feat: Post 비공개 기능 추가

- Post 모델에 is_private 필드 추가
- 비공개 게시글은 작성자만 목록/상세에서 조회 가능
- 공개/비공개 토글 기능 지원

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

blog/views.py

@@ -11,6 +11,7 @@ from rest_framework.response import Response
 from rest_framework.views import APIView
 from rest_framework.parsers import MultiPartParser, FormParser
 from django.shortcuts import get_object_or_404
+from django.db.models import Q
 from .models import Post, Comment, Tag, Attachment
 from .serializers import PostSerializer, PostListSerializer, CommentSerializer, TagSerializer, AttachmentSerializer
 import logging
@@ -66,7 +67,25 @@ class PostListView(generics.ListAPIView):
     permission_classes = [permissions.AllowAny]
 
     def get_queryset(self):
-        queryset = Post.objects.all()
+        user = self.request.user
+
+        if user.is_authenticated:
+            # 로그인 사용자: 공개 게시글 + 자신의 비공개 게시글
+            user_id = str(getattr(user, 'id', '') or getattr(user, 'email', ''))
+            username = getattr(user, 'username', '') or getattr(user, 'email', '')
+
+            # 자신의 비공개 게시글 조건 (빈 문자열은 제외)
+            private_conditions = Q()
+            if user_id:
+                private_conditions |= Q(is_private=True, author_id=user_id)
+            if username:
+                private_conditions |= Q(is_private=True, author_name=username)
+
+            queryset = Post.objects.filter(Q(is_private=False) | private_conditions)
+        else:
+            # 비로그인 사용자: 공개 게시글만
+            queryset = Post.objects.filter(is_private=False)
+
         tag = self.request.query_params.get('tag')
         if tag:
             queryset = queryset.filter(tags__name=tag)
@@ -104,9 +123,21 @@ class PostDetailView(generics.RetrieveUpdateDestroyAPIView):
         return [permissions.AllowAny()]
 
     def retrieve(self, request, *args, **kwargs):
-        response = super().retrieve(request, *args, **kwargs)
-        logger.info(f"Post detail requested. ID: {kwargs.get('pk')}, Title: {response.data.get('title')}")
-        return response
+        instance = self.get_object()
+
+        # 비공개 게시글은 작성자만 조회 가능
+        if instance.is_private:
+            user = request.user
+            if not user.is_authenticated:
+                raise PermissionDenied("비공개 게시글입니다.")
+            user_id = str(getattr(user, 'id', '') or getattr(user, 'email', ''))
+            username = getattr(user, 'username', '') or getattr(user, 'email', '')
+            if instance.author_id != user_id and instance.author_name != username:
+                raise PermissionDenied("비공개 게시글입니다.")
+
+        serializer = self.get_serializer(instance)
+        logger.info(f"Post detail requested. ID: {kwargs.get('pk')}, Title: {serializer.data.get('title')}")
+        return Response(serializer.data)
 
     def perform_update(self, serializer):
         instance = serializer.instance