feat: add Node ACS admin workflows

2026-07-16 11:00:09 +09:00
parent a25872394a
commit c6f342a861
24 changed files with 3442 additions and 266 deletions
--- a/server/routes/security.ts
+++ b/server/routes/security.ts
@@ -0,0 +1,119 @@
+import type { Request } from 'express';
+import { ApiError } from '../http/errors.js';
+import { query } from '../db/pool.js';
+
+export interface UserRow {
+  id: string;
+  username: string;
+  password_hash: string;
+  full_name: string;
+  email: string | null;
+  department: string | null;
+  team_id?: string | null;
+  team_code?: string | null;
+  team_name?: string | null;
+  must_change_password: boolean;
+  enabled: boolean;
+  locked: boolean;
+  roles: string[];
+}
+
+export type QueryFn = typeof query;
+
+export async function findUserByUsername(dbQuery: QueryFn, username: string): Promise<UserRow | undefined> {
+  const result = await dbQuery<UserRow>(
+    `
+      SELECT
+        u.id,
+        u.username,
+        u.password_hash,
+        u.full_name,
+        u.email,
+        u.department,
+        u.team_id,
+        t.code AS team_code,
+        t.name AS team_name,
+        u.must_change_password,
+        u.enabled,
+        u.locked,
+        COALESCE(array_agg(ur.role) FILTER (WHERE ur.role IS NOT NULL), '{}') AS roles
+      FROM users u
+      LEFT JOIN teams t ON t.id = u.team_id
+      LEFT JOIN user_roles ur ON ur.user_id = u.id
+      WHERE u.username = $1
+      GROUP BY u.id, t.id
+    `,
+    [username],
+  );
+  return result.rows[0];
+}
+
+export async function findUserById(dbQuery: QueryFn, id: number): Promise<UserRow | undefined> {
+  const result = await dbQuery<UserRow>(
+    `
+      SELECT
+        u.id,
+        u.username,
+        u.password_hash,
+        u.full_name,
+        u.email,
+        u.department,
+        u.team_id,
+        t.code AS team_code,
+        t.name AS team_name,
+        u.must_change_password,
+        u.enabled,
+        u.locked,
+        COALESCE(array_agg(ur.role) FILTER (WHERE ur.role IS NOT NULL), '{}') AS roles
+      FROM users u
+      LEFT JOIN teams t ON t.id = u.team_id
+      LEFT JOIN user_roles ur ON ur.user_id = u.id
+      WHERE u.id = $1
+      GROUP BY u.id, t.id
+    `,
+    [id],
+  );
+  return result.rows[0];
+}
+
+export async function requireCurrentUser(dbQuery: QueryFn, req: Request): Promise<UserRow> {
+  const userId = req.session.userId;
+  if (!userId) {
+    throw new ApiError(401, '로그인이 필요합니다.');
+  }
+
+  const user = await findUserById(dbQuery, userId);
+  if (!user || !user.enabled || user.locked) {
+    req.session.userId = undefined;
+    throw new ApiError(401, '로그인이 필요합니다.');
+  }
+
+  return user;
+}
+
+export async function requireAdmin(dbQuery: QueryFn, req: Request): Promise<UserRow> {
+  const user = await requireCurrentUser(dbQuery, req);
+  if (!user.roles.includes('ADMIN')) {
+    throw new ApiError(403, '접근 권한이 없습니다.');
+  }
+  return user;
+}
+
+export function parseRole(value: string): string {
+  const role = value.trim().toUpperCase() === 'USER' ? 'HOST' : value.trim().toUpperCase();
+  if (!['ADMIN', 'SECURITY', 'HOST'].includes(role)) {
+    throw new ApiError(400, `알 수 없는 권한입니다: ${value}`);
+  }
+  return role;
+}
+
+export function parseRoles(values: unknown): string[] {
+  if (!Array.isArray(values)) {
+    throw new ApiError(400, '권한은 배열로 입력해야 합니다.');
+  }
+  const roles = [...new Set(values.map((value) => parseRole(String(value))))];
+  if (roles.length === 0) {
+    throw new ApiError(400, '권한은 최소 1개 이상 필요합니다.');
+  }
+  return roles;
+}