Phase 3 + 6

inventory-server/src/routes/data-management.js

@@ -1,13 +1,20 @@
-const express = require('express');
-const router = express.Router();
-const { spawn } = require('child_process');
-const path = require('path');
-const db = require('../utils/db');
+import express from 'express';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import db from '../utils/db.js';
+import { requirePermission } from '../../shared/auth/middleware.js';
 
-// Debug middleware MUST be first
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const router = express.Router();
+
+// Phase 6.2: CSV / full-update / full-reset / metrics-recalc are destructive.
+// Writes require data_management; reads (status polls, SSE streams) pass through.
 router.use((req, res, next) => {
-    console.log(`[CSV Route Debug] ${req.method} ${req.path}`);
-    next();
+    if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') return next();
+    return requirePermission('data_management')(req, res, next);
 });
 
 // Store active processes and their progress
@@ -437,4 +444,4 @@ router.get('/status/table-counts', async (req, res) => {
     }
 });
 
-module.exports = router; 
+export default router;