Dev -> Main 배포 (2026-10-06)

.github/workflows/api-cd.yml

@@ -42,6 +42,9 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@v7
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -56,6 +59,7 @@ jobs:
         with:
           context: services/api/app
           target: prod
+          platforms: linux/arm64
           push: true
           pull: true
           tags: |

.github/workflows/batch-cd.yml

@@ -42,6 +42,9 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@v7
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -56,6 +59,7 @@ jobs:
         with:
           context: services/api/batch
           target: prod
+          platforms: linux/arm64
           push: true
           pull: true
           tags: |

.gitignore

@@ -41,4 +41,6 @@ lerna-debug.log*
 .cursor/settings.json
 
 # pnpm store
-.pnpm-store/
+.pnpm-store/
+
+.superpowers/

admin/.env.example

@@ -1,2 +1,2 @@
-# /api 요청을 넘길 API 서버 주소. 운영 서버: https://api.connectgnu.kro.kr
+# /api 요청을 넘길 API 서버 주소. 운영 서버: https://admin.connectgnu.kro.kr
 VITE_API_TARGET=http://localhost:3000

admin/README.md

@@ -7,12 +7,23 @@
 ```bash
 cd admin
 pnpm install
-cp .env.example .env.local   # 운영 서버에 붙이려면 VITE_API_TARGET=https://api.connectgnu.kro.kr
+cp .env.example .env.local   # 운영 서버에 붙이려면 VITE_API_TARGET=https://admin.connectgnu.kro.kr
 pnpm dev                      # http://localhost:5173
 ```
 
-로그인 화면에 API 서버의 `ADMIN_API_KEY` 값을 넣어요. 키는 브라우저 탭의 sessionStorage에만 남고, 탭을 닫으면 사라져요.
-API 서버에 `ADMIN_API_KEY`가 설정돼 있지 않으면 모든 admin 요청이 403이라 로그인할 수 없어요.
+로그인 화면에 운영자 계정의 이메일과 비밀번호를 넣어요. 서버가 DB에 세션을 만들고 HttpOnly 쿠키로 돌려줘요(24시간, 쓰는 동안 연장). 연속 5번 틀리면 15분 동안 잠겨요.
+계정은 API 서버에서 시드 스크립트로 만들어요. 비밀번호를 명령줄에 적지 않도록 먼저 입력받아 환경변수로 올려요.
+
+```bash
+# 운영 (서버에서)
+read -s ADMIN_SEED_PASSWORD; export ADMIN_SEED_PASSWORD
+docker compose exec -e ADMIN_SEED_EMAIL=admin@example.com -e ADMIN_SEED_PASSWORD app node dist/scripts/seed-admin.js
+
+# 로컬 (services/api/app에서 pnpm build 뒤에)
+# 스크립트는 .env를 읽지 않으므로 DB_HOST, DB_PORT, DB_USERNAME, DB_PASSWORD, DB_DATABASE도 설정돼 있어야 해요.
+read -s ADMIN_SEED_PASSWORD; export ADMIN_SEED_PASSWORD
+ADMIN_SEED_EMAIL=admin@example.com node --env-file=.env dist/scripts/seed-admin.js
+```
 
 ## 화면
 

admin/src/api/adminClient.test.ts

@@ -1,9 +1,12 @@
 import { jsonResponse, mockFetch, ok } from '../test/http';
 import { makeRun } from '../test/fixtures';
 import {
+  getMe,
   getScrapeRun,
   getScraperStatuses,
   listScrapeRuns,
+  login,
+  logout,
   requestScrapeRun,
 } from './adminClient';
 import {
@@ -15,28 +18,29 @@ import {
 } from './errors';
 
 describe('adminClient', () => {
-  it('키 헤더를 붙여 /api/admin/scrapers를 부르고 data를 꺼낸다', async () => {
+  it('쿠키를 함께 보내 /api/admin/scrapers를 부르고 data를 꺼낸다', async () => {
     const fetchMock = mockFetch().mockResolvedValue(ok([]));
 
-    await expect(getScraperStatuses('secret')).resolves.toEqual([]);
+    await expect(getScraperStatuses()).resolves.toEqual([]);
 
     const [url, init] = fetchMock.mock.calls[0];
     expect(url).toBe('/api/admin/scrapers');
-    expect(init.headers['x-admin-api-key']).toBe('secret');
+    expect(init.credentials).toBe('same-origin');
+    expect(init.headers['x-admin-api-key']).toBeUndefined();
   });
 
   it('목록 조회는 값이 있는 파라미터만 쿼리로 보낸다', async () => {
     const fetchMock = mockFetch().mockResolvedValue(ok({ items: [], nextCursor: null }));
 
-    await listScrapeRuns('k', { type: 'cafeteria', status: undefined, cursor: 40, limit: 20 });
+    await listScrapeRuns({ type: 'cafeteria', status: undefined, cursor: 40, limit: 20 });
 
     expect(fetchMock.mock.calls[0][0]).toBe('/api/admin/scrape-runs?type=cafeteria&cursor=40&limit=20');
   });
 
   it('파라미터가 없으면 쿼리 문자열을 붙이지 않는다', async () => {
     const fetchMock = mockFetch().mockResolvedValue(ok({ items: [], nextCursor: null }));
 
-    await listScrapeRuns('k');
+    await listScrapeRuns();
 
     expect(fetchMock.mock.calls[0][0]).toBe('/api/admin/scrape-runs');
   });
@@ -45,15 +49,15 @@ describe('adminClient', () => {
     const run = makeRun({ id: 7 });
     const fetchMock = mockFetch().mockResolvedValue(ok(run));
 
-    await expect(getScrapeRun('k', 7)).resolves.toEqual(run);
+    await expect(getScrapeRun(7)).resolves.toEqual(run);
     expect(fetchMock.mock.calls[0][0]).toBe('/api/admin/scrape-runs/7');
   });
 
   it('수동 실행은 JSON 본문으로 POST 하고 등록된 run 목록을 돌려준다', async () => {
     const run = makeRun({ status: 'pending', trigger: 'manual' });
     const fetchMock = mockFetch().mockResolvedValue(ok({ runs: [run] }, 202));
 
-    await expect(requestScrapeRun('k', 'shuttle')).resolves.toEqual([run]);
+    await expect(requestScrapeRun('shuttle')).resolves.toEqual([run]);
 
     const [url, init] = fetchMock.mock.calls[0];
     expect(url).toBe('/api/admin/scrape-runs');
@@ -65,23 +69,23 @@ describe('adminClient', () => {
   it('대상을 지정한 수동 실행은 target도 본문에 담는다', async () => {
     const fetchMock = mockFetch().mockResolvedValue(ok({ runs: [] }, 202));
 
-    await requestScrapeRun('k', 'cafeteria', '3');
+    await requestScrapeRun('cafeteria', '3');
 
     expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ type: 'cafeteria', target: '3' });
   });
 
   it('목록 조회는 target도 쿼리로 보낸다', async () => {
     const fetchMock = mockFetch().mockResolvedValue(ok({ items: [], nextCursor: null }));
 
-    await listScrapeRuns('k', { type: 'cafeteria', target: '3' });
+    await listScrapeRuns({ type: 'cafeteria', target: '3' });
 
     expect(fetchMock.mock.calls[0][0]).toBe('/api/admin/scrape-runs?type=cafeteria&target=3');
   });
 
   it.each([401, 403])('%i 응답은 UnauthorizedError', async status => {
     mockFetch().mockResolvedValue(jsonResponse(status, { statusCode: status, message: 'Forbidden resource' }));
 
-    const error = await getScraperStatuses('bad').catch(e => e);
+    const error = await getScraperStatuses().catch(e => e);
 
     expect(error).toBeInstanceOf(UnauthorizedError);
     expect(error.status).toBe(status);
@@ -92,7 +96,7 @@ describe('adminClient', () => {
       jsonResponse(409, { statusCode: 409, message: "'shuttle' 수집이 이미 대기 또는 실행 중입니다." }),
     );
 
-    const error = await requestScrapeRun('k', 'shuttle').catch(e => e);
+    const error = await requestScrapeRun('shuttle').catch(e => e);
 
     expect(error).toBeInstanceOf(ConflictError);
     expect(error.message).toBe("'shuttle' 수집이 이미 대기 또는 실행 중입니다.");
@@ -103,7 +107,7 @@ describe('adminClient', () => {
       jsonResponse(400, { statusCode: 400, message: ['type must be one of', 'limit must not be greater than 100'] }),
     );
 
-    const error = await listScrapeRuns('k').catch(e => e);
+    const error = await listScrapeRuns().catch(e => e);
 
     expect(error).toBeInstanceOf(ApiError);
     expect(error.message).toBe('type must be one of, limit must not be greater than 100');
@@ -112,7 +116,7 @@ describe('adminClient', () => {
   it('JSON이 아닌 5xx(프록시 오류 등)는 HTTP 상태를 담은 ApiError', async () => {
     mockFetch().mockResolvedValue(new Response('Bad Gateway', { status: 502 }));
 
-    const error = await getScraperStatuses('k').catch(e => e);
+    const error = await getScraperStatuses().catch(e => e);
 
     expect(error).toBeInstanceOf(ApiError);
     expect(error).not.toBeInstanceOf(UnauthorizedError);
@@ -123,7 +127,7 @@ describe('adminClient', () => {
   it('fetch 자체가 실패하면 NetworkError', async () => {
     mockFetch().mockRejectedValue(new TypeError('Failed to fetch'));
 
-    await expect(getScraperStatuses('k')).rejects.toBeInstanceOf(NetworkError);
+    await expect(getScraperStatuses()).rejects.toBeInstanceOf(NetworkError);
   });
 });
 
@@ -139,4 +143,40 @@ describe('errorText', () => {
       '알 수 없는 문제가 생겼어요. 잠시 뒤 다시 시도해 주세요.',
     );
   });
+
+  it('로그인은 이메일과 비밀번호를 JSON으로 POST 하고 사용자를 돌려준다', async () => {
+    const fetchMock = mockFetch().mockResolvedValue(ok({ email: 'admin@example.com' }));
+
+    await expect(login('admin@example.com', 'pw-123456')).resolves.toEqual({ email: 'admin@example.com' });
+
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(url).toBe('/api/admin/auth/login');
+    expect(init.method).toBe('POST');
+    expect(JSON.parse(init.body)).toEqual({ email: 'admin@example.com', password: 'pw-123456' });
+  });
+
+  it('로그인 상태 확인과 로그아웃 경로', async () => {
+    const fetchMock = mockFetch()
+      .mockResolvedValueOnce(ok({ email: 'admin@example.com' }))
+      .mockResolvedValueOnce(ok(null));
+
+    await getMe();
+    await logout();
+
+    expect(fetchMock.mock.calls[0][0]).toBe('/api/admin/auth/me');
+    expect(fetchMock.mock.calls[1][0]).toBe('/api/admin/auth/logout');
+    expect(fetchMock.mock.calls[1][1].method).toBe('POST');
+  });
+
+  it('잠긴 계정(429)은 서버 문구를 담은 ApiError로 던진다', async () => {
+    mockFetch().mockResolvedValue(
+      jsonResponse(429, { statusCode: 429, message: '로그인 시도가 너무 많아요. 15분 뒤에 다시 시도해 주세요.' }),
+    );
+
+    const error = await login('admin@example.com', 'pw-123456').catch(e => e);
+
+    expect(error).toBeInstanceOf(ApiError);
+    expect(error).not.toBeInstanceOf(UnauthorizedError);
+    expect(error.message).toBe('로그인 시도가 너무 많아요. 15분 뒤에 다시 시도해 주세요.');
+  });
 });

admin/src/api/adminClient.ts

@@ -1,5 +1,6 @@
 import { ApiError, ConflictError, NetworkError, UnauthorizedError } from './errors';
 import type {
+  AdminUser,
   ListScrapeRunsParams,
   ScrapeRun,
   ScrapeRunPage,
@@ -8,51 +9,53 @@ import type {
 } from './types';
 
 const BASE_PATH = '/api/admin';
-const ADMIN_API_KEY_HEADER = 'x-admin-api-key';
 
-export function getScraperStatuses(apiKey: string): Promise<ScraperStatus[]> {
-  return request(apiKey, '/scrapers');
+export function getMe(): Promise<AdminUser> {
+  return request('/auth/me');
 }
 
-export function listScrapeRuns(
-  apiKey: string,
-  params: ListScrapeRunsParams = {},
-): Promise<ScrapeRunPage> {
+export function login(email: string, password: string): Promise<AdminUser> {
+  return request('/auth/login', { method: 'POST', body: JSON.stringify({ email, password }) });
+}
+
+export function logout(): Promise<null> {
+  return request('/auth/logout', { method: 'POST' });
+}
+
+export function getScraperStatuses(): Promise<ScraperStatus[]> {
+  return request('/scrapers');
+}
+
+export function listScrapeRuns(params: ListScrapeRunsParams = {}): Promise<ScrapeRunPage> {
   const query = new URLSearchParams();
   for (const [key, value] of Object.entries(params)) {
     if (value !== undefined) query.set(key, String(value));
   }
   const qs = query.toString();
-  return request(apiKey, `/scrape-runs${qs ? `?${qs}` : ''}`);
+  return request(`/scrape-runs${qs ? `?${qs}` : ''}`);
 }
 
-export function getScrapeRun(apiKey: string, id: number): Promise<ScrapeRun> {
-  return request(apiKey, `/scrape-runs/${id}`);
+export function getScrapeRun(id: number): Promise<ScrapeRun> {
+  return request(`/scrape-runs/${id}`);
 }
 
-export async function requestScrapeRun(
-  apiKey: string,
-  type: ScrapeRunType,
-  target?: string,
-): Promise<ScrapeRun[]> {
+export async function requestScrapeRun(type: ScrapeRunType, target?: string): Promise<ScrapeRun[]> {
   const body = target === undefined ? { type } : { type, target };
-  const data = await request<{ runs: ScrapeRun[] }>(apiKey, '/scrape-runs', {
+  const data = await request<{ runs: ScrapeRun[] }>('/scrape-runs', {
     method: 'POST',
     body: JSON.stringify(body),
   });
   return data.runs;
 }
 
-async function request<T>(apiKey: string, path: string, init: RequestInit = {}): Promise<T> {
-  const headers: Record<string, string> = {
-    Accept: 'application/json',
-    [ADMIN_API_KEY_HEADER]: apiKey,
-  };
+async function request<T>(path: string, init: RequestInit = {}): Promise<T> {
+  const headers: Record<string, string> = { Accept: 'application/json' };
   if (init.body) headers['Content-Type'] = 'application/json';
 
   let response: Response;
   try {
-    response = await fetch(`${BASE_PATH}${path}`, { ...init, headers });
+    // 세션 쿠키는 브라우저가 같은 출처 요청에 알아서 붙인다
+    response = await fetch(`${BASE_PATH}${path}`, { ...init, headers, credentials: 'same-origin' });
   } catch {
     throw new NetworkError();
   }

admin/src/api/errors.ts

@@ -8,7 +8,7 @@ export class ApiError extends Error {
   }
 }
 
-/** 401/403. 키가 없거나 틀림 */
+/** 401/403. 로그인하지 않았거나 세션이 만료됨 */
 export class UnauthorizedError extends ApiError {
   constructor(status: number, message: string) {
     super(status, message);

admin/src/api/types.ts

@@ -11,13 +11,21 @@ export type ScrapeRunStatus = (typeof SCRAPE_RUN_STATUSES)[number];
 
 export type ScrapeRunTrigger = 'cron' | 'manual';
 
+/** 수집 대상을 설명하는 항목 하나(예: 캠퍼스 → 가좌캠퍼스) */
+export interface ScrapeTargetMeta {
+  label: string;
+  value: string;
+}
+
 export interface ScrapeRun {
   id: number;
   type: ScrapeRunType;
   /** 수집 대상 id(식당, 공지 카테고리). 대상 없는 타입은 null */
   target: string | null;
-  /** 수집 대상 이름 */
+  /** 수집 대상 대표 이름(targetMeta의 마지막 값) */
   targetName: string | null;
+  /** 수집 대상 메타데이터. 일반 → 구체 순서. 대상이 없거나 찾지 못하면 빈 배열 */
+  targetMeta: ScrapeTargetMeta[];
   trigger: ScrapeRunTrigger;
   status: ScrapeRunStatus;
   errorMessage: string | null;
@@ -53,3 +61,7 @@ export interface ListScrapeRunsParams {
   cursor?: number;
   limit?: number;
 }
+
+export interface AdminUser {
+  email: string;
+}