Document Library Directory Module

목적

Directory Module은 포탈별 게시판·문서·업무 기능과 분리된 조직·사용자·권한 기반 공통 모듈이다. 여러 포탈은 동일한 조직도와 사용자 디렉터리를 조회하고, 권한 판정은 권한부여 부서 → 권한부여 사용자 순서로 수행한다.

조직도에 부여된 권한은 선택한 부서와 모든 하위 부서에 적용된다. 개별 사용자는 명시적으로 권한을 부여할 수 있지만, 사용자의 소속 부서가 같은 그룹에 포함되어 있으면 부서 권한이 우선한다.

제안 디렉토리 구조

modules/directory/
├── domain/
│   ├── department.ts        # Dept Code, parent-child tree, subtree scope
│   ├── user.ts              # KnoxID, employment status, department relation
│   ├── group.ts             # group, department grants, explicit user grants
│   └── permission.ts        # department-first permission evaluation
├── application/
│   ├── department-service.ts
│   ├── user-service.ts
│   ├── group-service.ts
│   └── permission-service.ts
├── ports/
│   ├── directory-repository.ts
│   └── session-user-provider.ts
├── adapters/
│   ├── mysql-directory-repository.ts
│   └── http-directory-controller.ts
├── contracts/
│   ├── directory.openapi.yaml
│   └── dto.ts
└── index.ts                 # public exports only

server/
├── directory-api.ts         # temporary adapter; migrate to modules/directory/adapters
└── db.ts                    # current normalized persistence boundary

client/src/
├── modules/directory/
│   ├── components/
│   ├── hooks/
│   └── api.ts
└── pages/Admin.tsx          # temporary host; extract directory screens here first

Domain boundaries

Department owns id, deptCode, name, and parentId. User owns KnoxID, identity, employment status, one department relation, and administrator status. Group owns its description plus two separate grant collections: department grants and explicit user grants. Archive boards and posts must not be imported into the module; they should consume the permission service through a small adapter.

Permission contract

The permission service receives a session user, a resource policy, and a department tree. It expands each granted department to its descendant scope, then evaluates the session user’s department before checking explicit user grants. It returns a structured decision containing allowed, reason, matchedGrantType, and matchedGrantId, which allows each consuming portal to explain access decisions consistently.

Extraction sequence

First, keep the existing normalized tables and expose repository interfaces around readDirectory() and writeDirectory(). Next, move the pure organization-scope and group-priority rules into modules/directory/domain. Then extract REST controllers behind the OpenAPI contract. Finally, replace Admin.tsx’s direct context calls with directory hooks while retaining an adapter for the current Document Library portal. This sequence avoids copying data and preserves a rollback path.

Development authentication bypass

The temporary bypass is implemented only for NODE_ENV=development. It automatically restores the configured development KnoxID (hohyun by default) during /api/auth/me when no session exists, while an explicit logout writes a short-lived marker so logout still works. The bypass is never active in production, even if DOCUMENT_LIBRARY_DEV_AUTH_BYPASS=true is accidentally present. Set DOCUMENT_LIBRARY_DEV_AUTH_BYPASS=false to disable it locally or set DOCUMENT_LIBRARY_DEV_AUTH_KNOX_ID to use another active KnoxID.

The bypass is a development convenience, not an authentication mechanism. It must be removed or disabled before any external review or production deployment that requires real login behavior.