memi-board 0.5.0 → 0.9.0

package/docs/firestore.rules.example

@@ -19,57 +19,130 @@ service cloud.firestore {
       return isSignedIn() &&
         get(/databases/$(database)/documents/memiBoardUsers/$(request.auth.uid)).data.role == 'admin';
     }
+    function isStaff() {
+      return isSignedIn() &&
+        get(/databases/$(database)/documents/memiBoardUsers/$(request.auth.uid)).data.role in ['admin', 'staff'];
+    }
+    function canWriteCategory(categoryId) {
+      let categoryPath = /databases/$(database)/documents/memiBoardSettings/config/categories/$(categoryId);
+      let requiredRole = get(categoryPath).data.get('writeRole', 'user');
+      return exists(categoryPath)
+        && (requiredRole == 'user'
+          || (requiredRole == 'staff' && isStaff())
+          || (requiredRole == 'admin' && isAdmin()));
+    }
     function isOwner(resource) {
       return isSignedIn() && request.auth.uid == resource.data.authorUid;
     }
+    function isCommentCountUpdate() {
+      return isSignedIn()
+        && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['commentCount'])
+        && request.resource.data.commentCount is int
+        && request.resource.data.commentCount >= 0
+        && (request.resource.data.commentCount == resource.data.get('commentCount', 0) + 1
+          || request.resource.data.commentCount == resource.data.get('commentCount', 0) - 1);
+    }
 
     match /memiBoardPosts/{postId} {
       allow read: if true;
 
       allow create: if isSignedIn()
         && request.resource.data.authorUid == request.auth.uid
-        && request.resource.data.moderationStatus == 'approved';
+        && request.resource.data.moderationStatus == 'approved'
+        && request.resource.data.category is string
+        && canWriteCategory(request.resource.data.category);
 
-      // 작성자 본인 또는 관리자만 수정/삭제 가능
-      allow update, delete: if isOwner(resource) || isAdmin();
+      // 작성자 본인 또는 관리자·스태프만 수정/삭제 가능
+      allow update: if isOwner(resource) || isStaff() || isCommentCountUpdate();
+      allow delete: if isOwner(resource) || isStaff();
 
       match /body/{docId} {
         allow read: if true;
-        allow write: if isOwner(get(/databases/$(database)/documents/memiBoardPosts/$(postId))) || isAdmin();
+        allow write: if isOwner(get(/databases/$(database)/documents/memiBoardPosts/$(postId))) || isStaff();
       }
 
       match /comments/{commentId} {
         allow read: if true;
 
+        function isLegacyTopLevelComment() {
+          return !request.resource.data.keys().hasAny([
+            'parentId', 'rootId', 'depth', 'replyToUid', 'replyToName', 'replyCount', 'isReply'
+          ]);
+        }
+        function isValidTopLevelComment() {
+          return request.resource.data.parentId == null
+            && request.resource.data.rootId == commentId
+            && request.resource.data.depth == 0
+            && request.resource.data.replyToUid == null
+            && request.resource.data.replyToName == null
+            && request.resource.data.replyCount == 0
+            && request.resource.data.isReply == false;
+        }
+        function isValidReply() {
+          let parentPath = /databases/$(database)/documents/memiBoardPosts/$(postId)/comments/$(request.resource.data.parentId);
+          let rootPath = /databases/$(database)/documents/memiBoardPosts/$(postId)/comments/$(request.resource.data.rootId);
+          let parent = get(parentPath).data;
+          return request.resource.data.parentId is string
+            && request.resource.data.rootId is string
+            && request.resource.data.parentId != commentId
+            && exists(parentPath)
+            && exists(rootPath)
+            && get(rootPath).data.get('parentId', null) == null
+            && request.resource.data.replyToUid == parent.authorUid
+            && request.resource.data.replyCount == 0
+            && request.resource.data.isReply == true
+            && ((parent.get('parentId', null) == null
+                  && request.resource.data.rootId == request.resource.data.parentId)
+              || (parent.get('parentId', null) != null
+                  && request.resource.data.rootId == parent.rootId))
+            && ((parent.get('depth', 0) < 2
+                  && request.resource.data.depth == parent.get('depth', 0) + 1)
+              || (parent.get('depth', 0) >= 2
+                  && request.resource.data.depth == 2));
+        }
+        function isReplyCountUpdate() {
+          return isSignedIn()
+            && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['replyCount'])
+            && request.resource.data.replyCount is int
+            && request.resource.data.replyCount >= 0
+            && (request.resource.data.replyCount == resource.data.get('replyCount', 0) + 1
+              || request.resource.data.replyCount == resource.data.get('replyCount', 0) - 1);
+        }
+
         allow create: if isSignedIn()
           && request.resource.data.authorUid == request.auth.uid
-          && request.resource.data.moderationStatus == 'approved';
+          && request.resource.data.postId == postId
+          && request.resource.data.body is string
+          && request.resource.data.moderationStatus == 'approved'
+          && (isLegacyTopLevelComment()
+            || (request.resource.data.keys().hasAll([
+                'parentId', 'rootId', 'depth', 'replyToUid', 'replyToName', 'replyCount', 'isReply'
+              ])
+              && (isValidTopLevelComment() || isValidReply())));
 
         // 댓글 작성자·부모 게시글 작성자·게시판 관리자 모두 삭제 가능.
         // 부모 글을 삭제할 때 작성자가 다른 사용자의 댓글도 함께 정리할 수 있어야 한다.
         allow delete: if isOwner(resource)
           || isOwner(get(/databases/$(database)/documents/memiBoardPosts/$(postId)))
-          || isAdmin();
+          || isStaff();
 
-        // 댓글 수정은 지원하지 않는다 (삭제 후 재작성만 가능) — Editor에서 UI 자체도 제공하지 않음
-        allow update: if false;
+        // 댓글 본문 수정은 지원하지 않는다. 답글 batch의 replyCount ±1만 허용한다.
+        allow update: if isReplyCountUpdate();
       }
     }
 
     // 게시판 역할 문서.
-    // 본인은 role:'user'로만 생성/유지할 수 있고, 자기 role을 'admin'으로 바꿀 수 없다.
-    // 관리자 승격은 Firebase 콘솔에서 해당 uid 문서의 role 필드를 직접 'admin'으로 바꿔야 한다
-    // (이 모듈은 관리자 승격 UI를 제공하지 않는다).
+    // 본인은 role:'user'로만 생성하며, admin은 Users UI에서 admin/staff/user를 변경한다.
     // moderationBlockCount/At: 검열 차단 누적(+1만). 감소·리셋은 admin.
     match /memiBoardUsers/{uid} {
-      allow read: if isSignedIn();
+      allow read: if isAdmin() || (isSignedIn() && request.auth.uid == uid);
       allow create: if isSignedIn()
         && request.auth.uid == uid
         && request.resource.data.role == 'user'
         && (!('moderationBlockCount' in request.resource.data)
             || request.resource.data.moderationBlockCount == 0
             || request.resource.data.moderationBlockCount == 1);
-      allow update: if isAdmin()
+      allow update: if (isAdmin() && request.resource.data.role in ['admin', 'staff', 'user'])
         || (isSignedIn()
           && request.auth.uid == uid
           && request.resource.data.role == resource.data.role
@@ -94,9 +167,10 @@ service cloud.firestore {
       match /categories/{categoryId} {
         allow read: if true;
         allow create, update: if isAdmin()
-          && request.resource.data.keys().hasOnly(['label', 'listView', 'order', 'updatedAt'])
+          && request.resource.data.keys().hasOnly(['label', 'listView', 'writeRole', 'order', 'updatedAt'])
           && request.resource.data.label is string
           && request.resource.data.listView in ['default', 'image', 'video']
+          && request.resource.data.writeRole in ['user', 'staff', 'admin']
           && request.resource.data.order is number;
         allow delete: if isAdmin();
       }

package/docs/storage.rules.example

@@ -12,9 +12,9 @@ service firebase.storage {
     function isSignedIn() {
       return request.auth != null;
     }
-    function isAdmin() {
+    function isStaff() {
       return isSignedIn() &&
-        firestore.get(/databases/(default)/documents/memiBoardUsers/$(request.auth.uid)).data.role == 'admin';
+        firestore.get(/databases/(default)/documents/memiBoardUsers/$(request.auth.uid)).data.role in ['admin', 'staff'];
     }
     function postExists(postId) {
       return firestore.exists(/databases/(default)/documents/memiBoardPosts/$(postId));
@@ -28,9 +28,9 @@ service firebase.storage {
       allow read: if true;
       // uploadBytesResumable → create + 청크 update 필요 (write)
       allow write: if isSignedIn()
-        && (!postExists(postId) || isPostOwner(postId) || isAdmin())
+        && (!postExists(postId) || isPostOwner(postId) || isStaff())
         && request.resource.size < 20 * 1024 * 1024;
-      allow delete: if isSignedIn() && (!postExists(postId) || isPostOwner(postId) || isAdmin());
+      allow delete: if isSignedIn() && (!postExists(postId) || isPostOwner(postId) || isStaff());
     }
 
     // 에디터 본문 이미지 + 썸네일
@@ -39,10 +39,10 @@ service firebase.storage {
     match /memiBoard/posts/{postId}/images/{allPaths=**} {
       allow read: if true;
       allow write: if isSignedIn()
-        && (!postExists(postId) || isPostOwner(postId) || isAdmin())
+        && (!postExists(postId) || isPostOwner(postId) || isStaff())
         && request.resource.size < 5 * 1024 * 1024
         && request.resource.contentType.matches('image/(jpeg|png|webp|gif|jpg)');
-      allow delete: if isSignedIn() && (!postExists(postId) || isPostOwner(postId) || isAdmin());
+      allow delete: if isSignedIn() && (!postExists(postId) || isPostOwner(postId) || isStaff());
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memi-board",
-  "version": "0.5.0",
+  "version": "0.9.0",
   "type": "module",
   "description": "Firebase 게시판 — core composable + thin Nuxt module(UI SFC). Nuxt 4 + Nuxt UI 호스트에 붙임",
   "license": "MIT",
@@ -58,6 +58,7 @@
     "@nuxt/ui": "^4.0.0",
     "@tiptap/core": ">=2.0.0",
     "@tiptap/pm": ">=2.0.0",
+    "dayjs": "^1.11.0",
     "firebase": "^12.0.0",
     "nuxt": ">=3.0.0 || >=4.0.0",
     "vue": "^3.5.0",
@@ -80,6 +81,7 @@
   },
   "devDependencies": {
     "@nuxt/ui": "^4.9.0",
+    "dayjs": "^1.11.21",
     "firebase": "^12.15.0",
     "nuxt": "^4.5.1",
     "nuxt-vuefire": "^1.1.2",