[feat] 백오피스에서 관리자(허용 이메일) DB 관리

admin-web/src/App.tsx

@@ -8,6 +8,7 @@ import { AdminLayout } from '@/components/layout/AdminLayout'
 import { LoginPage } from '@/pages/login'
 import { MemberList } from '@/pages/members/list'
 import { MemberShow } from '@/pages/members/show'
+import { AdminAccountList } from '@/pages/admin-accounts/list'
 import { LlmSettingsPage } from '@/pages/llm-settings'
 
 // mock(로컬) 모드에서는 Firebase 없이 dev-login 을 쓴다.
@@ -20,7 +21,10 @@ export default function App() {
         dataProvider={dataProvider}
         authProvider={authProvider}
         routerProvider={routerBindings}
-        resources={[{ name: 'members', list: '/members', show: '/members/:id', meta: { label: '회원 관리' } }]}
+        resources={[
+          { name: 'members', list: '/members', show: '/members/:id', meta: { label: '회원 관리' } },
+          { name: 'admin-accounts', list: '/admin-accounts', meta: { label: '관리자 관리' } },
+        ]}
         options={{ syncWithLocation: true, disableTelemetry: true }}
       >
         <Routes>
@@ -34,6 +38,7 @@ export default function App() {
             <Route index element={<NavigateToResource resource="members" />} />
             <Route path="/members" element={<MemberList />} />
             <Route path="/members/:id" element={<MemberShow />} />
+            <Route path="/admin-accounts" element={<AdminAccountList />} />
             <Route path="/llm-settings" element={<LlmSettingsPage />} />
           </Route>
 

admin-web/src/components/layout/AdminLayout.tsx

@@ -1,6 +1,6 @@
 import { useGetIdentity, useLogout } from '@refinedev/core'
 import { Link, Outlet, useLocation } from 'react-router-dom'
-import { LayoutDashboard, LogOut, Sparkles, Users } from 'lucide-react'
+import { LayoutDashboard, LogOut, ShieldCheck, Sparkles, Users } from 'lucide-react'
 import { Avatar } from '@/components/ui/avatar'
 import { Button } from '@/components/ui/button'
 import { cn } from '@/lib/utils'
@@ -17,6 +17,7 @@ interface NavItem {
 const NAV: NavItem[] = [
   { label: '대시보드', to: '/dashboard', icon: LayoutDashboard, disabled: true },
   { label: '회원 관리', to: '/members', icon: Users },
+  { label: '관리자 관리', to: '/admin-accounts', icon: ShieldCheck },
   { label: 'LLM 설정', to: '/llm-settings', icon: Sparkles },
 ]
 
@@ -30,6 +31,9 @@ function sectionOf(pathname: string): string {
   if (pathname.startsWith('/members')) {
     return '회원 관리'
   }
+  if (pathname.startsWith('/admin-accounts')) {
+    return '관리자 관리'
+  }
   if (pathname.startsWith('/dashboard')) {
     return '대시보드'
   }

admin-web/src/pages/admin-accounts/list.tsx

@@ -0,0 +1,216 @@
+import { useState } from 'react'
+import { useCustom, useCustomMutation } from '@refinedev/core'
+import { Plus, RotateCcw, ShieldCheck, Trash2 } from 'lucide-react'
+import type { AdminAccount } from '@/types/adminAccount'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { Card } from '@/components/ui/card'
+import { Input } from '@/components/ui/input'
+import { Skeleton } from '@/components/ui/skeleton'
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from '@/components/ui/table'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { PageHeader } from '@/components/page-header'
+import { formatDateTime } from '@/lib/format'
+
+function mapError(code?: string): string {
+  switch (code) {
+    case 'ADMIN_ACCOUNT_ALREADY_EXISTS':
+      return '이미 등록된 관리자입니다.'
+    case 'INVALID_INPUT':
+      return '이메일 형식이 올바르지 않습니다.'
+    case 'CANNOT_REMOVE_SELF':
+      return '자기 자신은 삭제할 수 없습니다.'
+    case 'ADMIN_ACCOUNT_NOT_FOUND':
+      return '이미 삭제된 관리자입니다.'
+    default:
+      return '요청에 실패했습니다.'
+  }
+}
+
+export function AdminAccountList() {
+  const { data, isLoading, isError, refetch } = useCustom<AdminAccount[]>({
+    url: '/api/admin/accounts',
+    method: 'get',
+  })
+  const { mutate: addMutate, isLoading: adding } = useCustomMutation()
+  const { mutate: removeMutate } = useCustomMutation()
+
+  const [email, setEmail] = useState('')
+  const [error, setError] = useState<string | null>(null)
+
+  const accounts = data?.data ?? []
+
+  const submit = () => {
+    const value = email.trim()
+    if (!value || adding) {
+      return
+    }
+    setError(null)
+    addMutate(
+      { url: '/api/admin/accounts', method: 'post', values: { email: value } },
+      {
+        onSuccess: () => {
+          setEmail('')
+          refetch()
+        },
+        onError: (e) => setError(mapError(e?.message)),
+      },
+    )
+  }
+
+  const remove = (id: number) => {
+    setError(null)
+    removeMutate(
+      { url: `/api/admin/accounts/${id}`, method: 'delete', values: {} },
+      {
+        onSuccess: () => refetch(),
+        onError: (e) => setError(mapError(e?.message)),
+      },
+    )
+  }
+
+  return (
+    <div className="space-y-6">
+      <PageHeader
+        title="관리자 관리"
+        description="백오피스에 로그인할 수 있는 관리자를 관리합니다. 추가·삭제는 재배포 없이 즉시 반영됩니다."
+      />
+
+      <Card className="space-y-3 p-4">
+        <label htmlFor="admin-email" className="text-sm font-medium">
+          관리자 추가
+        </label>
+        <div className="flex flex-wrap items-center gap-2">
+          <Input
+            id="admin-email"
+            type="email"
+            className="w-full max-w-sm"
+            placeholder="구글 계정 이메일 (예: teammate@gmail.com)"
+            value={email}
+            onChange={(e) => setEmail(e.target.value)}
+            onKeyDown={(e) => {
+              if (e.key === 'Enter') {
+                submit()
+              }
+            }}
+          />
+          <Button size="sm" onClick={submit} disabled={!email.trim() || adding}>
+            <Plus className="size-4" />
+            추가
+          </Button>
+        </div>
+        {error && <p className="text-sm text-destructive">{error}</p>}
+        <p className="text-xs text-muted-foreground">
+          추가한 계정은 다음 구글 로그인부터 백오피스에 접근할 수 있습니다. 구글 로그인만 허용됩니다.
+        </p>
+      </Card>
+
+      {isError && !data ? (
+        <Card className="flex flex-col items-start gap-3 p-6">
+          <p className="text-sm text-muted-foreground">관리자 목록을 불러오지 못했습니다.</p>
+          <Button variant="outline" size="sm" onClick={() => refetch()}>
+            <RotateCcw className="size-4" />
+            다시 시도
+          </Button>
+        </Card>
+      ) : (
+        <Card className="overflow-hidden">
+          <Table>
+            <TableHeader>
+              <TableRow className="hover:bg-transparent">
+                <TableHead>이메일</TableHead>
+                <TableHead className="w-28">출처</TableHead>
+                <TableHead>추가한 관리자</TableHead>
+                <TableHead className="w-48">추가일</TableHead>
+                <TableHead className="w-16" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {isLoading ? (
+                Array.from({ length: 3 }).map((_, i) => (
+                  <TableRow key={i} className="hover:bg-transparent">
+                    <TableCell>
+                      <Skeleton className="h-4 w-48" />
+                    </TableCell>
+                    <TableCell>
+                      <Skeleton className="h-5 w-16 rounded-full" />
+                    </TableCell>
+                    <TableCell>
+                      <Skeleton className="h-4 w-32" />
+                    </TableCell>
+                    <TableCell>
+                      <Skeleton className="h-4 w-32" />
+                    </TableCell>
+                    <TableCell />
+                  </TableRow>
+                ))
+              ) : (
+                accounts.map((account) => (
+                  <TableRow key={account.source === 'ENV' ? `env-${account.email}` : account.id} className="hover:bg-transparent">
+                    <TableCell className="font-medium">{account.email}</TableCell>
+                    <TableCell>
+                      {account.source === 'ENV' ? (
+                        <Badge variant="muted">환경 설정</Badge>
+                      ) : (
+                        <Badge variant="secondary">관리</Badge>
+                      )}
+                    </TableCell>
+                    <TableCell className="text-sm text-muted-foreground">
+                      {account.addedByEmail ?? <span className="text-muted-foreground/60">—</span>}
+                    </TableCell>
+                    <TableCell className="text-sm text-muted-foreground">
+                      {account.createdAt ? formatDateTime(account.createdAt) : <span className="text-muted-foreground/60">—</span>}
+                    </TableCell>
+                    <TableCell className="text-right">
+                      {account.removable && account.id !== null && (
+                        <AlertDialog>
+                          <AlertDialogTrigger asChild>
+                            <Button
+                              variant="ghost"
+                              size="sm"
+                              className="text-muted-foreground hover:text-destructive"
+                              aria-label={`${account.email} 관리자 삭제`}
+                            >
+                              <Trash2 className="size-4" />
+                            </Button>
+                          </AlertDialogTrigger>
+                          <AlertDialogContent>
+                            <AlertDialogHeader>
+                              <AlertDialogTitle>관리자를 삭제할까요?</AlertDialogTitle>
+                              <AlertDialogDescription>
+                                <span className="font-medium text-foreground">{account.email}</span> 계정의 백오피스
+                                접근이 즉시 차단됩니다.
+                              </AlertDialogDescription>
+                            </AlertDialogHeader>
+                            <AlertDialogFooter>
+                              <AlertDialogCancel>취소</AlertDialogCancel>
+                              <AlertDialogAction onClick={() => remove(account.id as number)}>삭제</AlertDialogAction>
+                            </AlertDialogFooter>
+                          </AlertDialogContent>
+                        </AlertDialog>
+                      )}
+                    </TableCell>
+                  </TableRow>
+                ))
+              )}
+            </TableBody>
+          </Table>
+          <div className="flex items-center gap-2 border-t px-4 py-2.5 text-xs text-muted-foreground">
+            <ShieldCheck className="size-3.5" />
+            <span>환경 설정(부트스트랩) 관리자는 안전장치로 UI에서 삭제할 수 없습니다.</span>
+          </div>
+        </Card>
+      )}
+    </div>
+  )
+}

admin-web/src/types/adminAccount.ts

@@ -0,0 +1,8 @@
+export interface AdminAccount {
+  id: number | null
+  email: string
+  source: 'ENV' | 'DB'
+  removable: boolean
+  addedByEmail: string | null
+  createdAt: string | null
+}

src/main/kotlin/com/nexters/gamss/admin/config/AdminProperties.kt

@@ -16,6 +16,9 @@ data class AdminProperties(
 
     fun isAllowed(email: String): Boolean = normalize(email) in allowed
 
+    /** 환경(ENV)으로 고정된 부트스트랩 허용 이메일. UI로는 지울 수 없는 break-glass 목록이다. */
+    fun bootstrapEmails(): Set<String> = allowed
+
     /** 이메일 비교·저장에 쓰는 정규화(공백 제거·소문자). 토큰 발급 등 다른 곳에서도 재사용한다. */
     fun normalize(email: String): String = email.trim().lowercase()
 }

src/main/kotlin/com/nexters/gamss/admin/controller/AdminAccountController.kt

@@ -0,0 +1,79 @@
+package com.nexters.gamss.admin.controller
+
+import com.nexters.gamss.admin.controller.dto.AddAdminAccountRequest
+import com.nexters.gamss.admin.controller.dto.AdminAccountResponse
+import com.nexters.gamss.admin.service.AdminAccountEntry
+import com.nexters.gamss.admin.service.AdminAccountService
+import com.nexters.gamss.global.response.ApiResponse
+import com.nexters.gamss.global.security.AdminPrincipal
+import io.swagger.v3.oas.annotations.Operation
+import io.swagger.v3.oas.annotations.Parameter
+import io.swagger.v3.oas.annotations.tags.Tag
+import jakarta.validation.Valid
+import org.springframework.security.core.annotation.AuthenticationPrincipal
+import org.springframework.web.bind.annotation.DeleteMapping
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.PathVariable
+import org.springframework.web.bind.annotation.PostMapping
+import org.springframework.web.bind.annotation.RequestBody
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RestController
+
+@Tag(
+    name = "백오피스 관리자",
+    description = "백오피스 접근 허용 관리자 조회·추가·삭제 API (ROLE_ADMIN 필요). 재배포 없이 즉시 반영.",
+)
+@RestController
+@RequestMapping("/api/admin/accounts")
+class AdminAccountController(
+    private val adminAccountService: AdminAccountService,
+) {
+    @Operation(
+        summary = "관리자 목록 조회",
+        description = "허용 관리자를 반환합니다. ENV 부트스트랩(삭제 불가)과 DB 관리 항목을 함께 보여줍니다.",
+    )
+    @GetMapping
+    fun list(
+        @Parameter(hidden = true) @AuthenticationPrincipal principal: AdminPrincipal,
+    ): ApiResponse<List<AdminAccountResponse>> =
+        ApiResponse.success(adminAccountService.list(principal.email).map { AdminAccountResponse.from(it) })
+
+    @Operation(
+        summary = "관리자 추가",
+        description =
+            "이메일로 관리자를 추가합니다. 다음 로그인부터 즉시 허용됩니다.\n\n" +
+                "**실패 응답**\n\n" +
+                "| error.code | HTTP | 설명 |\n" +
+                "|---|---|---|\n" +
+                "| INVALID_INPUT | 400 | email 누락 또는 형식 오류 |\n" +
+                "| ADMIN_ACCOUNT_ALREADY_EXISTS | 409 | 이미 허용된(ENV·DB) 관리자 |",
+    )
+    @PostMapping
+    fun add(
+        @Parameter(hidden = true) @AuthenticationPrincipal principal: AdminPrincipal,
+        @Valid @RequestBody request: AddAdminAccountRequest,
+    ): ApiResponse<AdminAccountResponse> {
+        val account = adminAccountService.add(checkNotNull(request.email), principal.email)
+        // 방금 추가한 계정은 남을 추가한 것이라(본인은 이미 허용돼 추가 불가) 삭제 가능하다.
+        return ApiResponse.success(AdminAccountResponse.from(AdminAccountEntry.db(account, removable = true)))
+    }
+
+    @Operation(
+        summary = "관리자 삭제",
+        description =
+            "DB로 관리되는 관리자를 삭제합니다. 자기 자신은 삭제할 수 없습니다.\n\n" +
+                "**실패 응답**\n\n" +
+                "| error.code | HTTP | 설명 |\n" +
+                "|---|---|---|\n" +
+                "| ADMIN_ACCOUNT_NOT_FOUND | 404 | 존재하지 않는 관리자 |\n" +
+                "| CANNOT_REMOVE_SELF | 409 | 자기 자신은 삭제 불가 |",
+    )
+    @DeleteMapping("/{id}")
+    fun remove(
+        @Parameter(hidden = true) @AuthenticationPrincipal principal: AdminPrincipal,
+        @PathVariable id: Long,
+    ): ApiResponse<Unit> {
+        adminAccountService.remove(id, principal.email)
+        return ApiResponse.success()
+    }
+}

src/main/kotlin/com/nexters/gamss/admin/controller/dto/AddAdminAccountRequest.kt

@@ -0,0 +1,14 @@
+package com.nexters.gamss.admin.controller.dto
+
+import io.swagger.v3.oas.annotations.media.Schema
+import jakarta.validation.constraints.Email
+import jakarta.validation.constraints.NotBlank
+import jakarta.validation.constraints.Size
+
+data class AddAdminAccountRequest(
+    @field:NotBlank(message = "email은 필수입니다.")
+    @field:Email(message = "이메일 형식이 올바르지 않습니다.")
+    @field:Size(max = 255, message = "email은 255자 이하여야 합니다.")
+    @field:Schema(description = "관리자로 추가할 이메일", example = "teammate@gmail.com")
+    val email: String?,
+)