sori.studio/server/api/auth/avatar.post.js

import { randomUUID } from 'node:crypto'
import { mkdir, writeFile } from 'node:fs/promises'
import { join } from 'node:path'
import { createError, readMultipartFormData } from 'h3'
import sharp from 'sharp'
import { getPostgresClient } from '../../repositories/postgres-client'
import { updateMemberProfile, getUserById } from '../../repositories/member-repository'
import { requireMemberSession } from '../../utils/member-auth'
import { removeManagedAvatarAsset } from '../../utils/member-avatar'

const allowedImageTypes = new Map([
  ['image/jpeg', '.jpg'],
  ['image/png', '.png'],
  ['image/webp', '.webp'],
  ['image/gif', '.gif']
])

/**
 * 업로드 경로 조각을 URL 안전 문자열로 정리
 * @param {string} value - 원본 경로 조각
 * @returns {string} 정리된 경로 조각
 */
const sanitizePathPart = (value) => value
  .replace(/[^a-zA-Z0-9가-힣._-]/g, '-')
  .replace(/-+/g, '-')
  .replace(/^-|-$/g, '')

/**
 * 숫자 설정값을 최소/최대 범위로 보정한다.
 * @param {number} value - 원본 값
 * @param {number} minimum - 최소값
 * @param {number} maximum - 최대값
 * @returns {number} 보정된 값
 */
const clampNumber = (value, minimum, maximum) => {
  if (!Number.isFinite(value)) {
    return minimum
  }

  if (value < minimum) {
    return minimum
  }

  if (value > maximum) {
    return maximum
  }

  return Math.round(value)
}

/**
 * 회원 썸네일 업로드 API
 * @param {import('h3').H3Event} event - 요청 이벤트
 * @returns {Promise<{ avatarUrl: string }>} 업로드 결과
 */
export default defineEventHandler(async (event) => {
  const session = requireMemberSession(event)
  const currentUser = await getUserById(session.userId)
  if (!currentUser) {
    throw createError({
      statusCode: 404,
      message: '회원 정보를 찾을 수 없습니다.'
    })
  }

  const config = useRuntimeConfig()
  const maxFileSize = Number(config.maxFileSize || 10485760)
  const avatarMinWidth = clampNumber(Number(config.avatarMinWidth || 96), 1, 4096)
  const avatarMinHeight = clampNumber(Number(config.avatarMinHeight || 96), 1, 4096)
  const avatarMaxWidth = clampNumber(Number(config.avatarMaxWidth || 512), avatarMinWidth, 4096)
  const avatarMaxHeight = clampNumber(Number(config.avatarMaxHeight || 512), avatarMinHeight, 4096)
  const avatarSquareSize = Math.min(avatarMaxWidth, avatarMaxHeight)
  const avatarWebpQuality = clampNumber(Number(config.avatarWebpQuality || 82), 1, 100)
  const formData = await readMultipartFormData(event)
  const file = (formData || []).find((part) => part.name === 'file' && part.filename)

  if (!file) {
    throw createError({
      statusCode: 400,
      message: '업로드할 이미지가 없습니다.'
    })
  }

  if (!allowedImageTypes.has(file.type)) {
    throw createError({
      statusCode: 400,
      message: '이미지 파일만 업로드할 수 있습니다.'
    })
  }

  if (file.data.length > maxFileSize) {
    throw createError({
      statusCode: 413,
      message: '업로드 가능한 파일 크기를 초과했습니다.'
    })
  }

  const now = new Date()
  const year = String(now.getFullYear())
  const month = String(now.getMonth() + 1).padStart(2, '0')
  const uploadBaseUrl = String(config.uploadDir || '/uploads').replace(/\/+$/g, '') || '/uploads'
  const publicBasePath = uploadBaseUrl.replace(/^\/+/, '')
  const directoryPath = join(process.cwd(), 'public', publicBasePath, 'members', 'avatars', year, month)

  await mkdir(directoryPath, { recursive: true })

  const originalName = sanitizePathPart(file.filename.replace(/\.[^.]+$/g, '')) || 'avatar'
  const fileName = `${originalName}-${randomUUID()}.webp`
  const filePath = join(directoryPath, fileName)
  const avatarUrl = `${uploadBaseUrl}/members/avatars/${year}/${month}/${fileName}`
  const metadata = await sharp(file.data).metadata()

  if (!metadata.width || !metadata.height) {
    throw createError({
      statusCode: 400,
      message: '이미지 메타데이터를 읽을 수 없습니다.'
    })
  }

  if (metadata.width < avatarMinWidth || metadata.height < avatarMinHeight) {
    throw createError({
      statusCode: 400,
      message: `최소 ${avatarMinWidth}x${avatarMinHeight} 이상 이미지만 업로드할 수 있습니다.`
    })
  }

  const resizedBuffer = await sharp(file.data)
    .rotate()
    .resize({
      width: avatarSquareSize,
      height: avatarSquareSize,
      fit: 'cover',
      position: 'centre'
    })
    .webp({
      quality: avatarWebpQuality
    })
    .toBuffer()

  await writeFile(filePath, resizedBuffer)

  await updateMemberProfile({
    userId: session.userId,
    username: currentUser.username,
    avatarUrl
  })

  const sql = getPostgresClient()
  if (sql) {
    await sql`
      INSERT INTO media_metadata (url, category)
      VALUES (${avatarUrl}, ${'회원/썸네일'})
      ON CONFLICT (url) DO UPDATE
      SET
        category = EXCLUDED.category,
        updated_at = now()
    `
  }

  if (currentUser.avatarUrl && currentUser.avatarUrl !== avatarUrl) {
    await removeManagedAvatarAsset(currentUser.avatarUrl)
  }

  return {
    avatarUrl
  }
})