All checks were successful
farmcontrol/farmcontrol-api/pipeline/head This commit looks good
This commit updates various route handlers in the management and inventory modules to include permission checks using the `checkPermissions` middleware. The changes ensure that access to properties, values, and search functionalities for different entities (e.g., users, products, tax rates) is properly restricted based on user permissions. This enhancement improves the security and integrity of the application by enforcing role-based access control across multiple routes.
122 lines
3.6 KiB
JavaScript
122 lines
3.6 KiB
JavaScript
import express from 'express';
|
|
import { isAuthenticated } from '../../keycloak.js';
|
|
import { checkPermissions } from '../../database/permissions.js';
|
|
import { convertPropertiesString, getFilter, parseFilter, getSort } from '../../utils.js';
|
|
|
|
const router = express.Router();
|
|
|
|
const listAllowedFilters = [
|
|
'_id',
|
|
'material',
|
|
'material._id',
|
|
'diameter',
|
|
'name',
|
|
'cost',
|
|
'createdAt',
|
|
'updatedAt',
|
|
'_reference',
|
|
];
|
|
const listAllowedSorters = [
|
|
'name',
|
|
'createdAt',
|
|
'vendor',
|
|
'material',
|
|
'cost',
|
|
'costWithTax',
|
|
'updatedAt',
|
|
];
|
|
const propertiesAllowedFilters = ['diameter', 'material'];
|
|
import {
|
|
listFilamentsRouteHandler,
|
|
listFilamentsByPropertiesRouteHandler,
|
|
getFilamentRouteHandler,
|
|
editFilamentRouteHandler,
|
|
editMultipleFilamentsRouteHandler,
|
|
newFilamentRouteHandler,
|
|
deleteFilamentRouteHandler,
|
|
getFilamentStatsRouteHandler,
|
|
getFilamentHistoryRouteHandler,
|
|
searchFilamentsRouteHandler,
|
|
getFilamentPropertyValuesRouteHandler,
|
|
|
|
getFilamentNeighborsRouteHandler
|
|
} from '../../services/management/filaments.js';
|
|
|
|
// list of filaments
|
|
router.get('/', isAuthenticated, async (req, res) => {
|
|
const { page, limit, property, search, sort, order } = req.query;
|
|
|
|
|
|
var filter = {};
|
|
|
|
for (const [key, value] of Object.entries(req.query)) {
|
|
for (var i = 0; i < listAllowedFilters.length; i++) {
|
|
if (key == listAllowedFilters[i]) {
|
|
filter = { ...filter, ...(await parseFilter(key, value)) };
|
|
}
|
|
}
|
|
}
|
|
|
|
listFilamentsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
|
|
});
|
|
|
|
router.get('/properties', checkPermissions('filament', 'list'), isAuthenticated, async (req, res) => {
|
|
let properties = convertPropertiesString(req.query.properties);
|
|
const filter = await getFilter(req.query, propertiesAllowedFilters, false);
|
|
var masterFilter = {};
|
|
if (req.query.masterFilter) {
|
|
masterFilter = JSON.parse(req.query.masterFilter);
|
|
}
|
|
listFilamentsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
|
|
});
|
|
|
|
router.get('/values', checkPermissions('filament', 'list'), isAuthenticated, async (req, res) => {
|
|
const { property } = req.query;
|
|
getFilamentPropertyValuesRouteHandler(req, res, property);
|
|
});
|
|
|
|
router.get('/search', checkPermissions('filament', 'list'), isAuthenticated, async (req, res) => {
|
|
const { search } = req.query;
|
|
searchFilamentsRouteHandler(req, res, search);
|
|
});
|
|
|
|
router.post('/', isAuthenticated, checkPermissions('filament', 'new'), async (req, res) => {
|
|
newFilamentRouteHandler(req, res);
|
|
});
|
|
|
|
// get filament stats
|
|
router.get('/stats', isAuthenticated, async (req, res) => {
|
|
getFilamentStatsRouteHandler(req, res);
|
|
});
|
|
|
|
// get filaments history
|
|
router.get('/history', isAuthenticated, async (req, res) => {
|
|
getFilamentHistoryRouteHandler(req, res);
|
|
});
|
|
|
|
router.get('/neighbors', isAuthenticated, async (req, res) => {
|
|
const { property, search, sort, order, id } = req.query;
|
|
const filter = await getFilter(req.query, listAllowedFilters);
|
|
getFilamentNeighborsRouteHandler(req, res, property, filter, search, getSort(sort, listAllowedSorters), order, id);
|
|
});
|
|
|
|
router.get('/:id', isAuthenticated, async (req, res) => {
|
|
getFilamentRouteHandler(req, res);
|
|
});
|
|
|
|
// update filaments info
|
|
router.put('/', isAuthenticated, checkPermissions('filament', 'edit'), async (req, res) => {
|
|
editMultipleFilamentsRouteHandler(req, res);
|
|
});
|
|
|
|
// update filament info
|
|
router.put('/:id', isAuthenticated, checkPermissions('filament', 'edit'), async (req, res) => {
|
|
editFilamentRouteHandler(req, res);
|
|
});
|
|
|
|
router.delete('/:id', isAuthenticated, async (req, res) => {
|
|
deleteFilamentRouteHandler(req, res);
|
|
});
|
|
|
|
export default router;
|