zenn
de767095ba
세션·로그인 제한, ZIP/업로드 스트리밍, CSP 최소 강제와 Report-Only, Playwright 격리 검증을 추가하고 미디어 목록을 reconcile 후 database 모드로 고정한다. Co-authored-by: Cursor <cursoragent@cursor.com>
62 lines
1.9 KiB
JavaScript
62 lines
1.9 KiB
JavaScript
import { createError, getRouterParam } from 'h3'
|
|
import { requireAdminSession } from '../../../../../utils/admin-auth'
|
|
import { getMemberForAdmin, updateMemberAvatarByAdmin } from '../../../../../repositories/member-repository'
|
|
import { removeManagedAvatarAsset } from '../../../../../utils/member-avatar'
|
|
import { uploadMemberAvatarImage } from '../../../../../utils/member-avatar-upload'
|
|
import { MEDIA_THUMBNAIL_ROOT, upsertMediaMetadataCategory } from '../../../../../utils/media-library'
|
|
import { replaceMediaReferences } from '../../../../../repositories/media-catalog-repository'
|
|
|
|
/**
|
|
* 관리자 회원 썸네일 업로드 API
|
|
* @param {import('h3').H3Event} event - 요청 이벤트
|
|
* @returns {Promise<Object>} 수정된 회원
|
|
*/
|
|
export default defineEventHandler(async (event) => {
|
|
const session = requireAdminSession(event)
|
|
const memberId = String(getRouterParam(event, 'id') || '')
|
|
|
|
if (!memberId) {
|
|
throw createError({
|
|
statusCode: 400,
|
|
message: '회원 ID가 필요합니다.'
|
|
})
|
|
}
|
|
|
|
const member = await getMemberForAdmin(memberId)
|
|
if (!member) {
|
|
throw createError({
|
|
statusCode: 404,
|
|
message: '회원을 찾을 수 없습니다.'
|
|
})
|
|
}
|
|
|
|
const { avatarUrl } = await uploadMemberAvatarImage(event)
|
|
const updated = await updateMemberAvatarByAdmin({
|
|
actorUserId: session.userId,
|
|
memberId,
|
|
avatarUrl
|
|
})
|
|
|
|
if (!updated) {
|
|
throw createError({
|
|
statusCode: 500,
|
|
message: '회원 썸네일 수정에 실패했습니다.'
|
|
})
|
|
}
|
|
|
|
await upsertMediaMetadataCategory(avatarUrl, MEDIA_THUMBNAIL_ROOT)
|
|
await replaceMediaReferences('user', memberId, {
|
|
avatarUrl
|
|
}, {
|
|
title: updated.username
|
|
}).catch(() => {
|
|
console.warn('[media-catalog] 회원 아바타 참조 갱신 실패')
|
|
})
|
|
|
|
if (member.avatarUrl && member.avatarUrl !== avatarUrl) {
|
|
await removeManagedAvatarAsset(member.avatarUrl)
|
|
}
|
|
|
|
return updated
|
|
})
|