Tom Butcher e8c9a307ab
All checks were successful
farmcontrol/farmcontrol-api/pipeline/head This commit looks good
Enhance route permission checks across management and inventory modules
This commit updates various route handlers in the management and inventory modules to include permission checks using the `checkPermissions` middleware. The changes ensure that access to properties, values, and search functionalities for different entities (e.g., users, products, tax rates) is properly restricted based on user permissions. This enhancement improves the security and integrity of the application by enforcing role-based access control across multiple routes.
2026-08-20 20:15:07 +01:00

122 lines
3.6 KiB
JavaScript

import express from 'express';
import { isAuthenticated } from '../../keycloak.js';
import { checkPermissions } from '../../database/permissions.js';
import { convertPropertiesString, getFilter, parseFilter, getSort } from '../../utils.js';
const router = express.Router();
const listAllowedFilters = [
'_id',
'material',
'material._id',
'diameter',
'name',
'cost',
'createdAt',
'updatedAt',
'_reference',
];
const listAllowedSorters = [
'name',
'createdAt',
'vendor',
'material',
'cost',
'costWithTax',
'updatedAt',
];
const propertiesAllowedFilters = ['diameter', 'material'];
import {
listFilamentsRouteHandler,
listFilamentsByPropertiesRouteHandler,
getFilamentRouteHandler,
editFilamentRouteHandler,
editMultipleFilamentsRouteHandler,
newFilamentRouteHandler,
deleteFilamentRouteHandler,
getFilamentStatsRouteHandler,
getFilamentHistoryRouteHandler,
searchFilamentsRouteHandler,
getFilamentPropertyValuesRouteHandler,
getFilamentNeighborsRouteHandler
} from '../../services/management/filaments.js';
// list of filaments
router.get('/', isAuthenticated, async (req, res) => {
const { page, limit, property, search, sort, order } = req.query;
var filter = {};
for (const [key, value] of Object.entries(req.query)) {
for (var i = 0; i < listAllowedFilters.length; i++) {
if (key == listAllowedFilters[i]) {
filter = { ...filter, ...(await parseFilter(key, value)) };
}
}
}
listFilamentsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
});
router.get('/properties', checkPermissions('filament', 'list'), isAuthenticated, async (req, res) => {
let properties = convertPropertiesString(req.query.properties);
const filter = await getFilter(req.query, propertiesAllowedFilters, false);
var masterFilter = {};
if (req.query.masterFilter) {
masterFilter = JSON.parse(req.query.masterFilter);
}
listFilamentsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
});
router.get('/values', checkPermissions('filament', 'list'), isAuthenticated, async (req, res) => {
const { property } = req.query;
getFilamentPropertyValuesRouteHandler(req, res, property);
});
router.get('/search', checkPermissions('filament', 'list'), isAuthenticated, async (req, res) => {
const { search } = req.query;
searchFilamentsRouteHandler(req, res, search);
});
router.post('/', isAuthenticated, checkPermissions('filament', 'new'), async (req, res) => {
newFilamentRouteHandler(req, res);
});
// get filament stats
router.get('/stats', isAuthenticated, async (req, res) => {
getFilamentStatsRouteHandler(req, res);
});
// get filaments history
router.get('/history', isAuthenticated, async (req, res) => {
getFilamentHistoryRouteHandler(req, res);
});
router.get('/neighbors', isAuthenticated, async (req, res) => {
const { property, search, sort, order, id } = req.query;
const filter = await getFilter(req.query, listAllowedFilters);
getFilamentNeighborsRouteHandler(req, res, property, filter, search, getSort(sort, listAllowedSorters), order, id);
});
router.get('/:id', isAuthenticated, async (req, res) => {
getFilamentRouteHandler(req, res);
});
// update filaments info
router.put('/', isAuthenticated, checkPermissions('filament', 'edit'), async (req, res) => {
editMultipleFilamentsRouteHandler(req, res);
});
// update filament info
router.put('/:id', isAuthenticated, checkPermissions('filament', 'edit'), async (req, res) => {
editFilamentRouteHandler(req, res);
});
router.delete('/:id', isAuthenticated, async (req, res) => {
deleteFilamentRouteHandler(req, res);
});
export default router;