chore: relocate backend into apps/api ahead of monorepo merge

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-27 00:12:54 +08:00 · 2026-08-24 12:20:40 +08:00
parent af44598df6
commit eaa6d2276a
388 changed files with 0 additions and 13998 deletions
@@ -0,0 +1,72 @@
+/***********************************************************************************************************************************************************************
+ * File Name: client.routes.js
+ * Type of Program: Router
+ * Description: Protected routes accessible by any authenticated user (client, staff, admin).
+ *
+ * Route Map:
+ *   GET    /api/client/profile          → view own profile
+ *   PUT    /api/client/profile          → update own profile
+ *   DELETE /api/client/profile          → delete own account (soft-delete)
+ *   GET    /api/client/sessions         → view own active sessions
+ *   DELETE /api/client/sessions/:id     → revoke own session
+ *
+ * Guards: authenticate → requireClient()
+ * Other routes contain here
+ *
+ * Author: rgrgogu
+ * Date Created: Oct. 6, 2025
+ * Modified: Jun. 13, 2026 (by Kenneth Obsequio (@lash0000)
+ ***********************************************************************************************************************************************************************/
+const express = require('express');
+const router = express.Router();
+const profileCtrl = require('../../controllers/client/profile.controller');
+const { authenticate, softAuthenticate } = require('../../middleware/auth.middleware');
+const { requireClient } = require('../../middleware/rbac.middleware');
+const { validate } = require('../../middleware/validate.middleware');
+const { updateProfileValidator } = require('../../validators/profile.validator');
+const { handleAvatarUpload } = require('../../middleware/avatar_upload.middleware');
+
+const tiersRoutes           = require('./tiers.routes');
+const coursesRoutes         = require('./courses.routes');
+const unitsRoutes           = require('./units.routes');
+const lessonsRoutes         = require('./lessons.routes');
+const coursePurchasesRoutes = require('./course_purchases.routes');
+const mediaRoutes           = require("./media.routes");
+const groupsRoutes          = require("./groups.routes");
+const advertisementRoutes   = require('./advertisements.routes');
+const notificationRoutes    = require('./notifications.routes');
+const certificateCtrl    = require('../../controllers/client/certificate.controller');
+
+// ── Media routes FIRST — before global auth ───────────────────────────────────
+// /stream/:token is authenticated by the signed JWT in the URL param, not by
+// session cookies. Browser media elements don't send auth headers on range requests.
+router.use('/media', mediaRoutes);
+
+// ── Soft-auth routes — return null instead of 401 when unauthenticated ────────
+const { unseenCount } = require('../../controllers/client/notification.controller');
+router.get('/notifications/unseen', softAuthenticate, unseenCount);
+
+// ── Apply auth + role to all remaining routes ─────────────────────────────────
+router.use(authenticate, requireClient());
+
+router.get('/profile',            profileCtrl.getProfile);
+router.put('/profile',            ...updateProfileValidator, validate, profileCtrl.updateProfile);
+router.delete('/profile',         profileCtrl.deleteAccount);
+router.post('/profile/avatar',    handleAvatarUpload, profileCtrl.uploadAvatar);
+router.delete('/profile/avatar',  profileCtrl.deleteAvatar);
+router.get('/sessions',           profileCtrl.getSessions);
+router.get('/achievements',       profileCtrl.getAchievements);
+router.delete('/sessions/:id',    profileCtrl.revokeSession);
+
+router.use('/tiers', tiersRoutes);
+router.use('/courses', coursesRoutes);
+router.use('/units',   unitsRoutes);    // standalone Unit consumption (junction revamp)
+router.use('/lessons', lessonsRoutes);  // standalone Lesson consumption (junction revamp)
+router.use('/course-purchases', coursePurchasesRoutes);
+router.use('/groups', groupsRoutes);
+router.use('/advertisements',  advertisementRoutes);
+router.use('/notifications',   notificationRoutes);
+
+router.get('/certificates/:courseUuid', certificateCtrl.getCertificate);
+
+module.exports = router;