샘플 관리자 토큰 검증 비활성화

apps/server/src/server.js

@@ -9,6 +9,7 @@ const PORT = Number(process.env.PORT || 8080);
 const DATA_DIR = process.env.DATA_DIR || path.resolve(__dirname, "..", "data");
 const WEB_ROOT = process.env.WEB_ROOT || path.resolve(__dirname, "..", "..", "web", "public");
 const ADMIN_TOKEN = process.env.ADMIN_TOKEN || "";
+const ADMIN_AUTH_REQUIRED = parseBoolean(process.env.ADMIN_AUTH_REQUIRED, false);
 const DEFAULT_KAKAO_JAVASCRIPT_KEY = "07f4728599ceaf4299f77c772a135423";
 const SIMULATOR_ENABLED = parseBoolean(process.env.SIMULATOR_ENABLED, true);
 const SIMULATOR_INTERVAL_MS = clampNumber(Number(process.env.SIMULATOR_INTERVAL_MS || 4000), 1000, 60000);
@@ -650,7 +651,7 @@ function addCorsHeaders(res) {
 }
 
 function authorizeAdmin(req, res) {
-  if (!ADMIN_TOKEN) return true;
+  if (!ADMIN_AUTH_REQUIRED || !ADMIN_TOKEN) return true;
 
   const token = extractToken(req, "x-admin-token");
   const requestUrl = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);