From e2c6a50b4681a05c6fd5136cbfb96ddfbff1a02c Mon Sep 17 00:00:00 2001
From: king <heoseungpil@gmail.com>
Date: Sat, 30 May 2026 21:27:10 +0900
Subject: [PATCH] =?UTF-8?q?feat(vacation):=20=EA=B4=80=EB=A6=AC=EC=9E=90?=
 =?UTF-8?q?=EB=8A=94=20=EB=AA=A8=EB=93=A0=20=EC=83=81=ED=83=9C(=EC=8A=B9?=
 =?UTF-8?q?=EC=9D=B8/=EC=B7=A8=EC=86=8C=20=ED=8F=AC=ED=95=A8)=20=ED=9C=B4?=
 =?UTF-8?q?=EA=B0=80=20=EC=82=AD=EC=A0=9C=20=EA=B0=80=EB=8A=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 app/modules/vacation/db.py                    | 15 +++++---
 .../vacation/templates/vacation/detail.html   | 34 ++++++++++++-------
 2 files changed, 31 insertions(+), 18 deletions(-)

diff --git a/app/modules/vacation/db.py b/app/modules/vacation/db.py
index cdd7eca..1f812dd 100644
--- a/app/modules/vacation/db.py
+++ b/app/modules/vacation/db.py
@@ -352,15 +352,20 @@ class VacationDBStore:
         return self._req_serialize(row)
 
     def hard_delete(self, *, request_id: str, user_email: str, is_admin: bool) -> None:
-        """완전 삭제. 승인 전(작성중/제출/반려)만 허용. owner 또는 admin."""
+        """완전 삭제.
+
+        - 관리자(is_admin): 모든 상태 삭제 가능.
+        - 일반 사용자: 본인 + 승인 전(작성중/제출/반려)만. 승인/취소 건은 불가.
+        """
         user_email = user_email.lower().strip()
         current = self.get_request(request_id=request_id)
         if not current:
             raise KeyError(request_id)
-        if not is_admin and current["owner"] != user_email:
-            raise PermissionError("본인 신청만 삭제할 수 있습니다.")
-        if current["status"] == "승인":
-            raise ValueError("승인된 휴가는 삭제할 수 없습니다. 취소 처리하세요.")
+        if not is_admin:
+            if current["owner"] != user_email:
+                raise PermissionError("본인 신청만 삭제할 수 있습니다.")
+            if current["status"] not in ("작성중", "제출", "반려"):
+                raise ValueError("승인/취소된 휴가는 삭제할 수 없습니다. (관리자 문의)")
         with self._pool.connection() as conn:
             cur = conn.execute(
                 "DELETE FROM vacation_requests WHERE id = %s", (request_id,)
diff --git a/app/modules/vacation/templates/vacation/detail.html b/app/modules/vacation/templates/vacation/detail.html
index 72f13c1..1dbc25e 100644
--- a/app/modules/vacation/templates/vacation/detail.html
+++ b/app/modules/vacation/templates/vacation/detail.html
@@ -1,6 +1,6 @@
 {% extends "erp_base.html" %}
 
-{% block head_extra %}<link rel="stylesheet" href="/static/vacation.css?v=20260530i" />{% endblock %}
+{% block head_extra %}<link rel="stylesheet" href="/static/vacation.css?v=20260530j" />{% endblock %}
 
 {% block content %}
 <section class="vac">
@@ -65,18 +65,26 @@
       </form>
       {% endif %}
 
-      {% if (is_owner or is_admin) %}
-        {% if req.status == '승인' %}
-        <form method="post" action="/vacation/{{ req.id }}/cancel" class="vac-inline-form"
-              onsubmit="return confirm('승인된 휴가를 취소 처리할까요?');">
-          <button type="submit" class="erp-btn erp-btn-outline">취소처리</button>
-        </form>
-        {% elif req.status in ('작성중', '제출', '반려') %}
-        <form method="post" action="/vacation/{{ req.id }}/delete" class="vac-inline-form"
-              onsubmit="return confirm('이 휴가 신청을 삭제할까요? (복구 불가)');">
-          <button type="submit" class="erp-btn erp-btn-danger">삭제</button>
-        </form>
-        {% endif %}
+      {# 승인 건: 취소처리(owner/admin). 미승인: 삭제(owner/admin). 관리자는 모든 상태 삭제 가능. #}
+      {% if req.status == '승인' and (is_owner or is_admin) %}
+      <form method="post" action="/vacation/{{ req.id }}/cancel" class="vac-inline-form"
+            onsubmit="return confirm('승인된 휴가를 취소 처리할까요?');">
+        <button type="submit" class="erp-btn erp-btn-outline">취소처리</button>
+      </form>
+      {% endif %}
+
+      {% if req.status in ('작성중', '제출', '반려') and (is_owner or is_admin) %}
+      <form method="post" action="/vacation/{{ req.id }}/delete" class="vac-inline-form"
+            onsubmit="return confirm('이 휴가 신청을 삭제할까요? (복구 불가)');">
+        <button type="submit" class="erp-btn erp-btn-danger">삭제</button>
+      </form>
+      {% endif %}
+
+      {% if is_admin and req.status in ('승인', '취소') %}
+      <form method="post" action="/vacation/{{ req.id }}/delete" class="vac-inline-form"
+            onsubmit="return confirm('[관리자] 이 휴가({{ req.status }})를 완전 삭제할까요? (복구 불가)');">
+        <button type="submit" class="erp-btn erp-btn-danger">삭제</button>
+      </form>
       {% endif %}
 
       {% if can_edit %}