From edad1eebffcc62e6aa95a83563a24fdab7c26fe7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EA=B9=80=EA=B8=B0=EB=AF=BC?= <gimin1463@naver.com>
Date: Fri, 21 Aug 2026 03:20:57 +0900
Subject: [PATCH] =?UTF-8?q?fix:=20=EA=B6=8C=ED=95=9C=20=ED=9A=8C=EC=88=98?=
 =?UTF-8?q?=20=EC=8B=9C=20=ED=99=95=EC=9D=B8=20=EC=A0=88=EC=B0=A8=EB=A5=BC?=
 =?UTF-8?q?=20=EC=B6=94=EA=B0=80=ED=95=9C=EB=8B=A4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

권한 회수(revoke) 버튼이 확인 없이 즉시 DELETE를 호출하던 문제를
막는다. 문서 삭제·역할 회수·컬렉션 삭제와 동일한 window.confirm
컨벤션을 따라 리소스·대상·권한 종류를 표시하고 확인받는다.
---
 frontend/app/features/PermissionsPage.tsx | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/frontend/app/features/PermissionsPage.tsx b/frontend/app/features/PermissionsPage.tsx
index 14f8c462..a7b8252d 100644
--- a/frontend/app/features/PermissionsPage.tsx
+++ b/frontend/app/features/PermissionsPage.tsx
@@ -94,11 +94,14 @@ export function PermissionsPage({ notify }: { notify: (message: string) => void
     finally { setBusy(false); }
   }
 
-  async function revoke(permissionId: number) {
+  async function revoke(permission: PermissionGrant) {
     if (!resourceId) return;
+    const resourceLabel = resources.find((item) => String(item.id) === resourceId)?.label ?? resourceId;
+    const message = `${resourceType === "documents" ? "문서" : "컬렉션"} “${resourceLabel}”에서 ${targetLabel(permission)}의 ${permission.permissionType} 권한을 회수할까요?`;
+    if (!window.confirm(message)) return;
     setBusy(true);
     try {
-      await apiRequest(`/permissions/${resourceType}/${resourceId}/${permissionId}`, { method: "DELETE" });
+      await apiRequest(`/permissions/${resourceType}/${resourceId}/${permission.permissionId}`, { method: "DELETE" });
       notify("권한을 회수했습니다.");
       await loadDirectPermissions();
     } catch (reason) { setError(errorMessage(reason)); }
@@ -132,7 +135,7 @@ export function PermissionsPage({ notify }: { notify: (message: string) => void
         {permissionsLoading ? <LoadingState label="직접 권한을 불러오는 중입니다." /> : null}
         {!permissionsLoading && permissionsError ? <Notice>직접 권한 목록을 조회할 수 없습니다. {permissionsError}</Notice> : null}
         {!permissionsLoading && !permissionsError && !directPermissions.length ? <Notice>이 리소스에 직접 부여된 권한이 없습니다.</Notice> : null}
-        {!permissionsLoading && directPermissions.length ? <div className="mini-table permission-table"><div className="table-labels"><span>대상</span><span>권한</span><span>만료</span><span /></div>{directPermissions.map((permission) => <div key={permission.permissionId}><span><strong>{targetLabel(permission)}</strong><small>#{permission.permissionId} · user #{permission.grantedBy} · {formatDate(permission.grantedAt)}</small></span><StatusPill value={permission.permissionType} /><span>{permission.expiresAt ? formatDate(permission.expiresAt) : "제한 없음"}</span><button className="danger-text" disabled={busy} onClick={() => void revoke(permission.permissionId)}>회수</button></div>)}</div> : null}
+        {!permissionsLoading && directPermissions.length ? <div className="mini-table permission-table"><div className="table-labels"><span>대상</span><span>권한</span><span>만료</span><span /></div>{directPermissions.map((permission) => <div key={permission.permissionId}><span><strong>{targetLabel(permission)}</strong><small>#{permission.permissionId} · user #{permission.grantedBy} · {formatDate(permission.grantedAt)}</small></span><StatusPill value={permission.permissionType} /><span>{permission.expiresAt ? formatDate(permission.expiresAt) : "제한 없음"}</span><button className="danger-text" disabled={busy} onClick={() => void revoke(permission)}>회수</button></div>)}</div> : null}
       </div>
     </> : null}
   </section>;