403 lines
11 KiB
JavaScript
403 lines
11 KiB
JavaScript
const express = require('express');
|
|
const router = express.Router();
|
|
const pool = global.pool;
|
|
const bcrypt = require('bcrypt');
|
|
const jwt = require('jsonwebtoken');
|
|
const { requirePermission, getUserPermissions } = require('./permissions');
|
|
|
|
// Authentication middleware
|
|
const authenticate = async (req, res, next) => {
|
|
try {
|
|
const authHeader = req.headers.authorization;
|
|
if (!authHeader || !authHeader.startsWith('Bearer ')) {
|
|
return res.status(401).json({ error: 'Authentication required' });
|
|
}
|
|
|
|
const token = authHeader.split(' ')[1];
|
|
const decoded = jwt.verify(token, process.env.JWT_SECRET);
|
|
|
|
// Get user from database
|
|
const result = await pool.query(
|
|
'SELECT id, username, is_admin FROM users WHERE id = $1',
|
|
[decoded.userId]
|
|
);
|
|
|
|
if (result.rows.length === 0) {
|
|
return res.status(401).json({ error: 'User not found' });
|
|
}
|
|
|
|
// Attach user to request
|
|
req.user = result.rows[0];
|
|
next();
|
|
} catch (error) {
|
|
console.error('Authentication error:', error);
|
|
res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
};
|
|
|
|
// Login route
|
|
router.post('/login', async (req, res) => {
|
|
try {
|
|
const { username, password } = req.body;
|
|
|
|
// Get user from database
|
|
const result = await pool.query(
|
|
'SELECT id, username, password, is_admin, is_active FROM users WHERE username = $1',
|
|
[username]
|
|
);
|
|
|
|
if (result.rows.length === 0) {
|
|
return res.status(401).json({ error: 'Invalid username or password' });
|
|
}
|
|
|
|
const user = result.rows[0];
|
|
|
|
// Check if user is active
|
|
if (!user.is_active) {
|
|
return res.status(403).json({ error: 'Account is inactive' });
|
|
}
|
|
|
|
// Verify password
|
|
const validPassword = await bcrypt.compare(password, user.password);
|
|
if (!validPassword) {
|
|
return res.status(401).json({ error: 'Invalid username or password' });
|
|
}
|
|
|
|
// Update last login
|
|
await pool.query(
|
|
'UPDATE users SET last_login = CURRENT_TIMESTAMP WHERE id = $1',
|
|
[user.id]
|
|
);
|
|
|
|
// Generate JWT
|
|
const token = jwt.sign(
|
|
{ userId: user.id, username: user.username },
|
|
process.env.JWT_SECRET,
|
|
{ expiresIn: '8h' }
|
|
);
|
|
|
|
// Get user permissions
|
|
const permissions = await getUserPermissions(user.id);
|
|
|
|
res.json({
|
|
token,
|
|
user: {
|
|
id: user.id,
|
|
username: user.username,
|
|
is_admin: user.is_admin,
|
|
permissions
|
|
}
|
|
});
|
|
} catch (error) {
|
|
console.error('Login error:', error);
|
|
res.status(500).json({ error: 'Server error' });
|
|
}
|
|
});
|
|
|
|
// Get current user
|
|
router.get('/me', authenticate, async (req, res) => {
|
|
try {
|
|
// Get user permissions
|
|
const permissions = await getUserPermissions(req.user.id);
|
|
|
|
res.json({
|
|
id: req.user.id,
|
|
username: req.user.username,
|
|
is_admin: req.user.is_admin,
|
|
permissions
|
|
});
|
|
} catch (error) {
|
|
console.error('Error getting current user:', error);
|
|
res.status(500).json({ error: 'Server error' });
|
|
}
|
|
});
|
|
|
|
// Get all users
|
|
router.get('/users', authenticate, requirePermission('view:users'), async (req, res) => {
|
|
try {
|
|
const result = await pool.query(`
|
|
SELECT id, username, email, is_admin, is_active, created_at, last_login
|
|
FROM users
|
|
ORDER BY username
|
|
`);
|
|
|
|
res.json(result.rows);
|
|
} catch (error) {
|
|
console.error('Error getting users:', error);
|
|
res.status(500).json({ error: 'Server error' });
|
|
}
|
|
});
|
|
|
|
// Get user with permissions
|
|
router.get('/users/:id', authenticate, requirePermission('view:users'), async (req, res) => {
|
|
try {
|
|
const userId = req.params.id;
|
|
|
|
// Get user details
|
|
const userResult = await pool.query(`
|
|
SELECT id, username, email, is_admin, is_active, created_at, last_login
|
|
FROM users
|
|
WHERE id = $1
|
|
`, [userId]);
|
|
|
|
if (userResult.rows.length === 0) {
|
|
return res.status(404).json({ error: 'User not found' });
|
|
}
|
|
|
|
// Get user permissions
|
|
const permissionsResult = await pool.query(`
|
|
SELECT p.id, p.name, p.code, p.category, p.description
|
|
FROM permissions p
|
|
JOIN user_permissions up ON p.id = up.permission_id
|
|
WHERE up.user_id = $1
|
|
ORDER BY p.category, p.name
|
|
`, [userId]);
|
|
|
|
// Combine user and permissions
|
|
const user = {
|
|
...userResult.rows[0],
|
|
permissions: permissionsResult.rows
|
|
};
|
|
|
|
res.json(user);
|
|
} catch (error) {
|
|
console.error('Error getting user:', error);
|
|
res.status(500).json({ error: 'Server error' });
|
|
}
|
|
});
|
|
|
|
// Create new user
|
|
router.post('/users', authenticate, requirePermission('create:users'), async (req, res) => {
|
|
const client = await pool.connect();
|
|
|
|
try {
|
|
const { username, email, password, is_admin, is_active, permissions } = req.body;
|
|
|
|
// Validate required fields
|
|
if (!username || !password) {
|
|
return res.status(400).json({ error: 'Username and password are required' });
|
|
}
|
|
|
|
// Check if username is taken
|
|
const existingUser = await client.query(
|
|
'SELECT id FROM users WHERE username = $1',
|
|
[username]
|
|
);
|
|
|
|
if (existingUser.rows.length > 0) {
|
|
return res.status(400).json({ error: 'Username already exists' });
|
|
}
|
|
|
|
// Start transaction
|
|
await client.query('BEGIN');
|
|
|
|
// Hash password
|
|
const saltRounds = 10;
|
|
const hashedPassword = await bcrypt.hash(password, saltRounds);
|
|
|
|
// Insert new user
|
|
const userResult = await client.query(`
|
|
INSERT INTO users (username, email, password, is_admin, is_active, created_at)
|
|
VALUES ($1, $2, $3, $4, $5, CURRENT_TIMESTAMP)
|
|
RETURNING id
|
|
`, [username, email || null, hashedPassword, !!is_admin, is_active !== false]);
|
|
|
|
const userId = userResult.rows[0].id;
|
|
|
|
// Assign permissions if provided and not admin
|
|
if (!is_admin && Array.isArray(permissions) && permissions.length > 0) {
|
|
const permissionValues = permissions
|
|
.map(permId => `(${userId}, ${parseInt(permId, 10)})`)
|
|
.join(',');
|
|
|
|
await client.query(`
|
|
INSERT INTO user_permissions (user_id, permission_id)
|
|
VALUES ${permissionValues}
|
|
ON CONFLICT DO NOTHING
|
|
`);
|
|
}
|
|
|
|
await client.query('COMMIT');
|
|
|
|
res.status(201).json({
|
|
id: userId,
|
|
message: 'User created successfully'
|
|
});
|
|
} catch (error) {
|
|
await client.query('ROLLBACK');
|
|
console.error('Error creating user:', error);
|
|
res.status(500).json({ error: 'Server error' });
|
|
} finally {
|
|
client.release();
|
|
}
|
|
});
|
|
|
|
// Update user
|
|
router.put('/users/:id', authenticate, requirePermission('edit:users'), async (req, res) => {
|
|
const client = await pool.connect();
|
|
|
|
try {
|
|
const userId = req.params.id;
|
|
const { username, email, password, is_admin, is_active, permissions } = req.body;
|
|
|
|
// Check if user exists
|
|
const userExists = await client.query(
|
|
'SELECT id FROM users WHERE id = $1',
|
|
[userId]
|
|
);
|
|
|
|
if (userExists.rows.length === 0) {
|
|
return res.status(404).json({ error: 'User not found' });
|
|
}
|
|
|
|
// Start transaction
|
|
await client.query('BEGIN');
|
|
|
|
// Build update fields
|
|
const updateFields = [];
|
|
const updateValues = [userId]; // First parameter is the user ID
|
|
let paramIndex = 2;
|
|
|
|
if (username !== undefined) {
|
|
updateFields.push(`username = $${paramIndex++}`);
|
|
updateValues.push(username);
|
|
}
|
|
|
|
if (email !== undefined) {
|
|
updateFields.push(`email = $${paramIndex++}`);
|
|
updateValues.push(email || null);
|
|
}
|
|
|
|
if (is_admin !== undefined) {
|
|
updateFields.push(`is_admin = $${paramIndex++}`);
|
|
updateValues.push(!!is_admin);
|
|
}
|
|
|
|
if (is_active !== undefined) {
|
|
updateFields.push(`is_active = $${paramIndex++}`);
|
|
updateValues.push(!!is_active);
|
|
}
|
|
|
|
// Update password if provided
|
|
if (password) {
|
|
const saltRounds = 10;
|
|
const hashedPassword = await bcrypt.hash(password, saltRounds);
|
|
updateFields.push(`password = $${paramIndex++}`);
|
|
updateValues.push(hashedPassword);
|
|
}
|
|
|
|
// Update user if there are fields to update
|
|
if (updateFields.length > 0) {
|
|
updateFields.push(`updated_at = CURRENT_TIMESTAMP`);
|
|
|
|
await client.query(`
|
|
UPDATE users
|
|
SET ${updateFields.join(', ')}
|
|
WHERE id = $1
|
|
`, updateValues);
|
|
}
|
|
|
|
// Update permissions if provided
|
|
if (Array.isArray(permissions)) {
|
|
// First remove existing permissions
|
|
await client.query(
|
|
'DELETE FROM user_permissions WHERE user_id = $1',
|
|
[userId]
|
|
);
|
|
|
|
// Add new permissions if any and not admin
|
|
const newIsAdmin = is_admin !== undefined ? is_admin : (await client.query('SELECT is_admin FROM users WHERE id = $1', [userId])).rows[0].is_admin;
|
|
|
|
if (!newIsAdmin && permissions.length > 0) {
|
|
const permissionValues = permissions
|
|
.map(permId => `(${userId}, ${parseInt(permId, 10)})`)
|
|
.join(',');
|
|
|
|
await client.query(`
|
|
INSERT INTO user_permissions (user_id, permission_id)
|
|
VALUES ${permissionValues}
|
|
ON CONFLICT DO NOTHING
|
|
`);
|
|
}
|
|
}
|
|
|
|
await client.query('COMMIT');
|
|
|
|
res.json({ message: 'User updated successfully' });
|
|
} catch (error) {
|
|
await client.query('ROLLBACK');
|
|
console.error('Error updating user:', error);
|
|
res.status(500).json({ error: 'Server error' });
|
|
} finally {
|
|
client.release();
|
|
}
|
|
});
|
|
|
|
// Delete user
|
|
router.delete('/users/:id', authenticate, requirePermission('delete:users'), async (req, res) => {
|
|
try {
|
|
const userId = req.params.id;
|
|
|
|
// Check that user is not deleting themselves
|
|
if (req.user.id === parseInt(userId, 10)) {
|
|
return res.status(400).json({ error: 'Cannot delete your own account' });
|
|
}
|
|
|
|
// Delete user (this will cascade to user_permissions due to FK constraints)
|
|
const result = await pool.query(
|
|
'DELETE FROM users WHERE id = $1 RETURNING id',
|
|
[userId]
|
|
);
|
|
|
|
if (result.rows.length === 0) {
|
|
return res.status(404).json({ error: 'User not found' });
|
|
}
|
|
|
|
res.json({ message: 'User deleted successfully' });
|
|
} catch (error) {
|
|
console.error('Error deleting user:', error);
|
|
res.status(500).json({ error: 'Server error' });
|
|
}
|
|
});
|
|
|
|
// Get all permissions grouped by category
|
|
router.get('/permissions/categories', authenticate, requirePermission('view:users'), async (req, res) => {
|
|
try {
|
|
const result = await pool.query(`
|
|
SELECT category, json_agg(
|
|
json_build_object(
|
|
'id', id,
|
|
'name', name,
|
|
'code', code,
|
|
'description', description
|
|
) ORDER BY name
|
|
) as permissions
|
|
FROM permissions
|
|
GROUP BY category
|
|
ORDER BY category
|
|
`);
|
|
|
|
res.json(result.rows);
|
|
} catch (error) {
|
|
console.error('Error getting permissions:', error);
|
|
res.status(500).json({ error: 'Server error' });
|
|
}
|
|
});
|
|
|
|
// Get all permissions
|
|
router.get('/permissions', authenticate, requirePermission('view:users'), async (req, res) => {
|
|
try {
|
|
const result = await pool.query(`
|
|
SELECT *
|
|
FROM permissions
|
|
ORDER BY category, name
|
|
`);
|
|
|
|
res.json(result.rows);
|
|
} catch (error) {
|
|
console.error('Error getting permissions:', error);
|
|
res.status(500).json({ error: 'Server error' });
|
|
}
|
|
});
|
|
|
|
module.exports = router;
|