원이 작업 + 배포 보안 관련 스크립트 수정

docker-compose.prod.yml

@@ -13,8 +13,9 @@ services:
     container_name: cms_app
     restart: unless-stopped
     env_file: .env
+    # 127.0.0.1 만 바인딩: 외부 평문 접근(http://IP:3000) 차단, Caddy(호스트, localhost:3000)만 도달.
     ports:
-      - '3000:3000'
+      - '127.0.0.1:3000:3000'
     depends_on:
       - db
 

src/app/api/projects/[id]/route.ts

@@ -0,0 +1,49 @@
+/**
+ * GET /api/projects/:id — 상세 정보 (년도, 구분, 유형, 연구기간, 특성화트랙, 지도교수, 연구실, 참여기업, 참여학생)
+ */
+import { prisma } from '@/lib/db';
+import { requireRole } from '@/lib/auth';
+import { ok, fail, handle } from '@/lib/http';
+import { maskName } from '@/lib/list-filters';
+
+type Ctx = { params: { id: string } };
+
+export async function GET(_req: Request, { params }: Ctx) {
+  return handle(async () => {
+    await requireRole('ADMIN');
+    const it = await prisma.project.findUnique({
+      where: { id: params.id },
+      include: {
+        company: { select: { id: true, name: true } },
+        lab: { select: { professorName: true, labName: true } },
+        students: { include: { student: { select: { studentNo: true, nameMasked: true } } } },
+      },
+    });
+    if (!it) return fail('프로젝트를 찾을 수 없습니다.', 404);
+
+    const named = it.students
+      .filter((s) => !!s.student.nameMasked)
+      .map((s) => ({ studentNo: s.student.studentNo, nameMasked: s.student.nameMasked as string }));
+    const raws = it.studentNamesRaw
+      ? it.studentNamesRaw.split(',').filter(Boolean).map((n) => ({ studentNo: null, nameMasked: maskName(n) }))
+      : [];
+
+    const row = {
+      id: it.id,
+      year: it.year,
+      dept: it.dept,
+      category: it.category,
+      type: it.type,
+      title: it.title,
+      period: it.period,
+      track: it.track,
+      professorName: it.lab?.professorName ?? null,
+      labName: it.lab?.labName ?? null,
+      companyId: it.company?.id ?? null,
+      companyName: it.company?.name ?? it.companyNameRaw ?? '-',
+      students: [...named, ...raws],
+    };
+
+    return ok(row);
+  });
+}