v1.7.1: 멤버 권한·추천 사이트·네비게이션 UI 개선

관리자는 VIP·멤버만 수정 가능하도록 서버·UI 권한을 정리하고 소유자 권한 이전 API와 확인 모달을 추가했다. 추천 사이트 파비콘 캐시·URL 접두사·카드 편집 UI를 보강하고 확인 얼럿을 AdminConfirmModal로 통일했다.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/routes/admin/api/members/[id]/avatar.post.js

@@ -11,7 +11,7 @@ import { MEDIA_THUMBNAIL_ROOT, upsertMediaMetadataCategory } from '../../../../.
  * @returns {Promise<Object>} 수정된 회원
  */
 export default defineEventHandler(async (event) => {
-  requireAdminSession(event)
+  const session = requireAdminSession(event)
   const memberId = String(getRouterParam(event, 'id') || '')
 
   if (!memberId) {
@@ -31,6 +31,7 @@ export default defineEventHandler(async (event) => {
 
   const { avatarUrl } = await uploadMemberAvatarImage(event)
   const updated = await updateMemberAvatarByAdmin({
+    actorUserId: session.userId,
     memberId,
     avatarUrl
   })

server/routes/admin/api/members/[id]/ownership-transfer.post.js

@@ -0,0 +1,25 @@
+import { createError, getRouterParam } from 'h3'
+import { requireAdminSession } from '../../../../../utils/admin-auth'
+import { transferMemberOwnership } from '../../../../../repositories/member-repository'
+
+/**
+ * 소유자 권한 이전 API
+ * @param {import('h3').H3Event} event - 요청 이벤트
+ * @returns {Promise<{ target: Object, previousOwner: Object }>} 이전 결과
+ */
+export default defineEventHandler(async (event) => {
+  const session = requireAdminSession(event)
+  const memberId = String(getRouterParam(event, 'id') || '')
+
+  if (!memberId) {
+    throw createError({
+      statusCode: 400,
+      message: '대상 회원 ID가 필요합니다.'
+    })
+  }
+
+  return transferMemberOwnership({
+    actorUserId: session.userId,
+    targetUserId: memberId
+  })
+})

server/routes/admin/api/members/[id]/password.put.js

@@ -2,7 +2,7 @@ import bcrypt from 'bcrypt'
 import { createError, getRouterParam, readBody } from 'h3'
 import { z } from 'zod'
 import { requireAdminSession } from '../../../../../utils/admin-auth'
-import { getMemberForAdmin, updateMemberPassword } from '../../../../../repositories/member-repository'
+import { getMemberForAdmin, updateMemberPassword, assertActorCanEditMemberProfile } from '../../../../../repositories/member-repository'
 
 const adminMemberPasswordSchema = z.object({
   password: z.string().min(8).max(32)
@@ -14,7 +14,7 @@ const adminMemberPasswordSchema = z.object({
  * @returns {Promise<{ ok: true }>} 변경 결과
  */
 export default defineEventHandler(async (event) => {
-  requireAdminSession(event)
+  const session = requireAdminSession(event)
   const memberId = String(getRouterParam(event, 'id') || '')
   const parsedBody = adminMemberPasswordSchema.safeParse(await readBody(event))
 
@@ -32,6 +32,11 @@ export default defineEventHandler(async (event) => {
     })
   }
 
+  await assertActorCanEditMemberProfile({
+    actorUserId: session.userId,
+    targetUserId: memberId
+  })
+
   const member = await getMemberForAdmin(memberId)
   if (!member) {
     throw createError({