Phase 3 + 6

inventory-server/src/routes/templates.js

@@ -1,12 +1,23 @@
-const express = require('express');
-const { getPool } = require('../utils/db');
-const dotenv = require('dotenv');
-const path = require('path');
+import express from 'express';
+import dotenv from 'dotenv';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getPool } from '../utils/db.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
 
 dotenv.config({ path: path.join(__dirname, "../../.env") });
 
 const router = express.Router();
 
+// Phase 6.2: template edits require templates_write. Reads pass through.
+import { requirePermission } from '../../shared/auth/middleware.js';
+router.use((req, res, next) => {
+  if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') return next();
+  return requirePermission('templates_write')(req, res, next);
+});
+
 // Get all templates
 router.get('/', async (req, res) => {
   try {
@@ -278,4 +289,4 @@ router.use((err, req, res, next) => {
   });
 });
 
-module.exports = router; 
+export default router;