admin appPermissions

src/admin-auth/admin-auth.service.ts

@@ -22,6 +22,9 @@ export class AdminAuthService {
         role: true,
         isActive: true,
         passwordHash: true,
+        appPermissions: {
+          select: { appId: true },
+        },
       },
     });
 
@@ -57,6 +60,7 @@ export class AdminAuthService {
         email: admin.email,
         name: admin.name,
         role: admin.role,
+        appPermissions: admin.appPermissions.map((permission) => permission.appId),
       },
     };
   }

src/admins/admins.controller.ts

@@ -1,9 +1,10 @@
-import { Body, Controller, Delete, Get, Param, Patch, Post } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Param, Patch, Post, Put } from '@nestjs/common';
 
 import {
   CreateAdminSshKeyDto,
   CreateAdminDto,
   ResetAdminPasswordDto,
+  UpdateAdminAppPermissionsDto,
   UpdateAdminRoleDto,
   UpdateAdminStatusDto,
 } from './dto';
@@ -46,6 +47,16 @@ export class AdminsController {
     return this.adminsService.resetPassword(id, body);
   }
 
+  @Get(':id/app-permissions')
+  listAppPermissions(@Param('id') id: string) {
+    return this.adminsService.listAppPermissions(id);
+  }
+
+  @Put(':id/app-permissions')
+  updateAppPermissions(@Param('id') id: string, @Body() body: UpdateAdminAppPermissionsDto) {
+    return this.adminsService.updateAppPermissions(id, body);
+  }
+
   @Post(':id/ssh-keys')
   createSshKey(@Param('id') id: string, @Body() body: CreateAdminSshKeyDto) {
     return this.adminsService.createSshKey(id, body);

src/admins/admins.service.ts

@@ -9,6 +9,7 @@ import {
   CreateAdminSshKeyDto,
   CreateAdminDto,
   ResetAdminPasswordDto,
+  UpdateAdminAppPermissionsDto,
   UpdateAdminRoleDto,
   UpdateAdminStatusDto,
 } from './dto';
@@ -63,6 +64,9 @@ export class AdminsService {
           orderBy: { createdAt: 'desc' },
           select: adminSshKeySelect,
         },
+        appPermissions: {
+          select: { appId: true },
+        },
       },
     });
   }
@@ -132,6 +136,55 @@ export class AdminsService {
     return { admin };
   }
 
+  async listAppPermissions(id: string) {
+    await this.ensureExists(id);
+
+    const permissions = await this.prisma.adminAppPermission.findMany({
+      where: { adminId: id },
+      orderBy: { createdAt: 'asc' },
+      select: { appId: true },
+    });
+
+    return { appIds: permissions.map((permission) => permission.appId) };
+  }
+
+  async updateAppPermissions(id: string, body: UpdateAdminAppPermissionsDto) {
+    const admin = await this.prisma.admin.findUnique({
+      where: { id },
+      select: { id: true, role: true },
+    });
+
+    if (!admin) {
+      throw new NotFoundException('관리자를 찾을 수 없습니다.');
+    }
+
+    if (admin.role === AdminRole.OWNER) {
+      throw new BadRequestException('오너 권한은 앱 권한을 개별 설정하지 않습니다.');
+    }
+
+    const appIds = [...new Set(body.appIds.filter(Boolean))];
+    const existingApps = await this.prisma.app.findMany({
+      where: { id: { in: appIds } },
+      select: { id: true },
+    });
+    const existingAppIds = new Set(existingApps.map((app) => app.id));
+    const validAppIds = appIds.filter((appId) => existingAppIds.has(appId));
+
+    await this.prisma.$transaction([
+      this.prisma.adminAppPermission.deleteMany({ where: { adminId: id } }),
+      ...(validAppIds.length
+        ? [
+            this.prisma.adminAppPermission.createMany({
+              data: validAppIds.map((appId) => ({ adminId: id, appId })),
+              skipDuplicates: true,
+            }),
+          ]
+        : []),
+    ]);
+
+    return { appIds: validAppIds };
+  }
+
   async createSshKey(adminId: string, body: CreateAdminSshKeyDto) {
     await this.ensureExists(adminId);
 

src/admins/dto.ts

@@ -1,4 +1,4 @@
-import { IsBoolean, IsEmail, IsEnum, IsOptional, IsString, MinLength } from 'class-validator';
+import { IsArray, IsBoolean, IsEmail, IsEnum, IsOptional, IsString, IsUUID, MinLength } from 'class-validator';
 import { AdminRole } from './admin-role';
 
 export class CreateAdminDto {
@@ -44,3 +44,9 @@ export class CreateAdminSshKeyDto {
   @IsString()
   giteaUsername?: string;
 }
+
+export class UpdateAdminAppPermissionsDto {
+  @IsArray()
+  @IsUUID('4', { each: true })
+  appIds!: string[];
+}