v1.10.88 품질·보안 개선과 미디어 카탈로그 database 전환을 반영한다.

세션·로그인 제한, ZIP/업로드 스트리밍, CSP 최소 강제와 Report-Only, Playwright 격리 검증을 추가하고 미디어 목록을 reconcile 후 database 모드로 고정한다.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/routes/admin/api/auth/login.post.js

@@ -6,6 +6,11 @@ import { getAdminUserByEmail, getMemberBootstrapState, touchUserActivity, upsert
 import { setMemberSession } from '../../../../utils/member-auth'
 import { getRuntimeEnvValue } from '../../../../utils/runtime-env'
 import { getClientIp } from '../../../../utils/request-ip'
+import {
+  assertLoginAttemptAllowed,
+  clearLoginAccountFailures,
+  recordLoginFailure
+} from '../../../../utils/login-attempt-limit'
 
 const loginSchema = z.object({
   email: z.string().email(),
@@ -64,6 +69,15 @@ export default defineEventHandler(async (event) => {
   }
 
   const body = parsedBody.data
+  const emailNorm = body.email.trim().toLowerCase()
+  const ip = getClientIp(event)
+  const attempt = {
+    scope: 'admin',
+    email: emailNorm,
+    ip
+  }
+
+  assertLoginAttemptAllowed(event, attempt)
 
   const adminUser = await getAdminUserByEmail(body.email) || await createBootstrapAdminUser(body)
   const passwordMatched = adminUser
@@ -71,23 +85,27 @@ export default defineEventHandler(async (event) => {
     : false
 
   if (!adminUser || !passwordMatched) {
+    recordLoginFailure(attempt)
     throw createError({
       statusCode: 401,
       message: '이메일 또는 비밀번호가 올바르지 않습니다.'
     })
   }
 
+  clearLoginAccountFailures(attempt)
   setAdminSession(event, {
     userId: adminUser.id,
-    email: adminUser.email
+    email: adminUser.email,
+    sessionVersion: adminUser.sessionVersion
   })
   setMemberSession(event, {
     userId: adminUser.id,
-    email: adminUser.email
+    email: adminUser.email,
+    sessionVersion: adminUser.sessionVersion
   })
   await touchUserActivity({
     userId: adminUser.id,
-    ip: getClientIp(event)
+    ip
   })
 
   return {

server/routes/admin/api/auth/me.get.js

@@ -17,7 +17,9 @@ export default defineEventHandler(async (event) => {
   const member = await getMemberForAdmin(session.userId)
 
   return {
-    ...session,
+    userId: session.userId,
+    email: session.email,
+    role: session.role,
     roleCode: member?.roleCode || 'admin',
     roleLabel: member?.role || '관리자'
   }