From 4022ccf7e78380a6b55d63f4456c331417a86a2e Mon Sep 17 00:00:00 2001
From: Hyoseong Jo <coziny@osolit.net>
Date: Sun, 11 Jan 2026 22:05:46 +0900
Subject: [PATCH] =?UTF-8?q?feat:=20=EB=B9=84=EB=B0=80=EB=B2=88=ED=98=B8=20?=
 =?UTF-8?q?=EC=B0=BE=EA=B8=B0=20=ED=9C=B4=EB=8C=80=ED=8F=B0=20=EB=B2=88?=
 =?UTF-8?q?=ED=98=B8=20=ED=95=84=EC=88=98=20=EC=9E=85=EB=A0=A5=EC=9C=BC?=
 =?UTF-8?q?=EB=A1=9C=20=EB=B3=80=EA=B2=BD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 휴대폰 번호 선택 → 필수 입력으로 변경
- 이메일: 양쪽 모두 소문자로 비교
- 핸드폰: 양쪽 모두 숫자만 추출하여 비교 (하이픈, 공백 등 제거)
---
 frontend/forgot-password.vue           |  8 ++++----
 server/api/auth/reset-password.post.ts | 27 +++++++++++++-------------
 2 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/frontend/forgot-password.vue b/frontend/forgot-password.vue
index 639493f..e3a0149 100644
--- a/frontend/forgot-password.vue
+++ b/frontend/forgot-password.vue
@@ -19,8 +19,8 @@
               <input type="text" class="form-control" v-model="name" placeholder="홍길동" required />
             </div>
             <div class="mb-3">
-              <label class="form-label">휴대폰 번호 <small class="text-muted">(선택)</small></label>
-              <input type="tel" class="form-control" v-model="phone" placeholder="010-1234-5678" />
+              <label class="form-label">휴대폰 번호</label>
+              <input type="tel" class="form-control" v-model="phone" placeholder="010-1234-5678" required />
             </div>
             <button type="submit" class="btn btn-warning w-100" :disabled="isSubmitting">
               <span v-if="isSubmitting"><span class="spinner-border spinner-border-sm me-2"></span>처리 중...</span>
@@ -64,13 +64,13 @@ const isComplete = ref(false)
 const resultMessage = ref('')
 
 async function handleSubmit() {
-  if (!email.value || !name.value) return
+  if (!email.value || !name.value || !phone.value) return
   isSubmitting.value = true
   errorMessage.value = ''
   try {
     const res = await $fetch<{ message: string }>('/api/auth/reset-password', {
       method: 'POST',
-      body: { email: email.value, name: name.value, phone: phone.value || undefined }
+      body: { email: email.value, name: name.value, phone: phone.value }
     })
     resultMessage.value = res.message
     isComplete.value = true
diff --git a/server/api/auth/reset-password.post.ts b/server/api/auth/reset-password.post.ts
index 9a2ae90..c39367e 100644
--- a/server/api/auth/reset-password.post.ts
+++ b/server/api/auth/reset-password.post.ts
@@ -6,7 +6,7 @@ import { getClientIp } from '../../utils/ip'
 interface ResetPasswordBody {
   email: string
   name: string
-  phone?: string
+  phone: string
 }
 
 /**
@@ -17,23 +17,24 @@ export default defineEventHandler(async (event) => {
   const body = await readBody<ResetPasswordBody>(event)
   const clientIp = getClientIp(event)
   
-  if (!body.email || !body.name) {
-    throw createError({ statusCode: 400, message: '이메일과 이름을 입력해주세요.' })
+  if (!body.email || !body.name || !body.phone) {
+    throw createError({ statusCode: 400, message: '이메일, 이름, 휴대폰 번호를 입력해주세요.' })
   }
   
   const emailLower = body.email.toLowerCase()
   const nameTrimmed = body.name.trim()
   
-  // 사용자 조회 (이메일 + 이름)
-  let sql = `SELECT * FROM wr_employee_info WHERE employee_email = $1 AND employee_name = $2`
-  const params: any[] = [emailLower, nameTrimmed]
-  
-  // 핸드폰 번호도 제공된 경우 추가 검증
-  if (body.phone) {
-    const phoneClean = body.phone.replace(/[^0-9]/g, '')
-    sql += ` AND REPLACE(employee_phone, '-', '') = $3`
-    params.push(phoneClean)
-  }
+  // 사용자 조회 (이메일 + 이름 + 핸드폰)
+  // 이메일: 양쪽 모두 소문자로 비교
+  // 핸드폰: 양쪽 모두 숫자만 추출해서 비교
+  const sql = `
+    SELECT * FROM wr_employee_info 
+    WHERE LOWER(employee_email) = $1 
+      AND employee_name = $2
+      AND REGEXP_REPLACE(employee_phone, '[^0-9]', '', 'g') = $3
+  `
+  const phoneClean = body.phone.replace(/[^0-9]/g, '')
+  const params: any[] = [emailLower, nameTrimmed, phoneClean]
   
   const employees = await query<any>(sql, params)