fix: restrict content image uploads to chiefs

app/game-api/src/router/board/index.ts

@@ -148,8 +148,7 @@ export const boardRouter = router({
             title: z.string().trim().max(250),
             content: z.string().trim().max(20000),
         })
-        )
+    ).mutation(async ({ ctx, input }) => {
-        .mutation(async ({ ctx, input }) => {
         const { general, permission } = await getBoardActor(ctx);
         assertBoardAccess(permission, input.isSecret);
 
@@ -176,8 +175,7 @@ export const boardRouter = router({
             postId: z.number().int().positive(),
             content: z.string().trim().max(2000),
         })
-        )
+    ).mutation(async ({ ctx, input }) => {
-        .mutation(async ({ ctx, input }) => {
         const { general, permission } = await getBoardActor(ctx);
         if (!input.content) {
             throw new TRPCError({ code: 'BAD_REQUEST', message: '내용이 비어있습니다.' });
@@ -215,7 +213,7 @@ export const boardRouter = router({
     }),
     uploadImage: authedProcedure.input(z.object({ dataUrl: z.string().min(1) })).mutation(async ({ ctx, input }) => {
         const { permission } = await getBoardActor(ctx);
-        assertBoardAccess(permission, false);
+        assertBoardAccess(permission, true);
 
         const buffer = parseDataUrl(input.dataUrl);
         if (buffer.length > MAX_UPLOAD_BYTES) {

app/game-api/test/boardRouter.test.ts

@@ -267,7 +267,10 @@ describe('board router actor, nation, and secret permissions', () => {
         const upload = vi.fn(async ({ filename }: { filename: string }) => ({
             publicUrl: `https://sam-image.hided.net/uploads/core2026/${filename}`,
         }));
-        const fixture = buildContext({ contentImageUpload: { upload } });
+        const fixture = buildContext({
+            me: buildGeneral({ officerLevel: 5 }),
+            contentImageUpload: { upload },
+        });
         const png = await sharp({
             create: { width: 64, height: 48, channels: 4, background: '#224466' },
         })
@@ -278,15 +281,31 @@ describe('board router actor, nation, and secret permissions', () => {
             dataUrl: `data:image/png;base64,${png.toString('base64')}`,
         });
 
-        expect(result.url).toMatch(
+        expect(result.url).toMatch(/^https:\/\/sam-image\.hided\.net\/uploads\/core2026\/[a-f0-9]{32}\.webp$/);
-            /^https:\/\/sam-image\.hided\.net\/uploads\/core2026\/[a-f0-9]{32}\.webp$/
-        );
         expect(upload).toHaveBeenCalledWith(
             expect.objectContaining({ contentType: 'image/webp', body: expect.any(Buffer) })
         );
         expect(result).toMatchObject({ width: 64, height: 48, format: 'webp', animated: false });
     });
 
+    it('rejects editor image uploads from an ordinary nation member', async () => {
+        const upload = vi.fn();
+        const fixture = buildContext({
+            me: buildGeneral({ officerLevel: 1 }),
+            contentImageUpload: { upload },
+        });
+
+        await expect(
+            appRouter.createCaller(fixture.context).board.uploadImage({
+                dataUrl: 'data:image/png;base64,AA==',
+            })
+        ).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+            message: '권한이 부족합니다. 수뇌부가 아닙니다.',
+        });
+        expect(upload).not.toHaveBeenCalled();
+    });
+
     it('does not reveal whether another nation owns a requested comment target', async () => {
         const fixture = buildContext({
             me: buildGeneral({ nationId: 3, officerLevel: 5 }),