7.1 게시글 CRUD API 및 페이지 연동 o

src/app/api/posts/[id]/route.ts

@@ -1,5 +1,8 @@
 import { NextResponse } from "next/server";
 import prisma from "@/lib/prisma";
+import { z } from "zod";
+import { getUserIdFromRequest } from "@/lib/auth";
+import { requirePermission } from "@/lib/rbac";
 
 export async function GET(_: Request, context: { params: Promise<{ id: string }> }) {
   const { id } = await context.params;
@@ -13,4 +16,28 @@ export async function GET(_: Request, context: { params: Promise<{ id: string }>
   return NextResponse.json({ post });
 }
 
+const updateSchema = z.object({
+  title: z.string().min(1).optional(),
+  content: z.string().min(1).optional(),
+});
+
+export async function PATCH(req: Request, context: { params: Promise<{ id: string }> }) {
+  const { id } = await context.params;
+  const userId = getUserIdFromRequest(req);
+  await requirePermission({ userId, resource: "POST", action: "UPDATE" });
+  const body = await req.json();
+  const parsed = updateSchema.safeParse(body);
+  if (!parsed.success) return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
+  const post = await prisma.post.update({ where: { id }, data: parsed.data });
+  return NextResponse.json({ post });
+}
+
+export async function DELETE(req: Request, context: { params: Promise<{ id: string }> }) {
+  const { id } = await context.params;
+  const userId = getUserIdFromRequest(req);
+  await requirePermission({ userId, resource: "POST", action: "DELETE" });
+  const post = await prisma.post.update({ where: { id }, data: { status: "deleted" } });
+  return NextResponse.json({ post });
+}
+
 

src/app/api/posts/route.ts

@@ -48,6 +48,7 @@ export async function GET(req: Request) {
   }
   const { page, pageSize, boardId, q, sort = "recent" } = parsed.data;
   const where = {
+    NOT: { status: "deleted" as const },
     ...(boardId ? { boardId } : {}),
     ...(q
       ? {