샘플 관리자 토큰 검증 비활성화

.env.example

@@ -1,5 +1,6 @@
 CARGORADAR_PORT=8080
 ADMIN_TOKEN=
+ADMIN_AUTH_REQUIRED=false
 KAKAO_JAVASCRIPT_KEY=07f4728599ceaf4299f77c772a135423
 SIMULATOR_ENABLED=true
 SIMULATOR_INTERVAL_MS=4000

.env.nas.example

@@ -1,5 +1,6 @@
 CARGORADAR_PORT=18081
 ADMIN_TOKEN=change_this_admin_token
+ADMIN_AUTH_REQUIRED=false
 KAKAO_JAVASCRIPT_KEY=07f4728599ceaf4299f77c772a135423
 SIMULATOR_ENABLED=true
 SIMULATOR_INTERVAL_MS=4000

README.md

@@ -125,6 +125,18 @@ The default driver is:
 
 Change the token before real use.
 
+## Admin Access
+
+For sample/demo operation, admin API token checks are disabled by default:
+
+```text
+ADMIN_AUTH_REQUIRED=false
+```
+
+With this setting, the control screen works regardless of the admin token value
+entered in the URL or prompt. Before real deployment, set
+`ADMIN_AUTH_REQUIRED=true` and use a strong `ADMIN_TOKEN`.
+
 ## Test Simulator
 
 The built-in simulator creates 10 test vehicles with fixed device tokens and

apps/server/src/server.js

@@ -9,6 +9,7 @@ const PORT = Number(process.env.PORT || 8080);
 const DATA_DIR = process.env.DATA_DIR || path.resolve(__dirname, "..", "data");
 const WEB_ROOT = process.env.WEB_ROOT || path.resolve(__dirname, "..", "..", "web", "public");
 const ADMIN_TOKEN = process.env.ADMIN_TOKEN || "";
+const ADMIN_AUTH_REQUIRED = parseBoolean(process.env.ADMIN_AUTH_REQUIRED, false);
 const DEFAULT_KAKAO_JAVASCRIPT_KEY = "07f4728599ceaf4299f77c772a135423";
 const SIMULATOR_ENABLED = parseBoolean(process.env.SIMULATOR_ENABLED, true);
 const SIMULATOR_INTERVAL_MS = clampNumber(Number(process.env.SIMULATOR_INTERVAL_MS || 4000), 1000, 60000);
@@ -650,7 +651,7 @@ function addCorsHeaders(res) {
 }
 
 function authorizeAdmin(req, res) {
-  if (!ADMIN_TOKEN) return true;
+  if (!ADMIN_AUTH_REQUIRED || !ADMIN_TOKEN) return true;
 
   const token = extractToken(req, "x-admin-token");
   const requestUrl = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);

docs/SYNOLOGY.md

@@ -44,6 +44,7 @@ tested with `curl -k` while the certificate is being prepared.
 ```text
 CARGORADAR_PORT=8080
 ADMIN_TOKEN=
+ADMIN_AUTH_REQUIRED=false
 KAKAO_JAVASCRIPT_KEY=07f4728599ceaf4299f77c772a135423
 SIMULATOR_ENABLED=true
 SIMULATOR_INTERVAL_MS=4000
@@ -55,12 +56,15 @@ host port is `18081` because `18080` is already forwarded for `opendaw`.
 ```text
 CARGORADAR_PORT=18081
 ADMIN_TOKEN=change_this_admin_token
+ADMIN_AUTH_REQUIRED=false
 KAKAO_JAVASCRIPT_KEY=07f4728599ceaf4299f77c772a135423
 SIMULATOR_ENABLED=true
 SIMULATOR_INTERVAL_MS=4000
 ```
 
-`ADMIN_TOKEN` can stay blank during local MVP testing. For NAS exposure, set it.
+`ADMIN_AUTH_REQUIRED=false` keeps the sample control screen open regardless of
+the entered admin token. For real operation, set `ADMIN_AUTH_REQUIRED=true` and
+use a strong `ADMIN_TOKEN`.
 Set `SIMULATOR_ENABLED=false` when real Android phones are ready to provide
 driver locations.
 If opening the app directly by port, use: