farmcontrol-api/src/routes/sales/salesorders.js
Tom Butcher e8c9a307ab
All checks were successful
farmcontrol/farmcontrol-api/pipeline/head This commit looks good
Enhance route permission checks across management and inventory modules
This commit updates various route handlers in the management and inventory modules to include permission checks using the `checkPermissions` middleware. The changes ensure that access to properties, values, and search functionalities for different entities (e.g., users, products, tax rates) is properly restricted based on user permissions. This enhancement improves the security and integrity of the application by enforcing role-based access control across multiple routes.
2026-08-20 20:15:07 +01:00

113 lines
4.0 KiB
JavaScript

import express from 'express';
import { isAuthenticated } from '../../keycloak.js';
import { checkPermissions } from '../../database/permissions.js';
import { getFilter, convertPropertiesString, getSort } from '../../utils.js';
const router = express.Router();
const listAllowedFilters = [
'client',
'client._id',
'state',
'value',
'createdAt',
'updatedAt',
'_reference',
];
const listAllowedSorters = ['createdAt', 'state', 'updatedAt'];
const propertiesAllowedFilters = ['client', 'state.type', 'value', 'client._id'];
import {
listSalesOrdersRouteHandler,
getSalesOrderRouteHandler,
editSalesOrderRouteHandler,
editMultipleSalesOrdersRouteHandler,
newSalesOrderRouteHandler,
deleteSalesOrderRouteHandler,
listSalesOrdersByPropertiesRouteHandler,
getSalesOrderStatsRouteHandler,
getSalesOrderHistoryRouteHandler,
postSalesOrderRouteHandler,
confirmSalesOrderRouteHandler,
cancelSalesOrderRouteHandler,
searchSalesOrdersRouteHandler,
getSalesOrderPropertyValuesRouteHandler,
getSalesOrderNeighborsRouteHandler,
} from '../../services/sales/salesorders.js';
// list of sales orders
router.get('/', isAuthenticated, async (req, res) => {
const { page, limit, property, search, sort, order } = req.query;
const filter = await getFilter(req.query, listAllowedFilters);
listSalesOrdersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
});
router.get('/properties', checkPermissions('salesOrder', 'list'), isAuthenticated, async (req, res) => {
let properties = convertPropertiesString(req.query.properties);
const filter = await getFilter(req.query, propertiesAllowedFilters, false);
var masterFilter = {};
if (req.query.masterFilter) {
masterFilter = await getFilter(JSON.parse(req.query.masterFilter), propertiesAllowedFilters, true);
}
listSalesOrdersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
});
router.get('/values', checkPermissions('salesOrder', 'list'), isAuthenticated, async (req, res) => {
const { property } = req.query;
getSalesOrderPropertyValuesRouteHandler(req, res, property);
});
router.get('/search', checkPermissions('salesOrder', 'list'), isAuthenticated, async (req, res) => {
const { search } = req.query;
searchSalesOrdersRouteHandler(req, res, search);
});
router.post('/', isAuthenticated, checkPermissions('salesOrder', 'new'), async (req, res) => {
newSalesOrderRouteHandler(req, res);
});
// get sales order stats
router.get('/stats', isAuthenticated, async (req, res) => {
getSalesOrderStatsRouteHandler(req, res);
});
// get sales orders history
router.get('/history', isAuthenticated, async (req, res) => {
getSalesOrderHistoryRouteHandler(req, res);
});
router.get('/neighbors', isAuthenticated, async (req, res) => {
const { property, search, sort, order, id } = req.query;
const filter = await getFilter(req.query, listAllowedFilters);
getSalesOrderNeighborsRouteHandler(req, res, property, filter, search, getSort(sort, listAllowedSorters), order, id);
});
router.get('/:id', isAuthenticated, checkPermissions('salesOrder', 'info'), async (req, res) => {
getSalesOrderRouteHandler(req, res);
});
// update multiple sales orders
router.put('/', isAuthenticated, checkPermissions('salesOrder', 'edit'), async (req, res) => {
editMultipleSalesOrdersRouteHandler(req, res);
});
router.put('/:id', isAuthenticated, checkPermissions('salesOrder', 'edit'), async (req, res) => {
editSalesOrderRouteHandler(req, res);
});
router.delete('/:id', isAuthenticated, async (req, res) => {
deleteSalesOrderRouteHandler(req, res);
});
router.post('/:id/post', isAuthenticated, checkPermissions('salesOrder', 'post'), async (req, res) => {
postSalesOrderRouteHandler(req, res);
});
router.post('/:id/confirm', isAuthenticated, checkPermissions('salesOrder', 'confirm'), async (req, res) => {
confirmSalesOrderRouteHandler(req, res);
});
router.post('/:id/cancel', isAuthenticated, checkPermissions('salesOrder', 'cancel'), async (req, res) => {
cancelSalesOrderRouteHandler(req, res);
});
export default router;