릴리스: v1.3.11 회원 관리 모달과 최고 관리자 보호

backend/src/routes/auth.js

@@ -9,6 +9,7 @@ const {
   findUserById,
   createUser,
   updateUserProfile,
+  findPrimaryAdminUser,
 } = require('../db')
 const { requireAuth } = require('../middleware/auth')
 const { createMemoryUpload, writeOptimizedImage } = require('../lib/image-storage')
@@ -25,6 +26,24 @@ const profileSchema = z.object({
   removeAvatar: z.union([z.string(), z.undefined()]).optional(),
 })
 
+async function serializeUser(user) {
+  if (!user) return null
+  const primaryAdmin = await findPrimaryAdminUser()
+  const isPrimaryAdmin = !!user.isAdmin && primaryAdmin?.id === user.id
+
+  return {
+    id: user.id,
+    email: user.email,
+    nickname: user.nickname || '',
+    isAdmin: !!user.isAdmin,
+    isPrimaryAdmin,
+    isOperator: !!user.isAdmin && !isPrimaryAdmin,
+    role: isPrimaryAdmin ? 'owner' : user.isAdmin ? 'operator' : 'user',
+    avatarSrc: user.avatarSrc || '',
+    createdAt: user.createdAt,
+  }
+}
+
 router.post('/signup', async (req, res) => {
   const parsed = signupSchema.safeParse(req.body)
   if (!parsed.success) return res.status(400).json({ error: 'bad_request' })
@@ -39,9 +58,9 @@ router.post('/signup', async (req, res) => {
 
   req.session.userId = user.id
   req.session.isAdmin = !!user.isAdmin
-  req.session.save((err) => {
+  req.session.save(async (err) => {
     if (err) return res.status(500).json({ error: 'session_save_failed' })
-    res.json(user)
+    res.json(await serializeUser(user))
   })
 })
 
@@ -58,16 +77,9 @@ router.post('/login', async (req, res) => {
 
   req.session.userId = user.id
   req.session.isAdmin = !!user.isAdmin
-  req.session.save((err) => {
+  req.session.save(async (err) => {
     if (err) return res.status(500).json({ error: 'session_save_failed' })
-    res.json({
-      id: user.id,
-      email: user.email,
-      nickname: user.nickname || '',
-      isAdmin: !!user.isAdmin,
-      avatarSrc: user.avatarSrc || '',
-      createdAt: user.createdAt,
-    })
+    res.json(await serializeUser(user))
   })
 })
 
@@ -80,7 +92,7 @@ router.get('/me', async (req, res) => {
   if (!req.session || !req.session.userId) return res.json({ user: null })
   const user = await findUserById(req.session.userId)
   if (!user) return res.json({ user: null })
-  res.json({ user })
+  res.json({ user: await serializeUser(user) })
 })
 
 router.get('/meta', async (req, res) => {
@@ -115,7 +127,7 @@ router.post('/profile', requireAuth, upload.single('avatar'), async (req, res) =
     avatarSrc: nextAvatarSrc,
   })
 
-  res.json({ user: updated })
+  res.json({ user: await serializeUser(updated) })
 })
 
 module.exports = router