@withwiz/gallery 0.1.0 → 0.2.0

package/README.ko.md

@@ -97,6 +97,17 @@ export const galleryConfig: GalleryConfig = {
   },
   revalidate: revalidatePath,
   revalidatePaths: ["/", "/home/v1"],
+  // 선택 — 생략하면 apiWrapper 를 통과한 사용자 전원에게 모든 권한 부여
+  permissions: {
+    canEdit: (ctx, g) => ctx.user?.role === "owner" || g.authorId === ctx.user?.id,
+    canDelete: (ctx, g) => ctx.user?.role === "owner" || g.authorId === ctx.user?.id,
+    canManageCategories: (ctx) => ctx.user?.role === "owner",
+  },
+  // 선택 — 생략하면 안전한 기본값 적용 ("보안 참고" 절 참조)
+  validation: {
+    imageUrlHosts: ["cdn.example.com"],
+    imageKeyPattern: /^gallery\/[A-Za-z0-9._-]+$/,
+  },
   storage: {
     isEnabled: isR2Enabled,
     collectKeys: collectR2Keys,
@@ -386,6 +397,15 @@ function PublicGalleryMosaic(props: {
 - **Storage / auth / revalidate 는 호스트 책임** — 본 패키지는 키/경로만 다루고 실제 R2/S3/로컬 호출은 호스트의 `config.storage.deleteKeys` 등에 위임.
 - **`presets/ballet` 에서 `next/image`, `next/navigation`, `useI18n` 직접 의존 없음** — 이미지는 plain `<img>`, 라벨은 props.
 
+## 보안 참고
+
+- **인증은 전적으로 호스트의 `apiWrapper` 책임이다.** 비공개 항목까지 반환하는 목록 GET 을 포함해 모든 admin 라우트는 래퍼가 통과시킨 요청을 그대로 신뢰한다. 래퍼는 관리자 세션을 검증해야 하며, admin 컴포넌트가 쿠키를 함께 전송하므로(`credentials: "include"`) CSRF 방어도 갖춰야 한다.
+- **`permissions` 훅은 bulk 라우트에도 적용된다.** `canDelete` 는 collection `DELETE`(ids) 를, `canEdit` 는 `bulk PATCH` 를 검사한다. 대상 전원이 통과해야 하며 하나라도 거부되면 요청 전체가 403 으로 거부된다(부분 성공 없음). `canManageCategories` 는 카테고리 생성 / 수정 / 삭제를 검사한다.
+- **`imageUrl` 은 기본적으로 `https:` / `http:` 프로토콜만 허용한다** (`javascript:`, `data:` 거부). `validation.imageUrlProtocols` / `validation.imageUrlHosts` 로 더 좁힐 수 있다.
+- **`imageKey` 는 `storage.deleteKeys` 에 전달되기 전에 형식 검증을 거친다.** 기본 패턴은 `[A-Za-z0-9._-/]` 만 허용하고 선행 슬래시, `//`, `..` 세그먼트를 금지하며 512자로 제한한다. 버킷 접두사를 강제하려면 `validation.imageKeyPattern` 을 지정한다. `storage.collectKeys` 도 키를 신뢰하지 않는 방향으로 구현해야 한다.
+- **`search` 는 DB 조회 전에 `validation.searchMaxLength`(기본 100) 로 잘린다.**
+- **peer 의존성 `next` 는 패치된 릴리스를 유지한다.** 본 패키지는 버전을 고정하지 않으므로 호스트에서 `npm audit` 을 수행해야 한다.
+
 ## CSS 커스터마이즈
 
 호스트의 root CSS 에서 CSS variable 을 override.
@@ -455,7 +475,6 @@ node-packages/withwiz-gallery/
 │   ├── gallery.schema.prisma            # GalleryCategory + Gallery 모델 partial
 │   └── migrations/
 │       └── 2026-05-24-enum-to-table.sql # ballet enum → table backfill
-├── docs/superpowers/{specs,plans}/      # 설계 문서 + sprint contracts/reports
 └── src/
     ├── index.ts              # main entry — config, types, errors, utils
     ├── config.ts

package/README.md

@@ -102,6 +102,17 @@ export const galleryConfig: GalleryConfig = {
     collectKeys: collectR2Keys,
     deleteKeys: deleteR2Keys,
   },
+  // optional — omit to allow every apiWrapper-authenticated user everything
+  permissions: {
+    canEdit: (ctx, g) => ctx.user?.role === "owner" || g.authorId === ctx.user?.id,
+    canDelete: (ctx, g) => ctx.user?.role === "owner" || g.authorId === ctx.user?.id,
+    canManageCategories: (ctx) => ctx.user?.role === "owner",
+  },
+  // optional — safe defaults apply when omitted (see "Security notes")
+  validation: {
+    imageUrlHosts: ["cdn.example.com"],
+    imageKeyPattern: /^gallery\/[A-Za-z0-9._-]+$/,
+  },
   i18n: {
     "admin.title": "Gallery",
     "admin.newButton": "New image",
@@ -386,6 +397,15 @@ function PublicGalleryMosaic(props: {
 - **Storage / auth / revalidate are the host's responsibility** — this package only deals with keys/paths; actual R2/S3/local calls are delegated to the host via `config.storage.deleteKeys`, etc.
 - **`presets/ballet` does not import `next/image`, `next/navigation`, or `useI18n`** — images use plain `<img>`, labels come from props.
 
+## Security notes
+
+- **Authentication is entirely the host's `apiWrapper`.** Every admin route (including the list GET that returns unpublished items) trusts whatever the wrapper lets through. The wrapper must enforce an admin session and, because the admin components send cookies (`credentials: "include"`), CSRF protection.
+- **`permissions` hooks apply to bulk routes too.** `canDelete` gates the collection `DELETE` (ids) and `canEdit` gates `bulk PATCH`; every target must pass or the whole request is rejected with 403 (no partial success). `canManageCategories` gates category create / update / delete.
+- **`imageUrl` is protocol-restricted** to `https:` / `http:` by default (`javascript:` and `data:` are rejected). Set `validation.imageUrlProtocols` / `validation.imageUrlHosts` to tighten further.
+- **`imageKey` is validated before it reaches `storage.deleteKeys`.** The default pattern allows `[A-Za-z0-9._-/]`, forbids a leading slash, `//` and `..` segments, and caps at 512 chars. Pass `validation.imageKeyPattern` to enforce your bucket prefix; `storage.collectKeys` should still treat the key as untrusted.
+- **`search` is truncated** to `validation.searchMaxLength` (default 100) before hitting the database.
+- **Keep the peer `next` on a patched release.** The package pins nothing; run `npm audit` in the host.
+
 ## CSS customization
 
 Override the CSS variables from the host's root CSS.
@@ -455,7 +475,6 @@ node-packages/withwiz-gallery/
 │   ├── gallery.schema.prisma            # GalleryCategory + Gallery partial models
 │   └── migrations/
 │       └── 2026-05-24-enum-to-table.sql # ballet enum → table backfill
-├── docs/superpowers/{specs,plans}/      # design docs + sprint contracts/reports
 └── src/
     ├── index.ts              # main entry — config, types, errors, utils
     ├── config.ts

package/dist/chunk-IEXSUEDO.mjs

@@ -0,0 +1,78 @@
+// src/validators/index.ts
+import { z } from "zod";
+var DEFAULT_IMAGE_URL_PROTOCOLS = ["https:", "http:"];
+var DEFAULT_IMAGE_KEY_MAX_LENGTH = 512;
+var DEFAULT_IMAGE_KEY_PATTERN = /^(?!.*(?:^|\/)\.\.(?:\/|$))(?!.*\/\/)[A-Za-z0-9][A-Za-z0-9._\-/]*$/;
+function buildImageUrlSchema(opts) {
+  const protocols = new Set(
+    (opts.imageUrlProtocols ?? DEFAULT_IMAGE_URL_PROTOCOLS).map(
+      (p) => p.endsWith(":") ? p.toLowerCase() : `${p.toLowerCase()}:`
+    )
+  );
+  const hosts = opts.imageUrlHosts ? new Set(opts.imageUrlHosts.map((h) => h.toLowerCase())) : null;
+  return z.string().max(2048).url().refine(
+    (value) => {
+      let parsed;
+      try {
+        parsed = new URL(value);
+      } catch {
+        return false;
+      }
+      if (!protocols.has(parsed.protocol)) return false;
+      if (hosts && !hosts.has(parsed.hostname.toLowerCase())) return false;
+      return true;
+    },
+    { message: "imageUrl \uC758 \uD504\uB85C\uD1A0\uCF5C \uB610\uB294 \uD638\uC2A4\uD2B8\uAC00 \uD5C8\uC6A9 \uBAA9\uB85D\uC5D0 \uC5C6\uC2B5\uB2C8\uB2E4" }
+  );
+}
+function createGallerySchemas(opts) {
+  const imageKeyPattern = opts.imageKeyPattern ?? DEFAULT_IMAGE_KEY_PATTERN;
+  const ImageUrlSchema = buildImageUrlSchema(opts);
+  const ImageKeySchema = z.string().min(1).max(DEFAULT_IMAGE_KEY_MAX_LENGTH).regex(imageKeyPattern, "imageKey \uD615\uC2DD\uC774 \uC62C\uBC14\uB974\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4");
+  const CreateGallerySchema = z.object({
+    imageUrl: ImageUrlSchema,
+    imageKey: ImageKeySchema.optional(),
+    caption: z.string().max(opts.captionMaxLength).optional(),
+    categoryId: z.string().cuid(),
+    sortOrder: z.number().int().nonnegative().default(0),
+    featured: z.boolean().default(false),
+    published: z.boolean().default(false)
+  });
+  const UpdateGallerySchema = CreateGallerySchema.partial();
+  const BatchCreateGallerySchema = z.object({
+    items: z.array(CreateGallerySchema).min(1).max(opts.batchMax)
+  });
+  const BulkUpdateSchema = z.object({
+    ids: z.array(z.string().cuid()).min(1).max(opts.batchMax),
+    published: z.boolean().optional(),
+    featured: z.boolean().optional()
+  });
+  const CreateCategorySchema = z.object({
+    slug: z.string().min(1).max(64).regex(/^[A-Z][A-Z0-9_]*$/, "slug \uB294 \uB300\uBB38\uC790/\uC22B\uC790/\uC5B8\uB354\uC2A4\uCF54\uC5B4\uB9CC"),
+    labelKo: z.string().min(1).max(64),
+    labelEn: z.string().min(1).max(64).optional(),
+    sortOrder: z.number().int().nonnegative().default(0),
+    isActive: z.boolean().default(true)
+  });
+  const UpdateCategorySchema = CreateCategorySchema.partial();
+  const ReorderCategorySchema = z.object({
+    ids: z.array(z.string().cuid()).min(1)
+  });
+  return {
+    CreateGallerySchema,
+    UpdateGallerySchema,
+    BatchCreateGallerySchema,
+    BulkUpdateSchema,
+    CreateCategorySchema,
+    UpdateCategorySchema,
+    ReorderCategorySchema
+  };
+}
+
+export {
+  DEFAULT_IMAGE_URL_PROTOCOLS,
+  DEFAULT_IMAGE_KEY_MAX_LENGTH,
+  DEFAULT_IMAGE_KEY_PATTERN,
+  createGallerySchemas
+};
+//# sourceMappingURL=chunk-IEXSUEDO.mjs.map

package/dist/chunk-IEXSUEDO.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/validators/index.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/**\n * spec §9-1 충실 구현.\n *\n * 호스트가 `config.limits.batchMax` 와 `config.limits.captionMaxLength` 를 넘겨\n * 패키지 내부 스키마를 생성한다. categoryId 는 cuid 형식만 검증하고,\n * 실제 카테고리 존재 여부는 service 레이어가 Prisma FK 제약으로 자연스럽게 잡는다.\n *\n * 보안 강화 (security hardening):\n *   - imageUrl: 프로토콜 allowlist (기본 https/http) — javascript:/data: 스킴 차단.\n *     `imageUrlHosts` 지정 시 호스트 allowlist 도 적용.\n *   - imageKey: 저장소 삭제 (`config.storage.deleteKeys`) 에 그대로 전달되므로\n *     경로 순회 (`..`), 선행 슬래시, 공백/제어문자를 차단하는 형식 검증을 기본 적용.\n */\n\nexport const DEFAULT_IMAGE_URL_PROTOCOLS = [\"https:\", \"http:\"] as const;\nexport const DEFAULT_IMAGE_KEY_MAX_LENGTH = 512;\n\n/** 영숫자로 시작, 영숫자/`.`/`_`/`-`/`/` 만 허용. `..` 세그먼트 및 `//` 금지. */\nexport const DEFAULT_IMAGE_KEY_PATTERN =\n  /^(?!.*(?:^|\\/)\\.\\.(?:\\/|$))(?!.*\\/\\/)[A-Za-z0-9][A-Za-z0-9._\\-/]*$/;\n\nexport interface CreateGallerySchemasOptions {\n  batchMax: number;\n  captionMaxLength: number;\n  imageUrlProtocols?: readonly string[];\n  imageUrlHosts?: readonly string[];\n  imageKeyPattern?: RegExp;\n}\n\nfunction buildImageUrlSchema(opts: CreateGallerySchemasOptions) {\n  const protocols = new Set(\n    (opts.imageUrlProtocols ?? DEFAULT_IMAGE_URL_PROTOCOLS).map((p) =>\n      p.endsWith(\":\") ? p.toLowerCase() : `${p.toLowerCase()}:`,\n    ),\n  );\n  const hosts = opts.imageUrlHosts\n    ? new Set(opts.imageUrlHosts.map((h) => h.toLowerCase()))\n    : null;\n\n  return z\n    .string()\n    .max(2048)\n    .url()\n    .refine(\n      (value) => {\n        let parsed: URL;\n        try {\n          parsed = new URL(value);\n        } catch {\n          return false;\n        }\n        if (!protocols.has(parsed.protocol)) return false;\n        if (hosts && !hosts.has(parsed.hostname.toLowerCase())) return false;\n        return true;\n      },\n      { message: \"imageUrl 의 프로토콜 또는 호스트가 허용 목록에 없습니다\" },\n    );\n}\n\nexport function createGallerySchemas(opts: CreateGallerySchemasOptions) {\n  const imageKeyPattern = opts.imageKeyPattern ?? DEFAULT_IMAGE_KEY_PATTERN;\n\n  const ImageUrlSchema = buildImageUrlSchema(opts);\n  const ImageKeySchema = z\n    .string()\n    .min(1)\n    .max(DEFAULT_IMAGE_KEY_MAX_LENGTH)\n    .regex(imageKeyPattern, \"imageKey 형식이 올바르지 않습니다\");\n\n  const CreateGallerySchema = z.object({\n    imageUrl: ImageUrlSchema,\n    imageKey: ImageKeySchema.optional(),\n    caption: z.string().max(opts.captionMaxLength).optional(),\n    categoryId: z.string().cuid(),\n    sortOrder: z.number().int().nonnegative().default(0),\n    featured: z.boolean().default(false),\n    published: z.boolean().default(false),\n  });\n\n  const UpdateGallerySchema = CreateGallerySchema.partial();\n\n  const BatchCreateGallerySchema = z.object({\n    items: z.array(CreateGallerySchema).min(1).max(opts.batchMax),\n  });\n\n  const BulkUpdateSchema = z.object({\n    ids: z.array(z.string().cuid()).min(1).max(opts.batchMax),\n    published: z.boolean().optional(),\n    featured: z.boolean().optional(),\n  });\n\n  const CreateCategorySchema = z.object({\n    slug: z\n      .string()\n      .min(1)\n      .max(64)\n      .regex(/^[A-Z][A-Z0-9_]*$/, \"slug 는 대문자/숫자/언더스코어만\"),\n    labelKo: z.string().min(1).max(64),\n    labelEn: z.string().min(1).max(64).optional(),\n    sortOrder: z.number().int().nonnegative().default(0),\n    isActive: z.boolean().default(true),\n  });\n\n  const UpdateCategorySchema = CreateCategorySchema.partial();\n\n  const ReorderCategorySchema = z.object({\n    ids: z.array(z.string().cuid()).min(1),\n  });\n\n  return {\n    CreateGallerySchema,\n    UpdateGallerySchema,\n    BatchCreateGallerySchema,\n    BulkUpdateSchema,\n    CreateCategorySchema,\n    UpdateCategorySchema,\n    ReorderCategorySchema,\n  };\n}\n\nexport type GallerySchemas = ReturnType<typeof createGallerySchemas>;\n"],"mappings":";AAAA,SAAS,SAAS;AAgBX,IAAM,8BAA8B,CAAC,UAAU,OAAO;AACtD,IAAM,+BAA+B;AAGrC,IAAM,4BACX;AAUF,SAAS,oBAAoB,MAAmC;AAC9D,QAAM,YAAY,IAAI;AAAA,KACnB,KAAK,qBAAqB,6BAA6B;AAAA,MAAI,CAAC,MAC3D,EAAE,SAAS,GAAG,IAAI,EAAE,YAAY,IAAI,GAAG,EAAE,YAAY,CAAC;AAAA,IACxD;AAAA,EACF;AACA,QAAM,QAAQ,KAAK,gBACf,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,IACtD;AAEJ,SAAO,EACJ,OAAO,EACP,IAAI,IAAI,EACR,IAAI,EACJ;AAAA,IACC,CAAC,UAAU;AACT,UAAI;AACJ,UAAI;AACF,iBAAS,IAAI,IAAI,KAAK;AAAA,MACxB,QAAQ;AACN,eAAO;AAAA,MACT;AACA,UAAI,CAAC,UAAU,IAAI,OAAO,QAAQ,EAAG,QAAO;AAC5C,UAAI,SAAS,CAAC,MAAM,IAAI,OAAO,SAAS,YAAY,CAAC,EAAG,QAAO;AAC/D,aAAO;AAAA,IACT;AAAA,IACA,EAAE,SAAS,0IAAsC;AAAA,EACnD;AACJ;AAEO,SAAS,qBAAqB,MAAmC;AACtE,QAAM,kBAAkB,KAAK,mBAAmB;AAEhD,QAAM,iBAAiB,oBAAoB,IAAI;AAC/C,QAAM,iBAAiB,EACpB,OAAO,EACP,IAAI,CAAC,EACL,IAAI,4BAA4B,EAChC,MAAM,iBAAiB,+EAAwB;AAElD,QAAM,sBAAsB,EAAE,OAAO;AAAA,IACnC,UAAU;AAAA,IACV,UAAU,eAAe,SAAS;AAAA,IAClC,SAAS,EAAE,OAAO,EAAE,IAAI,KAAK,gBAAgB,EAAE,SAAS;AAAA,IACxD,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,IAC5B,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,IACnD,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,IACnC,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,CAAC;AAED,QAAM,sBAAsB,oBAAoB,QAAQ;AAExD,QAAM,2BAA2B,EAAE,OAAO;AAAA,IACxC,OAAO,EAAE,MAAM,mBAAmB,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;AAAA,EAC9D,CAAC;AAED,QAAM,mBAAmB,EAAE,OAAO;AAAA,IAChC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;AAAA,IACxD,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,IAChC,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,EACjC,CAAC;AAED,QAAM,uBAAuB,EAAE,OAAO;AAAA,IACpC,MAAM,EACH,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,qBAAqB,kFAAsB;AAAA,IACpD,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,IACjC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,IAC5C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,IACnD,UAAU,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EACpC,CAAC;AAED,QAAM,uBAAuB,qBAAqB,QAAQ;AAE1D,QAAM,wBAAwB,EAAE,OAAO;AAAA,IACrC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,EACvC,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-IYQOJJBC.js

@@ -0,0 +1,78 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }// src/validators/index.ts
+var _zod = require('zod');
+var DEFAULT_IMAGE_URL_PROTOCOLS = ["https:", "http:"];
+var DEFAULT_IMAGE_KEY_MAX_LENGTH = 512;
+var DEFAULT_IMAGE_KEY_PATTERN = /^(?!.*(?:^|\/)\.\.(?:\/|$))(?!.*\/\/)[A-Za-z0-9][A-Za-z0-9._\-/]*$/;
+function buildImageUrlSchema(opts) {
+  const protocols = new Set(
+    (_nullishCoalesce(opts.imageUrlProtocols, () => ( DEFAULT_IMAGE_URL_PROTOCOLS))).map(
+      (p) => p.endsWith(":") ? p.toLowerCase() : `${p.toLowerCase()}:`
+    )
+  );
+  const hosts = opts.imageUrlHosts ? new Set(opts.imageUrlHosts.map((h) => h.toLowerCase())) : null;
+  return _zod.z.string().max(2048).url().refine(
+    (value) => {
+      let parsed;
+      try {
+        parsed = new URL(value);
+      } catch (e) {
+        return false;
+      }
+      if (!protocols.has(parsed.protocol)) return false;
+      if (hosts && !hosts.has(parsed.hostname.toLowerCase())) return false;
+      return true;
+    },
+    { message: "imageUrl \uC758 \uD504\uB85C\uD1A0\uCF5C \uB610\uB294 \uD638\uC2A4\uD2B8\uAC00 \uD5C8\uC6A9 \uBAA9\uB85D\uC5D0 \uC5C6\uC2B5\uB2C8\uB2E4" }
+  );
+}
+function createGallerySchemas(opts) {
+  const imageKeyPattern = _nullishCoalesce(opts.imageKeyPattern, () => ( DEFAULT_IMAGE_KEY_PATTERN));
+  const ImageUrlSchema = buildImageUrlSchema(opts);
+  const ImageKeySchema = _zod.z.string().min(1).max(DEFAULT_IMAGE_KEY_MAX_LENGTH).regex(imageKeyPattern, "imageKey \uD615\uC2DD\uC774 \uC62C\uBC14\uB974\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4");
+  const CreateGallerySchema = _zod.z.object({
+    imageUrl: ImageUrlSchema,
+    imageKey: ImageKeySchema.optional(),
+    caption: _zod.z.string().max(opts.captionMaxLength).optional(),
+    categoryId: _zod.z.string().cuid(),
+    sortOrder: _zod.z.number().int().nonnegative().default(0),
+    featured: _zod.z.boolean().default(false),
+    published: _zod.z.boolean().default(false)
+  });
+  const UpdateGallerySchema = CreateGallerySchema.partial();
+  const BatchCreateGallerySchema = _zod.z.object({
+    items: _zod.z.array(CreateGallerySchema).min(1).max(opts.batchMax)
+  });
+  const BulkUpdateSchema = _zod.z.object({
+    ids: _zod.z.array(_zod.z.string().cuid()).min(1).max(opts.batchMax),
+    published: _zod.z.boolean().optional(),
+    featured: _zod.z.boolean().optional()
+  });
+  const CreateCategorySchema = _zod.z.object({
+    slug: _zod.z.string().min(1).max(64).regex(/^[A-Z][A-Z0-9_]*$/, "slug \uB294 \uB300\uBB38\uC790/\uC22B\uC790/\uC5B8\uB354\uC2A4\uCF54\uC5B4\uB9CC"),
+    labelKo: _zod.z.string().min(1).max(64),
+    labelEn: _zod.z.string().min(1).max(64).optional(),
+    sortOrder: _zod.z.number().int().nonnegative().default(0),
+    isActive: _zod.z.boolean().default(true)
+  });
+  const UpdateCategorySchema = CreateCategorySchema.partial();
+  const ReorderCategorySchema = _zod.z.object({
+    ids: _zod.z.array(_zod.z.string().cuid()).min(1)
+  });
+  return {
+    CreateGallerySchema,
+    UpdateGallerySchema,
+    BatchCreateGallerySchema,
+    BulkUpdateSchema,
+    CreateCategorySchema,
+    UpdateCategorySchema,
+    ReorderCategorySchema
+  };
+}
+
+
+
+
+
+
+exports.DEFAULT_IMAGE_URL_PROTOCOLS = DEFAULT_IMAGE_URL_PROTOCOLS; exports.DEFAULT_IMAGE_KEY_MAX_LENGTH = DEFAULT_IMAGE_KEY_MAX_LENGTH; exports.DEFAULT_IMAGE_KEY_PATTERN = DEFAULT_IMAGE_KEY_PATTERN; exports.createGallerySchemas = createGallerySchemas;
+//# sourceMappingURL=chunk-IYQOJJBC.js.map

package/dist/chunk-IYQOJJBC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/uni4love/project/workspace/211-withwiz/node-packages/withwiz-gallery/dist/chunk-IYQOJJBC.js","../src/validators/index.ts"],"names":[],"mappings":"AAAA;ACAA,0BAAkB;AAgBX,IAAM,4BAAA,EAA8B,CAAC,QAAA,EAAU,OAAO,CAAA;AACtD,IAAM,6BAAA,EAA+B,GAAA;AAGrC,IAAM,0BAAA,EACX,oEAAA;AAUF,SAAS,mBAAA,CAAoB,IAAA,EAAmC;AAC9D,EAAA,MAAM,UAAA,EAAY,IAAI,GAAA;AAAA,IAAA,kBACnB,IAAA,CAAK,iBAAA,UAAqB,6BAAA,CAAA,CAA6B,GAAA;AAAA,MAAI,CAAC,CAAA,EAAA,GAC3D,CAAA,CAAE,QAAA,CAAS,GAAG,EAAA,EAAI,CAAA,CAAE,WAAA,CAAY,EAAA,EAAI,CAAA,EAAA;AACtC,IAAA;AACF,EAAA;AAEiB,EAAA;AAOd,EAAA;AACY,IAAA;AACL,MAAA;AACA,MAAA;AACoB,QAAA;AAChB,MAAA;AACC,QAAA;AACT,MAAA;AAC4C,MAAA;AACJ,MAAA;AACjC,MAAA;AACT,IAAA;AACW,IAAA;AACb,EAAA;AACJ;AAEwE;AACtB,EAAA;AAED,EAAA;AAIxC,EAAA;AAG8B,EAAA;AACzB,IAAA;AACwB,IAAA;AACW,IAAA;AACjB,IAAA;AACc,IAAA;AACP,IAAA;AACC,IAAA;AACrC,EAAA;AAE+C,EAAA;AAEN,EAAA;AACG,IAAA;AAC5C,EAAA;AAEiC,EAAA;AACW,IAAA;AACX,IAAA;AACD,IAAA;AAChC,EAAA;AAEqC,EAAA;AAK3B,IAAA;AACwB,IAAA;AACW,IAAA;AACF,IAAA;AACR,IAAA;AACnC,EAAA;AAE4B,EAAA;AAEU,EAAA;AACA,IAAA;AACtC,EAAA;AAEM,EAAA;AACL,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACF;ADlDkD;AACA;AACA;AACA;AACA;AACA;AACA","file":"/Users/uni4love/project/workspace/211-withwiz/node-packages/withwiz-gallery/dist/chunk-IYQOJJBC.js","sourcesContent":[null,"import { z } from \"zod\";\n\n/**\n * spec §9-1 충실 구현.\n *\n * 호스트가 `config.limits.batchMax` 와 `config.limits.captionMaxLength` 를 넘겨\n * 패키지 내부 스키마를 생성한다. categoryId 는 cuid 형식만 검증하고,\n * 실제 카테고리 존재 여부는 service 레이어가 Prisma FK 제약으로 자연스럽게 잡는다.\n *\n * 보안 강화 (security hardening):\n *   - imageUrl: 프로토콜 allowlist (기본 https/http) — javascript:/data: 스킴 차단.\n *     `imageUrlHosts` 지정 시 호스트 allowlist 도 적용.\n *   - imageKey: 저장소 삭제 (`config.storage.deleteKeys`) 에 그대로 전달되므로\n *     경로 순회 (`..`), 선행 슬래시, 공백/제어문자를 차단하는 형식 검증을 기본 적용.\n */\n\nexport const DEFAULT_IMAGE_URL_PROTOCOLS = [\"https:\", \"http:\"] as const;\nexport const DEFAULT_IMAGE_KEY_MAX_LENGTH = 512;\n\n/** 영숫자로 시작, 영숫자/`.`/`_`/`-`/`/` 만 허용. `..` 세그먼트 및 `//` 금지. */\nexport const DEFAULT_IMAGE_KEY_PATTERN =\n  /^(?!.*(?:^|\\/)\\.\\.(?:\\/|$))(?!.*\\/\\/)[A-Za-z0-9][A-Za-z0-9._\\-/]*$/;\n\nexport interface CreateGallerySchemasOptions {\n  batchMax: number;\n  captionMaxLength: number;\n  imageUrlProtocols?: readonly string[];\n  imageUrlHosts?: readonly string[];\n  imageKeyPattern?: RegExp;\n}\n\nfunction buildImageUrlSchema(opts: CreateGallerySchemasOptions) {\n  const protocols = new Set(\n    (opts.imageUrlProtocols ?? DEFAULT_IMAGE_URL_PROTOCOLS).map((p) =>\n      p.endsWith(\":\") ? p.toLowerCase() : `${p.toLowerCase()}:`,\n    ),\n  );\n  const hosts = opts.imageUrlHosts\n    ? new Set(opts.imageUrlHosts.map((h) => h.toLowerCase()))\n    : null;\n\n  return z\n    .string()\n    .max(2048)\n    .url()\n    .refine(\n      (value) => {\n        let parsed: URL;\n        try {\n          parsed = new URL(value);\n        } catch {\n          return false;\n        }\n        if (!protocols.has(parsed.protocol)) return false;\n        if (hosts && !hosts.has(parsed.hostname.toLowerCase())) return false;\n        return true;\n      },\n      { message: \"imageUrl 의 프로토콜 또는 호스트가 허용 목록에 없습니다\" },\n    );\n}\n\nexport function createGallerySchemas(opts: CreateGallerySchemasOptions) {\n  const imageKeyPattern = opts.imageKeyPattern ?? DEFAULT_IMAGE_KEY_PATTERN;\n\n  const ImageUrlSchema = buildImageUrlSchema(opts);\n  const ImageKeySchema = z\n    .string()\n    .min(1)\n    .max(DEFAULT_IMAGE_KEY_MAX_LENGTH)\n    .regex(imageKeyPattern, \"imageKey 형식이 올바르지 않습니다\");\n\n  const CreateGallerySchema = z.object({\n    imageUrl: ImageUrlSchema,\n    imageKey: ImageKeySchema.optional(),\n    caption: z.string().max(opts.captionMaxLength).optional(),\n    categoryId: z.string().cuid(),\n    sortOrder: z.number().int().nonnegative().default(0),\n    featured: z.boolean().default(false),\n    published: z.boolean().default(false),\n  });\n\n  const UpdateGallerySchema = CreateGallerySchema.partial();\n\n  const BatchCreateGallerySchema = z.object({\n    items: z.array(CreateGallerySchema).min(1).max(opts.batchMax),\n  });\n\n  const BulkUpdateSchema = z.object({\n    ids: z.array(z.string().cuid()).min(1).max(opts.batchMax),\n    published: z.boolean().optional(),\n    featured: z.boolean().optional(),\n  });\n\n  const CreateCategorySchema = z.object({\n    slug: z\n      .string()\n      .min(1)\n      .max(64)\n      .regex(/^[A-Z][A-Z0-9_]*$/, \"slug 는 대문자/숫자/언더스코어만\"),\n    labelKo: z.string().min(1).max(64),\n    labelEn: z.string().min(1).max(64).optional(),\n    sortOrder: z.number().int().nonnegative().default(0),\n    isActive: z.boolean().default(true),\n  });\n\n  const UpdateCategorySchema = CreateCategorySchema.partial();\n\n  const ReorderCategorySchema = z.object({\n    ids: z.array(z.string().cuid()).min(1),\n  });\n\n  return {\n    CreateGallerySchema,\n    UpdateGallerySchema,\n    BatchCreateGallerySchema,\n    BulkUpdateSchema,\n    CreateCategorySchema,\n    UpdateCategorySchema,\n    ReorderCategorySchema,\n  };\n}\n\nexport type GallerySchemas = ReturnType<typeof createGallerySchemas>;\n"]}

package/dist/server/index.d.mts

@@ -57,6 +57,10 @@ declare function createGalleryService(config: GalleryConfig): {
         sortBy?: SortKey$1;
     }) => Promise<PaginatedResult<GalleryListItem>>;
     getById: (id: string) => Promise<GalleryDetail | null>;
+    getAuthorIds: (ids: string[]) => Promise<Array<{
+        id: string;
+        authorId: string;
+    }>>;
     create: (data: CreateGalleryInput, authorId: string) => Promise<GalleryDetail>;
     createMany: (items: CreateGalleryInput[], authorId: string) => Promise<{
         count: number;

package/dist/server/index.d.ts

@@ -57,6 +57,10 @@ declare function createGalleryService(config: GalleryConfig): {
         sortBy?: SortKey$1;
     }) => Promise<PaginatedResult<GalleryListItem>>;
     getById: (id: string) => Promise<GalleryDetail | null>;
+    getAuthorIds: (ids: string[]) => Promise<Array<{
+        id: string;
+        authorId: string;
+    }>>;
     create: (data: CreateGalleryInput, authorId: string) => Promise<GalleryDetail>;
     createMany: (items: CreateGalleryInput[], authorId: string) => Promise<{
         count: number;

package/dist/server/index.js

@@ -11,7 +11,7 @@ var _chunkGFOWZGJXjs = require('../chunk-GFOWZGJX.js');
 var _chunkWVRTM6E7js = require('../chunk-WVRTM6E7.js');
 
 
-var _chunkILSZPLMEjs = require('../chunk-ILSZPLME.js');
+var _chunkIYQOJJBCjs = require('../chunk-IYQOJJBC.js');
 
 // src/services/helpers.ts
 function buildPaginatedResult(items, page, limit, total) {
@@ -143,6 +143,13 @@ function createGalleryService(config) {
     });
     return _nullishCoalesce(row, () => ( null));
   }
+  async function getAuthorIds(ids) {
+    const rows = await galleryDelegate().findMany({
+      where: { id: { in: ids } },
+      select: { id: true, authorId: true }
+    });
+    return rows;
+  }
   async function create(data, authorId) {
     const row = await galleryDelegate().create({
       data: {
@@ -272,6 +279,7 @@ function createGalleryService(config) {
     listPublishedByCategory,
     listAll,
     getById,
+    getAuthorIds,
     create,
     createMany,
     update,
@@ -375,19 +383,46 @@ function getRouteId(ctx) {
   const id = _optionalChain([ctx, 'access', _12 => _12.params, 'optionalAccess', _13 => _13.id]);
   return typeof id === "string" && id.length > 0 ? id : null;
 }
+var DEFAULT_SEARCH_MAX_LENGTH = 100;
+function canManageCategories(config, ctx) {
+  const fn = _optionalChain([config, 'access', _14 => _14.permissions, 'optionalAccess', _15 => _15.canManageCategories]);
+  return fn ? fn(ctx) === true : true;
+}
+async function checkBulkPermission(ctx, ids, hook, loadAuthorIds) {
+  if (!hook) return { ok: true };
+  const unique = [...new Set(ids)];
+  const rows = await loadAuthorIds(unique);
+  if (rows.length !== unique.length) {
+    return {
+      ok: false,
+      response: jsonError("one or more gallery items not found", 404, "NotFound")
+    };
+  }
+  for (const row of rows) {
+    if (!hook(ctx, { authorId: row.authorId })) {
+      return { ok: false, response: jsonError("forbidden", 403, "Forbidden") };
+    }
+  }
+  return { ok: true };
+}
 function createGalleryRoutes(config) {
   const service = createGalleryService(config);
   const categoryService = createCategoryService(config);
-  const schemas = _chunkILSZPLMEjs.createGallerySchemas.call(void 0, {
+  const schemas = _chunkIYQOJJBCjs.createGallerySchemas.call(void 0, {
     batchMax: config.limits.batchMax,
-    captionMaxLength: _nullishCoalesce(config.limits.captionMaxLength, () => ( 200))
+    captionMaxLength: _nullishCoalesce(config.limits.captionMaxLength, () => ( 200)),
+    imageUrlProtocols: _optionalChain([config, 'access', _16 => _16.validation, 'optionalAccess', _17 => _17.imageUrlProtocols]),
+    imageUrlHosts: _optionalChain([config, 'access', _18 => _18.validation, 'optionalAccess', _19 => _19.imageUrlHosts]),
+    imageKeyPattern: _optionalChain([config, 'access', _20 => _20.validation, 'optionalAccess', _21 => _21.imageKeyPattern])
   });
+  const searchMaxLength = _nullishCoalesce(_optionalChain([config, 'access', _22 => _22.validation, 'optionalAccess', _23 => _23.searchMaxLength]), () => ( DEFAULT_SEARCH_MAX_LENGTH));
   const collectionGET = config.apiWrapper(async (ctx) => {
     const { page, limit } = parsePagination(ctx.request);
     const { searchParams } = new URL(ctx.request.url);
     const categoryId = getSearchParam(ctx.request, "categoryId");
     const publishedRaw = getSearchParam(ctx.request, "published");
-    const search = getSearchParam(ctx.request, "search");
+    const searchRaw = _optionalChain([getSearchParam, 'call', _24 => _24(ctx.request, "search"), 'optionalAccess', _25 => _25.trim, 'call', _26 => _26()]);
+    const search = searchRaw ? searchRaw.slice(0, searchMaxLength) : void 0;
     const sortBy = parseSortKey(
       searchParams,
       VALID_SORT_KEYS,
@@ -416,8 +451,22 @@ function createGalleryRoutes(config) {
   });
   const collectionDELETE = config.apiWrapper(async (ctx) => {
     const body = await ctx.request.json();
-    const check = validateIds(_optionalChain([body, 'optionalAccess', _14 => _14.ids]));
+    const check = validateIds(_optionalChain([body, 'optionalAccess', _27 => _27.ids]));
     if (!check.valid) return check.response;
+    if (check.ids.length > config.limits.batchMax) {
+      return jsonError(
+        `ids exceeds batchMax (${config.limits.batchMax})`,
+        400,
+        "InvalidIds"
+      );
+    }
+    const perm = await checkBulkPermission(
+      ctx,
+      check.ids,
+      _optionalChain([config, 'access', _28 => _28.permissions, 'optionalAccess', _29 => _29.canDelete]),
+      service.getAuthorIds
+    );
+    if (!perm.ok) return perm.response;
     const { count } = await service.removeMany(check.ids);
     callRevalidate(config);
     return _server.NextResponse.json({ success: true, data: { count } });
@@ -437,7 +486,7 @@ function createGalleryRoutes(config) {
     if (!validation.success) return validation.response;
     const existing = await service.getById(id);
     if (!existing) return jsonError("Gallery item not found", 404, "NotFound");
-    if (_optionalChain([config, 'access', _15 => _15.permissions, 'optionalAccess', _16 => _16.canEdit])) {
+    if (_optionalChain([config, 'access', _30 => _30.permissions, 'optionalAccess', _31 => _31.canEdit])) {
       const ok = config.permissions.canEdit(ctx, { authorId: existing.authorId });
       if (!ok) return jsonError("forbidden", 403, "Forbidden");
     }
@@ -448,7 +497,7 @@ function createGalleryRoutes(config) {
   const itemDELETE = config.apiWrapper(async (ctx) => {
     const id = getRouteId(ctx);
     if (!id) return jsonError("missing route param: id", 400, "InvalidParams");
-    if (_optionalChain([config, 'access', _17 => _17.permissions, 'optionalAccess', _18 => _18.canDelete])) {
+    if (_optionalChain([config, 'access', _32 => _32.permissions, 'optionalAccess', _33 => _33.canDelete])) {
       const existing = await service.getById(id);
       if (!existing) return jsonError("Gallery item not found", 404, "NotFound");
       const ok = config.permissions.canDelete(ctx, {
@@ -463,7 +512,7 @@ function createGalleryRoutes(config) {
   const publishTogglePATCH = config.apiWrapper(async (ctx) => {
     const id = getRouteId(ctx);
     if (!id) return jsonError("missing route param: id", 400, "InvalidParams");
-    if (_optionalChain([config, 'access', _19 => _19.permissions, 'optionalAccess', _20 => _20.canEdit])) {
+    if (_optionalChain([config, 'access', _34 => _34.permissions, 'optionalAccess', _35 => _35.canEdit])) {
       const existing = await service.getById(id);
       if (!existing) return jsonError("Gallery item not found", 404, "NotFound");
       const ok = config.permissions.canEdit(ctx, {
@@ -500,6 +549,13 @@ function createGalleryRoutes(config) {
     const validation = validateAndParse(schemas.BulkUpdateSchema, body);
     if (!validation.success) return validation.response;
     const { ids, published, featured } = validation.data;
+    const perm = await checkBulkPermission(
+      ctx,
+      ids,
+      _optionalChain([config, 'access', _36 => _36.permissions, 'optionalAccess', _37 => _37.canEdit]),
+      service.getAuthorIds
+    );
+    if (!perm.ok) return perm.response;
     let count = 0;
     if (published !== void 0) {
       const r = await service.bulkUpdatePublished(ids, published);
@@ -521,6 +577,7 @@ function createGalleryRoutes(config) {
     return _server.NextResponse.json({ success: true, data: items });
   });
   const categoryCollectionPOST = config.apiWrapper(async (ctx) => {
+    if (!canManageCategories(config, ctx)) return jsonError("forbidden", 403, "Forbidden");
     const body = await ctx.request.json();
     const validation = validateAndParse(schemas.CreateCategorySchema, body);
     if (!validation.success) return validation.response;
@@ -538,6 +595,7 @@ function createGalleryRoutes(config) {
   const categoryItemPUT = config.apiWrapper(async (ctx) => {
     const id = getRouteId(ctx);
     if (!id) return jsonError("missing route param: id", 400, "InvalidParams");
+    if (!canManageCategories(config, ctx)) return jsonError("forbidden", 403, "Forbidden");
     const body = await ctx.request.json();
     const validation = validateAndParse(schemas.UpdateCategorySchema, body);
     if (!validation.success) return validation.response;
@@ -550,6 +608,7 @@ function createGalleryRoutes(config) {
   const categoryItemDELETE = config.apiWrapper(async (ctx) => {
     const id = getRouteId(ctx);
     if (!id) return jsonError("missing route param: id", 400, "InvalidParams");
+    if (!canManageCategories(config, ctx)) return jsonError("forbidden", 403, "Forbidden");
     try {
       await categoryService.remove(id);
     } catch (err) {