mirror of
https://github.com/rgrgogu/new_starr.git
synced 2026-09-27 00:12:54 +08:00
initial
This commit is contained in:
rgrgogu
@@ -0,0 +1,63 @@
|
||||
/***********************************************************************************************************************************************************************
|
||||
* File Name: admin.routes.js
|
||||
* Type of Program: Router
|
||||
* Description: Protected routes accessible by admin only — full control.
|
||||
*
|
||||
* Route Map:
|
||||
* Users:
|
||||
* GET /api/admin/users → all users
|
||||
* GET /api/admin/users/:id → single user with groups
|
||||
* PUT /api/admin/users/:id → update user (acc_type, status, profile)
|
||||
* DELETE /api/admin/users/:id → hard delete user
|
||||
* GET /api/admin/users/:id/sessions → view all sessions
|
||||
* DELETE /api/admin/users/:id/sessions/:sid → force-terminate a session
|
||||
*
|
||||
* Groups:
|
||||
* GET /api/admin/groups → list groups
|
||||
* POST /api/admin/groups → create group
|
||||
* DELETE /api/admin/groups/:gid → delete group
|
||||
* POST /api/admin/users/:id/groups/:gid → add user to group
|
||||
* DELETE /api/admin/users/:id/groups/:gid → remove user from group
|
||||
*
|
||||
* Guards: authenticate → requireAdmin()
|
||||
*
|
||||
* Author: rgrgogu
|
||||
* Date Created: Oct. 6, 2025
|
||||
***********************************************************************************************************************************************************************/
|
||||
const express = require('express');
|
||||
const router = express.Router();
|
||||
|
||||
const usersCtrl = require('../../controllers/admin/users.controller');
|
||||
const { authenticate } = require('../../middleware/auth.middleware');
|
||||
const { requireAdmin } = require('../../middleware/rbac.middleware');
|
||||
const { adminLimiter, sensitiveOpsLimiter } = require('../../middleware/rateLimiter.middleware');
|
||||
|
||||
// Apply adminLimiter to ALL admin routes
|
||||
router.use(authenticate, requireAdmin(), adminLimiter);
|
||||
|
||||
// ── User management ────────────────────────────────────────────────────────────
|
||||
router.get('/users', usersCtrl.getUsers);
|
||||
router.get('/users/:id', usersCtrl.getUser);
|
||||
router.put('/users/:id', sensitiveOpsLimiter, usersCtrl.updateUser);
|
||||
router.delete('/users/:id', sensitiveOpsLimiter, usersCtrl.deactivateUser); // soft delete
|
||||
router.post('/users/:id/restore', sensitiveOpsLimiter, usersCtrl.restoreUser); // restore
|
||||
|
||||
// ── Session management ─────────────────────────────────────────────────────────
|
||||
router.get('/users/:id/sessions', usersCtrl.getUserSessions);
|
||||
router.delete('/users/:id/sessions/:sid', sensitiveOpsLimiter, usersCtrl.terminateSession);
|
||||
|
||||
// ─── Groups Management ───────────────────────────────────────────────────────────────
|
||||
router.get('/groups', usersCtrl.getGroups);
|
||||
router.get('/groups/:gid', usersCtrl.getGroup);
|
||||
router.post('/groups', sensitiveOpsLimiter, usersCtrl.createGroup);
|
||||
router.put('/groups/:gid', sensitiveOpsLimiter, usersCtrl.updateGroup);
|
||||
router.patch('/groups/:gid/deactivate', sensitiveOpsLimiter, usersCtrl.deactivateGroup);
|
||||
router.patch('/groups/:gid/restore', sensitiveOpsLimiter, usersCtrl.restoreGroup);
|
||||
|
||||
// ─── Group membership ──────────────────────────────────────────────────────────
|
||||
router.get('/groups/:gid/users', usersCtrl.getUsersInGroup);
|
||||
router.get('/groups/:gid/users/add', usersCtrl.getUsersNotInGroup);
|
||||
router.post('/groups/:gid/users', sensitiveOpsLimiter, usersCtrl.addUserToGroup);
|
||||
router.delete('/groups/:gid/users', sensitiveOpsLimiter, usersCtrl.removeUserFromGroup);
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,61 @@
|
||||
/***********************************************************************************************************************************************************************
|
||||
* File Name: auth.routes.js
|
||||
* Type of Program: Router
|
||||
* Description: Public authentication routes (no auth required).
|
||||
* CSRF protection is applied to state-mutating endpoints.
|
||||
*
|
||||
* Route Map:
|
||||
* GET /api/auth/csrf-token → get CSRF token (for cookie-based clients)
|
||||
* POST /api/auth/register → system registration
|
||||
* POST /api/auth/verify-otp → OTP verification + auto-login
|
||||
* POST /api/auth/resend-otp → resend OTP email
|
||||
* POST /api/auth/login → system login
|
||||
* POST /api/auth/refresh → refresh access token
|
||||
* POST /api/auth/logout → logout (requires authenticate)
|
||||
* POST /api/auth/change-password → change password (requires authenticate)
|
||||
* GET /api/auth/google → initiate Google OAuth
|
||||
* GET /api/auth/google/callback → Google OAuth callback
|
||||
*
|
||||
* Author: rgrgogu
|
||||
* Date Created: Oct. 6, 2025
|
||||
***********************************************************************************************************************************************************************/
|
||||
const express = require('express');
|
||||
const passport = require('passport');
|
||||
const router = express.Router();
|
||||
|
||||
const authCtrl = require('../controllers/auth.controller');
|
||||
const { authenticate } = require('../middleware/auth.middleware');
|
||||
const { authLimiter, otpLimiter, sensitiveOpsLimiter } = require('../middleware/rateLimiter.middleware');
|
||||
const { csrfProtection, getCsrfToken } = require('../middleware/csrf.middleware');
|
||||
const { validate } = require('../middleware/validate.middleware');
|
||||
const {
|
||||
registerValidator, loginValidator,
|
||||
verifyOTPValidator, resendOTPValidator, changePassValidator,
|
||||
} = require('../validators/auth.validator');
|
||||
|
||||
// ── CSRF token (GET — no CSRF needed on GETs) ──────────────────────────────────
|
||||
router.get('/csrf-token', csrfProtection, getCsrfToken);
|
||||
|
||||
// ── System auth ────────────────────────────────────────────────────────────────
|
||||
router.post('/register', ...registerValidator, validate, authCtrl.register);
|
||||
router.post('/verify-otp', otpLimiter, ...verifyOTPValidator, validate, authCtrl.verifyOTP);
|
||||
router.post('/resend-otp', otpLimiter, ...resendOTPValidator, validate, authCtrl.resendOTP);
|
||||
router.post('/login', ...loginValidator, validate, authCtrl.login);
|
||||
router.post('/refresh', authCtrl.refreshToken);
|
||||
router.post('/logout', authenticate, authLimiter, authCtrl.logout);
|
||||
router.post('/change-password', authenticate, sensitiveOpsLimiter, ...changePassValidator, validate, authCtrl.changePassword);
|
||||
|
||||
// ── Google OAuth ───────────────────────────────────────────────────────────────
|
||||
router.get('/google',
|
||||
authLimiter,
|
||||
passport.authenticate('google', { scope: ['profile', 'email'], session: false })
|
||||
);
|
||||
router.get('/google/callback',
|
||||
passport.authenticate('google', { session: false, failureRedirect: '/api/auth/google/failed' }),
|
||||
authCtrl.googleCallback
|
||||
);
|
||||
router.get('/google/failed', (req, res) => {
|
||||
res.status(401).json({ status: 'error', message: 'Google authentication failed.' });
|
||||
});
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,34 @@
|
||||
/***********************************************************************************************************************************************************************
|
||||
* File Name: client.routes.js
|
||||
* Type of Program: Router
|
||||
* Description: Protected routes accessible by any authenticated user (client, staff, admin).
|
||||
*
|
||||
* Route Map:
|
||||
* GET /api/client/profile → view own profile
|
||||
* PUT /api/client/profile → update own profile
|
||||
* GET /api/client/sessions → view own active sessions
|
||||
* DELETE /api/client/sessions/:id → revoke own session
|
||||
*
|
||||
* Guards: authenticate → requireClient()
|
||||
*
|
||||
* Author: rgrgogu
|
||||
* Date Created: Oct. 6, 2025
|
||||
***********************************************************************************************************************************************************************/
|
||||
const express = require('express');
|
||||
const router = express.Router();
|
||||
|
||||
const profileCtrl = require('../../controllers/client/profile.controller');
|
||||
const { authenticate } = require('../../middleware/auth.middleware');
|
||||
const { requireClient } = require('../../middleware/rbac.middleware');
|
||||
const { validate } = require('../../middleware/validate.middleware');
|
||||
const { updateProfileValidator } = require('../../validators/profile.validator');
|
||||
|
||||
// Apply auth + role to all routes in this file
|
||||
router.use(authenticate, requireClient());
|
||||
|
||||
router.get('/profile', profileCtrl.getProfile);
|
||||
router.put('/profile', ...updateProfileValidator, validate, profileCtrl.updateProfile);
|
||||
router.get('/sessions', profileCtrl.getSessions);
|
||||
router.delete('/sessions/:id', profileCtrl.revokeSession);
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,33 @@
|
||||
/***********************************************************************************************************************************************************************
|
||||
* File Name: staff.routes.js
|
||||
* Type of Program: Router
|
||||
* Description: Protected routes accessible by staff and admin only.
|
||||
* Staff can view non-admin users and toggle their status.
|
||||
* Staff cannot view or modify admins.
|
||||
*
|
||||
* Route Map:
|
||||
* GET /api/staff/users → paginated user list (non-admins)
|
||||
* GET /api/staff/users/:id → view a specific non-admin user
|
||||
* PUT /api/staff/users/:id/status → activate or deactivate a user
|
||||
* GET /api/staff/users/:id/sessions → view user's sessions
|
||||
*
|
||||
* Guards: authenticate → requireStaff()
|
||||
*
|
||||
* Author: rgrgogu
|
||||
* Date Created: Oct. 6, 2025
|
||||
***********************************************************************************************************************************************************************/
|
||||
const express = require('express');
|
||||
const router = express.Router();
|
||||
|
||||
const usersCtrl = require('../../controllers/staff/users.controller');
|
||||
const { authenticate } = require('../../middleware/auth.middleware');
|
||||
const { requireStaff } = require('../../middleware/rbac.middleware');
|
||||
|
||||
router.use(authenticate, requireStaff());
|
||||
|
||||
router.get('/users/', usersCtrl.getUsers);
|
||||
router.get('/users/:id', usersCtrl.getUser);
|
||||
router.put('/users/:id/status', usersCtrl.setUserStatus);
|
||||
router.get('/users/:id/sessions', usersCtrl.getUserSessions);
|
||||
|
||||
module.exports = router;
|
||||
Reference in New Issue
Block a user