mirror of
https://github.com/rgrgogu/new_starr.git
synced 2026-09-27 00:12:54 +08:00
72 lines
4.7 KiB
JavaScript
72 lines
4.7 KiB
JavaScript
/***********************************************************************************************************************************************************************
|
|
* File Name: admin.routes.js
|
|
* Type of Program: Router
|
|
* Description: Protected routes accessible by admin only — full control.
|
|
*
|
|
* Route Map:
|
|
* Users:
|
|
* GET /api/admin/users → all users
|
|
* GET /api/admin/users/:id → single user with groups
|
|
* PUT /api/admin/users/:id → update user (acc_type, status, profile)
|
|
* DELETE /api/admin/users/:id → hard delete user
|
|
* GET /api/admin/users/:id/sessions → view all sessions
|
|
* DELETE /api/admin/users/:id/sessions/:sid → force-terminate a session
|
|
*
|
|
* Groups:
|
|
* GET /api/admin/groups → list groups
|
|
* POST /api/admin/groups → create group
|
|
* DELETE /api/admin/groups/:gid → delete group
|
|
* POST /api/admin/users/:id/groups/:gid → add user to group
|
|
* DELETE /api/admin/users/:id/groups/:gid → remove user from group
|
|
*
|
|
* Guards: authenticate → requireAdmin()
|
|
*
|
|
* Author: rgrgogu
|
|
* Date Created: Oct. 6, 2025
|
|
***********************************************************************************************************************************************************************/
|
|
const express = require('express');
|
|
const router = express.Router();
|
|
|
|
const usersCtrl = require('../../controllers/admin/users.controller');
|
|
const { authenticate } = require('../../middleware/auth.middleware');
|
|
const { requireAdmin } = require('../../middleware/rbac.middleware');
|
|
const { adminLimiter, sensitiveOpsLimiter } = require('../../middleware/rateLimiter.middleware');
|
|
|
|
// Apply adminLimiter to ALL admin routes
|
|
router.use(authenticate, requireAdmin(), adminLimiter);
|
|
|
|
// ── User management ────────────────────────────────────────────────────────────
|
|
router.post('/users/bulk/restore', sensitiveOpsLimiter, usersCtrl.bulkRestoreUsers); // ← before /:id
|
|
router.delete('/users/bulk', sensitiveOpsLimiter, usersCtrl.bulkDeactivateUsers); // ← before /:id
|
|
router.get('/users/field-values', usersCtrl.getUserFieldValues); // ← before /:id
|
|
router.get('/users/archived', usersCtrl.getArchivedUsers); // ← before /:id
|
|
router.post('/users/staff', sensitiveOpsLimiter, usersCtrl.addStaffUser);
|
|
router.get('/users', usersCtrl.getUsers);
|
|
router.get('/users/:id', usersCtrl.getUser);
|
|
router.put('/users/:id', sensitiveOpsLimiter, usersCtrl.updateUser);
|
|
router.delete('/users/:id', sensitiveOpsLimiter, usersCtrl.deactivateUser); // soft delete
|
|
router.post('/users/:id/restore', sensitiveOpsLimiter, usersCtrl.restoreUser); // restore
|
|
|
|
// ── Session management ─────────────────────────────────────────────────────────
|
|
router.get('/users/:id/sessions', usersCtrl.getUserSessions);
|
|
router.delete('/users/:id/sessions/:sid', sensitiveOpsLimiter, usersCtrl.terminateSession);
|
|
|
|
// ─── Groups Management ───────────────────────────────────────────────────────────────
|
|
router.get('/groups/field-values', usersCtrl.getGroupFieldValues); // ← before /:gid
|
|
router.post('/groups/bulk/restore', sensitiveOpsLimiter, usersCtrl.bulkRestoreGroups);
|
|
router.delete('/groups/bulk', sensitiveOpsLimiter, usersCtrl.bulkDeactivateGroups);
|
|
router.get('/groups/archived', usersCtrl.getArchivedGroups);
|
|
router.get('/groups', usersCtrl.getGroups);
|
|
router.get('/groups/:gid', usersCtrl.getGroup);
|
|
router.post('/groups', sensitiveOpsLimiter, usersCtrl.createGroup);
|
|
router.put('/groups/:gid', sensitiveOpsLimiter, usersCtrl.updateGroup);
|
|
router.patch('/groups/:gid/deactivate', sensitiveOpsLimiter, usersCtrl.deactivateGroup);
|
|
router.patch('/groups/:gid/restore', sensitiveOpsLimiter, usersCtrl.restoreGroup);
|
|
|
|
// ─── Group membership ──────────────────────────────────────────────────────────
|
|
router.get('/groups/:gid/users', usersCtrl.getUsersInGroup);
|
|
router.get('/groups/:gid/users/add', usersCtrl.getUsersNotInGroup);
|
|
router.post('/groups/:gid/users', sensitiveOpsLimiter, usersCtrl.addUserToGroup);
|
|
router.delete('/groups/:gid/users', sensitiveOpsLimiter, usersCtrl.removeUserFromGroup);
|
|
|
|
module.exports = router; |