All checks were successful
farmcontrol/farmcontrol-api/pipeline/head This commit looks good
This commit updates various route handlers in the management and inventory modules to include permission checks using the `checkPermissions` middleware. The changes ensure that access to properties, values, and search functionalities for different entities (e.g., users, products, tax rates) is properly restricted based on user permissions. This enhancement improves the security and integrity of the application by enforcing role-based access control across multiple routes.
113 lines
4.0 KiB
JavaScript
113 lines
4.0 KiB
JavaScript
import express from 'express';
|
|
import { isAuthenticated } from '../../keycloak.js';
|
|
import { checkPermissions } from '../../database/permissions.js';
|
|
import { getFilter, convertPropertiesString, getSort } from '../../utils.js';
|
|
|
|
const router = express.Router();
|
|
|
|
const listAllowedFilters = [
|
|
'client',
|
|
'client._id',
|
|
'state',
|
|
'value',
|
|
'createdAt',
|
|
'updatedAt',
|
|
'_reference',
|
|
];
|
|
const listAllowedSorters = ['createdAt', 'state', 'updatedAt'];
|
|
const propertiesAllowedFilters = ['client', 'state.type', 'value', 'client._id'];
|
|
import {
|
|
listSalesOrdersRouteHandler,
|
|
getSalesOrderRouteHandler,
|
|
editSalesOrderRouteHandler,
|
|
editMultipleSalesOrdersRouteHandler,
|
|
newSalesOrderRouteHandler,
|
|
deleteSalesOrderRouteHandler,
|
|
listSalesOrdersByPropertiesRouteHandler,
|
|
getSalesOrderStatsRouteHandler,
|
|
getSalesOrderHistoryRouteHandler,
|
|
postSalesOrderRouteHandler,
|
|
confirmSalesOrderRouteHandler,
|
|
cancelSalesOrderRouteHandler,
|
|
searchSalesOrdersRouteHandler,
|
|
getSalesOrderPropertyValuesRouteHandler,
|
|
getSalesOrderNeighborsRouteHandler,
|
|
} from '../../services/sales/salesorders.js';
|
|
|
|
// list of sales orders
|
|
router.get('/', isAuthenticated, async (req, res) => {
|
|
const { page, limit, property, search, sort, order } = req.query;
|
|
const filter = await getFilter(req.query, listAllowedFilters);
|
|
listSalesOrdersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
|
|
});
|
|
|
|
router.get('/properties', checkPermissions('salesOrder', 'list'), isAuthenticated, async (req, res) => {
|
|
let properties = convertPropertiesString(req.query.properties);
|
|
const filter = await getFilter(req.query, propertiesAllowedFilters, false);
|
|
var masterFilter = {};
|
|
if (req.query.masterFilter) {
|
|
masterFilter = await getFilter(JSON.parse(req.query.masterFilter), propertiesAllowedFilters, true);
|
|
}
|
|
listSalesOrdersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
|
|
});
|
|
|
|
router.get('/values', checkPermissions('salesOrder', 'list'), isAuthenticated, async (req, res) => {
|
|
const { property } = req.query;
|
|
getSalesOrderPropertyValuesRouteHandler(req, res, property);
|
|
});
|
|
router.get('/search', checkPermissions('salesOrder', 'list'), isAuthenticated, async (req, res) => {
|
|
const { search } = req.query;
|
|
searchSalesOrdersRouteHandler(req, res, search);
|
|
});
|
|
|
|
router.post('/', isAuthenticated, checkPermissions('salesOrder', 'new'), async (req, res) => {
|
|
newSalesOrderRouteHandler(req, res);
|
|
});
|
|
|
|
// get sales order stats
|
|
router.get('/stats', isAuthenticated, async (req, res) => {
|
|
getSalesOrderStatsRouteHandler(req, res);
|
|
});
|
|
|
|
// get sales orders history
|
|
router.get('/history', isAuthenticated, async (req, res) => {
|
|
getSalesOrderHistoryRouteHandler(req, res);
|
|
});
|
|
|
|
router.get('/neighbors', isAuthenticated, async (req, res) => {
|
|
const { property, search, sort, order, id } = req.query;
|
|
const filter = await getFilter(req.query, listAllowedFilters);
|
|
getSalesOrderNeighborsRouteHandler(req, res, property, filter, search, getSort(sort, listAllowedSorters), order, id);
|
|
});
|
|
|
|
router.get('/:id', isAuthenticated, checkPermissions('salesOrder', 'info'), async (req, res) => {
|
|
getSalesOrderRouteHandler(req, res);
|
|
});
|
|
|
|
// update multiple sales orders
|
|
router.put('/', isAuthenticated, checkPermissions('salesOrder', 'edit'), async (req, res) => {
|
|
editMultipleSalesOrdersRouteHandler(req, res);
|
|
});
|
|
|
|
router.put('/:id', isAuthenticated, checkPermissions('salesOrder', 'edit'), async (req, res) => {
|
|
editSalesOrderRouteHandler(req, res);
|
|
});
|
|
|
|
router.delete('/:id', isAuthenticated, async (req, res) => {
|
|
deleteSalesOrderRouteHandler(req, res);
|
|
});
|
|
|
|
router.post('/:id/post', isAuthenticated, checkPermissions('salesOrder', 'post'), async (req, res) => {
|
|
postSalesOrderRouteHandler(req, res);
|
|
});
|
|
|
|
router.post('/:id/confirm', isAuthenticated, checkPermissions('salesOrder', 'confirm'), async (req, res) => {
|
|
confirmSalesOrderRouteHandler(req, res);
|
|
});
|
|
|
|
router.post('/:id/cancel', isAuthenticated, checkPermissions('salesOrder', 'cancel'), async (req, res) => {
|
|
cancelSalesOrderRouteHandler(req, res);
|
|
});
|
|
|
|
export default router;
|