refactor: [approval] SAM API 규칙 준수 코드 리뷰 반영

- ApprovalStep에 BelongsToTenant, SoftDeletes 추가 (마이그레이션 포함)
- ApprovalForm, ApprovalDelegation에 ModelTrait 추가 (중복 scopeActive 제거)
- ApprovalDelegation에 Auditable 추가
- 모든 결재 액션에 FormRequest 적용 (approve, cancel, hold, preDecide)
- 위임 CRUD에 DelegationStoreRequest, DelegationUpdateRequest 적용
- ApprovalStep 생성 시 tenant_id 포함

app/Http/Controllers/Api/V1/ApprovalController.php

@@ -4,8 +4,14 @@
 
 use App\Helpers\ApiResponse;
 use App\Http\Controllers\Controller;
+use App\Http\Requests\Approval\ApproveRequest;
+use App\Http\Requests\Approval\CancelRequest;
+use App\Http\Requests\Approval\DelegationStoreRequest;
+use App\Http\Requests\Approval\DelegationUpdateRequest;
+use App\Http\Requests\Approval\HoldRequest;
 use App\Http\Requests\Approval\InboxIndexRequest;
 use App\Http\Requests\Approval\IndexRequest;
+use App\Http\Requests\Approval\PreDecideRequest;
 use App\Http\Requests\Approval\ReferenceIndexRequest;
 use App\Http\Requests\Approval\RejectRequest;
 use App\Http\Requests\Approval\StoreRequest;
@@ -133,10 +139,10 @@ public function submit(int $id, SubmitRequest $request): JsonResponse
      * 결재 승인
      * POST /v1/approvals/{id}/approve
      */
-    public function approve(int $id, Request $request): JsonResponse
+    public function approve(int $id, ApproveRequest $request): JsonResponse
     {
         return ApiResponse::handle(function () use ($id, $request) {
-            return $this->service->approve($id, $request->input('comment'));
+            return $this->service->approve($id, $request->validated()['comment'] ?? null);
         }, __('message.approval.approved'));
     }
 
@@ -155,10 +161,10 @@ public function reject(int $id, RejectRequest $request): JsonResponse
      * 결재 회수 (기안자만)
      * POST /v1/approvals/{id}/cancel
      */
-    public function cancel(int $id, Request $request): JsonResponse
+    public function cancel(int $id, CancelRequest $request): JsonResponse
     {
         return ApiResponse::handle(function () use ($id, $request) {
-            return $this->service->cancel($id, $request->input('recall_reason'));
+            return $this->service->cancel($id, $request->validated()['recall_reason'] ?? null);
         }, __('message.approval.cancelled'));
     }
 
@@ -166,15 +172,10 @@ public function cancel(int $id, Request $request): JsonResponse
      * 보류 (현재 결재자만)
      * POST /v1/approvals/{id}/hold
      */
-    public function hold(int $id, Request $request): JsonResponse
+    public function hold(int $id, HoldRequest $request): JsonResponse
     {
         return ApiResponse::handle(function () use ($id, $request) {
-            $comment = $request->input('comment');
-            if (empty($comment)) {
-                throw new \Symfony\Component\HttpKernel\Exception\BadRequestHttpException(__('error.approval.comment_required'));
-            }
-
-            return $this->service->hold($id, $comment);
+            return $this->service->hold($id, $request->validated()['comment']);
         }, __('message.approval.held'));
     }
 
@@ -193,10 +194,10 @@ public function releaseHold(int $id): JsonResponse
      * 전결 (현재 결재자가 이후 모든 결재를 건너뛰고 최종 승인)
      * POST /v1/approvals/{id}/pre-decide
      */
-    public function preDecide(int $id, Request $request): JsonResponse
+    public function preDecide(int $id, PreDecideRequest $request): JsonResponse
     {
         return ApiResponse::handle(function () use ($id, $request) {
-            return $this->service->preDecide($id, $request->input('comment'));
+            return $this->service->preDecide($id, $request->validated()['comment'] ?? null);
         }, __('message.approval.pre_decided'));
     }
 
@@ -296,10 +297,10 @@ public function delegationIndex(Request $request): JsonResponse
      * 위임 생성
      * POST /v1/approvals/delegations
      */
-    public function delegationStore(Request $request): JsonResponse
+    public function delegationStore(DelegationStoreRequest $request): JsonResponse
     {
         return ApiResponse::handle(function () use ($request) {
-            return $this->service->delegationStore($request->all());
+            return $this->service->delegationStore($request->validated());
         }, __('message.created'));
     }
 
@@ -307,10 +308,10 @@ public function delegationStore(Request $request): JsonResponse
      * 위임 수정
      * PATCH /v1/approvals/delegations/{id}
      */
-    public function delegationUpdate(int $id, Request $request): JsonResponse
+    public function delegationUpdate(int $id, DelegationUpdateRequest $request): JsonResponse
     {
         return ApiResponse::handle(function () use ($id, $request) {
-            return $this->service->delegationUpdate($id, $request->all());
+            return $this->service->delegationUpdate($id, $request->validated());
         }, __('message.updated'));
     }
 

app/Http/Requests/Approval/ApproveRequest.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Requests\Approval;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class ApproveRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'comment' => 'nullable|string|max:1000',
+        ];
+    }
+}

app/Http/Requests/Approval/CancelRequest.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Requests\Approval;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class CancelRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'recall_reason' => 'nullable|string|max:1000',
+        ];
+    }
+}

app/Http/Requests/Approval/DelegationStoreRequest.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Requests\Approval;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class DelegationStoreRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'delegate_id' => 'required|integer|exists:users,id',
+            'start_date' => 'required|date|after_or_equal:today',
+            'end_date' => 'required|date|after_or_equal:start_date',
+            'form_ids' => 'nullable|array',
+            'form_ids.*' => 'integer|exists:approval_forms,id',
+            'notify_delegator' => 'nullable|boolean',
+            'reason' => 'nullable|string|max:500',
+        ];
+    }
+}

app/Http/Requests/Approval/DelegationUpdateRequest.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Requests\Approval;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class DelegationUpdateRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'delegate_id' => 'nullable|integer|exists:users,id',
+            'start_date' => 'nullable|date',
+            'end_date' => 'nullable|date|after_or_equal:start_date',
+            'form_ids' => 'nullable|array',
+            'form_ids.*' => 'integer|exists:approval_forms,id',
+            'notify_delegator' => 'nullable|boolean',
+            'is_active' => 'nullable|boolean',
+            'reason' => 'nullable|string|max:500',
+        ];
+    }
+}

app/Http/Requests/Approval/HoldRequest.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Requests\Approval;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class HoldRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'comment' => 'required|string|max:1000',
+        ];
+    }
+
+    public function messages(): array
+    {
+        return [
+            'comment.required' => __('error.approval.comment_required'),
+        ];
+    }
+}

app/Http/Requests/Approval/PreDecideRequest.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Requests\Approval;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class PreDecideRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'comment' => 'nullable|string|max:1000',
+        ];
+    }
+}

app/Models/Tenants/ApprovalDelegation.php

@@ -3,14 +3,16 @@
 namespace App\Models\Tenants;
 
 use App\Models\Members\User;
+use App\Traits\Auditable;
 use App\Traits\BelongsToTenant;
+use App\Traits\ModelTrait;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class ApprovalDelegation extends Model
 {
-    use BelongsToTenant, SoftDeletes;
+    use Auditable, BelongsToTenant, ModelTrait, SoftDeletes;
 
     protected $table = 'approval_delegations';
 
@@ -59,11 +61,6 @@ public function delegate(): BelongsTo
     // 스코프
     // =========================================================================
 
-    public function scopeActive($query)
-    {
-        return $query->where('is_active', true);
-    }
-
     public function scopeForDelegator($query, int $userId)
     {
         return $query->where('delegator_id', $userId);

app/Models/Tenants/ApprovalForm.php

@@ -5,6 +5,7 @@
 use App\Models\Members\User;
 use App\Traits\Auditable;
 use App\Traits\BelongsToTenant;
+use App\Traits\ModelTrait;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
@@ -26,7 +27,7 @@
  */
 class ApprovalForm extends Model
 {
-    use Auditable, BelongsToTenant, SoftDeletes;
+    use Auditable, BelongsToTenant, ModelTrait, SoftDeletes;
 
     protected $table = 'approval_forms';
 
@@ -100,14 +101,6 @@ public function updater(): BelongsTo
     // 스코프
     // =========================================================================
 
-    /**
-     * 활성 양식만
-     */
-    public function scopeActive($query)
-    {
-        return $query->where('is_active', true);
-    }
-
     /**
      * 특정 카테고리
      */

app/Models/Tenants/ApprovalStep.php

@@ -4,13 +4,16 @@
 
 use App\Models\Members\User;
 use App\Traits\Auditable;
+use App\Traits\BelongsToTenant;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * 결재 단계 모델
  *
  * @property int $id
+ * @property int $tenant_id
  * @property int $approval_id
  * @property int $step_order
  * @property string $step_type
@@ -23,7 +26,7 @@
  */
 class ApprovalStep extends Model
 {
-    use Auditable;
+    use Auditable, BelongsToTenant, SoftDeletes;
 
     protected $table = 'approval_steps';
 
@@ -36,6 +39,7 @@ class ApprovalStep extends Model
     ];
 
     protected $fillable = [
+        'tenant_id',
         'approval_id',
         'step_order',
         'step_type',

app/Services/ApprovalService.php

@@ -1230,6 +1230,7 @@ public function copyForRedraft(int $id): Approval
             // 결재선 복사 (모두 pending 상태로, 스냅샷 유지)
             foreach ($original->steps as $step) {
                 ApprovalStep::create([
+                    'tenant_id' => $tenantId,
                     'approval_id' => $newApproval->id,
                     'step_order' => $step->step_order,
                     'step_type' => $step->step_type,
@@ -1597,6 +1598,7 @@ private function createApprovalSteps(Approval $approval, array $steps): void
                 }
 
                 ApprovalStep::create([
+                    'tenant_id' => $approval->tenant_id,
                     'approval_id' => $approval->id,
                     'step_order' => $stepOrder,
                     'step_type' => $stepType,

database/migrations/2026_03_11_100001_add_tenant_id_and_soft_deletes_to_approval_steps_table.php

@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('approval_steps', function (Blueprint $table) {
+            $table->unsignedBigInteger('tenant_id')->nullable()->after('id')->comment('테넌트 ID');
+            $table->softDeletes()->comment('삭제일시');
+
+            $table->index('tenant_id', 'idx_approval_steps_tenant');
+        });
+
+        // 기존 데이터: 부모 approvals 테이블에서 tenant_id 복사
+        DB::statement('
+            UPDATE approval_steps AS s
+            INNER JOIN approvals AS a ON s.approval_id = a.id
+            SET s.tenant_id = a.tenant_id
+        ');
+    }
+
+    public function down(): void
+    {
+        Schema::table('approval_steps', function (Blueprint $table) {
+            $table->dropIndex('idx_approval_steps_tenant');
+            $table->dropColumn(['tenant_id', 'deleted_at']);
+        });
+    }
+};