v1.7.1: 멤버 권한·추천 사이트·네비게이션 UI 개선

관리자는 VIP·멤버만 수정 가능하도록 서버·UI 권한을 정리하고 소유자 권한 이전 API와 확인 모달을 추가했다. 추천 사이트 파비콘 캐시·URL 접두사·카드 편집 UI를 보강하고 확인 얼럿을 AdminConfirmModal로 통일했다.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/routes/admin/api/member-avatar.post.js

@@ -3,7 +3,7 @@ import { uploadMemberAvatarImage } from '../../../utils/member-avatar-upload'
 import { MEDIA_THUMBNAIL_ROOT, upsertMediaMetadataCategory } from '../../../utils/media-library'
 
 /**
- * 관리자 새 회원용 썸네일 사전 업로드 API
+ * 관리자 멤버 썸네일 사전 업로드 API(신규·편집 미리보기)
  * @param {import('h3').H3Event} event - 요청 이벤트
  * @returns {Promise<{ avatarUrl: string }>} 업로드 결과
  */

server/routes/admin/api/members/[id].put.js

@@ -1,7 +1,7 @@
 import { createError, getRouterParam, readBody } from 'h3'
 import { z } from 'zod'
 import { requireAdminSession } from '../../../../utils/admin-auth'
-import { getMemberForAdmin, isEmailTaken, isUsernameTaken, updateMemberByAdmin } from '../../../../repositories/member-repository'
+import { getMemberForAdmin, isEmailTaken, isUsernameTaken, updateMemberByAdmin, assertActorCanEditMemberProfile } from '../../../../repositories/member-repository'
 import { removeManagedAvatarAsset } from '../../../../utils/member-avatar'
 
 const memberInputSchema = z.object({
@@ -18,7 +18,7 @@ const memberInputSchema = z.object({
  * @returns {Promise<Object>} 수정된 회원
  */
 export default defineEventHandler(async (event) => {
-  requireAdminSession(event)
+  const session = requireAdminSession(event)
   const memberId = String(getRouterParam(event, 'id') || '')
   const parsedBody = memberInputSchema.safeParse(await readBody(event))
 
@@ -62,6 +62,7 @@ export default defineEventHandler(async (event) => {
   }
 
   const updated = await updateMemberByAdmin({
+    actorUserId: session.userId,
     memberId,
     username: body.username,
     email,

server/routes/admin/api/members/[id]/avatar.post.js

@@ -11,7 +11,7 @@ import { MEDIA_THUMBNAIL_ROOT, upsertMediaMetadataCategory } from '../../../../.
  * @returns {Promise<Object>} 수정된 회원
  */
 export default defineEventHandler(async (event) => {
-  requireAdminSession(event)
+  const session = requireAdminSession(event)
   const memberId = String(getRouterParam(event, 'id') || '')
 
   if (!memberId) {
@@ -31,6 +31,7 @@ export default defineEventHandler(async (event) => {
 
   const { avatarUrl } = await uploadMemberAvatarImage(event)
   const updated = await updateMemberAvatarByAdmin({
+    actorUserId: session.userId,
     memberId,
     avatarUrl
   })

server/routes/admin/api/members/[id]/ownership-transfer.post.js

@@ -0,0 +1,25 @@
+import { createError, getRouterParam } from 'h3'
+import { requireAdminSession } from '../../../../../utils/admin-auth'
+import { transferMemberOwnership } from '../../../../../repositories/member-repository'
+
+/**
+ * 소유자 권한 이전 API
+ * @param {import('h3').H3Event} event - 요청 이벤트
+ * @returns {Promise<{ target: Object, previousOwner: Object }>} 이전 결과
+ */
+export default defineEventHandler(async (event) => {
+  const session = requireAdminSession(event)
+  const memberId = String(getRouterParam(event, 'id') || '')
+
+  if (!memberId) {
+    throw createError({
+      statusCode: 400,
+      message: '대상 회원 ID가 필요합니다.'
+    })
+  }
+
+  return transferMemberOwnership({
+    actorUserId: session.userId,
+    targetUserId: memberId
+  })
+})

server/routes/admin/api/members/[id]/password.put.js

@@ -2,7 +2,7 @@ import bcrypt from 'bcrypt'
 import { createError, getRouterParam, readBody } from 'h3'
 import { z } from 'zod'
 import { requireAdminSession } from '../../../../../utils/admin-auth'
-import { getMemberForAdmin, updateMemberPassword } from '../../../../../repositories/member-repository'
+import { getMemberForAdmin, updateMemberPassword, assertActorCanEditMemberProfile } from '../../../../../repositories/member-repository'
 
 const adminMemberPasswordSchema = z.object({
   password: z.string().min(8).max(32)
@@ -14,7 +14,7 @@ const adminMemberPasswordSchema = z.object({
  * @returns {Promise<{ ok: true }>} 변경 결과
  */
 export default defineEventHandler(async (event) => {
-  requireAdminSession(event)
+  const session = requireAdminSession(event)
   const memberId = String(getRouterParam(event, 'id') || '')
   const parsedBody = adminMemberPasswordSchema.safeParse(await readBody(event))
 
@@ -32,6 +32,11 @@ export default defineEventHandler(async (event) => {
     })
   }
 
+  await assertActorCanEditMemberProfile({
+    actorUserId: session.userId,
+    targetUserId: memberId
+  })
+
   const member = await getMemberForAdmin(memberId)
   if (!member) {
     throw createError({

server/routes/admin/api/navigation.put.js

@@ -3,6 +3,7 @@ import { requireAdminSession } from '../../../utils/admin-auth'
 import { parseAdminNavigationInput } from '../../../utils/admin-navigation-input'
 import { updateNavigationItems } from '../../../repositories/content-repository'
 import { renumberSortOrderByTree, validateNavigationItems } from '../../../utils/navigation-tree'
+import { refreshRecommendedSiteFaviconsWithoutCache } from '../../../utils/recommended-site-favicon'
 
 /**
  * 저장 직전에 항목별 표시·폴더 플래그를 정리한다(관리자 UI는 항상 노출, 폴더는 자식 유무로만).
@@ -68,7 +69,9 @@ export default defineEventHandler(async (event) => {
   applyNavigationDerivedFlags(items)
 
   try {
-    return await updateNavigationItems(items)
+    const saved = await updateNavigationItems(items)
+    void refreshRecommendedSiteFaviconsWithoutCache().catch(() => {})
+    return saved
   } catch (err) {
     const msg = err?.message != null ? String(err.message) : String(err)
     const code = err?.code != null ? String(err.code) : ''
@@ -77,6 +80,8 @@ export default defineEventHandler(async (event) => {
       msg.includes('is_folder') ||
       msg.includes('description_text') ||
       msg.includes('thumbnail_url') ||
+      msg.includes('cached_favicon_url') ||
+      msg.includes('favicon_cached_at') ||
       code === '42703'
     ) {
       throw createError({

server/routes/admin/api/navigation/[id]/favicon-refresh.post.js

@@ -0,0 +1,41 @@
+import { createError, getRouterParam } from 'h3'
+import { requireAdminSession } from '../../../../../utils/admin-auth'
+import { refreshRecommendedSiteFaviconById } from '../../../../../utils/recommended-site-favicon'
+
+/**
+ * 추천 사이트 파비콘 수동 갱신 API
+ * @param {import('h3').H3Event} event - 요청 이벤트
+ * @returns {Promise<{ cachedFaviconUrl: string, faviconCachedAt: string }>} 갱신 결과
+ */
+export default defineEventHandler(async (event) => {
+  requireAdminSession(event)
+
+  const itemId = String(getRouterParam(event, 'id') || '').trim()
+  if (!itemId) {
+    throw createError({
+      statusCode: 400,
+      message: '네비게이션 항목 ID가 필요합니다.'
+    })
+  }
+
+  try {
+    return await refreshRecommendedSiteFaviconById(itemId)
+  } catch (err) {
+    const msg = err?.message != null ? String(err.message) : '파비콘을 갱신하지 못했습니다.'
+    if (
+      msg.includes('cached_favicon_url')
+      || msg.includes('favicon_cached_at')
+      || String(err?.code || '') === '42703'
+    ) {
+      throw createError({
+        statusCode: 503,
+        message: 'DB에 추천 사이트 파비콘 캐시 컬럼이 없습니다. npm run db:migrate:dev 로 최신 마이그레이션을 적용한 뒤 다시 시도하세요.'
+      })
+    }
+
+    throw createError({
+      statusCode: 400,
+      message: msg
+    })
+  }
+})