dca1b90faa
- DB: audit_log 테이블(diff 포함) + subscriptions.admin_note + super_admin role - Edge Functions 4개: admin-users, admin-subscriptions, admin-payments, admin-audit-log - 공유 유틸: admin-auth.ts(권한 검증), audit.ts(감사로그 기록) - Swagger UI: 독립 정적 페이지 + OpenAPI 3.0 spec - CRUD 페이지: 구독 생성/수정/삭제, role 변경, 감사로그 목록/상세 - recharts: feature별 StackedBar + DAU Line + Top Users HorizontalBar - 결제 이력: DB + Payple API 병행 조회 - 권한: super_admin만 위험 작업, admin은 조회 전용 - RLS: admin/super_admin IN 정책 + super_admin 쓰기 정책 - SQL RPC: admin_usage_by_feature, admin_top_users, admin_dau
45 lines
1.6 KiB
TypeScript
45 lines
1.6 KiB
TypeScript
// server/supabase/functions/_shared/admin-auth.ts
|
|
// Admin/Super-admin 권한 검증 — requireUser 확장
|
|
|
|
// @ts-expect-error — Deno 런타임 import
|
|
import type { User } from 'https://esm.sh/@supabase/supabase-js@2.39.7'
|
|
import { requireUser, type AuthError } from './auth.ts'
|
|
|
|
export type AdminRole = 'admin' | 'super_admin'
|
|
|
|
/**
|
|
* admin 이상 권한 필요 (admin, super_admin).
|
|
* 실패 시 AuthError throw.
|
|
*/
|
|
export async function requireAdmin(req: Request): Promise<User> {
|
|
const user = await requireUser(req)
|
|
const role = (user.app_metadata as Record<string, unknown>)?.role as string | undefined
|
|
if (role !== 'admin' && role !== 'super_admin') {
|
|
// eslint-disable-next-line @typescript-eslint/no-throw-literal
|
|
throw { status: 403, message: 'Admin access required' } as AuthError
|
|
}
|
|
return user
|
|
}
|
|
|
|
/**
|
|
* super_admin 전용 권한 필요.
|
|
* 실패 시 AuthError throw.
|
|
*/
|
|
export async function requireSuperAdmin(req: Request): Promise<User> {
|
|
const user = await requireUser(req)
|
|
const role = (user.app_metadata as Record<string, unknown>)?.role as string | undefined
|
|
if (role !== 'super_admin') {
|
|
// eslint-disable-next-line @typescript-eslint/no-throw-literal
|
|
throw { status: 403, message: 'Super admin access required' } as AuthError
|
|
}
|
|
return user
|
|
}
|
|
|
|
/**
|
|
* 현재 유저의 admin role 반환. admin이 아니면 null.
|
|
*/
|
|
export function getAdminRole(user: User): AdminRole | null {
|
|
const role = (user.app_metadata as Record<string, unknown>)?.role as string | undefined
|
|
if (role === 'admin' || role === 'super_admin') return role
|
|
return null
|
|
}
|