push

pushy

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

routes/admin/admin.routes.js

@@ -30,7 +30,8 @@ const groupsRoutes        = require('./groups.routes');
 const assetsRoutes        = require('./assets.routes');
 const coursesRoutes       = require('./courses.routes');
 const taskRoutes          = require('./task.routes');
-const tiersRoutes         = require('./tiers.routes');
+const tiersRoutes           = require('./tiers.routes');
+const tierCategoriesRoutes  = require('./tier_categories.routes');
 const categoriesRoutes    = require('./categories.routes');
 const productsRoutes      = require('./products.routes');
 const advertisementRoutes  = require('./advertisements.routes');
@@ -49,6 +50,7 @@ router.use('/groups', groupsRoutes);
 router.use('/assets', assetsRoutes);
 router.use('/courses', coursesRoutes);
 router.use('/task-lists', taskRoutes);
+router.use('/tiers/categories', tierCategoriesRoutes);
 router.use('/tiers', tiersRoutes);
 router.use('/categories', categoriesRoutes);
 router.use('/products',   productsRoutes);

routes/admin/courses.routes.js

@@ -21,6 +21,7 @@ router.delete("/bulk", ctrl.bulkArchiveCourses);
 router.get("/archives", ctrl.getArchivedCourses);
 router.patch("/restore/bulk", ctrl.bulkRestoreCourses);
 router.get("/flat", ctrl.getCoursesFlat);
+router.get("/by-subscription", ctrl.getCoursesBySubscription);
 router.get("/units-flat", ctrl.getUnitsFlat);
 router.get("/lessons-flat", ctrl.getLessonsFlat);
 

routes/admin/media.routes.js

@@ -10,6 +10,7 @@ const router = require("express").Router();
 const ctrl   = require("../../controllers/admin/media.controller");
 
 // Auth + requireAdmin are already applied by admin.routes.js before reaching here.
-router.post("/token", ctrl.issueToken);
+router.post("/token",  ctrl.issueToken);
+router.post("/tokens", ctrl.issueTokensBatch);
 
 module.exports = router;

routes/admin/tier_categories.routes.js

@@ -0,0 +1,14 @@
+'use strict';
+
+const router = require('express').Router();
+const ctrl   = require('../../controllers/admin/tier_categories.controller');
+
+// Auth + requireAdmin applied by admin.routes.js
+
+router.get   ('/',    ctrl.getCategories);
+router.post  ('/',    ctrl.createCategory);
+router.get   ('/:id', ctrl.getCategory);
+router.put   ('/:id', ctrl.updateCategory);
+router.delete('/:id', ctrl.deleteCategory);
+
+module.exports = router;

routes/admin/tier_policies.routes.js

@@ -0,0 +1,19 @@
+const express = require('express');
+const router  = express.Router();
+const ctrl    = require('../../controllers/admin/tier_policies.controller');
+
+// ─── Plan Policies ────────────────────────────────────────────────────────────
+// GET  /admin/tiers/plans/:planId/policy
+// PUT  /admin/tiers/plans/:planId/policy   — JSON: { badge_asset_id, badge_label, access_rules, … }
+router.get('/plans/:planId/policy', ctrl.getPlanPolicy);
+router.put('/plans/:planId/policy', ctrl.upsertPlanPolicy);
+
+// ─── System Badges ────────────────────────────────────────────────────────────
+// GET  /admin/tiers/system-badges
+// GET  /admin/tiers/system-badges/:key
+// PUT  /admin/tiers/system-badges/:key    — JSON: { asset_id, label, active_from, active_until, … }
+router.get('/system-badges',      ctrl.getSystemBadges);
+router.get('/system-badges/:key', ctrl.getSystemBadge);
+router.put('/system-badges/:key', ctrl.upsertSystemBadge);
+
+module.exports = router;

routes/admin/users.routes.js

@@ -16,6 +16,13 @@ router.put('/:id', sensitiveOpsLimiter, usersCtrl.updateUser);
 router.delete('/:id', sensitiveOpsLimiter, usersCtrl.deactivateUser);
 router.post('/:id/restore', sensitiveOpsLimiter, usersCtrl.restoreUser);
 
+// ── Bans ──────────────────────────────────────────────────────────────────────
+router.post('/bulk/ban',   sensitiveOpsLimiter, usersCtrl.bulkBanUsers);
+router.post('/bulk/unban', sensitiveOpsLimiter, usersCtrl.bulkUnbanUsers);
+router.get('/:id/bans', usersCtrl.getUserBans);
+router.post('/:id/ban',   sensitiveOpsLimiter, usersCtrl.banUser);
+router.post('/:id/unban', sensitiveOpsLimiter, usersCtrl.unbanUser);
+
 // ── Sessions ──────────────────────────────────────────────────────────────────
 router.get('/:id/sessions', usersCtrl.getUserSessions);
 router.delete('/:id/sessions/:sid', sensitiveOpsLimiter, usersCtrl.terminateSession);

routes/auth.routes.js

@@ -40,7 +40,7 @@ router.post('/register', ...registerValidator, validate, authCtrl.register);
 router.post('/verify-otp', otpLimiter, ...verifyOTPValidator, validate, authCtrl.verifyOTP);
 router.post('/resend-otp', otpLimiter, ...resendOTPValidator, validate, authCtrl.resendOTP);
 router.post('/login', ...loginValidator, validate, authCtrl.login);
-router.post('/refresh', authCtrl.refreshToken);
+router.post('/refresh', authLimiter, authCtrl.refreshToken);
 router.post('/logout', authenticate, authLimiter, authCtrl.logout);
 router.post('/change-password', authenticate, sensitiveOpsLimiter, ...changePassValidator, validate, authCtrl.changePassword);
 

routes/client/client.routes.js

@@ -6,6 +6,7 @@
  * Route Map:
  *   GET    /api/client/profile          → view own profile
  *   PUT    /api/client/profile          → update own profile
+ *   DELETE /api/client/profile          → delete own account (soft-delete)
  *   GET    /api/client/sessions         → view own active sessions
  *   DELETE /api/client/sessions/:id     → revoke own session
  *
@@ -48,6 +49,7 @@ router.use(authenticate, requireClient());
 
 router.get('/profile',            profileCtrl.getProfile);
 router.put('/profile',            ...updateProfileValidator, validate, profileCtrl.updateProfile);
+router.delete('/profile',         profileCtrl.deleteAccount);
 router.post('/profile/avatar',    handleAvatarUpload, profileCtrl.uploadAvatar);
 router.delete('/profile/avatar',  profileCtrl.deleteAvatar);
 router.get('/sessions',           profileCtrl.getSessions);

routes/client/courses.routes.js

@@ -31,12 +31,14 @@ router.post('/:courseId/assessment/:assessmentId/start',          ctrl.startCour
 router.get( '/:courseId/assessment/:assessmentId/session',        ctrl.getAssessmentSession);
 router.patch('/:courseId/assessment/:assessmentId/draft',         ctrl.saveDraft);
 
+router.patch('/:courseId/units/:unitId/quiz/:quizId/draft',  ctrl.saveQuizDraft);
 router.post('/:courseId/units/:unitId/quiz/:quizId/submit',  ctrl.submitUnitQuiz);
 router.post('/:courseId/assessment/:assessmentId/submit',    ctrl.submitCourseAssessment);
 
 // Reading progress
 router.get( '/:courseId/progress/summary',                                  progressCtrl.getCourseProgressSummary);
 router.get( '/:courseId/progress',                                          progressCtrl.getCourseProgress);
+router.get( '/:courseId/task-context',                                      progressCtrl.getCourseTaskContext);
 router.post('/:courseId/units/:unitId/lessons/:lessonId/progress',          progressCtrl.upsertLessonProgress);
 
 module.exports = router;

routes/client/groups.routes.js

@@ -88,6 +88,11 @@ router.post(
     sensitiveOpsLimiter,
     progressController.visitLink
 );
+router.delete(
+    '/:groupId/task-lists/:taskListId/tasks/:taskId/requirements/:requirementId/visit',
+    sensitiveOpsLimiter,
+    progressController.unvisitLink
+);
 router.post(
     '/:groupId/task-lists/:taskListId/tasks/:taskId/requirements/:requirementId/progress',
     sensitiveOpsLimiter,

routes/client/tiers.routes.js

@@ -20,4 +20,10 @@ router.post('/checkout/refund',  ctrl.refundOrder);
 // My payments
 router.get ('/me/payments',      ctrl.getMyPayments);
 
+// Tier categories (public — for course badge display)
+router.get ('/categories',       ctrl.getCategories);
+
+// System badges (public read for profile display)
+router.get ('/system-badges',    ctrl.getSystemBadges);
+
 module.exports = router;