v1.10.88 품질·보안 개선과 미디어 카탈로그 database 전환을 반영한다.

세션·로그인 제한, ZIP/업로드 스트리밍, CSP 최소 강제와 Report-Only, Playwright 격리 검증을 추가하고 미디어 목록을 reconcile 후 database 모드로 고정한다.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/api/auth/account.delete.js

@@ -16,7 +16,7 @@ const deleteAccountSchema = z.object({
  * @returns {Promise<{ ok: true }>} 처리 결과
  */
 export default defineEventHandler(async (event) => {
-  const session = requireMemberSession(event)
+  const session = await requireMemberSession(event)
   const parsedBody = deleteAccountSchema.safeParse(await readBody(event))
 
   if (!parsedBody.success) {

server/api/auth/avatar.delete.js

@@ -9,7 +9,7 @@ import { removeManagedAvatarAsset } from '../../utils/member-avatar'
  * @returns {Promise<{ ok: true }>} 처리 결과
  */
 export default defineEventHandler(async (event) => {
-  const session = requireMemberSession(event)
+  const session = await requireMemberSession(event)
   const user = await getUserById(session.userId)
 
   if (!user) {

server/api/auth/avatar.post.js

@@ -4,6 +4,7 @@ import { requireMemberSession } from '../../utils/member-auth'
 import { removeManagedAvatarAsset } from '../../utils/member-avatar'
 import { uploadMemberAvatarImage } from '../../utils/member-avatar-upload'
 import { MEDIA_THUMBNAIL_ROOT, upsertMediaMetadataCategory } from '../../utils/media-library'
+import { replaceMediaReferences } from '../../repositories/media-catalog-repository'
 
 /**
  * 회원 썸네일 업로드 API
@@ -11,7 +12,7 @@ import { MEDIA_THUMBNAIL_ROOT, upsertMediaMetadataCategory } from '../../utils/m
  * @returns {Promise<{ avatarUrl: string }>} 업로드 결과
  */
 export default defineEventHandler(async (event) => {
-  const session = requireMemberSession(event)
+  const session = await requireMemberSession(event)
   const currentUser = await getUserById(session.userId)
   if (!currentUser) {
     throw createError({
@@ -29,6 +30,13 @@ export default defineEventHandler(async (event) => {
   })
 
   await upsertMediaMetadataCategory(avatarUrl, MEDIA_THUMBNAIL_ROOT)
+  await replaceMediaReferences('user', session.userId, {
+    avatarUrl
+  }, {
+    title: currentUser.username
+  }).catch(() => {
+    console.warn('[media-catalog] 회원 아바타 참조 갱신 실패')
+  })
 
   if (currentUser.avatarUrl && currentUser.avatarUrl !== avatarUrl) {
     await removeManagedAvatarAsset(currentUser.avatarUrl)

server/api/auth/check-username.get.js

@@ -8,7 +8,7 @@ import { requireMemberSession } from '../../utils/member-auth'
  * @returns {Promise<{ available: boolean }>} 사용 가능 여부
  */
 export default defineEventHandler(async (event) => {
-  const session = requireMemberSession(event)
+  const session = await requireMemberSession(event)
   const rawUsername = getQuery(event).username
   const username = typeof rawUsername === 'string' ? rawUsername.trim() : ''
 

server/api/auth/login.post.js

@@ -4,6 +4,11 @@ import { createError, readBody } from 'h3'
 import { getUserByEmail, touchUserActivity } from '../../repositories/member-repository'
 import { setMemberSession } from '../../utils/member-auth'
 import { getClientIp } from '../../utils/request-ip'
+import {
+  assertLoginAttemptAllowed,
+  clearLoginAccountFailures,
+  recordLoginFailure
+} from '../../utils/login-attempt-limit'
 
 const loginSchema = z.object({
   email: z.string().trim().email(),
@@ -27,19 +32,34 @@ export default defineEventHandler(async (event) => {
 
   const body = parsedBody.data
   const emailNorm = body.email.trim().toLowerCase()
+  const ip = getClientIp(event)
+  const attempt = {
+    scope: 'member',
+    email: emailNorm,
+    ip
+  }
+
+  assertLoginAttemptAllowed(event, attempt)
+
   const user = await getUserByEmail(emailNorm)
 
   if (!user || !(await bcrypt.compare(body.password, user.passwordHash))) {
+    recordLoginFailure(attempt)
     throw createError({
       statusCode: 401,
       message: '이메일 또는 비밀번호가 올바르지 않습니다.'
     })
   }
 
-  setMemberSession(event, { userId: user.id, email: user.email })
+  clearLoginAccountFailures(attempt)
+  setMemberSession(event, {
+    userId: user.id,
+    email: user.email,
+    sessionVersion: user.sessionVersion
+  })
   await touchUserActivity({
     userId: user.id,
-    ip: getClientIp(event)
+    ip
   })
 
   return {

server/api/auth/me.get.js

@@ -1,5 +1,5 @@
 import { getUserById } from '../../repositories/member-repository'
-import { getMemberSession, requireMemberSession } from '../../utils/member-auth'
+import { getVerifiedMemberSession, requireMemberSession } from '../../utils/member-auth'
 
 /**
  * 회원 세션 조회 API
@@ -8,7 +8,9 @@ import { getMemberSession, requireMemberSession } from '../../utils/member-auth'
  */
 export default defineEventHandler(async (event) => {
   const isOptional = getQuery(event).optional === '1'
-  const session = isOptional ? getMemberSession(event) : requireMemberSession(event)
+  const session = isOptional
+    ? await getVerifiedMemberSession(event)
+    : await requireMemberSession(event)
 
   if (!session) {
     return null

server/api/auth/password.put.js

@@ -2,7 +2,8 @@ import bcrypt from 'bcrypt'
 import { createError, readBody } from 'h3'
 import { z } from 'zod'
 import { getUserByIdWithPassword, updateMemberPassword } from '../../repositories/member-repository'
-import { requireMemberSession } from '../../utils/member-auth'
+import { clearMemberSession, requireMemberSession } from '../../utils/member-auth'
+import { clearAdminSession } from '../../utils/admin-auth'
 
 const updatePasswordSchema = z.object({
   currentPassword: z.string().min(1),
@@ -15,7 +16,7 @@ const updatePasswordSchema = z.object({
  * @returns {Promise<{ ok: true }>} 변경 결과
  */
 export default defineEventHandler(async (event) => {
-  const session = requireMemberSession(event)
+  const session = await requireMemberSession(event)
   const parsedBody = updatePasswordSchema.safeParse(await readBody(event))
 
   if (!parsedBody.success) {
@@ -46,6 +47,8 @@ export default defineEventHandler(async (event) => {
     userId: session.userId,
     passwordHash: nextHash
   })
+  clearMemberSession(event)
+  clearAdminSession(event)
 
   return { ok: true }
 })

server/api/auth/profile.get.js

@@ -8,7 +8,7 @@ import { createError } from 'h3'
  * @returns {Promise<{ id: string, email: string, username: string, avatarUrl: string, createdAt: string, updatedAt: string, lastSeenAt: string | null, previousLastSeenAt: string | null, previousLastSeenIp: string, commentCount: number }>} 회원 프로필
  */
 export default defineEventHandler(async (event) => {
-  const session = requireMemberSession(event)
+  const session = await requireMemberSession(event)
   const user = await getUserProfileById(session.userId)
 
   if (!user) {

server/api/auth/profile.put.js

@@ -16,7 +16,7 @@ const updateProfileSchema = z.object({
  * @returns {Promise<{ id: string, email: string, username: string, avatarUrl: string }>} 수정된 회원 프로필
  */
 export default defineEventHandler(async (event) => {
-  const session = requireMemberSession(event)
+  const session = await requireMemberSession(event)
   const parsedBody = updateProfileSchema.safeParse(await readBody(event))
 
   if (!parsedBody.success) {

server/api/auth/signup.post.js

@@ -104,11 +104,16 @@ export default defineEventHandler(async (event) => {
     passwordHash
   })
 
-  setMemberSession(event, { userId: created.id, email: created.email })
+  setMemberSession(event, {
+    userId: created.id,
+    email: created.email,
+    sessionVersion: created.sessionVersion
+  })
   if (created.isAdmin) {
     setAdminSession(event, {
       userId: created.id,
-      email: created.email
+      email: created.email,
+      sessionVersion: created.sessionVersion
     })
   }
   await touchUserActivity({

server/api/csp-report.post.js

@@ -0,0 +1,118 @@
+import {
+  createError,
+  getRequestHeader,
+  setResponseStatus
+} from 'h3'
+import {
+  CSP_REPORT_MAX_BYTES,
+  isSupportedCspReportContentType,
+  parseCspReportPayload
+} from '../../lib/csp-report.js'
+import { recordCspReports } from '../repositories/csp-report-repository.js'
+import { assertCspReportRequestAllowed } from '../utils/csp-report-request-limit.js'
+
+const STORAGE_FAILURE_LOG_INTERVAL_MS = 5 * 60 * 1000
+let lastStorageFailureLogAt = 0
+
+/**
+ * 요청 스트림을 최대 크기 안에서 JSON으로 읽는다.
+ * @param {import('h3').H3Event} event - 요청 이벤트
+ * @returns {Promise<unknown>} JSON payload
+ */
+const readLimitedJsonBody = async (event) => {
+  const contentLengthHeader = String(getRequestHeader(event, 'content-length') || '').trim()
+  if (contentLengthHeader) {
+    const contentLength = Number(contentLengthHeader)
+    if (!Number.isSafeInteger(contentLength) || contentLength < 0) {
+      throw createError({
+        statusCode: 400,
+        message: '올바르지 않은 Content-Length입니다.'
+      })
+    }
+    if (contentLength > CSP_REPORT_MAX_BYTES) {
+      throw createError({
+        statusCode: 413,
+        message: 'CSP 보고 본문이 너무 큽니다.'
+      })
+    }
+  }
+
+  const chunks = []
+  let byteLength = 0
+
+  for await (const chunk of event.node.req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    byteLength += buffer.byteLength
+    if (byteLength > CSP_REPORT_MAX_BYTES) {
+      throw createError({
+        statusCode: 413,
+        message: 'CSP 보고 본문이 너무 큽니다.'
+      })
+    }
+    chunks.push(buffer)
+  }
+
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+  } catch {
+    throw createError({
+      statusCode: 400,
+      message: '올바른 JSON CSP 보고서가 아닙니다.'
+    })
+  }
+}
+
+/**
+ * 저장 실패를 원문 정보 없이 제한된 빈도로 기록한다.
+ * @returns {void}
+ */
+const logStorageFailure = () => {
+  const now = Date.now()
+  if (now - lastStorageFailureLogAt < STORAGE_FAILURE_LOG_INTERVAL_MS) {
+    return
+  }
+
+  lastStorageFailureLogAt = now
+  console.warn('CSP 위반 집계 저장에 실패했습니다.')
+}
+
+/**
+ * 인증 없는 CSP 위반 보고를 개인정보 최소화 집계로 저장한다.
+ * @param {import('h3').H3Event} event - 요청 이벤트
+ * @returns {Promise<null>} 빈 204 응답
+ */
+export default defineEventHandler(async (event) => {
+  assertCspReportRequestAllowed(event)
+
+  const contentType = String(getRequestHeader(event, 'content-type') || '')
+  if (!isSupportedCspReportContentType(contentType)) {
+    throw createError({
+      statusCode: 415,
+      message: '지원하지 않는 CSP 보고 형식입니다.'
+    })
+  }
+
+  const payload = await readLimitedJsonBody(event)
+  let reports
+
+  try {
+    reports = parseCspReportPayload(
+      payload,
+      String(getRequestHeader(event, 'user-agent') || '')
+    )
+  } catch {
+    throw createError({
+      statusCode: 400,
+      message: '올바른 CSP 보고서가 아닙니다.'
+    })
+  }
+
+  try {
+    await recordCspReports(reports)
+  } catch {
+    logStorageFailure()
+  }
+
+  setResponseStatus(event, 204)
+  return null
+})

server/api/posts.get.js

@@ -1,7 +1,7 @@
 import { getQuery } from 'h3'
 import { listPosts } from '../repositories/content-repository'
 import { canAccessMembershipContent } from '../repositories/member-repository'
-import { getMemberSession } from '../utils/member-auth'
+import { getVerifiedMemberSession } from '../utils/member-auth'
 import {
   DEFAULT_POST_LIST_PAGE_SIZE,
   normalizeDisplayCount,
@@ -14,14 +14,12 @@ import {
  * @returns {Promise<Array>} 게시물 목록
  */
 export default defineEventHandler(async (event) => {
-  const session = getMemberSession(event)
+  const session = await getVerifiedMemberSession(event)
   const includeMembership = await canAccessMembershipContent(session?.userId)
   const query = getQuery(event)
   const page = normalizeListPage(query.page)
-  const limit = query.limit
-    ? normalizeDisplayCount(query.limit, DEFAULT_POST_LIST_PAGE_SIZE)
-    : null
-  const offset = limit ? (page - 1) * limit : 0
+  const limit = normalizeDisplayCount(query.limit, DEFAULT_POST_LIST_PAGE_SIZE)
+  const offset = (page - 1) * limit
   const paginated = query.paginated === '1'
 
   const result = await listPosts({
@@ -38,7 +36,7 @@ export default defineEventHandler(async (event) => {
   }
 
   const total = Number(result.total || 0)
-  const pageSize = limit || DEFAULT_POST_LIST_PAGE_SIZE
+  const pageSize = limit
 
   return {
     items: result.items,

server/api/posts/[slug].get.js

@@ -1,6 +1,6 @@
 import { getAdjacentPosts, getPostBySlug } from '../../repositories/content-repository'
 import { canAccessMembershipContent } from '../../repositories/member-repository'
-import { getMemberSession } from '../../utils/member-auth'
+import { getVerifiedMemberSession } from '../../utils/member-auth'
 
 /**
  * 공개 게시물 상세 API
@@ -9,7 +9,7 @@ import { getMemberSession } from '../../utils/member-auth'
  */
 export default defineEventHandler(async (event) => {
   const slug = getRouterParam(event, 'slug')
-  const session = getMemberSession(event)
+  const session = await getVerifiedMemberSession(event)
   const includeMembership = await canAccessMembershipContent(session?.userId)
   const [post, adjacent] = await Promise.all([
     getPostBySlug(slug, { includeMembership }),

server/api/posts/[slug]/comments.get.js

@@ -1,5 +1,6 @@
 import { listPostCommentsBySlug } from '../../../repositories/comment-repository'
-import { getMemberSession } from '../../../utils/member-auth'
+import { canAccessMembershipContent } from '../../../repositories/member-repository'
+import { getVerifiedMemberSession } from '../../../utils/member-auth'
 
 /**
  * 게시물 댓글 목록 조회 API
@@ -8,8 +9,9 @@ import { getMemberSession } from '../../../utils/member-auth'
  */
 export default defineEventHandler(async (event) => {
   const slug = String(getRouterParam(event, 'slug') || '')
-  const session = getMemberSession(event)
-  const comments = await listPostCommentsBySlug(slug, session?.userId || null)
+  const session = await getVerifiedMemberSession(event)
+  const includeMembership = await canAccessMembershipContent(session?.userId)
+  const comments = await listPostCommentsBySlug(slug, session?.userId || null, includeMembership)
 
   return {
     comments

server/api/posts/[slug]/comments.post.js

@@ -1,7 +1,10 @@
 import { createError, readBody } from 'h3'
 import { z } from 'zod'
 import { createComment } from '../../../repositories/comment-repository'
-import { touchUserActivity } from '../../../repositories/member-repository'
+import {
+  canAccessMembershipContent,
+  touchUserActivity
+} from '../../../repositories/member-repository'
 import { requireMemberSession } from '../../../utils/member-auth'
 import { getClientIp } from '../../../utils/request-ip'
 
@@ -16,7 +19,8 @@ const createCommentSchema = z.object({
  * @returns {Promise<{ comment: Object }>} 생성 댓글
  */
 export default defineEventHandler(async (event) => {
-  const session = requireMemberSession(event)
+  const session = await requireMemberSession(event)
+  const includeMembership = await canAccessMembershipContent(session.userId)
   const slug = String(getRouterParam(event, 'slug') || '')
   const parsedBody = createCommentSchema.safeParse(await readBody(event))
 
@@ -31,7 +35,8 @@ export default defineEventHandler(async (event) => {
     slug,
     userId: session.userId,
     body: parsedBody.data.body,
-    parentId: parsedBody.data.parentId || null
+    parentId: parsedBody.data.parentId || null,
+    includeMembership
   })
   await touchUserActivity({
     userId: session.userId,

server/api/posts/[slug]/comments/[commentId]/like.post.js

@@ -1,5 +1,8 @@
 import { toggleCommentLike } from '../../../../../repositories/comment-repository'
-import { touchUserActivity } from '../../../../../repositories/member-repository'
+import {
+  canAccessMembershipContent,
+  touchUserActivity
+} from '../../../../../repositories/member-repository'
 import { requireMemberSession } from '../../../../../utils/member-auth'
 import { getClientIp } from '../../../../../utils/request-ip'
 
@@ -9,14 +12,16 @@ import { getClientIp } from '../../../../../utils/request-ip'
  * @returns {Promise<{ liked: boolean, likeCount: number }>} 좋아요 상태
  */
 export default defineEventHandler(async (event) => {
-  const session = requireMemberSession(event)
+  const session = await requireMemberSession(event)
+  const includeMembership = await canAccessMembershipContent(session.userId)
   const slug = String(getRouterParam(event, 'slug') || '')
   const commentId = String(getRouterParam(event, 'commentId') || '')
 
   const result = await toggleCommentLike({
     slug,
     commentId,
-    userId: session.userId
+    userId: session.userId,
+    includeMembership
   })
 
   await touchUserActivity({