farmcontrol-api/src/routes/management/documenttemplates.js
Tom Butcher e8c9a307ab
All checks were successful
farmcontrol/farmcontrol-api/pipeline/head This commit looks good
Enhance route permission checks across management and inventory modules
This commit updates various route handlers in the management and inventory modules to include permission checks using the `checkPermissions` middleware. The changes ensure that access to properties, values, and search functionalities for different entities (e.g., users, products, tax rates) is properly restricted based on user permissions. This enhancement improves the security and integrity of the application by enforcing role-based access control across multiple routes.
2026-08-20 20:15:07 +01:00

122 lines
4.1 KiB
JavaScript

import express from 'express';
import { isAuthenticated } from '../../keycloak.js';
import { checkPermissions } from '../../database/permissions.js';
import { getFilter, convertPropertiesString, getSort } from '../../utils.js';
const router = express.Router();
const listAllowedFilters = [
'name',
'tags',
'active',
'global',
'parent',
'parent._id',
'documentSize',
'documentSize._id',
'objectType',
'createdAt',
'updatedAt',
'_reference',
];
const listAllowedSorters = [
'name',
'parent',
'documentSize',
'createdAt',
'updatedAt',
'active',
'global',
'objectType',
];
const propertiesAllowedFilters = ['documentSize', 'tags'];
import {
listDocumentTemplatesRouteHandler,
getDocumentTemplateRouteHandler,
editDocumentTemplateRouteHandler,
newDocumentTemplateRouteHandler,
deleteDocumentTemplateRouteHandler,
listDocumentTemplatesByPropertiesRouteHandler,
getDocumentTemplateStatsRouteHandler,
getDocumentTemplateHistoryRouteHandler,
getDocumentTemplatePropertyValuesRouteHandler,
searchDocumentTemplatesRouteHandler,
getDocumentTemplateNeighborsRouteHandler,
previewDocumentTemplateRouteHandler,
downloadDocumentTemplateRouteHandler,
formatDocumentTemplateRouteHandler,
} from '../../services/management/documenttemplates.js';
// list of document templates
router.get('/', isAuthenticated, async (req, res) => {
const { page, limit, property, search, sort, order } = req.query;
const filter = await getFilter(req.query, listAllowedFilters);
listDocumentTemplatesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
});
router.get('/properties', checkPermissions('documentTemplate', 'list'), isAuthenticated, async (req, res) => {
let properties = convertPropertiesString(req.query.properties);
const filter = await getFilter(req.query, propertiesAllowedFilters, false);
var masterFilter = {};
if (req.query.masterFilter) {
masterFilter = JSON.parse(req.query.masterFilter);
}
listDocumentTemplatesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
});
router.get('/values', checkPermissions('documentTemplate', 'list'), isAuthenticated, async (req, res) => {
const { property } = req.query;
getDocumentTemplatePropertyValuesRouteHandler(req, res, property);
});
router.get('/search', checkPermissions('documentTemplate', 'list'), isAuthenticated, async (req, res) => {
const { search } = req.query;
searchDocumentTemplatesRouteHandler(req, res, search);
});
router.post('/', isAuthenticated, checkPermissions('documentTemplate', 'new'), async (req, res) => {
newDocumentTemplateRouteHandler(req, res);
});
router.post('/format', isAuthenticated, checkPermissions('documentTemplate', 'design'), async (req, res) => {
formatDocumentTemplateRouteHandler(req, res);
});
// get document template stats
router.get('/stats', isAuthenticated, async (req, res) => {
getDocumentTemplateStatsRouteHandler(req, res);
});
// get document template history
router.get('/history', isAuthenticated, async (req, res) => {
getDocumentTemplateHistoryRouteHandler(req, res);
});
router.get('/neighbors', isAuthenticated, async (req, res) => {
const { property, search, sort, order, id } = req.query;
const filter = await getFilter(req.query, listAllowedFilters);
getDocumentTemplateNeighborsRouteHandler(req, res, property, filter, search, getSort(sort, listAllowedSorters), order, id);
});
router.post('/:id/preview', isAuthenticated, checkPermissions('documentTemplate', 'design'), async (req, res) => {
previewDocumentTemplateRouteHandler(req, res);
});
router.post('/:id/download', isAuthenticated, checkPermissions('documentTemplate', 'design'), async (req, res) => {
downloadDocumentTemplateRouteHandler(req, res);
});
router.get('/:id', isAuthenticated, async (req, res) => {
getDocumentTemplateRouteHandler(req, res);
});
router.put('/:id', isAuthenticated, checkPermissions('documentTemplate', 'edit'), async (req, res) => {
editDocumentTemplateRouteHandler(req, res);
});
router.delete('/:id', isAuthenticated, async (req, res) => {
deleteDocumentTemplateRouteHandler(req, res);
});
export default router;