mirror of
https://github.com/rgrgogu/new_starr.git
synced 2026-09-27 00:12:54 +08:00
Adjusted
This commit is contained in:
rgrgogu
@@ -4,69 +4,35 @@
|
||||
* Description: Protected routes accessible by admin only — full control.
|
||||
*
|
||||
* Route Map:
|
||||
* Users:
|
||||
* GET /api/admin/users → all users
|
||||
* GET /api/admin/users/:id → single user with groups
|
||||
* PUT /api/admin/users/:id → update user (acc_type, status, profile)
|
||||
* DELETE /api/admin/users/:id → hard delete user
|
||||
* GET /api/admin/users/:id/sessions → view all sessions
|
||||
* DELETE /api/admin/users/:id/sessions/:sid → force-terminate a session
|
||||
* Dashboard : GET /api/admin/dashboard
|
||||
* Users : /api/admin/users/*
|
||||
* Groups : /api/admin/groups/*
|
||||
* Assets : /api/admin/assets/*
|
||||
*
|
||||
* Groups:
|
||||
* GET /api/admin/groups → list groups
|
||||
* POST /api/admin/groups → create group
|
||||
* DELETE /api/admin/groups/:gid → delete group
|
||||
* POST /api/admin/users/:id/groups/:gid → add user to group
|
||||
* DELETE /api/admin/users/:id/groups/:gid → remove user from group
|
||||
*
|
||||
* Guards: authenticate → requireAdmin()
|
||||
* Guards: authenticate → requireAdmin() → adminLimiter
|
||||
*
|
||||
* Author: rgrgogu
|
||||
* Date Created: Oct. 6, 2025
|
||||
***********************************************************************************************************************************************************************/
|
||||
const express = require('express');
|
||||
const router = express.Router();
|
||||
const router = express.Router();
|
||||
|
||||
const usersCtrl = require('../../controllers/admin/users.controller');
|
||||
const { authenticate } = require('../../middleware/auth.middleware');
|
||||
const { requireAdmin } = require('../../middleware/rbac.middleware');
|
||||
const { adminLimiter, sensitiveOpsLimiter } = require('../../middleware/rateLimiter.middleware');
|
||||
const { authenticate } = require('../../middleware/auth.middleware');
|
||||
const { requireAdmin } = require('../../middleware/rbac.middleware');
|
||||
const { adminLimiter } = require('../../middleware/rateLimiter.middleware');
|
||||
|
||||
// Apply adminLimiter to ALL admin routes
|
||||
const dashboardRoutes = require('./dashboard.routes');
|
||||
const usersRoutes = require('./users.routes');
|
||||
const groupsRoutes = require('./groups.routes');
|
||||
const assetsRoutes = require('./assets.routes');
|
||||
|
||||
// ── Guards — applied to ALL admin routes ──────────────────────────────────────
|
||||
router.use(authenticate, requireAdmin(), adminLimiter);
|
||||
|
||||
// ── User management ────────────────────────────────────────────────────────────
|
||||
router.post('/users/bulk/restore', sensitiveOpsLimiter, usersCtrl.bulkRestoreUsers); // ← before /:id
|
||||
router.delete('/users/bulk', sensitiveOpsLimiter, usersCtrl.bulkDeactivateUsers); // ← before /:id
|
||||
router.get('/users/field-values', usersCtrl.getUserFieldValues); // ← before /:id
|
||||
router.get('/users/archived', usersCtrl.getArchivedUsers); // ← before /:id
|
||||
router.post('/users/staff', sensitiveOpsLimiter, usersCtrl.addStaffUser);
|
||||
router.get('/users', usersCtrl.getUsers);
|
||||
router.get('/users/:id', usersCtrl.getUser);
|
||||
router.put('/users/:id', sensitiveOpsLimiter, usersCtrl.updateUser);
|
||||
router.delete('/users/:id', sensitiveOpsLimiter, usersCtrl.deactivateUser); // soft delete
|
||||
router.post('/users/:id/restore', sensitiveOpsLimiter, usersCtrl.restoreUser); // restore
|
||||
|
||||
// ── Session management ─────────────────────────────────────────────────────────
|
||||
router.get('/users/:id/sessions', usersCtrl.getUserSessions);
|
||||
router.delete('/users/:id/sessions/:sid', sensitiveOpsLimiter, usersCtrl.terminateSession);
|
||||
|
||||
// ─── Groups Management ───────────────────────────────────────────────────────────────
|
||||
router.get('/groups/field-values', usersCtrl.getGroupFieldValues); // ← before /:gid
|
||||
router.post('/groups/bulk/restore', sensitiveOpsLimiter, usersCtrl.bulkRestoreGroups);
|
||||
router.delete('/groups/bulk', sensitiveOpsLimiter, usersCtrl.bulkDeactivateGroups);
|
||||
router.get('/groups/archived', usersCtrl.getArchivedGroups);
|
||||
router.get('/groups', usersCtrl.getGroups);
|
||||
router.get('/groups/:gid', usersCtrl.getGroup);
|
||||
router.post('/groups', sensitiveOpsLimiter, usersCtrl.createGroup);
|
||||
router.put('/groups/:gid', sensitiveOpsLimiter, usersCtrl.updateGroup);
|
||||
router.patch('/groups/:gid/deactivate', sensitiveOpsLimiter, usersCtrl.deactivateGroup);
|
||||
router.patch('/groups/:gid/restore', sensitiveOpsLimiter, usersCtrl.restoreGroup);
|
||||
|
||||
// ─── Group membership ──────────────────────────────────────────────────────────
|
||||
router.get('/groups/:gid/users', usersCtrl.getUsersInGroup);
|
||||
router.get('/groups/:gid/users/add', usersCtrl.getUsersNotInGroup);
|
||||
router.post('/groups/:gid/users', sensitiveOpsLimiter, usersCtrl.addUserToGroup);
|
||||
router.delete('/groups/:gid/users', sensitiveOpsLimiter, usersCtrl.removeUserFromGroup);
|
||||
// ── Mount ─────────────────────────────────────────────────────────────────────
|
||||
router.use('/dashboard', dashboardRoutes);
|
||||
router.use('/users', usersRoutes);
|
||||
router.use('/groups', groupsRoutes);
|
||||
router.use('/assets', assetsRoutes);
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,22 @@
|
||||
const express = require('express');
|
||||
const router = require('express').Router();
|
||||
const multer = require('multer');
|
||||
|
||||
const controller = require('../../controllers/admin/assets.controller');
|
||||
const { sensitiveOpsLimiter } = require('../../middleware/rateLimiter.middleware');
|
||||
|
||||
const upload = multer({
|
||||
storage: multer.memoryStorage(),
|
||||
limits: { fileSize: 10 * 1024 * 1024 * 1024 }, // 10GB
|
||||
});
|
||||
|
||||
router.get ('/', controller.getAssets);
|
||||
router.get ('/:assetId', controller.getAsset);
|
||||
router.post ('/upload', upload.single('file'), sensitiveOpsLimiter, controller.uploadAsset);
|
||||
router.put ('/:assetId', sensitiveOpsLimiter, controller.updateAsset);
|
||||
router.patch ('/:assetId/thumbnail', sensitiveOpsLimiter, controller.updateThumbnail);
|
||||
router.delete('/bulk', sensitiveOpsLimiter, controller.deleteAssets);
|
||||
router.delete('/:assetId', sensitiveOpsLimiter, controller.deleteAsset);
|
||||
router.patch ('/:assetId/restore', sensitiveOpsLimiter, controller.restoreAsset);
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,9 @@
|
||||
const express = require('express');
|
||||
const router = express.Router();
|
||||
|
||||
const { getUsersDashboard, getGroupsDashboard } = require('../../controllers/admin/dashboard.controller');
|
||||
|
||||
router.get('/users', getUsersDashboard);
|
||||
router.get('/groups', getGroupsDashboard);
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,23 @@
|
||||
const express = require('express');
|
||||
const router = express.Router();
|
||||
|
||||
const groupsCtrl = require('../../controllers/admin/user_groups.controller');
|
||||
const { sensitiveOpsLimiter } = require('../../middleware/rateLimiter.middleware');
|
||||
|
||||
// ── Groups ────────────────────────────────────────────────────────────────────
|
||||
router.get('/field-values', groupsCtrl.getGroupFieldValues);
|
||||
router.post('/bulk/restore', sensitiveOpsLimiter, groupsCtrl.bulkRestoreGroups);
|
||||
router.delete('/bulk', sensitiveOpsLimiter, groupsCtrl.bulkDeactivateGroups);
|
||||
router.get('/archived', groupsCtrl.getArchivedGroups);
|
||||
router.get('/', groupsCtrl.getGroups);
|
||||
router.get('/:gid', groupsCtrl.getGroup);
|
||||
router.post('/', sensitiveOpsLimiter, groupsCtrl.createGroup);
|
||||
router.put('/:gid', sensitiveOpsLimiter, groupsCtrl.updateGroup);
|
||||
router.patch('/:gid/deactivate', sensitiveOpsLimiter, groupsCtrl.deactivateGroup);
|
||||
router.patch('/:gid/restore', sensitiveOpsLimiter, groupsCtrl.restoreGroup);
|
||||
router.get('/:gid/users', groupsCtrl.getUsersInGroup);
|
||||
router.get('/:gid/users/add', groupsCtrl.getUsersNotInGroup);
|
||||
router.post('/:gid/users', sensitiveOpsLimiter, groupsCtrl.addUserToGroup);
|
||||
router.delete('/:gid/users', sensitiveOpsLimiter, groupsCtrl.removeUserFromGroup);
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,22 @@
|
||||
const express = require('express');
|
||||
const router = express.Router();
|
||||
|
||||
const usersCtrl = require('../../controllers/admin/users.controller');
|
||||
const { sensitiveOpsLimiter } = require('../../middleware/rateLimiter.middleware');
|
||||
|
||||
router.post('/bulk/restore', sensitiveOpsLimiter, usersCtrl.bulkRestoreUsers);
|
||||
router.delete('/bulk', sensitiveOpsLimiter, usersCtrl.bulkDeactivateUsers);
|
||||
router.get('/field-values', usersCtrl.getUserFieldValues);
|
||||
router.get('/archived', usersCtrl.getArchivedUsers);
|
||||
router.post('/staff', sensitiveOpsLimiter, usersCtrl.addStaffUser);
|
||||
router.get('/', usersCtrl.getUsers);
|
||||
router.get('/:id', usersCtrl.getUser);
|
||||
router.put('/:id', sensitiveOpsLimiter, usersCtrl.updateUser);
|
||||
router.delete('/:id', sensitiveOpsLimiter, usersCtrl.deactivateUser);
|
||||
router.post('/:id/restore', sensitiveOpsLimiter, usersCtrl.restoreUser);
|
||||
|
||||
// ── Sessions ──────────────────────────────────────────────────────────────────
|
||||
router.get('/:id/sessions', usersCtrl.getUserSessions);
|
||||
router.delete('/:id/sessions/:sid', sensitiveOpsLimiter, usersCtrl.terminateSession);
|
||||
|
||||
module.exports = router;
|
||||
Reference in New Issue
Block a user