릴리스: v0.1.47 템플릿 요청과 관리자 승인 흐름 추가

backend/src/db.js

@@ -85,6 +85,30 @@ function mapTierListRow(row) {
   }
 }
 
+function mapTemplateRequestRow(row) {
+  if (!row) return null
+  return {
+    id: row.id,
+    type: row.request_type,
+    requesterId: row.requester_id,
+    requesterName: getUserDisplayName(row),
+    requesterAccountName: getUserAccountName(row),
+    requesterAvatarSrc: row.requester_avatar_src || '',
+    sourceTierListId: row.source_tierlist_id,
+    sourceGameId: row.source_game_id,
+    sourceGameName: row.source_game_name || '',
+    sourceTierListTitle: row.title_snapshot || '',
+    sourceDescription: row.description_snapshot || '',
+    thumbnailSrc: row.thumbnail_src_snapshot || '',
+    targetGameId: row.target_game_id || '',
+    targetGameName: row.target_game_name || '',
+    status: row.status,
+    items: parseJson(row.items_json, []),
+    createdAt: Number(row.created_at),
+    updatedAt: Number(row.updated_at),
+  }
+}
+
 function getUserDisplayName(row) {
   if (!row) return ''
   const nickname = (row.nickname || '').trim()
@@ -226,6 +250,29 @@ async function ensureSchema() {
       ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
     `)
 
+    await query(`
+      CREATE TABLE IF NOT EXISTS template_requests (
+        id VARCHAR(64) PRIMARY KEY,
+        request_type VARCHAR(20) NOT NULL,
+        requester_id VARCHAR(64) NOT NULL,
+        source_tierlist_id VARCHAR(64) NOT NULL,
+        source_game_id VARCHAR(120) NOT NULL,
+        target_game_id VARCHAR(120) NOT NULL DEFAULT '',
+        status VARCHAR(20) NOT NULL DEFAULT 'pending',
+        title_snapshot VARCHAR(120) NOT NULL,
+        description_snapshot TEXT NOT NULL,
+        thumbnail_src_snapshot VARCHAR(255) NOT NULL DEFAULT '',
+        items_json LONGTEXT NOT NULL,
+        created_at BIGINT NOT NULL,
+        updated_at BIGINT NOT NULL,
+        INDEX idx_template_requests_status_created (status, created_at),
+        INDEX idx_template_requests_source_tierlist (source_tierlist_id),
+        INDEX idx_template_requests_requester (requester_id),
+        CONSTRAINT fk_template_requests_requester FOREIGN KEY (requester_id) REFERENCES users(id) ON DELETE CASCADE,
+        CONSTRAINT fk_template_requests_source_tierlist FOREIGN KEY (source_tierlist_id) REFERENCES tierlists(id) ON DELETE CASCADE
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
+    `)
+
     const tierListThumbnailColumns = await query("SHOW COLUMNS FROM tierlists LIKE 'thumbnail_src'")
     if (!tierListThumbnailColumns.length) {
       await query("ALTER TABLE tierlists ADD COLUMN thumbnail_src VARCHAR(255) NOT NULL DEFAULT '' AFTER title")
@@ -502,6 +549,24 @@ async function createCustomItem({ id, ownerId, src, label }) {
   return { id, ownerId, src, label, origin: 'custom', createdAt }
 }
 
+async function syncOwnedCustomItemLabels({ ownerId, items }) {
+  const customItems = Array.from(
+    new Map(
+      (items || [])
+        .filter((item) => item?.origin === 'custom' && item?.id && typeof item.label === 'string')
+        .map((item) => [item.id, item])
+    ).values()
+  )
+
+  if (!customItems.length) return
+
+  await Promise.all(
+    customItems.map((item) =>
+      query('UPDATE custom_items SET label = ? WHERE id = ? AND owner_id = ?', [item.label.trim().slice(0, 60), item.id, ownerId])
+    )
+  )
+}
+
 async function findCustomItemById(id) {
   const rows = await query(
     `
@@ -959,6 +1024,151 @@ async function findTierListById(id, currentUserId = '') {
   return applyFavoriteMetaToTierLists([tierList], favoriteStats)[0]
 }
 
+async function findPendingTemplateRequestByTierList({ sourceTierListId, type }) {
+  const rows = await query(
+    `
+      SELECT id, request_type, status
+      FROM template_requests
+      WHERE source_tierlist_id = ? AND request_type = ? AND status = 'pending'
+      LIMIT 1
+    `,
+    [sourceTierListId, type]
+  )
+  return rows[0] || null
+}
+
+async function createTemplateRequest({
+  id,
+  type,
+  requesterId,
+  sourceTierListId,
+  sourceGameId,
+  targetGameId = '',
+  title,
+  description = '',
+  thumbnailSrc = '',
+  items = [],
+}) {
+  const existing = await findPendingTemplateRequestByTierList({ sourceTierListId, type })
+  if (existing) {
+    const err = new Error('template_request_exists')
+    err.code = 'TEMPLATE_REQUEST_EXISTS'
+    throw err
+  }
+
+  const createdAt = now()
+  await query(
+    `
+      INSERT INTO template_requests (
+        id,
+        request_type,
+        requester_id,
+        source_tierlist_id,
+        source_game_id,
+        target_game_id,
+        status,
+        title_snapshot,
+        description_snapshot,
+        thumbnail_src_snapshot,
+        items_json,
+        created_at,
+        updated_at
+      )
+      VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?, ?, ?)
+    `,
+    [
+      id,
+      type,
+      requesterId,
+      sourceTierListId,
+      sourceGameId,
+      targetGameId,
+      title,
+      description,
+      thumbnailSrc,
+      serializeJson(items),
+      createdAt,
+      createdAt,
+    ]
+  )
+  return findTemplateRequestById(id)
+}
+
+async function findTemplateRequestById(id) {
+  const rows = await query(
+    `
+      SELECT
+        tr.id,
+        tr.request_type,
+        tr.requester_id,
+        tr.source_tierlist_id,
+        tr.source_game_id,
+        tr.target_game_id,
+        tr.status,
+        tr.title_snapshot,
+        tr.description_snapshot,
+        tr.thumbnail_src_snapshot,
+        tr.items_json,
+        tr.created_at,
+        tr.updated_at,
+        u.nickname,
+        u.email,
+        u.avatar_src AS requester_avatar_src,
+        sg.name AS source_game_name,
+        tg.name AS target_game_name
+      FROM template_requests tr
+      INNER JOIN users u ON u.id = tr.requester_id
+      LEFT JOIN games sg ON sg.id = tr.source_game_id
+      LEFT JOIN games tg ON tg.id = tr.target_game_id
+      WHERE tr.id = ?
+      LIMIT 1
+    `,
+    [id]
+  )
+
+  return mapTemplateRequestRow(rows[0])
+}
+
+async function listAdminTemplateRequests({ status = 'pending' } = {}) {
+  const rows = await query(
+    `
+      SELECT
+        tr.id,
+        tr.request_type,
+        tr.requester_id,
+        tr.source_tierlist_id,
+        tr.source_game_id,
+        tr.target_game_id,
+        tr.status,
+        tr.title_snapshot,
+        tr.description_snapshot,
+        tr.thumbnail_src_snapshot,
+        tr.items_json,
+        tr.created_at,
+        tr.updated_at,
+        u.nickname,
+        u.email,
+        u.avatar_src AS requester_avatar_src,
+        sg.name AS source_game_name,
+        tg.name AS target_game_name
+      FROM template_requests tr
+      INNER JOIN users u ON u.id = tr.requester_id
+      LEFT JOIN games sg ON sg.id = tr.source_game_id
+      LEFT JOIN games tg ON tg.id = tr.target_game_id
+      WHERE tr.status = ?
+      ORDER BY tr.created_at DESC
+    `,
+    [status]
+  )
+
+  return rows.map(mapTemplateRequestRow)
+}
+
+async function updateTemplateRequestStatus({ id, status }) {
+  await query('UPDATE template_requests SET status = ?, updated_at = ? WHERE id = ?', [status, now(), id])
+  return findTemplateRequestById(id)
+}
+
 async function deleteTierList(id) {
   await query('DELETE FROM tierlists WHERE id = ?', [id])
 }
@@ -992,6 +1202,7 @@ async function deleteCustomItems(ids) {
 
 async function saveTierList({ id, authorId, gameId, title, thumbnailSrc = '', description, isPublic, groups, pool }) {
   const existing = id ? await findTierListById(id, authorId) : null
+  await syncOwnedCustomItemLabels({ ownerId: authorId, items: pool })
 
   if (existing) {
     await query(
@@ -1064,4 +1275,8 @@ module.exports = {
   findCustomItemsByIds,
   deleteCustomItems,
   saveTierList,
+  createTemplateRequest,
+  findTemplateRequestById,
+  listAdminTemplateRequests,
+  updateTemplateRequestStatus,
 }

backend/src/routes/admin.js

@@ -24,6 +24,9 @@ const {
   listUsers,
   listAdminTierLists,
   findTierListById,
+  listAdminTemplateRequests,
+  findTemplateRequestById,
+  updateTemplateRequestStatus,
   adminUpdateUser,
   adminUpdateUserPassword,
   adminDeleteUser,
@@ -181,6 +184,11 @@ router.get('/tierlists', requireAdmin, async (req, res) => {
   res.json(result)
 })
 
+router.get('/template-requests', requireAdmin, async (req, res) => {
+  const requests = await listAdminTemplateRequests({ status: 'pending' })
+  res.json({ requests })
+})
+
 async function removeCustomItemFiles(items) {
   await Promise.all(
     items.map(async (item) => {
@@ -255,6 +263,24 @@ async function promoteTierListItemsToGame({ tierList, gameId, itemIds = [] }) {
   return createdItems
 }
 
+async function promoteSnapshotItemsToGame({ items, gameId }) {
+  const createdItems = []
+
+  for (const item of items || []) {
+    const copiedSrc = await copyUploadIntoGameAsset(item.src)
+    createdItems.push(
+      await createGameItem({
+        id: nanoid(),
+        gameId,
+        src: copiedSrc,
+        label: item.label,
+      })
+    )
+  }
+
+  return createdItems
+}
+
 async function createGameTemplateFromTierList({ tierList, gameId, gameName }) {
   await createGame({ id: gameId, name: gameName })
   if (tierList.thumbnailSrc) {
@@ -278,6 +304,22 @@ async function createGameTemplateFromTierList({ tierList, gameId, gameName }) {
   return { game: await findGameById(gameId), items: createdItems }
 }
 
+async function createGameTemplateFromRequest({ templateRequest, gameId, gameName }) {
+  await createGame({ id: gameId, name: gameName })
+
+  if (templateRequest.thumbnailSrc) {
+    const copiedThumb = await copyUploadIntoGameAsset(templateRequest.thumbnailSrc)
+    await updateGameThumbnail(gameId, copiedThumb)
+  }
+
+  const items = await promoteSnapshotItemsToGame({
+    items: templateRequest.items || [],
+    gameId,
+  })
+
+  return { game: await findGameById(gameId), items }
+}
+
 router.delete('/custom-items/:itemId', requireAdmin, async (req, res) => {
   const result = await listCustomItems({ page: 1, limit: 200, orphanOnly: false })
   const target = result.items.find((item) => item.id === req.params.itemId)
@@ -355,6 +397,52 @@ router.post('/tierlists/:tierListId/create-game-template', requireAdmin, async (
   res.json(result)
 })
 
+router.post('/template-requests/:requestId/approve', requireAdmin, async (req, res) => {
+  const templateRequest = await findTemplateRequestById(req.params.requestId)
+  if (!templateRequest) return res.status(404).json({ error: 'not_found' })
+  if (templateRequest.status !== 'pending') return res.status(409).json({ error: 'request_already_handled' })
+
+  if (templateRequest.type === 'update') {
+    const targetGameId = templateRequest.targetGameId || templateRequest.sourceGameId
+    const game = await findGameById(targetGameId)
+    if (!game) return res.status(404).json({ error: 'game_not_found' })
+
+    const items = await promoteSnapshotItemsToGame({
+      items: templateRequest.items || [],
+      gameId: game.id,
+    })
+    const request = await updateTemplateRequestStatus({ id: templateRequest.id, status: 'approved' })
+    return res.json({ request, items })
+  }
+
+  const schema = z.object({
+    gameId: z.string().trim().min(1).max(120),
+    name: z.string().trim().min(1).max(120),
+  })
+  const parsed = schema.safeParse(req.body)
+  if (!parsed.success) return res.status(400).json({ error: 'bad_request' })
+
+  const exists = await findGameById(parsed.data.gameId)
+  if (exists) return res.status(409).json({ error: 'game_id_taken' })
+
+  const result = await createGameTemplateFromRequest({
+    templateRequest,
+    gameId: parsed.data.gameId,
+    gameName: parsed.data.name,
+  })
+  const request = await updateTemplateRequestStatus({ id: templateRequest.id, status: 'approved' })
+  res.json({ request, ...result })
+})
+
+router.post('/template-requests/:requestId/reject', requireAdmin, async (req, res) => {
+  const templateRequest = await findTemplateRequestById(req.params.requestId)
+  if (!templateRequest) return res.status(404).json({ error: 'not_found' })
+  if (templateRequest.status !== 'pending') return res.status(409).json({ error: 'request_already_handled' })
+
+  const request = await updateTemplateRequestStatus({ id: templateRequest.id, status: 'rejected' })
+  res.json({ request })
+})
+
 router.delete('/custom-items', requireAdmin, async (req, res) => {
   const schema = z.object({
     q: z.string().trim().max(120).optional().default(''),

backend/src/routes/tierlists.js

@@ -11,6 +11,7 @@ const {
   deleteTierList,
   saveTierList,
   createCustomItem,
+  createTemplateRequest,
   findUserById,
   favoriteTierList,
   unfavoriteTierList,
@@ -18,6 +19,7 @@ const {
 const { requireAuth } = require('../middleware/auth')
 
 const router = express.Router()
+const FREEFORM_GAME_ID = 'freeform'
 
 function normalizePoolItem(item) {
   if (!item || item.origin !== 'game' || typeof item.src !== 'string') return item
@@ -42,6 +44,19 @@ function normalizeTierList(tierList) {
   }
 }
 
+function isTierListBoardEmpty(tierList) {
+  return !(tierList?.groups || []).some((group) => Array.isArray(group?.itemIds) && group.itemIds.length > 0)
+}
+
+function getCustomTemplateItems(tierList) {
+  const seen = new Set()
+  return (tierList?.pool || []).filter((item) => {
+    if (!item?.id || item.origin !== 'custom' || seen.has(item.id)) return false
+    seen.add(item.id)
+    return true
+  })
+}
+
 function buildUploadFilename(file) {
   const ext = path.extname(file.originalname || '').toLowerCase()
   const safeExt = ext && /^[.a-z0-9]+$/.test(ext) ? ext : ''
@@ -168,6 +183,49 @@ router.post('/thumbnail', requireAuth, thumbnailUpload.single('thumbnail'), asyn
   res.json({ thumbnailSrc: `/uploads/tierlists/${req.file.filename}` })
 })
 
+router.post('/:id/template-request', requireAuth, async (req, res) => {
+  const schema = z.object({
+    type: z.enum(['create', 'update']),
+  })
+  const parsed = schema.safeParse(req.body)
+  if (!parsed.success) return res.status(400).json({ error: 'bad_request' })
+
+  const tierList = await findTierListById(req.params.id, req.session.userId)
+  if (!tierList) return res.status(404).json({ error: 'not_found' })
+  if (tierList.authorId !== req.session.userId) return res.status(403).json({ error: 'forbidden' })
+
+  const customItems = getCustomTemplateItems(tierList)
+  if (!customItems.length) return res.status(400).json({ error: 'custom_items_required' })
+
+  if (parsed.data.type === 'create') {
+    if (tierList.gameId !== FREEFORM_GAME_ID) return res.status(400).json({ error: 'freeform_required' })
+    if (!isTierListBoardEmpty(tierList)) return res.status(400).json({ error: 'board_must_be_empty' })
+  } else {
+    if (tierList.gameId === FREEFORM_GAME_ID) return res.status(400).json({ error: 'game_template_required' })
+  }
+
+  try {
+    const request = await createTemplateRequest({
+      id: nanoid(),
+      type: parsed.data.type,
+      requesterId: req.session.userId,
+      sourceTierListId: tierList.id,
+      sourceGameId: tierList.gameId,
+      targetGameId: parsed.data.type === 'update' ? tierList.gameId : '',
+      title: tierList.title,
+      description: tierList.description || '',
+      thumbnailSrc: tierList.thumbnailSrc || '',
+      items: customItems,
+    })
+    return res.json({ request })
+  } catch (e) {
+    if (e?.code === 'TEMPLATE_REQUEST_EXISTS') {
+      return res.status(409).json({ error: 'template_request_exists' })
+    }
+    throw e
+  }
+})
+
 router.post('/', requireAuth, async (req, res) => {
   const parsed = tierListUpsertSchema.safeParse(req.body)
   if (!parsed.success) return res.status(400).json({ error: 'bad_request' })