id : ids) {
-            String name = lookupWriterName(id);
-            if (name != null && !name.isEmpty()) {
-                map.put(id, name);
+            Writer writer = lookupWriter(id);
+            if (writer != null && writer.name != null && !writer.name.isEmpty()) {
+                map.put(id, writer);
             } else {
                 log.warn("댓글 작성자명 조회 실패 — createdBy={}, isUuid={}", id, isUuid(id));
             }
@@ -122,23 +130,35 @@ public class InquiryCommentFacadeImpl implements InquiryCommentFacade {
         return map;
     }
 
-    private String lookupWriterName(String createdBy) {
+    private Writer lookupWriter(String createdBy) {
         if (isUuid(createdBy)) {
-            String name = portalUserRepository.findById(createdBy)
-                    .map(PortalUser::getUserName).orElse(null);
-            if (name != null && !name.isEmpty()) {
-                return name;
+            PortalUser portalUser = portalUserRepository.findById(createdBy).orElse(null);
+            if (portalUser != null && portalUser.getUserName() != null && !portalUser.getUserName().isEmpty()) {
+                return toWriter(portalUser);
             }
-            return userInfoRepository.findById(createdBy)
-                    .map(UserInfo::getUsername).orElse(null);
+            UserInfo userInfo = userInfoRepository.findById(createdBy).orElse(null);
+            return userInfo != null ? new Writer(userInfo.getUsername(), null, null) : null;
         }
-        String name = userInfoRepository.findById(createdBy)
-                .map(UserInfo::getUsername).orElse(null);
-        if (name != null && !name.isEmpty()) {
-            return name;
+        UserInfo userInfo = userInfoRepository.findById(createdBy).orElse(null);
+        if (userInfo != null && userInfo.getUsername() != null && !userInfo.getUsername().isEmpty()) {
+            return new Writer(userInfo.getUsername(), null, null);
         }
-        return portalUserRepository.findById(createdBy)
-                .map(PortalUser::getUserName).orElse(null);
+        PortalUser portalUser = portalUserRepository.findById(createdBy).orElse(null);
+        return portalUser != null ? toWriter(portalUser) : null;
+    }
+
+    private Writer toWriter(PortalUser portalUser) {
+        PortalOrg org = portalUser.getPortalOrg();
+        return new Writer(portalUser.getUserName(),
+                org != null ? org.getId() : null,
+                org != null ? org.getOrgName() : null);
+    }
+
+    private Writer currentWriter(PortalAuthenticatedUser current) {
+        PortalOrg org = current.getPortalOrg();
+        return new Writer(current.getUserName(),
+                org != null ? org.getId() : null,
+                org != null ? org.getOrgName() : null);
     }
 
     private boolean isUuid(String value) {
@@ -154,21 +174,50 @@ public class InquiryCommentFacadeImpl implements InquiryCommentFacade {
     }
 
     private InquiryCommentDTO toDto(InquiryComment entity, PortalAuthenticatedUser current,
-                                    Map<String, String> writerNames) {
+                                    Map<String, Writer> writers) {
         String writerId = entity.getCreatedBy();
-        boolean deletable = writerId != null
-                && writerId.equals(current.getId())
+        boolean isAdmin = "Y".equals(entity.getAdminYn());
+        boolean isPrivate = entity.isPrivate();
+        boolean owner = writerId != null && writerId.equals(current.getId());
+        Writer writer = writerId != null ? writers.get(writerId) : null;
+
+        // 비공개 댓글 열람 권한: 관리자 댓글은 대상 아님, 작성자 본인 또는 같은 법인 관리자만
+        boolean canSee = owner || canSeePrivate(current, writer);
+        String scopeName = entity.getVisibility() != null ? entity.getVisibility().name() : VisibilityScope.ALL.name();
+
+        if (isPrivate && !canSee) {
+            // 열람 권한 없는 비공개 댓글 → "비공개 댓글"로만 노출, 작성자 신원 숨김
+            return InquiryCommentDTO.builder()
+                    .id(entity.getId())
+                    .content("비공개 댓글")
+                    .writerId(null)
+                    .writerName("비공개")
+                    .adminYn(entity.getAdminYn())
+                    .createdDate(entity.getCreatedDate())
+                    .deletable(false)
+                    .visibility(scopeName)
+                    .privateComment(true)
+                    .privatePlaceholder(true)
+                    .build();
+        }
+
+        boolean deletable = owner
                 && entity.getInquiry() != null
                 && !DjbInquiryStatus.isClosed(entity.getInquiry().getInquiryStatus());
+
         String writerName;
-        if ("Y".equals(entity.getAdminYn())) {
+        if (isAdmin) {
             // 관리자 댓글은 실명 대신 "관리자"로만 표기 (신원 비노출)
             writerName = "관리자";
         } else {
-            writerName = writerId != null ? writerNames.get(writerId) : null;
-            if (writerName == null || writerName.isEmpty()) {
-                writerName = "(알 수 없음)";
+            String base = writer != null ? writer.name : null;
+            String masked = StringMaskingUtil.maskName(base, writerId, current.getId());
+            if (masked == null || masked.isEmpty()) {
+                masked = UNKNOWN_WRITER;
             }
+            writerName = (writer != null && writer.orgName != null && !writer.orgName.isEmpty())
+                    ? masked + " (" + writer.orgName + ")"
+                    : masked;
         }
         return InquiryCommentDTO.builder()
                 .id(entity.getId())
@@ -178,6 +227,34 @@ public class InquiryCommentFacadeImpl implements InquiryCommentFacade {
                 .adminYn(entity.getAdminYn())
                 .createdDate(entity.getCreatedDate())
                 .deletable(deletable)
+                .visibility(scopeName)
+                .privateComment(isPrivate)
+                .privatePlaceholder(false)
                 .build();
     }
+
+    /** 비공개 댓글을 볼 수 있는 같은 법인 관리자 여부. */
+    private boolean canSeePrivate(PortalAuthenticatedUser current, Writer writer) {
+        if (writer == null || writer.orgId == null) {
+            return false;
+        }
+        if (current.getRoleCode() != PortalUserEnums.RoleCode.ROLE_CORP_MANAGER) {
+            return false;
+        }
+        PortalOrg org = current.getPortalOrg();
+        return org != null && org.getId() != null && org.getId().equals(writer.orgId);
+    }
+
+    /** 댓글 작성자 정보(이름/법인). */
+    private static final class Writer {
+        private final String name;
+        private final String orgId;
+        private final String orgName;
+
+        private Writer(String name, String orgId, String orgName) {
+            this.name = name;
+            this.orgId = orgId;
+            this.orgName = orgName;
+        }
+    }
 }

src/main/java/com/eactive/apim/portal/djb/community/qna/comment/service/InquiryCommentService.java

@@ -4,6 +4,7 @@ import com.eactive.apim.portal.common.exception.NotFoundException;
 import com.eactive.apim.portal.djb.community.qna.comment.repository.InquiryCommentRepository;
 import com.eactive.apim.portal.qna.entity.Inquiry;
 import com.eactive.apim.portal.qna.entity.InquiryComment;
+import com.eactive.apim.portal.qna.entity.VisibilityScope;
 import lombok.RequiredArgsConstructor;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
@@ -25,12 +26,13 @@ public class InquiryCommentService {
         return repository.findByInquiry_IdAndDelYnOrderByCreatedDateAsc(inquiryId, DEL_N);
     }
 
-    public InquiryComment create(Inquiry inquiry, String content, String adminYn) {
+    public InquiryComment create(Inquiry inquiry, String content, String adminYn, VisibilityScope visibility) {
         InquiryComment comment = new InquiryComment();
         comment.setInquiry(inquiry);
         comment.setCommentDetail(content);
         comment.setAdminYn(adminYn);
         comment.setDelYn(DEL_N);
+        comment.setVisibility(visibility != null ? visibility : VisibilityScope.ALL);
         return repository.save(comment);
     }
 

src/main/java/com/eactive/apim/portal/djb/testbed/advice/DjbTestbedExceptionHandler.java

@@ -0,0 +1,37 @@
+package com.eactive.apim.portal.djb.testbed.advice;
+
+import com.eactive.apim.portal.djb.testbed.controller.DjbTestbedAuthController;
+import com.eactive.apim.portal.djb.testbed.controller.DjbTestbedSpecController;
+import com.eactive.apim.portal.djb.testbed.exception.DjbUnsupportedAuthTypeException;
+import java.util.HashMap;
+import java.util.Map;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+
+/**
+ * 테스트베드 두 컨트롤러 한정 예외 → JSON 변환.
+ * (qna 로컬 핸들러와 동일한 {@code {code, message}} 포맷.)
+ */
+@RestControllerAdvice(assignableTypes = {DjbTestbedAuthController.class, DjbTestbedSpecController.class})
+public class DjbTestbedExceptionHandler {
+
+    @ExceptionHandler(DjbUnsupportedAuthTypeException.class)
+    public ResponseEntity<Map<String, Object>> handleUnsupportedAuthType(DjbUnsupportedAuthTypeException ex) {
+        Map<String, Object> body = new HashMap<>();
+        body.put("code", "UNSUPPORTED_AUTHTYPE");
+        body.put("message", ex.getMessage());
+        body.put("authtype", ex.getAuthtype());
+        return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(body);
+    }
+
+    @ExceptionHandler(AccessDeniedException.class)
+    public ResponseEntity<Map<String, Object>> handleAccessDenied(AccessDeniedException ex) {
+        Map<String, Object> body = new HashMap<>();
+        body.put("code", "FORBIDDEN");
+        body.put("message", ex.getMessage());
+        return ResponseEntity.status(HttpStatus.FORBIDDEN).body(body);
+    }
+}

src/main/java/com/eactive/apim/portal/djb/testbed/config/DjbTestbedGatewayProperty.java

@@ -0,0 +1,157 @@
+package com.eactive.apim.portal.djb.testbed.config;
+
+import com.eactive.apim.portal.djb.testbed.enums.DjbGatewayMode;
+import com.eactive.apim.portal.portalproperty.service.PortalPropertyService;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+import org.springframework.util.StringUtils;
+
+/**
+ * 테스트베드 게이트웨이 설정을 {@code PTL_PROPERTY}(그룹 {@code Portal}, key prefix {@code djb.gateway.})
+ * 에서 읽는 얇은 접근자. 별도 property-injection 인프라 대신 기존
+ * {@link PortalPropertyService#getOrCreateProperty} 를 직접 사용한다(사용자 지시).
+ *
+ * <p>{@code getOrCreateProperty} 는 DB row 미존재 시 default 로 INSERT(그룹 존재 시)하지만
+ * <em>공백 값 보정은 하지 않으므로</em>, 여기 {@link #resolve} 에서 {@code isBlank → default} 폴백을 둔다.
+ *
+ * <p>비-Spring 컴포넌트인 {@code ApiTesterFilter}(@WebFilter)는
+ * {@code ApplicationContextUtil.getContext().getBean(DjbTestbedGatewayProperty.class)} 로 접근한다.
+ */
+@Component
+@RequiredArgsConstructor
+public class DjbTestbedGatewayProperty {
+
+    private final PortalPropertyService portalPropertyService;
+
+    private static final String GROUP = "Portal";
+
+    public static final String KEY_BASE_URL = "djb.gateway.base-url";
+    public static final String KEY_TOKEN_PATH = "djb.gateway.token-path";
+    public static final String KEY_API_KEY_HEADER = "djb.gateway.api-key-header";
+    public static final String KEY_OAUTH_HEADER = "djb.gateway.oauth-token-header";
+    public static final String KEY_TIMEOUT_SEC = "djb.gateway.timeout";
+    public static final String KEY_USE_PROXY = "djb.gateway.use-proxy";
+    public static final String KEY_TOKEN_USE_PROXY = "djb.gateway.token-use-proxy";
+
+    public static final String DEFAULT_BASE_URL = "PortalMock";
+    public static final String DEFAULT_TIMEOUT_SEC = "10";
+    public static final String DEFAULT_USE_PROXY = "true";
+    public static final String DEFAULT_TOKEN_USE_PROXY = "true";
+    private static final int TIMEOUT_FALLBACK_MS = 10_000;
+    /** GW 모드 실제 토큰 엔드포인트 경로 (DJERP_4000 OAuth 발급가이드 v0.2). */
+    public static final String DEFAULT_TOKEN_PATH = "/dj/oauth/token";
+    public static final String DEFAULT_API_KEY_HEADER = "X-DJB-API-Key";
+    /** 게이트웨이 API 호출 시 액세스 토큰 헤더명 (가이드 v0.2: Authorization → X-AUTH-TOKEN). */
+    public static final String DEFAULT_OAUTH_HEADER = "X-AUTH-TOKEN";
+
+    /** PortalMock 모드에서 사용하는 포털 기존 mock 토큰 경로. */
+    public static final String PORTAL_MOCK_TOKEN_PATH = "/api/v1/oauth/token";
+
+    public String baseUrl() {
+        return resolve(KEY_BASE_URL, DEFAULT_BASE_URL,
+                "GW Base URL. 문자열 \"PortalMock\" 이면 ApiTesterFilter 가 mock 토큰 반환");
+    }
+
+    public String tokenPath() {
+        return resolve(KEY_TOKEN_PATH, DEFAULT_TOKEN_PATH,
+                "OAuth 토큰 발급 경로 (GW 모드에서만 사용)");
+    }
+
+    public String apiKeyHeader() {
+        return resolve(KEY_API_KEY_HEADER, DEFAULT_API_KEY_HEADER,
+                "API Key 전달 헤더명");
+    }
+
+    public String oauthHeader() {
+        return resolve(KEY_OAUTH_HEADER, DEFAULT_OAUTH_HEADER,
+                "OAuth 액세스 토큰 전달 헤더명 (Bearer 토큰)");
+    }
+
+    /**
+     * 테스트베드 API 호출 시 서버 프록시({@code /api/call-api}) 사용 여부.
+     * {@code false} 이면 브라우저에서 대상 주소로 직접 호출(CORS 허용 필요). 기본 true.
+     */
+    public boolean useProxy() {
+        return parseBool(resolve(KEY_USE_PROXY, DEFAULT_USE_PROXY,
+                "테스트베드 API 호출 시 서버 프록시(/api/call-api) 사용 여부(true/false). false 이면 브라우저에서 직접 호출."), true);
+    }
+
+    /**
+     * 토큰 발급 시 서버 프록시({@code /api/call-api}) 사용 여부. API 호출 프록시와 별개로 설정.
+     * {@code false} 이면 브라우저에서 토큰 URL 로 직접 호출(CORS 허용 필요). 기본 true.
+     * (mock 모드는 포탈 자체 mock 토큰이라 프록시 유지가 자연스럽고, 실 GW 는 직접호출로 뺄 수 있음.)
+     */
+    public boolean tokenUseProxy() {
+        return parseBool(resolve(KEY_TOKEN_USE_PROXY, DEFAULT_TOKEN_USE_PROXY,
+                "테스트베드 토큰 발급 시 서버 프록시(/api/call-api) 사용 여부(true/false). false 이면 브라우저에서 직접 호출."), true);
+    }
+
+    /**
+     * 프로퍼티 값을 boolean 으로 해석. 레거시 {@code Y/N} 값도 자동 변환한다.
+     * {@code true}/{@code Y} → true, {@code false}/{@code N} → false, 그 외/null → {@code def}.
+     */
+    private static boolean parseBool(String v, boolean def) {
+        if (v == null) {
+            return def;
+        }
+        String s = v.trim();
+        if (s.equalsIgnoreCase("true") || s.equalsIgnoreCase("Y")) {
+            return true;
+        }
+        if (s.equalsIgnoreCase("false") || s.equalsIgnoreCase("N")) {
+            return false;
+        }
+        return def;
+    }
+
+    /** 테스트베드 프록시 연결/응답 타임아웃(ms). 미설정/파싱 실패 시 10초. (단위 저장: 초) */
+    public int timeoutMillis() {
+        try {
+            int sec = Integer.parseInt(resolve(KEY_TIMEOUT_SEC, DEFAULT_TIMEOUT_SEC,
+                    "테스트베드 프록시 연결/응답 타임아웃(초)"));
+            return sec > 0 ? sec * 1000 : TIMEOUT_FALLBACK_MS;
+        } catch (Exception e) {
+            return TIMEOUT_FALLBACK_MS;
+        }
+    }
+
+    public DjbGatewayMode resolveGatewayMode() {
+        return DEFAULT_BASE_URL.equalsIgnoreCase(baseUrl()) ? DjbGatewayMode.PORTAL_MOCK : DjbGatewayMode.GATEWAY;
+    }
+
+    /**
+     * OAuth 토큰 발급 URL.
+     * PortalMock → {@code portalOrigin + /api/v1/oauth/token} (기존 mock 필터가 가로챔),
+     * GATEWAY → {@code baseUrl + tokenPath}.
+     */
+    public String resolveTokenUrl(String portalOrigin) {
+        if (resolveGatewayMode() == DjbGatewayMode.PORTAL_MOCK) {
+            return stripTrailingSlash(portalOrigin) + PORTAL_MOCK_TOKEN_PATH;
+        }
+        return stripTrailingSlash(baseUrl()) + tokenPath();
+    }
+
+    /**
+     * GW 응답유형(spec responseType=gw)에서 사용할 API 호출 base URL.
+     * PortalMock → 요청 포탈 origin(mock 필터가 프록시), GATEWAY → {@code baseUrl}.
+     * (별도 {@code swagger.gw.address} 프로퍼티를 두지 않고 이 값을 단일 기준으로 사용한다.)
+     */
+    public String resolveApiBaseUrl(String portalOrigin) {
+        if (resolveGatewayMode() == DjbGatewayMode.PORTAL_MOCK) {
+            return stripTrailingSlash(portalOrigin);
+        }
+        return stripTrailingSlash(baseUrl());
+    }
+
+    private String resolve(String key, String defaultValue, String description) {
+        String value = portalPropertyService.getOrCreateProperty(GROUP, key, defaultValue, description);
+        return StringUtils.hasText(value) ? value.trim() : defaultValue;
+    }
+
+    private static String stripTrailingSlash(String s) {
+        if (s == null) {
+            return "";
+        }
+        return s.endsWith("/") ? s.substring(0, s.length() - 1) : s;
+    }
+}

src/main/java/com/eactive/apim/portal/djb/testbed/controller/DjbTestbedAuthController.java

@@ -0,0 +1,51 @@
+package com.eactive.apim.portal.djb.testbed.controller;
+
+import com.eactive.apim.portal.djb.testbed.dto.DjbCredentialSecretDto;
+import com.eactive.apim.portal.djb.testbed.dto.DjbTestbedContextDto;
+import com.eactive.apim.portal.djb.testbed.service.DjbTestbedAuthService;
+import javax.servlet.http.HttpServletRequest;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * 테스트베드 인증 컨텍스트/시크릿 REST.
+ * 컨트롤러 진입은 인증 없이 허용하되(비대상자도 context 를 받아야 함),
+ * 실제 인증/역할/소유권 검증은 {@link DjbTestbedAuthService} 가 수행한다.
+ */
+@RestController
+@RequestMapping("/djb/testbed/auth")
+@RequiredArgsConstructor
+public class DjbTestbedAuthController {
+
+    private final DjbTestbedAuthService authService;
+
+    @GetMapping("/context")
+    public ResponseEntity<DjbTestbedContextDto> context(HttpServletRequest request) {
+        return ResponseEntity.ok(authService.buildContext(resolveOrigin(request)));
+    }
+
+    @GetMapping("/credentials/{clientId}/secret")
+    public ResponseEntity<DjbCredentialSecretDto> credentialSecret(@PathVariable String clientId,
+                                                                   @RequestParam String apiId) {
+        DjbCredentialSecretDto secret = authService.getCredentialSecret(clientId, apiId);
+        return ResponseEntity.ok()
+                .header(HttpHeaders.CACHE_CONTROL, "no-store")
+                .header(HttpHeaders.PRAGMA, "no-cache")
+                .body(secret);
+    }
+
+    /** scheme://host[:port] (기본 포트는 생략). PortalMock 토큰 URL 구성에 사용. */
+    private String resolveOrigin(HttpServletRequest request) {
+        String scheme = request.getScheme();
+        String host = request.getServerName();
+        int port = request.getServerPort();
+        boolean defaultPort = ("http".equals(scheme) && port == 80) || ("https".equals(scheme) && port == 443);
+        return scheme + "://" + host + (defaultPort ? "" : ":" + port);
+    }
+}

src/main/java/com/eactive/apim/portal/djb/testbed/controller/DjbTestbedSpecController.java

@@ -0,0 +1,75 @@
+package com.eactive.apim.portal.djb.testbed.controller;
+
+import com.eactive.apim.portal.apispec.entity.ApiSpecInfo;
+import com.eactive.apim.portal.apispec.service.ApiSpecInfoService;
+import com.eactive.apim.portal.djb.testbed.enums.DjbAuthType;
+import com.eactive.apim.portal.djb.testbed.service.DjbSwaggerSpecEnricher;
+import com.eactive.apim.portal.djb.testbed.service.DjbTestbedAuthService;
+import com.eactive.apim.portal.djb.testbed.service.DjbTestbedSpecServerRewriter;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Optional;
+import javax.servlet.http.HttpServletRequest;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.util.FileCopyUtils;
+import org.springframework.util.StringUtils;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * testbed spec(swagger.json/yaml)에 AUTHTYPE 기반 securityScheme 를 주입하고,
+ * 서버 sentinel({@link DjbTestbedSpecServerRewriter#SERVER_SENTINEL})을 API SPEC 설정(responseType)에
+ * 따른 실주소로 치환해 반환한다.
+ * {@code default-token-api-spec} 은 클래스패스 기본 spec 을 그대로 반환(auth enrich 대상 외).
+ */
+@RestController
+@RequestMapping("/djb/testbed/apis")
+@RequiredArgsConstructor
+@Slf4j
+public class DjbTestbedSpecController {
+
+    private final ApiSpecInfoService apiSpecInfoService;
+    private final DjbTestbedAuthService authService;
+    private final DjbSwaggerSpecEnricher enricher;
+    private final DjbTestbedSpecServerRewriter serverRewriter;
+
+    private static final String DEFAULT_TOKEN_API_ID = "default-token-api-spec";
+    private static final String DEFAULT_SPEC_PATH = "swagger/default-token-api-spec.json";
+
+    @GetMapping(value = "/{id}/swagger.json", produces = MediaType.APPLICATION_JSON_VALUE)
+    public ResponseEntity<String> swaggerWithAuth(@PathVariable String id, HttpServletRequest request) throws IOException {
+        String json = buildSpecJson(id, request);
+        return json == null ? ResponseEntity.notFound().build() : ResponseEntity.ok(json);
+    }
+
+    @GetMapping(value = "/{id}/swagger.yaml", produces = "application/x-yaml")
+    public ResponseEntity<String> swaggerYamlWithAuth(@PathVariable String id, HttpServletRequest request) throws IOException {
+        String json = buildSpecJson(id, request);
+        return json == null ? ResponseEntity.notFound().build() : ResponseEntity.ok(serverRewriter.toYaml(json));
+    }
+
+    /** default 토큰 spec 또는 저장 spec(auth enrich + 서버 sentinel 치환)을 JSON 으로 반환. 없으면 null. */
+    private String buildSpecJson(String id, HttpServletRequest request) throws IOException {
+        if (DEFAULT_TOKEN_API_ID.equals(id)) {
+            Resource resource = new ClassPathResource(DEFAULT_SPEC_PATH);
+            String content = new String(FileCopyUtils.copyToByteArray(resource.getInputStream()), StandardCharsets.UTF_8);
+            return serverRewriter.rewriteServer(content, null, request);
+        }
+
+        Optional<ApiSpecInfo> spec = apiSpecInfoService.findById(id);
+        if (!spec.isPresent() || !StringUtils.hasText(spec.get().getTestbedSpec())) {
+            return null;
+        }
+
+        DjbAuthType authType = authService.resolveAuthType(id);
+        String enriched = enricher.enrich(spec.get().getTestbedSpec(), authType);
+        return serverRewriter.rewriteServer(enriched, spec.get(), request);
+    }
+}

src/main/java/com/eactive/apim/portal/djb/testbed/dto/DjbCredentialOptionDto.java

@@ -0,0 +1,21 @@
+package com.eactive.apim.portal.djb.testbed.dto;
+
+import lombok.Builder;
+import lombok.Data;
+
+/**
+ * 테스트베드 앱 셀렉트에 노출할 앱(PTL_CREDENTIAL) 1건. 시크릿은 포함하지 않는다.
+ */
+@Data
+@Builder
+public class DjbCredentialOptionDto {
+
+    /** PTL_CREDENTIAL.clientid */
+    private String clientId;
+
+    /** 사용자에게 보여줄 앱명(PTL_CREDENTIAL.clientname) */
+    private String clientName;
+
+    /** "0": 차단, "1": 정상 */
+    private String appStatus;
+}

src/main/java/com/eactive/apim/portal/djb/testbed/dto/DjbCredentialSecretDto.java

@@ -0,0 +1,20 @@
+package com.eactive.apim.portal.djb.testbed.dto;
+
+import com.eactive.apim.portal.djb.testbed.enums.DjbAuthType;
+import lombok.Builder;
+import lombok.Data;
+
+/**
+ * 선택한 앱의 시크릿 단건 응답(캐시 금지 · 로그 마스킹 대상).
+ * OAUTH 시 {@code clientSecret} 은 client_secret, API_KEY 시 API Key 값이다.
+ */
+@Data
+@Builder
+public class DjbCredentialSecretDto {
+
+    private String clientId;
+
+    private String clientSecret;
+
+    private DjbAuthType authType;
+}

src/main/java/com/eactive/apim/portal/djb/testbed/dto/DjbTestbedContextDto.java

@@ -0,0 +1,36 @@
+package com.eactive.apim.portal.djb.testbed.dto;
+
+import com.eactive.apim.portal.djb.testbed.enums.DjbGatewayMode;
+import java.util.List;
+import lombok.Builder;
+import lombok.Data;
+
+/**
+ * {@code GET /djb/testbed/auth/context} 응답. 시크릿은 포함하지 않는다.
+ */
+@Data
+@Builder
+public class DjbTestbedContextDto {
+
+    /** 인증 정보 제공 대상자 여부 */
+    private boolean eligible;
+
+    /** 비대상 사유 코드: ANONYMOUS / INDIVIDUAL_USER / NO_CREDENTIAL (대상자면 null) */
+    private String reason;
+
+    /** 사용자가 선택할 수 있는 앱 목록 */
+    private List<DjbCredentialOptionDto> credentials;
+
+    /** 게이트웨이 정보(시크릿 제외) */
+    private GatewayInfo gateway;
+
+    @Data
+    @Builder
+    public static class GatewayInfo {
+        private DjbGatewayMode mode;
+        private String baseUrl;
+        private String tokenUrl;
+        private String apiKeyHeader;
+        private String oauthTokenHeader;
+    }
+}

src/main/java/com/eactive/apim/portal/djb/testbed/enums/DjbAuthType.java

@@ -0,0 +1,42 @@
+package com.eactive.apim.portal.djb.testbed.enums;
+
+import com.eactive.apim.portal.djb.testbed.exception.DjbUnsupportedAuthTypeException;
+
+/**
+ * 테스트베드가 지원하는 인증 체계. {@code TSEAIHE01.AUTHTYPE}(소문자 저장) 값을 매핑한다.
+ * <ul>
+ *   <li>{@code oauth}/{@code oauth2}/{@code ca} → {@link #OAUTH}</li>
+ *   <li>{@code api_key}/{@code apikey} → {@link #API_KEY}</li>
+ *   <li>{@code none}/{@code no}/{@code noauth} → {@link #NONE}(인증 없이 호출 — 앱 선택 불필요)</li>
+ *   <li>{@code null}(EAIMessage 미존재) 및 그 외 → {@link DjbUnsupportedAuthTypeException}</li>
+ * </ul>
+ * ({@code ca} 는 게이트웨이 레거시 매퍼 {@code ObpApiService.mapAuthType} 이 OAUTH2 로 취급하는 값.)
+ */
+public enum DjbAuthType {
+    OAUTH,
+    API_KEY,
+    NONE;
+
+    public static DjbAuthType fromAuthtype(String authtype) {
+        // null(EAIMessage 미존재)은 데이터 문제 → 종전대로 예외. "none" 은 인증 없는 API.
+        if (authtype == null) {
+            throw new DjbUnsupportedAuthTypeException("null");
+        }
+        String normalized = authtype.trim().toLowerCase();
+        switch (normalized) {
+            case "oauth":
+            case "oauth2":
+            case "ca":
+                return OAUTH;
+            case "api_key":
+            case "apikey":
+                return API_KEY;
+            case "none":
+            case "no":
+            case "noauth":
+                return NONE;
+            default:
+                throw new DjbUnsupportedAuthTypeException(authtype);
+        }
+    }
+}

src/main/java/com/eactive/apim/portal/djb/testbed/enums/DjbGatewayMode.java

@@ -0,0 +1,14 @@
+package com.eactive.apim.portal.djb.testbed.enums;
+
+/**
+ * 테스트베드 호출이 향하는 대상 모드.
+ * <ul>
+ *   <li>{@code PORTAL_MOCK} — {@code djb.gateway.base-url} 이 문자열 "PortalMock" 인 경우.
+ *       {@code ApiTesterFilter} 가 mock 토큰/샘플 응답을 반환한다.</li>
+ *   <li>{@code GATEWAY} — 그 외(실제 게이트웨이 URL). 토큰 발급 요청을 실 게이트웨이로 forward.</li>
+ * </ul>
+ */
+public enum DjbGatewayMode {
+    PORTAL_MOCK,
+    GATEWAY
+}

src/main/java/com/eactive/apim/portal/djb/testbed/exception/DjbUnsupportedAuthTypeException.java

@@ -0,0 +1,20 @@
+package com.eactive.apim.portal.djb.testbed.exception;
+
+/**
+ * TSEAIHE01.AUTHTYPE 값이 테스트베드가 지원하는 인증 체계(oauth/api_key)로
+ * 매핑되지 않을 때 발생. {@link com.eactive.apim.portal.djb.testbed.advice.DjbTestbedExceptionHandler}
+ * 에서 400 응답으로 변환된다.
+ */
+public class DjbUnsupportedAuthTypeException extends RuntimeException {
+
+    private final String authtype;
+
+    public DjbUnsupportedAuthTypeException(String authtype) {
+        super("지원하지 않는 인증 체계: " + authtype);
+        this.authtype = authtype;
+    }
+
+    public String getAuthtype() {
+        return authtype;
+    }
+}

src/main/java/com/eactive/apim/portal/djb/testbed/service/DjbSwaggerSpecEnricher.java

@@ -0,0 +1,106 @@
+package com.eactive.apim.portal.djb.testbed.service;
+
+import com.eactive.apim.portal.djb.testbed.config.DjbTestbedGatewayProperty;
+import com.eactive.apim.portal.djb.testbed.enums.DjbAuthType;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ArrayNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+
+/**
+ * testbed spec(JSON)에 인증 체계를 주입한다.
+ *
+ * <p>현재 데이터는 <b>OpenAPI 3.0</b>(auto-gen {@code "openapi":"3.0.0"})이므로
+ * {@code components.securitySchemes} + 글로벌 {@code security} 에 주입한다.
+ * (원본이 Swagger 2.0 이면 {@code securityDefinitions} 로 폴백.)
+ *
+ * <p>게이트웨이가 OAuth 액세스 토큰을 표준 {@code Authorization} 이 아니라 커스텀 헤더
+ * {@code X-AUTH-TOKEN: Bearer ...} 로 받으므로(DJERP_4000 v0.2), OAuth 도 API_KEY 와 동일하게
+ * <b>apiKey-in-header</b> 스킴으로 모델링한다(헤더명만 상이). 토큰 발급은 템플릿 JS가
+ * {@code /api/call-api} 경유로 수행해 값을 {@code "Bearer <token>"} 으로 authorize 한다.
+ *
+ * <p>원본의 {@code paths}, {@code x-*} 확장, 기타 {@code components} 는 트리 조작으로 보존한다
+ * (문자열 치환 금지).
+ */
+@Service
+@RequiredArgsConstructor
+public class DjbSwaggerSpecEnricher {
+
+    private final ObjectMapper objectMapper;
+    private final DjbTestbedGatewayProperty gatewayProperty;
+
+    public static final String OAUTH_SCHEME = "djbOAuth";
+    public static final String API_KEY_SCHEME = "djbApiKey";
+
+    public String enrich(String specJson, DjbAuthType authType) throws JsonProcessingException {
+        JsonNode parsed = objectMapper.readTree(specJson);
+        if (!parsed.isObject()) {
+            // 예상 밖 형태면 원본 유지(멱등)
+            return specJson;
+        }
+        ObjectNode root = (ObjectNode) parsed;
+
+        // NONE: 인증 없이 호출 — 글로벌 security / securityScheme 흔적을 제거해
+        // Swagger UI 의 'Authorize' 버튼이 뜨지 않게 한다. (저장 spec 에 빈 securitySchemes 가
+        // 남아 있으면 UI 가 빈 인증 모달 버튼을 렌더하므로 정리한다.)
+        if (authType == DjbAuthType.NONE) {
+            return stripSecurity(root);
+        }
+
+        String schemeName = (authType == DjbAuthType.OAUTH) ? OAUTH_SCHEME : API_KEY_SCHEME;
+        ObjectNode scheme = buildApiKeyScheme(authType);
+
+        boolean swagger2 = root.has("swagger") && !root.has("openapi");
+        if (swagger2) {
+            getOrCreateObject(root, "securityDefinitions").set(schemeName, scheme);
+        } else {
+            ObjectNode components = getOrCreateObject(root, "components");
+            getOrCreateObject(components, "securitySchemes").set(schemeName, scheme);
+        }
+
+        // 글로벌 security 요구사항 (apiKey 스킴은 빈 스코프 배열)
+        ArrayNode security = objectMapper.createArrayNode();
+        ObjectNode requirement = objectMapper.createObjectNode();
+        requirement.set(schemeName, objectMapper.createArrayNode());
+        security.add(requirement);
+        root.set("security", security);
+
+        return objectMapper.writeValueAsString(root);
+    }
+
+    /** {@code { "type":"apiKey", "in":"header", "name":"<header>" }} — 2.0/3.0 동일 형태. */
+    private ObjectNode buildApiKeyScheme(DjbAuthType authType) {
+        String headerName = (authType == DjbAuthType.OAUTH)
+                ? gatewayProperty.oauthHeader()
+                : gatewayProperty.apiKeyHeader();
+        ObjectNode scheme = objectMapper.createObjectNode();
+        scheme.put("type", "apiKey");
+        scheme.put("in", "header");
+        scheme.put("name", headerName);
+        return scheme;
+    }
+
+    /** NONE 용: 글로벌 {@code security} / {@code components.securitySchemes} / {@code securityDefinitions} 제거. */
+    private String stripSecurity(ObjectNode root) throws JsonProcessingException {
+        root.remove("security");
+        root.remove("securityDefinitions"); // swagger 2.0
+        JsonNode components = root.get("components");
+        if (components != null && components.isObject()) {
+            ((ObjectNode) components).remove("securitySchemes");
+        }
+        return objectMapper.writeValueAsString(root);
+    }
+
+    private ObjectNode getOrCreateObject(ObjectNode parent, String field) {
+        JsonNode node = parent.get(field);
+        if (node != null && node.isObject()) {
+            return (ObjectNode) node;
+        }
+        ObjectNode created = objectMapper.createObjectNode();
+        parent.set(field, created);
+        return created;
+    }
+}

src/main/java/com/eactive/apim/portal/djb/testbed/service/DjbTestbedAuthService.java

@@ -0,0 +1,133 @@
+package com.eactive.apim.portal.djb.testbed.service;
+
+import com.eactive.apim.gateway.data.eaimessage.EAIMessageRepository;
+import com.eactive.apim.portal.app.entity.Credential;
+import com.eactive.apim.portal.app.repository.CredentialRepository;
+import com.eactive.apim.portal.common.user.PortalAuthenticatedUser;
+import com.eactive.apim.portal.common.util.SecurityUtil;
+import com.eactive.apim.portal.djb.testbed.config.DjbTestbedGatewayProperty;
+import com.eactive.apim.portal.djb.testbed.dto.DjbCredentialOptionDto;
+import com.eactive.apim.portal.djb.testbed.dto.DjbCredentialSecretDto;
+import com.eactive.apim.portal.djb.testbed.dto.DjbTestbedContextDto;
+import com.eactive.apim.portal.djb.testbed.dto.DjbTestbedContextDto.GatewayInfo;
+import com.eactive.apim.portal.djb.testbed.enums.DjbAuthType;
+import com.eactive.apim.portal.portaluser.entity.PortalUserEnums.RoleCode;
+import com.eactive.eai.data.entity.onl.message.EAIMessageEntity;
+import java.util.Collections;
+import java.util.List;
+import java.util.stream.Collectors;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.stereotype.Service;
+
+/**
+ * 테스트베드 인증 컨텍스트 구성 · 앱 시크릿 조회 · authtype 매핑.
+ * 인증/역할/소유권 검증은 이 서비스에서 수행한다({@code SecurityFilterChain} 은 URL 인가 블록이 없음).
+ */
+@Service
+@RequiredArgsConstructor
+public class DjbTestbedAuthService {
+
+    private final CredentialRepository credentialRepository;
+    private final EAIMessageRepository eaiMessageRepository;
+    private final DjbTestbedGatewayProperty gatewayProperty;
+
+    private static final String APP_STATUS_ACTIVE = "1";
+
+    /**
+     * 비대상 사유: {@code ANONYMOUS}(비로그인) / {@code INDIVIDUAL_USER}(ROLE_USER) /
+     * {@code NO_CREDENTIAL}(appstatus='1' 앱 0건). 하나라도 해당하면 {@code eligible=false}.
+     */
+    public DjbTestbedContextDto buildContext(String portalOrigin) {
+        GatewayInfo gateway = buildGatewayInfo(portalOrigin);
+
+        if (!SecurityUtil.isAuthenticated()) {
+            return notEligible("ANONYMOUS", gateway);
+        }
+        PortalAuthenticatedUser user = SecurityUtil.getPortalAuthenticatedUser();
+        if (user.getRoleCode() == RoleCode.ROLE_USER) {
+            return notEligible("INDIVIDUAL_USER", gateway);
+        }
+
+        String orgId = SecurityUtil.getUserOrg().getId();
+        List<DjbCredentialOptionDto> options = credentialRepository.findAllByOrgid(orgId).stream()
+                .filter(c -> APP_STATUS_ACTIVE.equals(c.getAppstatus()))
+                .map(this::toOption)
+                .collect(Collectors.toList());
+
+        if (options.isEmpty()) {
+            return notEligible("NO_CREDENTIAL", gateway);
+        }
+
+        return DjbTestbedContextDto.builder()
+                .eligible(true)
+                .reason(null)
+                .credentials(options)
+                .gateway(gateway)
+                .build();
+    }
+
+    /**
+     * 선택 앱의 시크릿 단건. 로그인 + 비-ROLE_USER + 본인 소유(orgId 일치) 검증 후 반환.
+     * 소유 불일치/비대상은 {@link AccessDeniedException}(→ 403).
+     */
+    public DjbCredentialSecretDto getCredentialSecret(String clientId, String apiId) {
+        if (!SecurityUtil.isAuthenticated()) {
+            throw new AccessDeniedException("로그인이 필요합니다.");
+        }
+        PortalAuthenticatedUser user = SecurityUtil.getPortalAuthenticatedUser();
+        if (user.getRoleCode() == RoleCode.ROLE_USER) {
+            throw new AccessDeniedException("개인사용자는 이용할 수 없습니다.");
+        }
+
+        String orgId = SecurityUtil.getUserOrg().getId();
+        Credential credential = credentialRepository.findByClientidAndOrgid(clientId, orgId)
+                .orElseThrow(() -> new AccessDeniedException("본인 소유의 앱이 아닙니다."));
+
+        DjbAuthType authType = resolveAuthType(apiId);
+
+        return DjbCredentialSecretDto.builder()
+                .clientId(credential.getClientid())
+                .clientSecret(credential.getClientsecret())
+                .authType(authType)
+                .build();
+    }
+
+    /**
+     * apiId(=TSEAIHE01.eaisvcname, admin 입력 컨벤션)로 authtype 조회 후 매핑.
+     * 미매핑/미존재는 {@code DjbUnsupportedAuthTypeException}(→ 400).
+     */
+    public DjbAuthType resolveAuthType(String apiId) {
+        String authtype = eaiMessageRepository.findById(apiId)
+                .map(EAIMessageEntity::getAuthtype)
+                .orElse(null);
+        return DjbAuthType.fromAuthtype(authtype);
+    }
+
+    private DjbCredentialOptionDto toOption(Credential c) {
+        return DjbCredentialOptionDto.builder()
+                .clientId(c.getClientid())
+                .clientName(c.getClientname())
+                .appStatus(c.getAppstatus())
+                .build();
+    }
+
+    private GatewayInfo buildGatewayInfo(String portalOrigin) {
+        return GatewayInfo.builder()
+                .mode(gatewayProperty.resolveGatewayMode())
+                .baseUrl(gatewayProperty.baseUrl())
+                .tokenUrl(gatewayProperty.resolveTokenUrl(portalOrigin))
+                .apiKeyHeader(gatewayProperty.apiKeyHeader())
+                .oauthTokenHeader(gatewayProperty.oauthHeader())
+                .build();
+    }
+
+    private DjbTestbedContextDto notEligible(String reason, GatewayInfo gateway) {
+        return DjbTestbedContextDto.builder()
+                .eligible(false)
+                .reason(reason)
+                .credentials(Collections.emptyList())
+                .gateway(gateway)
+                .build();
+    }
+}

src/main/java/com/eactive/apim/portal/djb/testbed/service/DjbTestbedSpecServerRewriter.java

@@ -0,0 +1,110 @@
+package com.eactive.apim.portal.djb.testbed.service;
+
+import com.eactive.apim.portal.apispec.entity.ApiSpecInfo;
+import com.eactive.apim.portal.djb.testbed.config.DjbTestbedGatewayProperty;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import javax.servlet.http.HttpServletRequest;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+import org.springframework.util.StringUtils;
+import org.yaml.snakeyaml.DumperOptions;
+import org.yaml.snakeyaml.Yaml;
+
+/**
+ * testbed spec(JSON)에 baking 된 서버 sentinel({@value #SERVER_SENTINEL})을
+ * API SPEC 설정(responseType)에 따른 실주소로 치환한다.
+ *
+ * <ul>
+ *   <li>gw     : {@link DjbTestbedGatewayProperty#resolveApiBaseUrl}(GW base URL, 단일 기준)</li>
+ *   <li>mock   : {@code ApiSpecInfo.mockUrl}</li>
+ *   <li>sample(기본) : 요청 포탈 origin(scheme://host)</li>
+ * </ul>
+ *
+ * <p>spec 의 서버주소는 Swagger UI path 표시 + cURL 스니펫용이다(실호출은 {@code /api/call-api} 프록시).
+ * admin(app.js buildOpenApiSpec)은 env별 실주소를 저장시 굳히지 않고 sentinel 만 path 앞에 baking 하며,
+ * 실제 치환은 이 서비스가 spec 제공 시점에 수행한다. 또한 동일 spec 을 YAML 로 변환 제공한다.
+ *
+ * <p>sentinel 문자열은 유일하므로 문자열 치환으로 처리한다(없으면 원본 유지, 멱등).
+ */
+@Service
+@RequiredArgsConstructor
+@Slf4j
+public class DjbTestbedSpecServerRewriter {
+
+    /** admin(app.js buildOpenApiSpec)이 path 앞에 baking 하는 고정 서버 sentinel. */
+    public static final String SERVER_SENTINEL = "http://swagger-server-url";
+
+    private final DjbTestbedGatewayProperty gatewayProperty;
+    private final ObjectMapper objectMapper;
+
+    /** sentinel → 응답유형별 실주소 치환한 spec JSON 반환. sentinel 없거나 실주소 미확정 시 원본 유지. */
+    public String rewriteServer(String specJson, ApiSpecInfo spec, HttpServletRequest request) {
+        if (specJson == null || !specJson.contains(SERVER_SENTINEL)) {
+            return specJson;
+        }
+        String base = stripTrailingSlash(resolveBase(spec, request));
+        if (!StringUtils.hasText(base)) {
+            return specJson;   // 실주소 미확정 시 sentinel 유지
+        }
+        return specJson.replace(SERVER_SENTINEL, base);
+    }
+
+    /** spec JSON → YAML 문자열. 변환 실패 시 JSON 원본 반환. */
+    public String toYaml(String specJson) {
+        try {
+            Object tree = objectMapper.readValue(specJson, Object.class);
+            DumperOptions opts = new DumperOptions();
+            opts.setDefaultFlowStyle(DumperOptions.FlowStyle.BLOCK);
+            opts.setPrettyFlow(true);
+            return new Yaml(opts).dump(tree);
+        } catch (Exception e) {
+            log.error("spec YAML 변환 실패, JSON 원본 반환", e);
+            return specJson;
+        }
+    }
+
+    private String resolveBase(ApiSpecInfo spec, HttpServletRequest request) {
+        String rt = (spec == null || !StringUtils.hasText(spec.getResponseType()))
+                ? "sample" : spec.getResponseType().trim();
+        if ("gw".equalsIgnoreCase(rt)) {
+            return gatewayProperty.resolveApiBaseUrl(originOf(request));
+        }
+        if ("mock".equalsIgnoreCase(rt)) {
+            String mock = (spec == null) ? null : spec.getMockUrl();
+            return StringUtils.hasText(mock) ? mock.trim() : originOf(request);
+        }
+        // sample(기본): 포탈 origin
+        return originOf(request);
+    }
+
+    /** 요청 기준 포탈 origin(scheme://host[:port]) — 리버스 프록시 X-Forwarded-* 우선. */
+    public static String originOf(HttpServletRequest request) {
+        if (request == null) {
+            return "";
+        }
+        String scheme = firstNonBlank(request.getHeader("X-Forwarded-Proto"), request.getScheme());
+        String host = firstNonBlank(request.getHeader("X-Forwarded-Host"), request.getHeader("Host"));
+        if (StringUtils.hasText(host)) {
+            return scheme + "://" + host.trim();
+        }
+        int port = request.getServerPort();
+        String hostPort = request.getServerName() + ((port == 80 || port == 443) ? "" : ":" + port);
+        return scheme + "://" + hostPort;
+    }
+
+    private static String firstNonBlank(String a, String b) {
+        return StringUtils.hasText(a) ? a.trim() : b;
+    }
+
+    private static String stripTrailingSlash(String s) {
+        if (s == null) {
+            return null;
+        }
+        String t = s.trim();
+        while (t.endsWith("/")) {
+            t = t.substring(0, t.length() - 1);
+        }
+        return t;
+    }
+}

src/main/resources/application-dev.yml

@@ -7,8 +7,8 @@ spring:
   jpa:
     properties:
       hibernate:
-        show_sql: true
-        format_sql: true
+        show_sql: false
+        format_sql: false
         use_sql_comments: true
   devtools:
     restart:
@@ -35,7 +35,7 @@ gateway:
 
     hibernate-dialect: org.hibernate.dialect.Oracle12cDialect
     hibernate-physical-naming-strategy: com.eactive.apim.portal.common.entity.CustomPhysicalNamingStrategy
-    entity-package: com.eactive.eai.data.entity.onl
+    entity-package: com.eactive.eai.data.entity.onl,com.eactive.apim.gateway.data.statistics.entity
 
 
 portal:

src/main/resources/application-stage.yml

@@ -46,5 +46,5 @@ gateway:
 
     hibernate-dialect: org.hibernate.dialect.Oracle12cDialect
     hibernate-physical-naming-strategy: com.eactive.apim.portal.common.entity.CustomPhysicalNamingStrategy
-    entity-package: com.eactive.eai.data.entity.onl
+    entity-package: com.eactive.eai.data.entity.onl,com.eactive.apim.gateway.data.statistics.entity
 

src/main/resources/application.yml

@@ -98,7 +98,7 @@ gateway:
 
     hibernate-dialect: org.hibernate.dialect.Oracle12cDialect
     hibernate-physical-naming-strategy: com.eactive.apim.portal.common.entity.CustomPhysicalNamingStrategy
-    entity-package: com.eactive.eai.data.entity.onl
+    entity-package: com.eactive.eai.data.entity.onl,com.eactive.apim.gateway.data.statistics.entity
 
 portal:
   file:

src/main/resources/static/css/api-statistics.css

@@ -1,18 +1,74 @@
-/* API Statistics Page Styles */
-
 .api-statistics-container {
-  /*max-width: 1200px;*/
   margin: 0 auto;
   padding: 48px 0px;
 }
 
-/* Search Section */
+.statistics-notice {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  margin-bottom: 16px;
+  padding: 12px 18px;
+  background: #eef4fc;
+  border: 1px solid #d6e4f5;
+  border-radius: 10px;
+  font-size: 13px;
+  color: #4a5568;
+}
+
+.statistics-notice-latest {
+  color: #0049B4;
+  font-weight: 600;
+}
+
 .statistics-search-section {
   display: flex;
-  justify-content: flex-end;
+  flex-direction: column;
+  align-items: flex-end;
+  gap: 12px;
   margin-bottom: 30px;
 }
 
+.search-mode-tabs {
+  display: inline-flex;
+  background: #eef1f5;
+  border-radius: 22px;
+  padding: 4px;
+}
+
+.mode-tab {
+  border: none;
+  background: transparent;
+  padding: 7px 22px;
+  border-radius: 18px;
+  font-size: 14px;
+  color: #666;
+  cursor: pointer;
+  transition: all 0.2s;
+}
+.mode-tab.active {
+  background: #0049B4;
+  color: #fff;
+  font-weight: 600;
+}
+
+.month-range-picker {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.month-input {
+  border: none;
+  padding: 8px 12px;
+  font-size: 14px;
+  color: #333;
+  background: transparent;
+  outline: none;
+  cursor: pointer;
+}
+
 .search-filter-row {
   display: flex;
   align-items: center;
@@ -54,16 +110,13 @@
   cursor: pointer;
   transition: background 0.2s;
 }
-
 .btn-search:hover {
   background: #003d99;
 }
-
 .btn-search svg {
   stroke: #fff;
 }
 
-/* Summary Card */
 .statistics-summary-card {
   background: #f5f8fc;
   border-radius: 16px;
@@ -103,11 +156,9 @@
   outline: none;
   transition: all 0.2s;
 }
-
 .app-select:hover {
   background-color: #f0f5ff;
 }
-
 .app-select:focus {
   border-color: #003d99;
   box-shadow: 0 0 0 3px rgba(0, 73, 180, 0.1);
@@ -122,7 +173,6 @@
   color: #333;
   margin-bottom: 16px;
 }
-
 .summary-total-text strong {
   font-size: 24px;
   color: #0049B4;
@@ -140,11 +190,12 @@
   gap: 8px;
   font-size: 14px;
 }
-
 .summary-detail-item.success .detail-icon {
   color: #4A90D9;
 }
-
+.summary-detail-item.timeout .detail-icon {
+  color: #F5C36B;
+}
 .summary-detail-item.failure .detail-icon {
   color: #F5A3B5;
 }
@@ -163,7 +214,6 @@
   color: #999;
 }
 
-/* Donut Chart */
 .summary-center {
   flex: 0 0 200px;
   display: flex;
@@ -180,7 +230,6 @@
   transition: stroke-dasharray 0.3s ease, stroke-dashoffset 0.3s ease;
 }
 
-/* Rate Display */
 .summary-right {
   flex: 0 0 230px;
   display: flex;
@@ -195,7 +244,6 @@
   padding: 16px 0;
   border-bottom: 1px solid #e0e0e0;
 }
-
 .rate-display:last-child {
   border-bottom: none;
 }
@@ -205,11 +253,12 @@
   height: 12px;
   border-radius: 50%;
 }
-
 .rate-indicator.success {
   background: #4A90D9;
 }
-
+.rate-indicator.timeout {
+  background: #F5C36B;
+}
 .rate-indicator.failure {
   background: #F5A3B5;
 }
@@ -228,6 +277,10 @@
   color: #4A90D9;
 }
 
+.timeout-rate .rate-value {
+  color: #F5C36B;
+}
+
 .failure-rate .rate-value {
   color: #F5A3B5;
 }
@@ -237,12 +290,15 @@
   color: #999;
 }
 
-/* Statistics Table Card */
 .statistics-table-card {
   background: #fff;
   border-radius: 16px;
   overflow: hidden;
   box-shadow: 0 2px 8px rgba(0, 0, 0, 0.08);
+  margin-bottom: 30px;
+}
+.statistics-table-card:last-child {
+  margin-bottom: 0;
 }
 
 .table-header {
@@ -262,7 +318,6 @@
   font-weight: 600;
   margin: 0;
 }
-
 .table-title svg {
   stroke: #fff;
 }
@@ -279,7 +334,6 @@
   font-size: 14px;
   transition: background 0.2s;
 }
-
 .btn-download:hover {
   background: rgba(255, 255, 255, 0.3);
   color: #fff;
@@ -293,7 +347,6 @@
   width: 100%;
   border-collapse: collapse;
 }
-
 .statistics-table thead th {
   padding: 16px 20px;
   text-align: left;
@@ -302,16 +355,23 @@
   border-bottom: 1px solid #e0e0e0;
   background: #fafafa;
 }
-
 .statistics-table tbody td {
   padding: 16px 20px;
   border-bottom: 1px solid #f0f0f0;
   color: #333;
 }
-
 .statistics-table tbody tr:hover {
   background: #f9f9f9;
 }
+.statistics-table tfoot .total-row {
+  background: #e3f2fd;
+}
+.statistics-table tfoot .total-row td {
+  padding: 16px 20px;
+  font-weight: 600;
+  color: #0049B4;
+  border-bottom: none;
+}
 
 .api-name {
   display: flex;
@@ -328,20 +388,16 @@
   background: #f0f0f0;
   border-radius: 6px;
 }
-
 .api-icon svg {
   stroke: #666;
 }
-
 .api-icon.total {
   background: #e3f2fd;
 }
-
 .api-icon.total svg {
   stroke: #0049B4;
 }
 
-/* Progress Bar */
 .progress-cell {
   min-width: 200px;
 }
@@ -359,83 +415,64 @@
   transition: width 0.3s ease;
 }
 
+.progress-timeout {
+  background: #F5C36B;
+  transition: width 0.3s ease;
+}
+
 .progress-failure {
   background: #F5A3B5;
   transition: width 0.3s ease;
 }
 
-/* Total Row */
-.statistics-table tfoot .total-row {
-  background: #e3f2fd;
-}
-
-.statistics-table tfoot .total-row td {
-  padding: 16px 20px;
-  font-weight: 600;
-  color: #0049B4;
-  border-bottom: none;
-}
-
-/* Empty State */
 .empty-row td {
   text-align: center;
   padding: 40px 20px;
   color: #999;
 }
 
-/* Responsive */
 @media (max-width: 992px) {
   .summary-content {
     flex-direction: column;
     gap: 30px;
   }
-
   .summary-left,
   .summary-center,
   .summary-right {
     flex: none;
     width: 100%;
   }
-
   .summary-center {
     order: -1;
   }
-
   .summary-right {
     flex-direction: row;
     justify-content: center;
   }
 }
-
 @media (max-width: 768px) {
   .api-statistics-container {
     padding: 20px 16px;
   }
-
   .statistics-summary-card {
     padding: 24px 20px;
   }
-
   .app-toggle-buttons {
     flex-wrap: wrap;
   }
-
   .toggle-btn {
     flex: 1;
     text-align: center;
   }
-
   .statistics-table thead th,
   .statistics-table tbody td,
   .statistics-table tfoot td {
     padding: 12px 10px;
     font-size: 13px;
   }
-
   .progress-cell {
     min-width: 100px;
   }
-
   .search-filter-row {
     flex-wrap: wrap;
   }

src/main/resources/static/css/main.css

@@ -6934,6 +6934,37 @@ button.djb-comment-submit:disabled {
   font-size: 13px;
 }
 
+.djb-comment-private-toggle {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  margin-right: auto;
+  color: #6B7280;
+  font-size: 13px;
+  cursor: pointer;
+}
+
+.djb-comment-private-tag {
+  display: inline-block;
+  margin-left: 6px;
+  padding: 1px 8px;
+  border-radius: 10px;
+  background-color: #FEF3C7;
+  color: #92400E;
+  font-size: 11px;
+  vertical-align: middle;
+}
+
+.djb-comment-item--private {
+  background-color: #FFFBEB;
+}
+
+.djb-comment-item--private-hidden .djb-comment-body,
+.djb-comment-item--private-hidden .djb-comment-writer {
+  color: #9CA3AF;
+  font-style: italic;
+}
+
 .hero-carousel-section {
   position: relative;
   width: 100%;
@@ -9412,6 +9443,117 @@ button.djb-comment-submit:disabled {
   display: flex;
 }
 
+.testbed-app-panel {
+  margin: 8px 0 24px;
+  padding: 24px;
+  background: #FFFFFF;
+  border: 1px solid #E2E8F0;
+  border-radius: 12px;
+  box-shadow: 0 2px 4px rgba(0, 0, 0, 0.05);
+}
+.testbed-app-panel .testbed-app-panel__head {
+  display: flex;
+  align-items: baseline;
+  flex-wrap: wrap;
+  gap: 4px 8px;
+  margin-bottom: 16px;
+}
+.testbed-app-panel .testbed-app-panel__title {
+  position: relative;
+  padding-left: 16px;
+  font-size: 16px;
+  font-weight: 700;
+  color: #1A1A2E;
+  letter-spacing: -0.01em;
+}
+.testbed-app-panel .testbed-app-panel__title::before {
+  content: "";
+  position: absolute;
+  left: 0;
+  top: 50%;
+  transform: translateY(-50%);
+  width: 4px;
+  height: 15px;
+  background: #0049b4;
+  border-radius: 2px;
+}
+.testbed-app-panel .testbed-app-panel__desc {
+  font-size: 14px;
+  color: #64748B;
+}
+.testbed-app-panel .testbed-app-field {
+  position: relative;
+  max-width: 380px;
+}
+.testbed-app-panel .testbed-app-field::after {
+  content: "";
+  position: absolute;
+  right: 16px;
+  top: 50%;
+  width: 9px;
+  height: 9px;
+  margin-top: -6px;
+  border-right: 2px solid #64748B;
+  border-bottom: 2px solid #64748B;
+  transform: rotate(45deg);
+  pointer-events: none;
+}
+.testbed-app-panel #apps {
+  width: 100%;
+  height: 46px;
+  padding: 0 42px 0 16px;
+  font-family: "Spoqa Han Sans Neo", "SpoqaHanSans", "Noto Sans KR", -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+  font-size: 14px;
+  color: #1A1A2E;
+  background: #F8FAFC;
+  border: 1px solid #E2E8F0;
+  border-radius: 8px;
+  appearance: none;
+  -webkit-appearance: none;
+  -moz-appearance: none;
+  cursor: pointer;
+  transition: all 0.15s ease;
+}
+.testbed-app-panel #apps:hover:not(:disabled) {
+  border-color: #94A3B8;
+  background: #FFFFFF;
+}
+.testbed-app-panel #apps:focus {
+  outline: none;
+  background: #FFFFFF;
+  border-color: #0049b4;
+  box-shadow: 0 0 0 3px rgba(0, 73, 180, 0.14);
+}
+.testbed-app-panel #apps:disabled {
+  color: #94A3B8;
+  background: #F8FAFC;
+  cursor: not-allowed;
+}
+.testbed-app-panel .testbed-app-notice {
+  margin: 16px 0 0;
+  padding: 11px 16px;
+  font-size: 14px;
+  line-height: 1.6;
+  color: #64748B;
+  background: #EFF6FF;
+  border: 1px solid rgba(0, 73, 180, 0.18);
+  border-left: 3px solid #0049b4;
+  border-radius: 6px;
+}
+.testbed-app-panel .testbed-app-notice::before {
+  content: "ⓘ ";
+  color: #0049b4;
+  font-weight: 700;
+}
+@media (max-width: 768px) {
+  .testbed-app-panel {
+    padding: 16px;
+  }
+  .testbed-app-panel .testbed-app-field {
+    max-width: 100%;
+  }
+}
+
 .api-overview-card {
   background: transparent;
   border-radius: 0;
@@ -15565,6 +15707,87 @@ input[type=checkbox]:checked + .custom-checkbox {
   }
 }
 
+.list-table-row--private {
+  opacity: 0.55;
+  cursor: default;
+}
+.list-table-row--private .inquiry-private-label {
+  color: #94A3B8;
+  font-style: italic;
+}
+
+.notice-title-link--disabled {
+  pointer-events: none;
+  cursor: default;
+}
+
+.inquiry-detail-views {
+  color: #94A3B8;
+  font-size: 13px;
+}
+
+.inquiry-detail-attach {
+  margin-top: 16px;
+}
+.inquiry-detail-attach .inquiry-attach-link {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  padding: 8px 14px;
+  border: 1px solid #CBD5E1;
+  border-radius: 6px;
+  color: #1E40AF;
+  font-size: 13px;
+  text-decoration: none;
+}
+.inquiry-detail-attach .inquiry-attach-link:hover {
+  background-color: #F1F5F9;
+}
+
+.row-cell--writer {
+  flex-direction: column;
+  justify-content: center;
+  line-height: 1.3;
+}
+.row-cell--writer .inquiry-writer-org {
+  color: #94A3B8;
+  font-size: 12px;
+}
+
+.inquiry-visibility-notice {
+  margin-left: 12px;
+  font-size: 13px;
+  font-weight: normal;
+  color: #64748B;
+}
+
+.list-table-body .inquiry-status-badge {
+  height: 24px;
+  padding: 0 10px;
+  font-size: 12px;
+}
+
+.inquiry-lock-icon {
+  vertical-align: -2px;
+  margin-right: 3px;
+  color: #64748B;
+}
+
+.inquiry-detail-visibility {
+  display: inline-flex;
+  align-items: center;
+  gap: 2px;
+  color: #64748B;
+  font-size: 13px;
+}
+.inquiry-detail-visibility--private {
+  color: #c0392b;
+  font-weight: 600;
+}
+.inquiry-detail-visibility--private .inquiry-lock-icon {
+  color: #c0392b;
+}
+
 .org-register-page {
   min-height: 100vh;
   padding: 0;
@@ -18925,12 +19148,72 @@ input[type=checkbox]:checked + .custom-checkbox {
   padding: 48px 0px;
 }
 
+.statistics-notice {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  margin-bottom: 16px;
+  padding: 12px 18px;
+  background: #eef4fc;
+  border: 1px solid #d6e4f5;
+  border-radius: 10px;
+  font-size: 13px;
+  color: #4a5568;
+}
+
+.statistics-notice-latest {
+  color: #0049B4;
+  font-weight: 600;
+}
+
 .statistics-search-section {
   display: flex;
-  justify-content: flex-end;
+  flex-direction: column;
+  align-items: flex-end;
+  gap: 12px;
   margin-bottom: 30px;
 }
 
+.search-mode-tabs {
+  display: inline-flex;
+  background: #eef1f5;
+  border-radius: 22px;
+  padding: 4px;
+}
+
+.mode-tab {
+  border: none;
+  background: transparent;
+  padding: 7px 22px;
+  border-radius: 18px;
+  font-size: 14px;
+  color: #666;
+  cursor: pointer;
+  transition: all 0.2s;
+}
+.mode-tab.active {
+  background: #0049B4;
+  color: #fff;
+  font-weight: 600;
+}
+
+.month-range-picker {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.month-input {
+  border: none;
+  padding: 8px 12px;
+  font-size: 14px;
+  color: #333;
+  background: transparent;
+  outline: none;
+  cursor: pointer;
+}
+
 .search-filter-row {
   display: flex;
   align-items: center;
@@ -19055,6 +19338,9 @@ input[type=checkbox]:checked + .custom-checkbox {
 .summary-detail-item.success .detail-icon {
   color: #4A90D9;
 }
+.summary-detail-item.timeout .detail-icon {
+  color: #F5C36B;
+}
 .summary-detail-item.failure .detail-icon {
   color: #F5A3B5;
 }
@@ -19115,6 +19401,9 @@ input[type=checkbox]:checked + .custom-checkbox {
 .rate-indicator.success {
   background: #4A90D9;
 }
+.rate-indicator.timeout {
+  background: #F5C36B;
+}
 .rate-indicator.failure {
   background: #F5A3B5;
 }
@@ -19133,6 +19422,10 @@ input[type=checkbox]:checked + .custom-checkbox {
   color: #4A90D9;
 }
 
+.timeout-rate .rate-value {
+  color: #F5C36B;
+}
+
 .failure-rate .rate-value {
   color: #F5A3B5;
 }
@@ -19147,6 +19440,10 @@ input[type=checkbox]:checked + .custom-checkbox {
   border-radius: 16px;
   overflow: hidden;
   box-shadow: 0 2px 8px rgba(0, 0, 0, 0.08);
+  margin-bottom: 30px;
+}
+.statistics-table-card:last-child {
+  margin-bottom: 0;
 }
 
 .table-header {
@@ -19263,6 +19560,11 @@ input[type=checkbox]:checked + .custom-checkbox {
   transition: width 0.3s ease;
 }
 
+.progress-timeout {
+  background: #F5C36B;
+  transition: width 0.3s ease;
+}
+
 .progress-failure {
   background: #F5A3B5;
   transition: width 0.3s ease;

src/main/resources/static/js/djb/inquiry-comments.js

@@ -12,6 +12,7 @@
   const formEl = document.getElementById('djbCommentForm');
   const inputEl = document.getElementById('djbCommentInput');
   const counterEl = document.getElementById('djbCommentCharCounter');
+  const privateEl = document.getElementById('djbCommentPrivate');
 
   function getCsrfToken() {
     // 세션 기반 CSRF: 쿠키 대신 <meta name="_csrf">에서 토큰을 읽는다.
@@ -74,14 +75,25 @@
     }
     comments.forEach(function (c) {
       const li = document.createElement('li');
-      li.className = 'djb-comment-item' + (c.adminYn === 'Y' ? ' djb-comment-item--admin' : '');
+      var cls = 'djb-comment-item';
+      if (c.adminYn === 'Y') cls += ' djb-comment-item--admin';
+      if (c.privatePlaceholder) cls += ' djb-comment-item--private-hidden';
+      else if (c.privateComment) cls += ' djb-comment-item--private';
+      li.className = cls;
       li.setAttribute('data-comment-id', c.id);
+
+      var writerHtml = (c.adminYn === 'Y')
+        ? '<span class="djb-comment-admin-badge">관리자</span>'
+        : '<span class="djb-comment-writer">' + escapeHtml(c.writerName || '(알 수 없음)') + '</span>';
+      // 비공개 댓글(열람 권한 있는 경우)에는 "비공개" 태그 표시
+      var privateTag = (c.privateComment && !c.privatePlaceholder)
+        ? '<span class="djb-comment-private-tag">비공개</span>' : '';
+
       li.innerHTML = ''
         + '<div class="djb-comment-meta">'
         + '  <div class="djb-comment-meta-left">'
-        + (c.adminYn === 'Y'
-            ? '    <span class="djb-comment-admin-badge">관리자</span>'
-            : '    <span class="djb-comment-writer">' + escapeHtml(c.writerName || '(알 수 없음)') + '</span>')
+        + writerHtml
+        + privateTag
         + '  </div>'
         + '  <div class="djb-comment-meta-right">'
         + '    <span class="djb-comment-date">' + escapeHtml(formatDate(c.createdDate)) + '</span>'
@@ -112,9 +124,10 @@
       inputEl.focus();
       return;
     }
+    var visibility = (privateEl && privateEl.checked) ? 'PRIVATE' : 'ALL';
     fetchJson('/djb/inquiry/' + encodeURIComponent(inquiryId) + '/comments', {
       method: 'POST',
-      body: JSON.stringify({ content: content })
+      body: JSON.stringify({ content: content, visibility: visibility })
     })
       .then(function (res) {
         if (res.status === 409) throw new Error('종료된 문의에는 댓글을 작성할 수 없습니다.');
@@ -123,6 +136,7 @@
       })
       .then(function () {
         inputEl.value = '';
+        if (privateEl) privateEl.checked = false;
         updateCounter();
         load();
       })

src/main/resources/static/js/djb/inquiry-view.js

@@ -0,0 +1,35 @@
+(function () {
+  'use strict';
+
+  // 조회수 비정상 증가 억제: sessionStorage 로 한 세션 내 중복 증가 방지.
+  var container = document.querySelector('.inquiry-detail-container[data-inquiry-id]');
+  if (!container) return;
+
+  var inquiryId = container.getAttribute('data-inquiry-id');
+  if (!inquiryId) return;
+
+  var viewedKey = 'inquiry_viewed_' + inquiryId;
+  if (sessionStorage.getItem(viewedKey)) {
+    return; // 이미 이번 세션에서 조회 → 증가하지 않음
+  }
+
+  function getCsrfToken() {
+    // 세션 기반 CSRF: 쿠키 대신 <meta name="_csrf">에서 토큰을 읽는다.
+    var meta = document.querySelector('meta[name="_csrf"]');
+    return meta ? meta.getAttribute('content') : '';
+  }
+
+  fetch('/inquiry/' + encodeURIComponent(inquiryId) + '/view', {
+    method: 'POST',
+    credentials: 'same-origin',
+    headers: { 'X-XSRF-TOKEN': getCsrfToken() }
+  })
+    .then(function (res) {
+      if (res.ok) {
+        sessionStorage.setItem(viewedKey, 'true');
+      }
+    })
+    .catch(function (err) {
+      console.error('[inquiry-view] increment error', err);
+    });
+})();

src/main/resources/static/plugins/swaggerUI/djb-swagger-i18n.js

@@ -0,0 +1,161 @@
+/*!
+ * djb-swagger-i18n.js
+ *  Swagger UI 영문 라벨을 한글로 치환하는 i18n 패치 (방법 B - DOM patch)
+ *  배포 경로 권장: static/plugins/swaggerUI/djb-swagger-i18n.js
+ *  index.html 의 swagger-initializer.js 직전 또는 직후에 <script> 로 로드
+ *
+ *  ?lang=en 쿼리스트링이 있으면 패치 비활성화 (원문 보기)
+ *  매핑 카탈로그는 01-i18n-mapping/i18n-strings.csv 와 동기 유지
+ */
+(function (window) {
+  'use strict';
+
+  // ── 비활성화 옵션 ──
+  if (/[?&]lang=en\b/.test(window.location.search)) return;
+
+  // ── 매핑 (key 는 디버깅용, 실제 비교는 EN 문자열 일치) ──
+  var I18N_MAP = {
+    // P0 — OAuth2 모달 본문
+    'auth.modal.title':          { en: 'Available authorizations', ko: '사용 가능한 인증' },
+    'auth.scopes.description':   {
+      en: 'Scopes are used to grant an application different levels of access to data on behalf of the end user. Each API may declare one or more scopes.',
+      ko: '스코프는 최종 사용자를 대신하여 애플리케이션이 데이터에 접근할 수 있는 권한 수준을 부여합니다. 각 API는 하나 이상의 스코프를 선언할 수 있습니다.'
+    },
+    'auth.scopes.swagger_grant': {
+      en: 'API requires the following scopes. Select which ones you want to grant to Swagger UI.',
+      ko: '이 API 는 아래 스코프가 필요합니다. Swagger UI 에 부여할 스코프를 선택하세요.'
+    },
+    'auth.flow.clientCredentials': { en: 'OAuth2 client credentials flow', ko: 'OAuth2 클라이언트 자격증명 흐름' },
+    'auth.flow.implicit':          { en: 'OAuth2 implicit flow',           ko: 'OAuth2 암묵적 흐름' },
+    'auth.flow.password':          { en: 'OAuth2 password flow',           ko: 'OAuth2 비밀번호 흐름' },
+    'auth.flow.authorizationCode': { en: 'OAuth2 authorization code flow', ko: 'OAuth2 인가 코드 흐름' },
+    'auth.field.tokenUrl':         { en: 'Token URL:',    ko: '토큰 URL:' },
+    'auth.field.flow':             { en: 'Flow:',         ko: '흐름:' },
+    'auth.field.clientId':         { en: 'client_id:',    ko: '클라이언트 ID (client_id):' },
+    'auth.field.clientSecret':     { en: 'client_secret:',ko: '클라이언트 시크릿 (client_secret):' },
+    'auth.field.scopes':           { en: 'Scopes:',       ko: '스코프:' },
+    'auth.action.selectAll':       { en: 'select all',    ko: '모두 선택' },
+    'auth.action.selectNone':      { en: 'select none',   ko: '선택 해제' },
+    'auth.action.authorize':       { en: 'Authorize',     ko: '인증' },
+    'auth.action.close':           { en: 'Close',         ko: '닫기' },
+    'auth.action.logout':          { en: 'Logout',        ko: '로그아웃' },
+    'auth.modal.authorized':       { en: 'authorized',    ko: '인증됨' },
+
+    // P1 — 기타 인증 흐름
+    'auth.scheme.apiKey':          { en: 'API key',  ko: 'API 키' },
+    'auth.field.name':             { en: 'name:',    ko: '이름:' },
+    'auth.field.in':               { en: 'in:',      ko: '위치:' },
+    'auth.field.value':            { en: 'Value:',   ko: '값:' },
+    'basic.field.username':        { en: 'Username:',ko: '사용자 ID:' },
+    'basic.field.password':        { en: 'Password:',ko: '비밀번호:' },
+
+    // P2 — 오퍼레이션 / 파라미터 / 응답 UI 라벨 (PoC ko-i18n.js 카탈로그와 동기)
+    'op.tryItOut':        { en: 'Try it out',            ko: '실행해보기' },
+    'op.cancel':          { en: 'Cancel',                ko: '취소' },
+    'op.execute':         { en: 'Execute',               ko: '실행' },
+    'op.clear':           { en: 'Clear',                 ko: '지우기' },
+    'op.reset':           { en: 'Reset',                 ko: '초기화' },
+    'op.parameters':      { en: 'Parameters',            ko: '파라미터' },
+    'op.parameter':       { en: 'Parameter',             ko: '파라미터' },
+    'op.name':            { en: 'Name',                  ko: '이름' },
+    'op.description':     { en: 'Description',            ko: '설명' },
+    'op.value':           { en: 'Value',                 ko: '값' },
+    'op.type':            { en: 'Type',                  ko: '타입' },
+    'op.requestBody':     { en: 'Request body',          ko: '요청 본문' },
+    'op.requestUrl':      { en: 'Request URL',           ko: '요청 URL' },
+    'op.responses':       { en: 'Responses',             ko: '응답' },
+    'op.response':        { en: 'Response',              ko: '응답' },
+    'op.responseBody':    { en: 'Response body',         ko: '응답 본문' },
+    'op.responseHeaders': { en: 'Response headers',      ko: '응답 헤더' },
+    'op.responseCType':   { en: 'Response content type', ko: '응답 컨텐츠 타입' },
+    'op.code':            { en: 'Code',                  ko: '코드' },
+    'op.details':         { en: 'Details',               ko: '상세' },
+    'op.schema':          { en: 'Schema',                ko: '스키마' },
+    'op.schemas':         { en: 'Schemas',               ko: '스키마' },
+    'op.exampleValue':    { en: 'Example Value',         ko: '예시 값' },
+    'op.noParameters':    { en: 'No parameters',         ko: '파라미터 없음' },
+    'op.required':        { en: 'required',              ko: '필수' },
+    'op.servers':         { en: 'Servers',               ko: '서버' },
+    'op.serverResponse':  { en: 'Server response',       ko: '서버 응답' },
+    'op.loading':         { en: 'Loading...',            ko: '불러오는 중...' },
+    'op.curlUpper':       { en: 'Curl',                  ko: 'cURL' },
+    'op.curlLower':       { en: 'curl',                  ko: 'cURL' },
+    'op.editValue':       { en: 'Edit Value',            ko: '값 편집' },
+    'op.model':           { en: 'Model',                 ko: '모델' },
+    'op.snippets':        { en: 'Snippets',              ko: '스니펫' },
+    'op.mediaType':       { en: 'Media type',            ko: '미디어 타입' },
+    'op.controlsAccept':  { en: 'Controls Accept header.', ko: 'Accept 헤더를 제어합니다.' },
+    'op.sendEmptyValue':  { en: 'Send empty value',      ko: '빈 값 전송' },
+    'op.hide':            { en: 'Hide',                  ko: '숨기기' },
+    'op.show':            { en: 'Show',                  ko: '표시' }
+  };
+
+  // 빠른 lookup 을 위해 EN → KO 인덱스 사전 생성
+  var EN_TO_KO = Object.create(null);
+  Object.keys(I18N_MAP).forEach(function (k) {
+    var e = I18N_MAP[k];
+    EN_TO_KO[e.en] = e.ko;
+  });
+
+  // ── 치환 대상 노드 식별 + 치환 ──
+  function translateNode(node) {
+    if (!node) return;
+    if (node.nodeType === Node.TEXT_NODE) {
+      var raw = node.nodeValue;
+      if (!raw) return;
+      var trimmed = raw.trim();
+      if (!trimmed) return;
+      // 1) 완전 일치 (가장 안전)
+      if (EN_TO_KO[trimmed]) {
+        node.nodeValue = raw.replace(trimmed, EN_TO_KO[trimmed]);
+        return;
+      }
+      // 2) 라벨 colon 패턴: "Token URL:" 같이 끝이 ":" 인 짧은 라벨
+      //    (불필요 — 1번 완전 일치로 대부분 커버)
+      return;
+    }
+    if (node.nodeType !== Node.ELEMENT_NODE) return;
+    if (node.tagName === 'SCRIPT' || node.tagName === 'STYLE') return;
+
+    // input placeholder / button title 도 일부 케이스에 대비
+    if (node.tagName === 'INPUT' && node.placeholder && EN_TO_KO[node.placeholder.trim()]) {
+      node.placeholder = EN_TO_KO[node.placeholder.trim()];
+    }
+
+    var i, child = node.childNodes, len = child.length;
+    for (i = 0; i < len; i++) translateNode(child[i]);
+  }
+
+  function translateAll() {
+    var root = document.getElementById('swagger-ui') || document.body;
+    translateNode(root);
+  }
+
+  // ── MutationObserver — SwaggerUI 가 동적으로 DOM 을 다시 그릴 때마다 재적용 ──
+  var observer = new MutationObserver(function (mutations) {
+    for (var i = 0; i < mutations.length; i++) {
+      var m = mutations[i];
+      if (m.addedNodes && m.addedNodes.length) {
+        for (var j = 0; j < m.addedNodes.length; j++) translateNode(m.addedNodes[j]);
+      }
+      if (m.type === 'characterData') {
+        translateNode(m.target);
+      }
+    }
+  });
+
+  function start() {
+    translateAll();
+    observer.observe(document.body, {
+      childList: true,
+      subtree: true,
+      characterData: true
+    });
+  }
+
+  if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', start);
+  } else {
+    start();
+  }
+})(window);

src/main/resources/static/plugins/swaggerUI/djb-swagger-response.js

@@ -0,0 +1,350 @@
+/*!
+ * DjbSwaggerResponse — Swagger UI 기본 라이브 응답 표(.live-responses-table)를 CSS 로
+ * 숨기고, 실행(Execute)한 operation 블록 안에 커스텀 응답 패널을 세로 적층으로 렌더한다.
+ * (요청 스니펫 .request-snippets 은 같은 .responses-wrapper 안에 있으므로 유지)
+ *
+ *   ┌─────────────────────────────────────────────┐
+ *   │ 응답 헤더 (Table)                            │
+ *   ├─────────────────────────────────────────────┤
+ *   │ 응답 본문 (JSON Pretty / Raw)                │
+ *   ├─────────────────────────────────────────────┤
+ *   │ 응답코드 칩 + Response Time(ms)              │
+ *   └─────────────────────────────────────────────┘
+ *
+ * 포탈 testbed 는 API 하나에 operation 이 여러 개일 수 있으므로, 전역 단일 그리드가
+ * 아니라 Execute 를 누른 opblock 안에 그리드를 만든다(클릭 캡처로 대상 특정).
+ *
+ * 연결:
+ *   const ui = SwaggerUIBundle({
+ *     responseInterceptor: function (res) { DjbSwaggerResponse.renderResponse(res); return res; }
+ *   });
+ *   window.ui = ui;
+ *   DjbSwaggerResponse.attach('#swagger-ui');   // Execute 클릭 캡처 + 타이머 등록
+ */
+(function (global) {
+  "use strict";
+
+  var startTs = 0;
+  var targetOpblock = null;
+
+  function now() {
+    return (global.performance && performance.now) ? performance.now() : Date.now();
+  }
+
+  function escapeHtml(s) {
+    return String(s == null ? "" : s)
+      .replace(/&/g, "&amp;").replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+  }
+
+  function statusKind(status) {
+    if (status >= 200 && status < 300) return "ok";
+    if (status >= 300 && status < 400) return "warn";
+    if (status >= 400) return "err";
+    return "neutral";
+  }
+
+  function prettyJson(text) {
+    try { return JSON.stringify(JSON.parse(text), null, 2); }
+    catch (e) { return null; }
+  }
+
+  // window.ui 에서 해석된 spec(json) 조회. (snippet-panel 과 동일 방식)
+  function getSpecJson() {
+    try {
+      var ui = global.ui;
+      if (ui && typeof ui.spec === "function") {
+        var s = ui.spec();
+        if (s && typeof s.toJS === "function") {
+          var o = s.toJS();
+          return o.json || o;
+        }
+      }
+    } catch (e) { /* noop */ }
+    return null;
+  }
+
+  // 단일 API 페이지 전제(첫 path/method)로 operation 반환.
+  function getSingleOperation(spec) {
+    var paths = (spec && spec.paths) ? spec.paths : {};
+    var pk = Object.keys(paths)[0];
+    if (!pk) return null;
+    var ops = paths[pk];
+    var mk = ["get", "post", "put", "patch", "delete", "options", "head"].filter(function (m) { return ops[m]; })[0];
+    if (!mk) return null;
+    return { path: pk, method: mk, operation: ops[mk] };
+  }
+
+  // opblock 안 파라미터 입력값(header/query) 읽기.
+  function readParamInput(opblock, name, where) {
+    var scope = opblock || document;
+    var row = scope.querySelector('tr[data-param-name="' + name + '"][data-param-in="' + where + '"]');
+    if (row) {
+      var input = row.querySelector('input[type="text"], input:not([type]), textarea');
+      if (input && input.value) return input.value;
+    }
+    return undefined;
+  }
+
+  // Execute 직전 상태에서 검증용 요청 객체를 조립(헤더/쿼리/본문).
+  function buildValidationRequest(opblock, opInfo) {
+    var op = opInfo.operation;
+    var headers = {};
+    var query = [];
+    (op.parameters || []).forEach(function (p) {
+      if (p.in === "header") {
+        var hv = readParamInput(opblock, p.name, "header");
+        if (hv !== undefined) headers[p.name] = hv;
+      } else if (p.in === "query") {
+        var qv = readParamInput(opblock, p.name, "query");
+        if (qv !== undefined) query.push(encodeURIComponent(p.name) + "=" + encodeURIComponent(qv));
+      }
+    });
+    var body = "";
+    if (op.requestBody) {
+      headers["Content-Type"] = headers["Content-Type"] || "application/json";
+      var ta = (opblock || document).querySelector("textarea.body-param__text");
+      if (ta) body = ta.value;
+    }
+    var url = "http://_local" + opInfo.path + (query.length ? "?" + query.join("&") : "");
+    return { url: url, method: opInfo.method.toUpperCase(), headers: headers, body: body };
+  }
+
+  function renderEmpty() {
+    return ''
+      + '<div class="cell-headers"><div class="cell-title">응답 헤더</div>'
+      +   '<div class="empty">요청 중…</div></div>'
+      + '<div class="cell-body"><div class="cell-title">응답 본문</div>'
+      +   '<div class="empty">요청 중…</div></div>'
+      + '<div class="cell-meta">'
+      +   '<span class="status-chip neutral">대기</span>'
+      +   '<span class="time">Response Time: -</span>'
+      + '</div>';
+  }
+
+  function renderHeadersTable(headers) {
+    var keys = Object.keys(headers || {});
+    if (!keys.length) return '<div class="empty">헤더가 없습니다.</div>';
+    var rows = keys.map(function (k) {
+      return '<tr><td class="hdr-name">' + escapeHtml(k) + '</td>'
+           +     '<td class="hdr-val">' + escapeHtml(headers[k]) + '</td></tr>';
+    }).join("");
+    return '<table class="hdr-table"><thead><tr><th>이름</th><th>값</th></tr></thead>'
+         + '<tbody>' + rows + '</tbody></table>';
+  }
+
+  function bodyTabs(rawText) {
+    var pretty = prettyJson(rawText);
+    var hasJson = pretty != null;
+    var jsonTab = hasJson ? '<button type="button" class="body-tab active" data-tab="json">JSON (Pretty)</button>' : "";
+    var rawTab  = '<button type="button" class="body-tab' + (hasJson ? "" : " active") + '" data-tab="raw">Raw</button>';
+    var jsonPanel = hasJson ? '<pre class="body-panel mono active" data-tab="json">' + escapeHtml(pretty) + '</pre>' : "";
+    var rawPanel  = '<pre class="body-panel mono' + (hasJson ? "" : " active") + '" data-tab="raw">' + escapeHtml(rawText || "") + '</pre>';
+    return '<div class="body-tabs" role="tablist">' + jsonTab + rawTab + '</div>'
+         + '<div class="body-panels">' + jsonPanel + rawPanel + '</div>';
+  }
+
+  function attachTabHandlers(root) {
+    if (root.__djbTabBound) return;
+    root.__djbTabBound = true;
+    root.addEventListener("click", function (e) {
+      var btn = e.target.closest && e.target.closest(".body-tab");
+      if (!btn) return;
+      var panels = root.querySelectorAll(".body-panel");
+      var tabs = root.querySelectorAll(".body-tab");
+      tabs.forEach(function (t) { t.classList.toggle("active", t === btn); });
+      var which = btn.getAttribute("data-tab");
+      panels.forEach(function (p) { p.classList.toggle("active", p.getAttribute("data-tab") === which); });
+    });
+  }
+
+  // 대상 opblock(없으면 열려있는/첫 opblock) 안 .opblock-body 에 그리드 1개 확보.
+  // 항상 opblock-body 최하단으로 이동시킨다: Execute 시점엔 responses-wrapper(요청
+  // 스니펫)가 아직 없어 그리드가 그 위에 붙지만, 응답 후 재호출 시 최하단으로 옮겨
+  // "Execute → 요청 스니펫 → 응답 그리드" 순서를 보장한다.
+  function gridFor(opblock) {
+    var host = opblock
+            || document.querySelector("#swagger-ui .opblock.is-open")
+            || document.querySelector("#swagger-ui .opblock");
+    if (!host) return null;
+    var body = host.querySelector(".opblock-body");
+    if (!body) return null; // 접힘 상태에는 마운트하지 않음 (bare opblock 오배치 방지)
+    var grid = body.querySelector(".djb-response-grid");
+    if (!grid) {
+      grid = document.createElement("div");
+      grid.className = "djb-response-grid djb-empty";
+      grid.innerHTML = renderEmpty();
+      attachTabHandlers(grid);
+    }
+    body.appendChild(grid); // 기존 노드면 최하단으로 이동
+    return grid;
+  }
+
+  // 검증 실패 렌더: 네트워크 요청이 발생하지 않은 상태. djb-error 스타일 그리드.
+  function renderValidationErrors(errors) {
+    var grid = gridFor(targetOpblock);
+    if (!grid) return;
+    var items = (errors || []).map(function (er) {
+      return '<li class="verr-item">'
+        + '<span class="verr-path">' + escapeHtml(er.path) + '</span> '
+        + '<span class="verr-msg">' + escapeHtml(er.message) + '</span>'
+        + (er.value !== undefined ? ' <code class="verr-val mono">' + escapeHtml(JSON.stringify(er.value)) + '</code>' : "")
+        + '</li>';
+    }).join("");
+    grid.classList.remove("djb-empty");
+    grid.classList.add("djb-error");
+    grid.innerHTML = ''
+      + '<div class="cell-headers"><div class="cell-title">응답 헤더</div>'
+      +   '<div class="empty">검증 실패 — 요청이 전송되지 않았습니다.</div></div>'
+      + '<div class="cell-body"><div class="cell-title">검증 실패 (' + (errors || []).length + '건)</div>'
+      +   '<ul class="verr-list">' + items + '</ul></div>'
+      + '<div class="cell-meta">'
+      +   '<span class="status-chip err">검증실패</span>'
+      +   '<span class="time">Response Time: -</span>'
+      + '</div>';
+  }
+
+  // 네트워크/CORS 실패 렌더: responseInterceptor 로 오지 않고 store 에만 error 로 남는 케이스.
+  function renderNetworkError(msg) {
+    var grid = gridFor(targetOpblock);
+    if (!grid) return;
+    grid.classList.remove("djb-empty");
+    grid.classList.add("djb-error");
+    grid.innerHTML = ''
+      + '<div class="cell-headers"><div class="cell-title">응답 헤더</div>'
+      +   '<div class="empty">응답을 받지 못했습니다.</div></div>'
+      + '<div class="cell-body"><div class="cell-title">네트워크 오류</div>'
+      +   '<pre class="body-panel mono active" data-tab="raw">요청 실패: ' + escapeHtml(msg) + '</pre></div>'
+      + '<div class="cell-meta">'
+      +   '<span class="status-chip err">네트워크 오류</span>'
+      +   '<span class="time">Response Time: -</span>'
+      + '</div>';
+  }
+
+  // Execute 클릭 시점에 대상 opblock 확정 + (검증) + 타이머 시작 + 빈 그리드 표시.
+  // 캡처 단계라 Swagger(React) 의 실행 핸들러보다 먼저 실행됨 → 검증 실패 시
+  // stopImmediatePropagation 으로 native 실행을 차단하고 에러만 렌더한다.
+  function onExecuteClick(e) {
+    var t = e.target;
+    if (!t || !t.closest) return;
+    var btn = t.closest(".btn.execute");
+    if (!btn) return;
+    targetOpblock = btn.closest(".opblock");
+
+    // ── 요청 파라미터/본문 검증 (검증기 로드된 경우) ──
+    if (global.DjbSwaggerValidator) {
+      try {
+        var spec = getSpecJson();
+        var opInfo = spec && getSingleOperation(spec);
+        if (opInfo) {
+          var req = buildValidationRequest(targetOpblock, opInfo);
+          var result = global.DjbSwaggerValidator.validateOperation(opInfo.operation, req, spec);
+          if (!result.ok) {
+            e.preventDefault();
+            e.stopImmediatePropagation();
+            renderValidationErrors(result.errors);
+            return;
+          }
+        }
+      } catch (err) { console.error("djb validation error:", err); }
+    }
+
+    startTs = now();
+    var grid = gridFor(targetOpblock);
+    if (grid) {
+      grid.classList.add("djb-empty");
+      grid.classList.remove("djb-error");
+      grid.innerHTML = renderEmpty();
+    }
+  }
+
+  /**
+   * @param {Object} res Swagger UI responseInterceptor 결과
+   *   { status, statusText, headers, text, data, ... }
+   */
+  function renderResponse(res) {
+    if (!res) return;
+    // spec 로딩 응답(/…/swagger.json)은 responseInterceptor 로도 들어온다. 이때 렌더하면
+    // 실행 전인데 응답 본문에 OpenAPI spec 이 그려지므로 무시한다. 사용자 API 호출은
+    // 프록시(/api/call-api)로 나가므로 url 에 swagger.json 이 없다.
+    if (res.url && res.url.indexOf("swagger.json") !== -1) return;
+    var ms = Math.max(0, Math.round(now() - startTs));
+    var status = res.status || 0;
+    var statusText = res.statusText || "";
+    var headers = res.headers || {};
+    var rawText = (typeof res.text === "string") ? res.text
+                : (typeof res.data === "string") ? res.data
+                : (res.data != null ? JSON.stringify(res.data) : "");
+    var op = targetOpblock;
+
+    // Swagger(React) 가 응답 렌더로 opblock-body 를 재조정한 뒤 append 되도록 지연.
+    setTimeout(function () {
+      var grid = gridFor(op);
+      if (!grid) return;
+      var kind = statusKind(status);
+      grid.classList.remove("djb-empty", "djb-error");
+      grid.innerHTML = ''
+        + '<div class="cell-headers"><div class="cell-title">응답 헤더</div>'
+        +   renderHeadersTable(headers) + '</div>'
+        + '<div class="cell-body"><div class="cell-title">응답 본문</div>'
+        +   bodyTabs(rawText) + '</div>'
+        + '<div class="cell-meta">'
+        +   '<span class="status-chip ' + kind + '">응답코드: ' + escapeHtml(status)
+        +     (statusText ? " " + escapeHtml(statusText) : "") + '</span>'
+        +   '<span class="time">Response Time: ' + ms + ' ms</span>'
+        + '</div>';
+      attachTabHandlers(grid);
+    }, 0);
+  }
+
+  // fetch 실패(네트워크/CORS/타임아웃)는 responseInterceptor 로 전달되지 않고 store 의
+  // spec.responses[path][method] 에 { error:true, err } 로만 저장된다. store 를 구독해
+  // 사용자에게 네트워크 오류 그리드로 보여준다. (PoC bootstrap 의 getStore().subscribe 이식)
+  function watchNetworkErrors(ui) {
+    if (!ui || typeof ui.getStore !== "function" || ui.__djbNetWatch) return;
+    ui.__djbNetWatch = true;
+    var rendered = {};
+    ui.getStore().subscribe(function () {
+      try {
+        var respMap = ui.getState().getIn(["spec", "responses"]);
+        if (!respMap || typeof respMap.forEach !== "function") return;
+        respMap.forEach(function (methods, path) {
+          if (!methods || typeof methods.forEach !== "function") return;
+          methods.forEach(function (resp, method) {
+            var key = path + " " + method;
+            var hasError = resp && (resp.get ? resp.get("error") : resp.error);
+            if (hasError) {
+              if (rendered[key]) return;
+              rendered[key] = true;
+              var err = resp.get ? resp.get("err") : resp.err;
+              var msg = (err && (err.message || (err.get && err.get("message"))))
+                     || (err ? String(err) : "응답을 받지 못했습니다.");
+              renderNetworkError(String(msg));
+            } else {
+              rendered[key] = false;
+            }
+          });
+        });
+      } catch (e) { /* ignore */ }
+    });
+  }
+
+  // #swagger-ui 는 API 전환 시에도 element 자체는 유지되므로 캡처 리스너 1회 등록으로 충분.
+  function attach(rootSel) {
+    var root = document.querySelector(rootSel || "#swagger-ui");
+    if (!root || root.__djbRespBound) return;
+    root.__djbRespBound = true;
+    // capture 단계: native 응답 흐름보다 먼저 타겟/타이머 확보 + 검증 차단
+    root.addEventListener("click", onExecuteClick, true);
+    // window.ui 준비 시 네트워크 오류 감시 등록
+    watchNetworkErrors(global.ui);
+  }
+
+  global.DjbSwaggerResponse = {
+    attach: attach,
+    renderResponse: renderResponse,
+    renderValidationErrors: renderValidationErrors,
+    renderNetworkError: renderNetworkError,
+    watchNetworkErrors: watchNetworkErrors
+  };
+})(window);

src/main/resources/static/plugins/swaggerUI/djb-swagger-snippet-panel.js

@@ -0,0 +1,265 @@
+/*!
+ * DjbSwaggerSnippetPanel — Execute 없이 페이지 진입 즉시 요청 스니펫을 보여주는 상시 패널.
+ * (PoC rinjae-works/swagger-poc/js/snippet-panel.js 를 포탈용으로 이식)
+ *
+ * Swagger UI 5 의 내장 .request-snippets 는 Execute 이후에만, 그리고 응답영역 안에
+ * 렌더되므로 CSS 로 숨기고, 동일한 window.SnippetGenerators 로 직접 패널을 만들어
+ * operation 의 Execute 버튼(.btn-group) 바로 아래에 마운트한다. Body/헤더 변경 시 자동 갱신.
+ *
+ * 전제: 이 페이지는 항상 1개 API(단일 operation) 노출 — spec 의 첫 path/method 사용.
+ * spec 은 window.ui 에서 지연 조회한다.
+ *
+ * 연결: SwaggerUIBundle 의 onComplete 에서 DjbSwaggerSnippetPanel.mount() 호출.
+ */
+(function (global) {
+  "use strict";
+
+  var TABS = [
+    { key: "curl_bash",       title: "cURL (Bash)",        gen: "curlBash" },
+    { key: "curl_powershell", title: "cURL (PowerShell)",  gen: "curlPwsh" },
+    { key: "curl_cmd",        title: "cURL (CMD)",         gen: "curlCmd" },
+    { key: "csharp",          title: "C#",                 gen: "csharp" },
+    { key: "ecma5",           title: "ECMA5 (JavaScript)", gen: "ecma5" },
+    { key: "java",            title: "Java",               gen: "javaOkhttp" },
+    { key: "python",          title: "Python",             gen: "python" }
+  ];
+
+  var activeKey = "curl_bash";
+  var rootSel = "#swagger-ui";
+  var observer = null;
+
+  function escapeHtml(s) {
+    return String(s == null ? "" : s)
+      .replace(/&/g, "&amp;").replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+  }
+
+  // window.ui 에서 해석된 spec(json) 조회.
+  function getSpecJson() {
+    try {
+      var ui = global.ui;
+      if (ui && typeof ui.spec === "function") {
+        var s = ui.spec();
+        if (s && typeof s.toJS === "function") {
+          var o = s.toJS();
+          return o.json || o;
+        }
+      }
+    } catch (e) { /* noop */ }
+    return null;
+  }
+
+  // Path 1 + Method 1 전제 하에 단일 operation 반환.
+  function getSingleOperation(spec) {
+    var paths = (spec && spec.paths) ? spec.paths : {};
+    var pk = Object.keys(paths)[0];
+    if (!pk) return null;
+    var ops = paths[pk];
+    var mk = ["get", "post", "put", "patch", "delete", "options", "head"].filter(function (m) { return ops[m]; })[0];
+    if (!mk) return null;
+    return { path: pk, method: mk, operation: ops[mk] };
+  }
+
+  function readHeaderInput(name) {
+    var row = document.querySelector('tr[data-param-name="' + name + '"][data-param-in="header"]');
+    if (row) {
+      var input = row.querySelector('input[type="text"], input:not([type])');
+      if (input && input.value) return input.value;
+    }
+    return null;
+  }
+
+  // Authorize 모달 사용 후에만 표시되는 인증 헤더 추출.
+  function readAuthHeaders() {
+    var headers = {};
+    try {
+      var ui = global.ui;
+      if (!ui || !ui.authSelectors) return headers;
+      var auths = ui.authSelectors.authorized();
+      if (!auths) return headers;
+      var js = auths.toJS();
+      Object.keys(js).forEach(function (key) {
+        var a = js[key];
+        if (!a || !a.schema) return;
+        var scheme = a.schema;
+        if (scheme.type === "oauth2") {
+          var tok = a.token && a.token.access_token;
+          if (tok) headers["Authorization"] = "Bearer " + tok;
+        } else if (scheme.type === "apiKey" && scheme.in === "header") {
+          if (a.value) headers[scheme.name] = a.value;
+        } else if (scheme.type === "http" && scheme.scheme === "bearer") {
+          if (a.value) headers["Authorization"] = "Bearer " + a.value;
+        }
+      });
+    } catch (e) { /* noop */ }
+    return headers;
+  }
+
+  function buildRequest() {
+    var spec = getSpecJson();
+    var opInfo = spec && getSingleOperation(spec);
+    if (!opInfo) return null;
+    var op = opInfo.operation;
+    var server = (spec.servers && spec.servers[0] && spec.servers[0].url) || "";
+    var url = server + opInfo.path;
+
+    var headers = {};
+    (op.parameters || []).forEach(function (p) {
+      if (p.in !== "header") return;
+      var val = readHeaderInput(p.name)
+        || (p.example !== undefined ? String(p.example) : null)
+        || (p.schema && p.schema.example !== undefined ? String(p.schema.example) : null);
+      if (val) headers[p.name] = val;
+    });
+
+    var body = "";
+    if (op.requestBody && op.requestBody.content) {
+      var cts = Object.keys(op.requestBody.content);
+      var ct = cts[0] || "application/json";
+      headers["Content-Type"] = ct;
+      var ta = document.querySelector(rootSel + " textarea.body-param__text");
+      if (ta && ta.value) {
+        body = ta.value;
+      } else if (op.requestBody.content[ct] && op.requestBody.content[ct].example !== undefined) {
+        try { body = JSON.stringify(op.requestBody.content[ct].example, null, 2); } catch (e) { body = ""; }
+      }
+    }
+    headers["accept"] = headers["accept"] || "application/json";
+    var auth = readAuthHeaders();
+    Object.keys(auth).forEach(function (k) { headers[k] = auth[k]; });
+
+    return { url: url, method: opInfo.method.toUpperCase(), headers: headers, body: body };
+  }
+
+  function panelEl() { return document.querySelector("#djb-snippet-panel"); }
+
+  function renderInto(el) {
+    if (!el) return;
+    var gens = global.SnippetGenerators;
+    var code;
+    if (!gens) {
+      code = "// 스니펫 생성기 로드 대기…";
+    } else {
+      try {
+        var req = buildRequest();
+        if (!req) { code = "// 스펙 로딩 중…"; }
+        else {
+          var active = TABS.filter(function (t) { return t.key === activeKey; })[0] || TABS[0];
+          code = gens[active.gen](req);
+        }
+      } catch (e) { code = "// 스니펫 생성 오류: " + e.message; }
+    }
+    var tabsHtml = TABS.map(function (t) {
+      return '<button type="button" class="djb-sn-tab ' + (t.key === activeKey ? "active" : "") + '" data-key="' + t.key + '">' + t.title + '</button>';
+    }).join("");
+    el.innerHTML =
+        '<div class="djb-sn-header">'
+      +   '<h4>요청 스니펫</h4>'
+      +   '<span class="djb-sn-hint">(실행 없이 즉시 미리보기 — Body / 헤더 변경 시 자동 갱신)</span>'
+      +   '<button type="button" class="djb-sn-copy" data-action="copy">복사</button>'
+      + '</div>'
+      + '<div class="djb-sn-tabs" role="tablist">' + tabsHtml + '</div>'
+      + '<pre class="djb-sn-code mono">' + escapeHtml(code) + '</pre>';
+  }
+
+  // 옵저버 재진입(무한 루프) 방지: 우리 DOM 변경 중에는 관찰 일시 중지.
+  function withObserverPaused(fn) {
+    if (observer) observer.disconnect();
+    try { fn(); }
+    finally {
+      if (observer) {
+        var root = document.querySelector(rootSel);
+        if (root) observer.observe(root, { childList: true, subtree: true });
+      }
+    }
+  }
+
+  // Execute 영역 바로 아래 = Swagger UI 폼 하단에 패널 확보.
+  //  - 앵커는 opblock-body '직속' 자식만 본다: 실행 전에는 .execute-wrapper, 실행 후에는
+  //    Swagger UI 5 가 이를 .btn-group(실행+초기화 버튼군)으로 '교체'하므로 둘 다 허용한다.
+  //    (execute-wrapper 만 앵커로 쓰면 실행 후 앵커 소실 → 패널이 제거되고 재생성 안 됨.)
+  //  - 중첩 .btn-group(파라미터 섹션 헤더의 try-out '취소' 버튼군)은 직속 자식이 아니라
+  //    건너뛴다: 그걸 앵커로 잡으면 flex 헤더 안에 삽입돼 "파라미터" 라벨이 찌부된다.
+  //  - operation 이 접혀 opblock-body/Execute 영역이 없으면: 잘못 남은 패널을 제거하고 중단.
+  //    다음 펼침 때 재생성.
+  //  - 이미 있으나 위치가 어긋나면: anchor 바로 뒤로 재배치.
+  function ensureMounted() {
+    var op = document.querySelector(rootSel + " .opblock.is-open")
+          || document.querySelector(rootSel + " .opblock");
+    var body = op && op.querySelector(".opblock-body");
+    var anchor = null;
+    if (body) {
+      for (var i = 0; i < body.children.length; i++) {
+        var kid = body.children[i];
+        if (kid.classList.contains("execute-wrapper") || kid.classList.contains("btn-group")) {
+          anchor = kid;
+          break;
+        }
+      }
+    }
+    var existing = panelEl();
+
+    if (!body || !anchor) {
+      if (existing && existing.parentNode) existing.parentNode.removeChild(existing);
+      return;
+    }
+
+    if (existing) {
+      if (existing.parentNode !== anchor.parentNode || existing.previousElementSibling !== anchor) {
+        anchor.parentNode.insertBefore(existing, anchor.nextSibling);
+      }
+      return;
+    }
+
+    var panel = document.createElement("div");
+    panel.id = "djb-snippet-panel";
+    panel.className = "djb-snippet-panel";
+    anchor.parentNode.insertBefore(panel, anchor.nextSibling);
+    renderInto(panel);
+  }
+
+  function onClick(e) {
+    var tab = e.target.closest && e.target.closest("#djb-snippet-panel .djb-sn-tab");
+    if (tab) {
+      activeKey = tab.getAttribute("data-key");
+      withObserverPaused(function () { renderInto(panelEl()); });
+      return;
+    }
+    var copy = e.target.closest && e.target.closest('#djb-snippet-panel [data-action="copy"]');
+    if (copy) {
+      var code = document.querySelector("#djb-snippet-panel .djb-sn-code");
+      if (code && global.navigator && navigator.clipboard) {
+        navigator.clipboard.writeText(code.innerText).then(function () {
+          copy.textContent = "복사됨";
+          setTimeout(function () { copy.textContent = "복사"; }, 1200);
+        });
+      }
+    }
+  }
+
+  function onInput(e) {
+    var t = e.target;
+    if (!t || !t.matches) return;
+    if (t.matches("textarea.body-param__text") || t.matches("tr[data-param-name] input")) {
+      withObserverPaused(function () { renderInto(panelEl()); });
+    }
+  }
+
+  function mount(opts) {
+    rootSel = (opts && opts.rootSel) || "#swagger-ui";
+    var root = document.querySelector(rootSel);
+    if (!root) return;
+    if (!root.__djbSnBound) {
+      root.__djbSnBound = true;
+      root.addEventListener("click", onClick);
+      root.addEventListener("input", onInput);
+      observer = new MutationObserver(function () {
+        withObserverPaused(function () { ensureMounted(); });
+      });
+      observer.observe(root, { childList: true, subtree: true });
+    }
+    withObserverPaused(function () { ensureMounted(); });
+  }
+
+  global.DjbSwaggerSnippetPanel = { mount: mount, render: function () { renderInto(panelEl()); } };
+})(window);

src/main/resources/static/plugins/swaggerUI/djb-swagger-snippets.js

@@ -0,0 +1,223 @@
+/*!
+ * DjbSwaggerSnippets — Swagger UI 의 SnippetGeneratorPlugin 에 등록되는 7개 언어
+ * 클라이언트 코드 생성기. 서버측 /api/sample_code/{language} 호출을 대체한다.
+ *
+ *   cURL (Bash) / cURL (PowerShell) / cURL (CMD) / C# / ECMA5 (JS) / Java / Python
+ *
+ * 입력: Swagger UI requestSnippetGenerator 가 넘기는 Immutable request.
+ *      .toJS() 로 plain object 변환 후 url/method/headers/body 사용.
+ *      (showMutatedRequest:false 이므로 프록시 URL 이 아닌 실제 대상 요청이 넘어온다)
+ * 출력: string (코드 본문)
+ *
+ * 전역: window.SnippetGeneratorPlugin (Swagger plugins 배열에 등록),
+ *      window.SnippetGenerators (개별 생성 함수 접근용)
+ */
+(function (global) {
+  "use strict";
+
+  function unwrap(req) {
+    if (!req) return {};
+    if (typeof req.toJS === "function") return req.toJS();
+    return req;
+  }
+
+  function getCt(headers) {
+    for (const k of Object.keys(headers || {})) {
+      if (k.toLowerCase() === "content-type") return headers[k];
+    }
+    return null;
+  }
+
+  function bodyAsString(body) {
+    if (body === undefined || body === null) return "";
+    if (typeof body === "string") return body;
+    try { return JSON.stringify(body); } catch (e) { return String(body); }
+  }
+
+  function escapeSingleQuote(s) { return String(s).replace(/'/g, "'\\''"); }
+  function escapeDoubleQuote(s) { return String(s).replace(/"/g, '\\"'); }
+
+  // ─── cURL (Bash) ────────────────────────────────────────────────────────────
+  function curlBash(reqRaw) {
+    const r = unwrap(reqRaw);
+    const lines = [`curl --location --request ${r.method || "GET"} '${escapeSingleQuote(r.url)}'`];
+    const headers = r.headers || {};
+    for (const k of Object.keys(headers)) {
+      lines.push(`  --header '${escapeSingleQuote(k)}: ${escapeSingleQuote(headers[k])}'`);
+    }
+    const body = bodyAsString(r.body);
+    if (body) {
+      lines.push(`  --data-raw '${escapeSingleQuote(body)}'`);
+    }
+    return lines.join(" \\\n");
+  }
+
+  // ─── cURL (PowerShell) ─────────────────────────────────────────────────────
+  function curlPwsh(reqRaw) {
+    const r = unwrap(reqRaw);
+    // 백틱(`) 줄 연속자
+    const segments = [`curl.exe --location --request ${r.method || "GET"} "${escapeDoubleQuote(r.url)}"`];
+    const headers = r.headers || {};
+    for (const k of Object.keys(headers)) {
+      segments.push(`  --header "${escapeDoubleQuote(k)}: ${escapeDoubleQuote(headers[k])}"`);
+    }
+    const body = bodyAsString(r.body);
+    if (body) {
+      segments.push(`  --data-raw "${escapeDoubleQuote(body)}"`);
+    }
+    return segments.join(" `\n");
+  }
+
+  // ─── cURL (Windows CMD) ────────────────────────────────────────────────────
+  function curlCmd(reqRaw) {
+    const r = unwrap(reqRaw);
+    const segments = [`curl.exe --location --request ${r.method || "GET"} "${escapeDoubleQuote(r.url)}"`];
+    const headers = r.headers || {};
+    for (const k of Object.keys(headers)) {
+      segments.push(`  --header "${escapeDoubleQuote(k)}: ${escapeDoubleQuote(headers[k])}"`);
+    }
+    const body = bodyAsString(r.body);
+    if (body) {
+      segments.push(`  --data-raw "${escapeDoubleQuote(body)}"`);
+    }
+    return segments.join(" ^\n");
+  }
+
+  // ─── C# (RestSharp) ─────────────────────────────────────────────────────────
+  function csharp(reqRaw) {
+    const r = unwrap(reqRaw);
+    const method = (r.method || "GET").toUpperCase();
+    const headers = r.headers || {};
+    const body = bodyAsString(r.body);
+    const lines = [
+      `using RestSharp;`,
+      ``,
+      `var client = new RestClient("${escapeDoubleQuote(r.url)}");`,
+      `var request = new RestRequest(Method.${method});`,
+    ];
+    for (const k of Object.keys(headers)) {
+      lines.push(`request.AddHeader("${escapeDoubleQuote(k)}", "${escapeDoubleQuote(headers[k])}");`);
+    }
+    if (body) {
+      const ct = getCt(headers) || "application/json";
+      lines.push(`request.AddParameter("${escapeDoubleQuote(ct)}", @"${body.replace(/"/g, '""')}", ParameterType.RequestBody);`);
+    }
+    lines.push(`IRestResponse response = client.Execute(request);`);
+    lines.push(`Console.WriteLine(response.Content);`);
+    return lines.join("\n");
+  }
+
+  // ─── ECMA5 / JavaScript (XHR) ──────────────────────────────────────────────
+  function ecma5(reqRaw) {
+    const r = unwrap(reqRaw);
+    const method = (r.method || "GET").toUpperCase();
+    const headers = r.headers || {};
+    const body = bodyAsString(r.body);
+    const lines = [
+      `var xhr = new XMLHttpRequest();`,
+      `xhr.withCredentials = false;`,
+      ``,
+      `xhr.addEventListener("readystatechange", function () {`,
+      `  if (this.readyState === 4) {`,
+      `    console.log(this.responseText);`,
+      `  }`,
+      `});`,
+      ``,
+      `xhr.open("${method}", "${escapeDoubleQuote(r.url)}");`,
+    ];
+    for (const k of Object.keys(headers)) {
+      lines.push(`xhr.setRequestHeader("${escapeDoubleQuote(k)}", "${escapeDoubleQuote(headers[k])}");`);
+    }
+    if (body) {
+      // ES5 라 template literal 사용 X — JSON.stringify 로 안전한 문자열 리터럴 생성
+      lines.push(`xhr.send(${JSON.stringify(body)});`);
+    } else {
+      lines.push(`xhr.send(null);`);
+    }
+    return lines.join("\n");
+  }
+
+  // ─── Java (OkHttp) ─────────────────────────────────────────────────────────
+  function javaOkhttp(reqRaw) {
+    const r = unwrap(reqRaw);
+    const method = (r.method || "GET").toUpperCase();
+    const headers = r.headers || {};
+    const body = bodyAsString(r.body);
+    const ct = getCt(headers) || "application/json";
+    const lines = [
+      `OkHttpClient client = new OkHttpClient().newBuilder().build();`,
+      `MediaType mediaType = MediaType.parse("${escapeDoubleQuote(ct)}");`,
+    ];
+    if (body) {
+      lines.push(`RequestBody body = RequestBody.create(mediaType, "${escapeDoubleQuote(body)}");`);
+    }
+    lines.push(`Request request = new Request.Builder()`);
+    lines.push(`  .url("${escapeDoubleQuote(r.url)}")`);
+    if (body) {
+      lines.push(`  .method("${method}", body)`);
+    } else {
+      lines.push(`  .method("${method}", null)`);
+    }
+    for (const k of Object.keys(headers)) {
+      lines.push(`  .addHeader("${escapeDoubleQuote(k)}", "${escapeDoubleQuote(headers[k])}")`);
+    }
+    lines.push(`  .build();`);
+    lines.push(`Response response = client.newCall(request).execute();`);
+    return lines.join("\n");
+  }
+
+  // ─── Python (requests) ─────────────────────────────────────────────────────
+  function python(reqRaw) {
+    const r = unwrap(reqRaw);
+    const method = (r.method || "GET").toLowerCase();
+    const headers = r.headers || {};
+    const body = bodyAsString(r.body);
+
+    const headerEntries = Object.keys(headers).map(
+      k => `  "${escapeDoubleQuote(k)}": "${escapeDoubleQuote(headers[k])}"`
+    );
+    const lines = [
+      `import requests`,
+      ``,
+      `url = "${escapeDoubleQuote(r.url)}"`,
+      ``,
+    ];
+    if (body) {
+      lines.push(`payload = ${JSON.stringify(body)}`);
+    }
+    lines.push(`headers = {`);
+    if (headerEntries.length) lines.push(headerEntries.join(",\n"));
+    lines.push(`}`);
+    lines.push(``);
+    if (body) {
+      lines.push(`response = requests.request("${method.toUpperCase()}", url, headers=headers, data=payload)`);
+    } else {
+      lines.push(`response = requests.request("${method.toUpperCase()}", url, headers=headers)`);
+    }
+    lines.push(`print(response.text)`);
+    return lines.join("\n");
+  }
+
+  // ─── Swagger UI 플러그인 등록 페이로드 ──────────────────────────────────────
+  const SnippetGeneratorPlugin = function () {
+    return {
+      fn: {
+        // curl_bash / curl_powershell / curl_cmd 는 Swagger UI 5 내장 기본 키와 동일하게
+        // 맞춰 내장 생성기를 덮어쓴다. (curl_pwsh 등 다른 키를 쓰면 내장 PowerShell 탭이
+        // 중복 표시됨)
+        requestSnippetGenerator_curl_bash:       curlBash,
+        requestSnippetGenerator_curl_powershell: curlPwsh,
+        requestSnippetGenerator_curl_cmd:        curlCmd,
+        requestSnippetGenerator_csharp:    csharp,
+        requestSnippetGenerator_ecma5:     ecma5,
+        requestSnippetGenerator_java:      javaOkhttp,
+        requestSnippetGenerator_python:    python
+      }
+    };
+  };
+
+  global.SnippetGeneratorPlugin = SnippetGeneratorPlugin;
+  global.SnippetGenerators = {
+    curlBash, curlPwsh, curlCmd, csharp, ecma5, javaOkhttp, python
+  };
+})(window);

src/main/resources/static/plugins/swaggerUI/djb-swagger-testbed.css

@@ -0,0 +1,314 @@
+/* ─────────────────────────────────────────────────────────────────────────── */
+/*  DJB Swagger Testbed overlay                                                */
+/*  - 기본 라이브 응답 표(.live-responses-table) 숨김 (스니펫은 유지)            */
+/*  - 실행한 operation 안에 세로 적층 커스텀 응답 패널(.djb-response-grid)       */
+/*  - D2Coding 우선 monospace fallback                                          */
+/*  포탈 통합용. PoC(rinjae-works/swagger-poc/css/overlay.css) 에서 응답 파트만 */
+/*  발췌·클래스화(단일 ID → 다중 op 대응).                                        */
+/* ─────────────────────────────────────────────────────────────────────────── */
+
+/* D2Coding 은 시스템에 설치된 경우에만 사용 (local()). 미설치 시 fallback 체인 사용. */
+@font-face {
+  font-family: "D2Coding";
+  src: local("D2Coding"),
+       local("D2Coding-Regular"),
+       local("D2Coding ligature");
+  font-display: swap;
+}
+
+:root {
+  --djb-mono: "D2Coding", "Menlo", "Consolas", "Courier New", monospace;
+  --djb-border: #d0d7de;
+  --djb-bg: #ffffff;
+  --djb-bg-alt: #f6f8fa;
+  --djb-text: #1f2328;
+  --djb-text-muted: #6e7781;
+  --djb-ok: #1f883d;
+  --djb-warn: #bf8700;
+  --djb-err: #cf222e;
+  --djb-accent: #0969da;
+}
+
+/* ─── Swagger UI 기본 응답영역: 문서화 응답 샘플만 노출 ────────────────────────
+   응답 영역(.responses-wrapper)은 표시하되(= 상태코드별 응답 예제/스키마 = "응답 샘플"),
+   실행 결과 라이브 블록은 숨긴다:
+     - 요청 스니펫(.request-snippets)  → 상시 다크 패널(#djb-snippet-panel)로 대체
+     - 라이브 응답(Curl/Request URL/Server response + .live-responses-table)
+       = .responses-inner 의 직접 자식 <div> → 커스텀 그리드(.djb-response-grid)로 대체
+   문서화 응답 예제는 .responses-inner > table.responses-table 이라 <div> 숨김과 구분됨.
+   최종 순서: 파라미터 → 요청 본문 → Execute → 요청 스니펫(패널) → 응답 샘플(표) → 응답 그리드. */
+.swagger-ui .request-snippets        { display: none !important; }
+.swagger-ui .responses-inner > div   { display: none !important; }
+.swagger-ui .live-responses-table    { display: none !important; }
+
+/* ─── 상시 요청 스니펫 패널 (PoC overlay.css #djb-snippet-panel) ─────────────── */
+.swagger-ui #djb-snippet-panel {
+  margin: 16px;
+  padding: 12px 16px 16px;
+  background: var(--djb-bg);
+  border: 1px solid var(--djb-border);
+  border-radius: 8px;
+}
+.swagger-ui #djb-snippet-panel .djb-sn-header {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-bottom: 8px;
+}
+.swagger-ui #djb-snippet-panel .djb-sn-header h4 {
+  margin: 0;
+  font-size: 14px;
+  font-weight: 700;
+  color: var(--djb-text);
+}
+.swagger-ui #djb-snippet-panel .djb-sn-hint {
+  color: var(--djb-text-muted);
+  font-size: 11px;
+}
+.swagger-ui #djb-snippet-panel .djb-sn-copy {
+  margin-left: auto;
+  padding: 4px 10px;
+  font-size: 12px;
+  font-weight: 600;
+  background: var(--djb-bg-alt);
+  border: 1px solid var(--djb-border);
+  border-radius: 4px;
+  cursor: pointer;
+  color: var(--djb-text);
+}
+.swagger-ui #djb-snippet-panel .djb-sn-copy:hover { background: #eaeef2; }
+.swagger-ui #djb-snippet-panel .djb-sn-tabs {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 4px;
+  margin-bottom: 8px;
+  border-bottom: 1px solid var(--djb-border);
+}
+.swagger-ui #djb-snippet-panel .djb-sn-tab {
+  background: transparent;
+  border: 1px solid transparent;
+  border-bottom: none;
+  padding: 6px 12px;
+  font-size: 12px;
+  font-weight: 600;
+  color: var(--djb-text-muted);
+  cursor: pointer;
+  border-radius: 4px 4px 0 0;
+  white-space: nowrap;
+}
+.swagger-ui #djb-snippet-panel .djb-sn-tab:hover { color: var(--djb-text); }
+.swagger-ui #djb-snippet-panel .djb-sn-tab.active {
+  color: var(--djb-accent);
+  border-color: var(--djb-border);
+  background: var(--djb-bg);
+  margin-bottom: -1px;
+}
+.swagger-ui #djb-snippet-panel .djb-sn-code {
+  margin: 0;
+  padding: 12px;
+  background: #0d1117;
+  color: #e6edf3;
+  border-radius: 6px;
+  max-height: 360px;
+  overflow: auto;
+  white-space: pre-wrap;
+  word-break: break-all;
+  font-family: var(--djb-mono);
+  font-size: 12.5px;
+  line-height: 1.55;
+}
+
+/* 한글 라벨이 길어도 깨지지 않도록 */
+.swagger-ui .opblock .opblock-summary-path,
+.swagger-ui .opblock-tag,
+.swagger-ui table thead tr th,
+.swagger-ui .parameter__name,
+.swagger-ui .parameter__type {
+  word-break: keep-all;
+}
+
+/* ─── 커스텀 응답 그리드: 헤더 → 본문 → 메타 세로 적층 (opblock 마다 1개) ── */
+.swagger-ui .djb-response-grid {
+  margin: 16px;
+  padding: 16px;
+  background: var(--djb-bg);
+  border: 1px solid var(--djb-border);
+  border-radius: 8px;
+  display: grid;
+  grid-template-columns: 1fr;
+  grid-template-areas:
+    "headers"
+    "body"
+    "meta";
+  gap: 12px;
+  color: var(--djb-text);
+}
+.swagger-ui .djb-response-grid.djb-error { border-color: var(--djb-err); background: #fff8f8; }
+
+.swagger-ui .djb-response-grid .cell-headers { grid-area: headers; min-width: 0; }
+.swagger-ui .djb-response-grid .cell-body    { grid-area: body;    min-width: 0; }
+.swagger-ui .djb-response-grid .cell-meta    {
+  grid-area: meta;
+  display: flex;
+  align-items: center;
+  gap: 16px;
+  padding-top: 8px;
+  border-top: 1px dashed var(--djb-border);
+}
+
+.swagger-ui .djb-response-grid .cell-title {
+  font-size: 12px;
+  font-weight: 700;
+  color: var(--djb-text-muted);
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  margin-bottom: 6px;
+}
+
+.swagger-ui .djb-response-grid .empty {
+  color: var(--djb-text-muted);
+  font-size: 13px;
+  padding: 8px 0;
+}
+
+/* Header 테이블 */
+.swagger-ui .djb-response-grid .hdr-table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 12px;
+  table-layout: fixed;
+}
+.swagger-ui .djb-response-grid .hdr-table th,
+.swagger-ui .djb-response-grid .hdr-table td {
+  border-bottom: 1px solid var(--djb-border);
+  padding: 6px 8px;
+  text-align: left;
+  vertical-align: top;
+  word-break: break-all;
+}
+.swagger-ui .djb-response-grid .hdr-table thead th {
+  background: var(--djb-bg-alt);
+  font-weight: 600;
+}
+.swagger-ui .djb-response-grid .hdr-table td.hdr-name {
+  font-weight: 600;
+  color: var(--djb-text);
+  width: 40%;
+}
+.swagger-ui .djb-response-grid .hdr-table td.hdr-val {
+  font-family: var(--djb-mono);
+  font-size: 12px;
+  color: var(--djb-text);
+}
+
+/* Body 탭 */
+.swagger-ui .djb-response-grid .body-tabs {
+  display: flex;
+  gap: 4px;
+  border-bottom: 1px solid var(--djb-border);
+  margin-bottom: 8px;
+}
+.swagger-ui .djb-response-grid .body-tab {
+  background: transparent;
+  border: 1px solid transparent;
+  border-bottom: none;
+  padding: 6px 12px;
+  font-size: 12px;
+  font-weight: 600;
+  color: var(--djb-text-muted);
+  cursor: pointer;
+  border-radius: 4px 4px 0 0;
+}
+.swagger-ui .djb-response-grid .body-tab:hover { color: var(--djb-text); }
+.swagger-ui .djb-response-grid .body-tab.active {
+  color: var(--djb-accent);
+  border-color: var(--djb-border);
+  background: var(--djb-bg);
+  margin-bottom: -1px;
+}
+
+.swagger-ui .djb-response-grid .body-panels {
+  position: relative;
+  min-height: 80px;
+}
+.swagger-ui .djb-response-grid .body-panel {
+  display: none;
+  margin: 0;
+  padding: 12px;
+  background: #0d1117;
+  color: #e6edf3;
+  border-radius: 6px;
+  max-height: 360px;
+  overflow: auto;
+  white-space: pre-wrap;
+  word-break: break-all;
+  font-size: 12.5px;
+  line-height: 1.55;
+}
+.swagger-ui .djb-response-grid .body-panel.active { display: block; }
+.swagger-ui .djb-response-grid .mono { font-family: var(--djb-mono); }
+
+/* Meta 칩 / 시간 */
+.swagger-ui .djb-response-grid .status-chip {
+  display: inline-block;
+  padding: 4px 12px;
+  border-radius: 999px;
+  font-size: 12px;
+  font-weight: 700;
+  font-family: var(--djb-mono);
+  color: #fff;
+}
+.swagger-ui .djb-response-grid .status-chip.ok      { background: var(--djb-ok); }
+.swagger-ui .djb-response-grid .status-chip.warn    { background: var(--djb-warn); }
+.swagger-ui .djb-response-grid .status-chip.err     { background: var(--djb-err); }
+.swagger-ui .djb-response-grid .status-chip.neutral { background: var(--djb-text-muted); }
+
+.swagger-ui .djb-response-grid .time {
+  font-family: var(--djb-mono);
+  font-size: 12px;
+  color: var(--djb-text-muted);
+}
+
+/* ─── 검증 실패 목록 (djb-swagger-validator.js) ─────────────────────────────── */
+.swagger-ui .djb-response-grid .verr-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+.swagger-ui .djb-response-grid .verr-item {
+  padding: 8px 10px;
+  margin-bottom: 6px;
+  background: #fff8f8;
+  border: 1px solid #ffd7d5;
+  border-left: 3px solid var(--djb-err);
+  border-radius: 4px;
+  font-size: 13px;
+  line-height: 1.5;
+}
+.swagger-ui .djb-response-grid .verr-path {
+  font-family: var(--djb-mono);
+  font-weight: 700;
+  color: var(--djb-err);
+}
+.swagger-ui .djb-response-grid .verr-msg { color: var(--djb-text); }
+.swagger-ui .djb-response-grid .verr-val {
+  display: inline-block;
+  margin-top: 2px;
+  padding: 1px 6px;
+  background: var(--djb-bg-alt);
+  border: 1px solid var(--djb-border);
+  border-radius: 3px;
+  color: var(--djb-text-muted);
+  font-size: 12px;
+}
+
+/* ─── 다크 코드 패널 텍스트 선택 가독성 ──────────────────────────────────────
+   기본 ::selection 색이 어두운 배경(#0d1117)과 겹쳐 선택한 글자가 안 보이므로,
+   선택 영역 배경/글자색을 명시한다. (요청 스니펫 코드 + 응답 본문 패널) */
+.swagger-ui #djb-snippet-panel .djb-sn-code::selection,
+.swagger-ui #djb-snippet-panel .djb-sn-code ::selection,
+.swagger-ui .djb-response-grid .body-panel::selection,
+.swagger-ui .djb-response-grid .body-panel ::selection {
+  background: #2f5c9e;
+  color: #ffffff;
+}

src/main/resources/static/plugins/swaggerUI/djb-swagger-validator.js

@@ -0,0 +1,202 @@
+/*!
+ * DjbSwaggerValidator — Execute 전에 요청 파라미터(header/query)와 요청 본문(body)을
+ * OpenAPI 스키마로 검증하는 경량 JSON Schema 검증기.
+ * (PoC rinjae-works/swagger-poc/js/validator.js 를 포탈용으로 이식)
+ *
+ * 지원 키워드: type, required, properties, items, $ref, maxLength, minLength,
+ *              maximum, minimum, pattern, enum
+ * 지원 type:   string, integer, number, object, array, boolean
+ *
+ * 사용:
+ *   var r = DjbSwaggerValidator.validateOperation(operation, parsedRequest, rootSpec);
+ *   if (!r.ok) console.log(r.errors);  // [{ path, message, value }]
+ */
+(function (global) {
+  "use strict";
+
+  function resolveRef(spec, ref) {
+    if (ref.indexOf("#/") !== 0) return null;
+    var parts = ref.slice(2).split("/");
+    var cur = spec;
+    for (var i = 0; i < parts.length; i++) {
+      if (cur == null) return null;
+      cur = cur[decodeURIComponent(parts[i]).replace(/~1/g, "/").replace(/~0/g, "~")];
+    }
+    return cur || null;
+  }
+
+  function deref(spec, schema, seen) {
+    if (!schema || typeof schema !== "object") return schema;
+    if (schema.$ref) {
+      if (seen && seen.indexOf(schema.$ref) !== -1) return {};
+      var next = resolveRef(spec, schema.$ref);
+      var seen2 = (seen || []).concat([schema.$ref]);
+      return deref(spec, next, seen2);
+    }
+    return schema;
+  }
+
+  function typeMatches(value, type) {
+    if (value === null || value === undefined) return false;
+    switch (type) {
+      case "string":  return typeof value === "string";
+      case "integer": return typeof value === "number" && isFinite(value) && Math.floor(value) === value;
+      case "number":  return typeof value === "number" && !isNaN(value);
+      case "boolean": return typeof value === "boolean";
+      case "array":   return Array.isArray(value);
+      case "object":  return typeof value === "object" && !Array.isArray(value);
+      default:        return true;
+    }
+  }
+
+  function pushErr(errors, path, message, value) {
+    errors.push({ path: path || "/", message: message, value: value });
+  }
+
+  function checkSchema(spec, schema, value, path, errors) {
+    if (!schema) return;
+    schema = deref(spec, schema);
+
+    if (value === undefined || value === null) {
+      // required 는 상위 object 단계에서 확인. 여기서는 통과.
+      return;
+    }
+
+    if (schema.type && !typeMatches(value, schema.type)) {
+      var actual = typeof value === "object" ? (Array.isArray(value) ? "array" : "object") : typeof value;
+      pushErr(errors, path, '타입이 "' + schema.type + '" 이어야 합니다 (현재: ' + actual + ")", value);
+      return;
+    }
+
+    if (Array.isArray(schema.enum) && schema.enum.indexOf(value) === -1) {
+      pushErr(errors, path, "허용된 값이 아닙니다 (허용: " + schema.enum.join(", ") + ")", value);
+    }
+
+    if (schema.type === "string" || typeof value === "string") {
+      if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
+        pushErr(errors, path, "최대 " + schema.maxLength + " 자까지 허용됩니다 (현재: " + value.length + "자)", value);
+      }
+      if (typeof schema.minLength === "number" && value.length < schema.minLength) {
+        pushErr(errors, path, "최소 " + schema.minLength + " 자 이상이어야 합니다 (현재: " + value.length + "자)", value);
+      }
+      if (schema.pattern) {
+        try {
+          if (!new RegExp(schema.pattern).test(value)) {
+            pushErr(errors, path, "형식이 올바르지 않습니다 (pattern: " + schema.pattern + ")", value);
+          }
+        } catch (e) { /* invalid regex in spec — skip */ }
+      }
+    }
+
+    if (schema.type === "integer" || schema.type === "number" || typeof value === "number") {
+      if (typeof schema.maximum === "number" && value > schema.maximum) {
+        pushErr(errors, path, "최대값 " + schema.maximum + " 이하여야 합니다 (현재: " + value + ")", value);
+      }
+      if (typeof schema.minimum === "number" && value < schema.minimum) {
+        pushErr(errors, path, "최소값 " + schema.minimum + " 이상이어야 합니다 (현재: " + value + ")", value);
+      }
+    }
+
+    if (schema.type === "object" && schema.properties) {
+      var requiredList = Array.isArray(schema.required) ? schema.required : [];
+      requiredList.forEach(function (reqKey) {
+        if (value[reqKey] === undefined || value[reqKey] === null || value[reqKey] === "") {
+          pushErr(errors, path + "/" + reqKey, "필수 항목이 누락되었습니다", undefined);
+        }
+      });
+      Object.keys(schema.properties).forEach(function (key) {
+        if (value[key] !== undefined && value[key] !== null) {
+          checkSchema(spec, schema.properties[key], value[key], path + "/" + key, errors);
+        }
+      });
+    }
+
+    if (schema.type === "array" && schema.items && Array.isArray(value)) {
+      value.forEach(function (item, idx) {
+        checkSchema(spec, schema.items, item, path + "/" + idx, errors);
+      });
+    }
+  }
+
+  /**
+   * Swagger UI 의 request 객체에서 header/query/body 를 추출해 operation 정의로 검증.
+   *
+   * @param {Object} operation  spec.paths[path][method] 객체
+   * @param {Object} req        { url, method, headers, body, ... }
+   * @param {Object} rootSpec   $ref 해석을 위한 전체 OpenAPI 문서(json)
+   * @returns {{ ok:boolean, errors:Array<{path,message,value}> }}
+   */
+  function validateOperation(operation, req, rootSpec) {
+    var errors = [];
+    if (!operation) return { ok: true, errors: errors };
+
+    // 1. parameters 검증 (header / query). path 는 Swagger 가 이미 치환 → 건너뜀.
+    var params = Array.isArray(operation.parameters) ? operation.parameters : [];
+    for (var i = 0; i < params.length; i++) {
+      var p = deref(rootSpec, params[i]);
+      var where = p.in;
+      var name = p.name;
+      var schema = p.schema ? deref(rootSpec, p.schema) : { type: "string" };
+
+      var value;
+      if (where === "header") {
+        var headers = req.headers || {};
+        var matchKey = Object.keys(headers).filter(function (k) {
+          return k.toLowerCase() === String(name).toLowerCase();
+        })[0];
+        value = matchKey ? headers[matchKey] : undefined;
+      } else if (where === "query") {
+        try {
+          var u = new URL(req.url, "http://_local");
+          value = u.searchParams.get(name);
+        } catch (e) { value = undefined; }
+      } else {
+        continue; // path/cookie 등은 건너뜀
+      }
+
+      if (p.required && (value === undefined || value === "" || value === null)) {
+        pushErr(errors, (where === "query" ? "query" : "header") + "[" + name + "]",
+          (where === "query" ? "필수 쿼리 파라미터가" : "필수 헤더가") + " 누락되었습니다", undefined);
+        continue;
+      }
+      if (value !== undefined && value !== null && value !== "") {
+        var coerced = (schema.type === "integer" || schema.type === "number") ? Number(value) : String(value);
+        checkSchema(rootSpec, schema, coerced, (where === "query" ? "query" : "header") + "[" + name + "]", errors);
+      }
+    }
+
+    // 2. requestBody 검증
+    if (operation.requestBody) {
+      var rb = deref(rootSpec, operation.requestBody);
+      if (rb.required && (req.body === undefined || req.body === null || req.body === "")) {
+        pushErr(errors, "body", "요청 본문이 비어 있습니다", undefined);
+      } else if (req.body) {
+        var contentTypes = Object.keys(rb.content || {});
+        var ctHeader = (req.headers && (req.headers["Content-Type"] || req.headers["content-type"])) || contentTypes[0];
+        var matchedCt = contentTypes.filter(function (c) {
+          return ctHeader && ctHeader.toLowerCase().indexOf(c.split(";")[0].toLowerCase()) !== -1;
+        })[0] || contentTypes[0];
+        var bodySchema = (matchedCt && rb.content[matchedCt]) ? deref(rootSpec, rb.content[matchedCt].schema) : null;
+
+        var parsed = req.body;
+        if (typeof parsed === "string") {
+          try { parsed = JSON.parse(parsed); }
+          catch (e) {
+            pushErr(errors, "body", "JSON 파싱 실패: " + e.message, req.body);
+            return { ok: false, errors: errors };
+          }
+        }
+        if (bodySchema) {
+          checkSchema(rootSpec, bodySchema, parsed, "body", errors);
+        }
+      }
+    }
+
+    return { ok: errors.length === 0, errors: errors };
+  }
+
+  global.DjbSwaggerValidator = {
+    validateOperation: validateOperation,
+    _internal: { resolveRef: resolveRef, deref: deref, checkSchema: checkSchema }
+  };
+})(window);

src/main/resources/static/plugins/swaggerUI/index.css

@@ -1,7 +1,7 @@
 html {
     box-sizing: border-box;
     overflow: -moz-scrollbars-vertical;
-    height: 100%;
+    overflow-y: scroll;
 }
 
 *,
@@ -12,4 +12,5 @@ html {
 
 body {
     margin: 0;
+    background: #fafafa;
 }

src/main/resources/static/plugins/swaggerUI/oauth2-redirect.html

@@ -1,79 +1,6 @@
 <!doctype html>
 <html lang="en-US">
-<head>
-    <title>Swagger UI: OAuth2 Redirect</title>
-</head>
 <body>
-<script>
-    'use strict';
-    function run () {
-        var oauth2 = window.opener.swaggerUIRedirectOauth2;
-        var sentState = oauth2.state;
-        var redirectUrl = oauth2.redirectUrl;
-        var isValid, qp, arr;
-
-        if (/code|token|error/.test(window.location.hash)) {
-            qp = window.location.hash.substring(1).replace('?', '&');
-        } else {
-            qp = location.search.substring(1);
-        }
-
-        arr = qp.split("&");
-        arr.forEach(function (v,i,_arr) { _arr[i] = '"' + v.replace('=', '":"') + '"';});
-        qp = qp ? JSON.parse('{' + arr.join() + '}',
-                function (key, value) {
-                    return key === "" ? value : decodeURIComponent(value);
-                }
-        ) : {};
-
-        isValid = qp.state === sentState;
-
-        if ((
-          oauth2.auth.schema.get("flow") === "accessCode" ||
-          oauth2.auth.schema.get("flow") === "authorizationCode" ||
-          oauth2.auth.schema.get("flow") === "authorization_code"
-        ) && !oauth2.auth.code) {
-            if (!isValid) {
-                oauth2.errCb({
-                    authId: oauth2.auth.name,
-                    source: "auth",
-                    level: "warning",
-                    message: "Authorization may be unsafe, passed state was changed in server. The passed state wasn't returned from auth server."
-                });
-            }
-
-            if (qp.code) {
-                delete oauth2.state;
-                oauth2.auth.code = qp.code;
-                oauth2.callback({auth: oauth2.auth, redirectUrl: redirectUrl});
-            } else {
-                let oauthErrorMsg;
-                if (qp.error) {
-                    oauthErrorMsg = "["+qp.error+"]: " +
-                        (qp.error_description ? qp.error_description+ ". " : "no accessCode received from the server. ") +
-                        (qp.error_uri ? "More info: "+qp.error_uri : "");
-                }
-
-                oauth2.errCb({
-                    authId: oauth2.auth.name,
-                    source: "auth",
-                    level: "error",
-                    message: oauthErrorMsg || "[Authorization failed]: no accessCode received from the server."
-                });
-            }
-        } else {
-            oauth2.callback({auth: oauth2.auth, token: qp, isValid: isValid, redirectUrl: redirectUrl});
-        }
-        window.close();
-    }
-
-    if (document.readyState !== 'loading') {
-        run();
-    } else {
-        document.addEventListener('DOMContentLoaded', function () {
-            run();
-        });
-    }
-</script>
+<script src="oauth2-redirect.js"></script>
 </body>
 </html>