공개 로그인 관리자 진입 개선

server/routes/admin/api/auth/me.get.js

@@ -1,5 +1,34 @@
-import { getAdminSession, requireAdminSession } from '../../../../utils/admin-auth'
-import { getMemberForAdmin } from '../../../../repositories/member-repository'
+import { clearAdminSession, getAdminSession, requireAdminSession, setAdminSession } from '../../../../utils/admin-auth'
+import { clearMemberSession, getVerifiedMemberSession } from '../../../../utils/member-auth'
+import { getMemberForAdmin, isPrivilegedMemberSession } from '../../../../repositories/member-repository'
+
+/**
+ * 공개 회원 세션이 관리자 권한이면 관리자 세션으로 승격한다.
+ * @param {import('h3').H3Event} event - 요청 이벤트
+ * @returns {Promise<{ userId: string, email: string, role: 'admin', sessionVersion: number } | null>} 관리자 세션
+ */
+const bridgeMemberAdminSession = async (event) => {
+  const memberSession = await getVerifiedMemberSession(event)
+
+  if (!memberSession) {
+    return null
+  }
+
+  const isPrivileged = await isPrivilegedMemberSession(memberSession.userId, memberSession.sessionVersion)
+  if (!isPrivileged) {
+    return null
+  }
+
+  const adminSession = {
+    userId: memberSession.userId,
+    email: memberSession.email,
+    role: 'admin',
+    sessionVersion: memberSession.sessionVersion
+  }
+
+  setAdminSession(event, adminSession)
+  return adminSession
+}
 
 /**
  * 관리자 세션 조회 API
@@ -8,7 +37,24 @@ import { getMemberForAdmin } from '../../../../repositories/member-repository'
  */
 export default defineEventHandler(async (event) => {
   const isOptional = getQuery(event).optional === '1'
-  const session = isOptional ? getAdminSession(event) : requireAdminSession(event)
+  let session = getAdminSession(event)
+
+  if (session) {
+    const isPrivileged = await isPrivilegedMemberSession(session.userId, session.sessionVersion)
+    if (!isPrivileged) {
+      clearAdminSession(event)
+      clearMemberSession(event)
+      session = null
+    }
+  }
+
+  if (!session) {
+    session = await bridgeMemberAdminSession(event)
+  }
+
+  if (!session && !isOptional) {
+    session = requireAdminSession(event)
+  }
 
   if (!session) {
     return null