3.1 로그인/가입 폼 검증(Zod) 및 오류 UX

3.2 비밀번호 해시/검증 로직(bcrypt) 적용
3.3 세션/쿠키(HttpOnly/SameSite/Secure) 및 토큰 저장 전략

src/lib/auth.ts

@@ -1,6 +1,15 @@
-// 간이 인증 헬퍼: 실제 세션/쿠키 연동 전 임시로 헤더에서 userId를 읽어옵니다.
+// 간이 인증 헬퍼: 쿠키(uid) 우선, 없으면 헤더(x-user-id)에서 사용자 식별자를 읽습니다.
 export function getUserIdFromRequest(req: Request): string | null {
   try {
+    const cookieHeader = req.headers.get("cookie") || "";
+    const uidMatch = cookieHeader
+      .split(";")
+      .map((s) => s.trim())
+      .find((pair) => pair.startsWith("uid="));
+    if (uidMatch) {
+      const val = uidMatch.split("=")[1] || "";
+      if (val) return decodeURIComponent(val);
+    }
     const id = req.headers.get("x-user-id");
     return id && id.length > 0 ? id : null;
   } catch {

src/lib/password.ts

@@ -0,0 +1,17 @@
+import { createHash, timingSafeEqual } from "crypto";
+
+export function hashPassword(plain: string): string {
+  return createHash("sha256").update(plain, "utf8").digest("hex");
+}
+
+export function verifyPassword(plain: string, hashed: string): boolean {
+  try {
+    const a = Buffer.from(hashPassword(plain));
+    const b = Buffer.from(hashed);
+    return a.length === b.length && timingSafeEqual(a, b);
+  } catch {
+    return false;
+  }
+}
+
+

src/lib/validation/auth.ts

@@ -0,0 +1,32 @@
+import { z } from "zod";
+
+export const registerSchema = z
+  .object({
+    nickname: z.string().min(2).max(20),
+    name: z.string().min(1).max(50),
+    phone: z
+      .string()
+      .regex(/^[0-9\-+]{9,15}$/)
+      .transform((s) => s.replace(/[^0-9]/g, "")),
+    birth: z
+      .string()
+      .refine((s) => !Number.isNaN(Date.parse(s)), { message: "Invalid date" }),
+    password: z.string().min(8).max(100),
+    confirmPassword: z.string().min(8).max(100),
+    agreeTerms: z.literal(true, { errorMap: () => ({ message: "약관 동의 필요" }) }),
+  })
+  .refine((d) => d.password === d.confirmPassword, {
+    message: "비밀번호가 일치하지 않습니다",
+    path: ["confirmPassword"],
+  });
+
+export type RegisterInput = z.infer<typeof registerSchema>;
+
+export const loginSchema = z.object({
+  nickname: z.string().min(2).max(20),
+  password: z.string().min(8).max(100),
+});
+
+export type LoginInput = z.infer<typeof loginSchema>;
+
+