소유자 관리자 진입 권한 보강

server/api/auth/login.post.js

@@ -1,7 +1,7 @@
 import bcrypt from 'bcrypt'
 import { z } from 'zod'
 import { createError, readBody } from 'h3'
-import { getUserByEmail, touchUserActivity } from '../../repositories/member-repository'
+import { getUserByEmail, isPrivilegedMemberRole, touchUserActivity } from '../../repositories/member-repository'
 import { setMemberSession } from '../../utils/member-auth'
 import { setAdminSession } from '../../utils/admin-auth'
 import { getClientIp } from '../../utils/request-ip'
@@ -16,6 +16,13 @@ const loginSchema = z.object({
   password: z.string().min(1)
 })
 
+/**
+ * 공개 회원이 관리자 진입 권한을 갖는지 확인한다.
+ * @param {{ isAdmin?: boolean, role?: string } | null} user - 회원 정보
+ * @returns {boolean} 관리자 진입 가능 여부
+ */
+const canOpenSiteAdmin = (user) => Boolean(user?.isAdmin) || isPrivilegedMemberRole(user?.role)
+
 /**
  * 회원 로그인 API
  * @param {import('h3').H3Event} event - 요청 이벤트
@@ -58,7 +65,8 @@ export default defineEventHandler(async (event) => {
     email: user.email,
     sessionVersion: user.sessionVersion
   })
-  if (user.isAdmin) {
+  const isAdminUser = canOpenSiteAdmin(user)
+  if (isAdminUser) {
     setAdminSession(event, {
       userId: user.id,
       email: user.email,
@@ -75,6 +83,6 @@ export default defineEventHandler(async (event) => {
     username: user.username,
     email: user.email,
     avatarUrl: user.avatarUrl || '',
-    isAdmin: Boolean(user.isAdmin)
+    isAdmin: isAdminUser
   }
 })

server/api/auth/me.get.js

@@ -1,4 +1,4 @@
-import { getUserById } from '../../repositories/member-repository'
+import { getUserById, isPrivilegedMemberRole } from '../../repositories/member-repository'
 import { getVerifiedMemberSession, requireMemberSession } from '../../utils/member-auth'
 
 /**
@@ -34,7 +34,7 @@ export default defineEventHandler(async (event) => {
     username: user.username,
     email: user.email,
     avatarUrl: user.avatarUrl || '',
-    isAdmin: Boolean(user.isAdmin),
+    isAdmin: Boolean(user.isAdmin) || isPrivilegedMemberRole(user.role),
     role: user.role || 'member'
   }
 })