feat: 3-tier role system across all platform apps
Portal: - Replace is_admin boolean with role column (admin/advanced/standard) - Settings UI: 3-tier portal role select + per-app role dropdowns - /portal-return endpoint: re-establishes session from JWT for sub-app back-links - /api/internal/nv-users: internal endpoint for NetworkView user sync - portal/migrate_roles.py: one-time DB migration script - Role badges (admin/advanced/standard) in topbar and settings table DigiServer: - Add editor and viewer roles (portal advanced->editor, standard->viewer) - PlaylistPermission model: grant viewer users edit access to specific playlists - app/utils/access.py: shared editor_required, admin_required, can_edit_playlist helpers - Content routes: editor_required on create/delete, per-playlist permission check on mutations - Admin: playlist_permissions route + template to manage viewer playlist grants - Base template: hide Admin nav for viewers, Portal button (⬡) returns to portal - content_list_new: hide create/delete for viewers; Manage vs View button per permission - manage_playlist_content: view-only mode when user lacks edit permission NetworkView: - backend/src/middleware/rbac.js: requireRole + requireWriteAccess helpers - site_permissions table: one site per advanced user - All mutating routes guarded (admin=all, advanced=assigned site, viewer=read-only) - Portal SSO auto-upsert: user row synced from X-Auth-Role on every request - GET /api/users: merges portal users list with local NV data (all 4 portal users visible) - GET/PUT /api/users/:id/site-permission: assign site to advanced user - Settings Users tab: role badges, site dropdown for advanced, (portal only) indicator - Sidebar: ⬡ Portal button between Settings and Logout - Frontend build: VITE_API_BASE=/networkview/api now set in start-dev.sh IT Assets / Server Monitor: - portal_sso.py updated: map advanced->editor/viewer, standard->readonly - AdminUser model: add editor role + is_editor property
This commit is contained in:
ske087
@@ -120,4 +120,14 @@ db.exec(`
|
||||
);
|
||||
`);
|
||||
|
||||
// ── Site permissions (advanced role: one site per user) ──────────────────────
|
||||
db.exec(`
|
||||
CREATE TABLE IF NOT EXISTS site_permissions (
|
||||
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||
site_id TEXT NOT NULL REFERENCES sites(id) ON DELETE CASCADE,
|
||||
granted_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
PRIMARY KEY (user_id)
|
||||
);
|
||||
`);
|
||||
|
||||
module.exports = db;
|
||||
|
||||
@@ -11,25 +11,55 @@ app.use(express.json());
|
||||
app.use(morgan('dev'));
|
||||
|
||||
// ── Actor middleware ──────────────────────────────────────────────────────────
|
||||
// The external main app sets x-user-id + x-username after token verification.
|
||||
// The external main app sets x-user-id + x-username + x-auth-role after token verification.
|
||||
// Direct calls can use x-api-key (validated against users.api_key).
|
||||
const VALID_ROLES = new Set(['admin', 'advanced', 'standard']);
|
||||
const db = require('./db');
|
||||
|
||||
app.use((req, _res, next) => {
|
||||
const userId = req.headers['x-user-id'];
|
||||
const username = req.headers['x-username'];
|
||||
const apiKey = req.headers['x-api-key'];
|
||||
const headerRole = (req.headers['x-auth-role'] || '').trim();
|
||||
const portalRole = VALID_ROLES.has(headerRole) ? headerRole : 'standard';
|
||||
|
||||
if (userId && username) {
|
||||
req.actor = { id: userId, username: String(username) };
|
||||
req.actor = { id: String(userId), username: String(username), role: portalRole };
|
||||
|
||||
// ── Portal SSO sync ──────────────────────────────────────────────────────
|
||||
// Upsert the user row so the local users table always reflects the portal.
|
||||
// Map portal roles → NV local roles: admin→admin, advanced→advanced, standard→viewer
|
||||
const localRole = portalRole === 'admin' ? 'admin'
|
||||
: portalRole === 'advanced' ? 'advanced'
|
||||
: 'viewer';
|
||||
try {
|
||||
const existing = db.prepare('SELECT id, role FROM users WHERE username = ?').get(username);
|
||||
if (!existing) {
|
||||
const { v4: uuidv4 } = require('uuid');
|
||||
db.prepare(
|
||||
'INSERT INTO users (id, username, role, is_active) VALUES (?, ?, ?, 1)'
|
||||
).run(String(userId), String(username), localRole);
|
||||
} else if (existing.role !== localRole) {
|
||||
db.prepare('UPDATE users SET role = ?, updated_at = CURRENT_TIMESTAMP WHERE username = ?')
|
||||
.run(localRole, String(username));
|
||||
}
|
||||
} catch (_) { /* best-effort; never break the request */ }
|
||||
|
||||
} else if (apiKey) {
|
||||
const user = db.prepare('SELECT id, username FROM users WHERE api_key = ? AND is_active = 1').get(apiKey);
|
||||
req.actor = user ? { id: user.id, username: user.username } : { id: null, username: 'api-key-invalid' };
|
||||
const user = db.prepare('SELECT id, username, role FROM users WHERE api_key = ? AND is_active = 1').get(apiKey);
|
||||
req.actor = user
|
||||
? { id: user.id, username: user.username, role: 'admin' }
|
||||
: { id: null, username: 'api-key-invalid', role: 'standard' };
|
||||
} else {
|
||||
req.actor = { id: null, username: 'anonymous' };
|
||||
req.actor = { id: null, username: 'anonymous', role: 'standard' };
|
||||
}
|
||||
next();
|
||||
});
|
||||
|
||||
// ── RBAC helpers (used by route files) ───────────────────────────────────────
|
||||
// requireRole / requireWriteAccess are defined in middleware/rbac.js
|
||||
app.locals.requireRole = require('./middleware/rbac').requireRole;
|
||||
|
||||
// API routes
|
||||
app.use('/api/sites', require('./routes/sites'));
|
||||
app.use('/api/rooms', require('./routes/rooms'));
|
||||
|
||||
@@ -0,0 +1,95 @@
|
||||
/**
|
||||
* RBAC middleware for NetworkView.
|
||||
*
|
||||
* Role tiers (from portal via X-Auth-Role header):
|
||||
* admin – full CRUD on everything
|
||||
* advanced – CRUD scoped to ONE assigned site (site_permissions table)
|
||||
* standard – read-only (GET only)
|
||||
*
|
||||
* Helpers exported:
|
||||
* requireRole(minRole) – rejects if actor tier < minRole
|
||||
* requireWriteAccess(getSiteId) – admin: always; advanced: only their site;
|
||||
* standard: never
|
||||
*/
|
||||
|
||||
const db = require('../db');
|
||||
|
||||
// Numeric tier so we can do >= comparisons
|
||||
const TIERS = { standard: 0, advanced: 1, admin: 2 };
|
||||
|
||||
/** Reject if actor's role tier is below minRole. */
|
||||
function requireRole(minRole) {
|
||||
const min = TIERS[minRole] ?? 0;
|
||||
return (req, res, next) => {
|
||||
const tier = TIERS[req.actor?.role] ?? 0;
|
||||
if (tier < min) {
|
||||
return res.status(403).json({
|
||||
error: `Requires ${minRole} role (you have ${req.actor?.role ?? 'none'})`,
|
||||
});
|
||||
}
|
||||
next();
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* requireWriteAccess(getSiteIdFn)
|
||||
*
|
||||
* getSiteIdFn(req) → siteId string (or null/undefined)
|
||||
* – called only when role is 'advanced' to resolve which site is being touched.
|
||||
* – for 'admin' it is never called.
|
||||
* – for 'standard' it is never called (rejected immediately).
|
||||
*
|
||||
* Usage:
|
||||
* router.post('/', requireWriteAccess(req => req.body.site_id), handler)
|
||||
* router.delete('/:id', requireWriteAccess(req => {
|
||||
* const room = db.prepare('SELECT site_id FROM rooms WHERE id=?').get(req.params.id);
|
||||
* return room?.site_id;
|
||||
* }), handler)
|
||||
*/
|
||||
function requireWriteAccess(getSiteIdFn) {
|
||||
return (req, res, next) => {
|
||||
const role = req.actor?.role ?? 'standard';
|
||||
|
||||
if (role === 'admin') return next();
|
||||
|
||||
if (role !== 'advanced') {
|
||||
return res.status(403).json({ error: 'Write access requires advanced or admin role.' });
|
||||
}
|
||||
|
||||
// advanced: check site_permissions
|
||||
const userId = req.actor?.id;
|
||||
if (!userId) {
|
||||
return res.status(403).json({ error: 'No user identity for permission check.' });
|
||||
}
|
||||
|
||||
const perm = db.prepare(
|
||||
'SELECT site_id FROM site_permissions WHERE user_id = ?'
|
||||
).get(userId);
|
||||
|
||||
if (!perm) {
|
||||
return res.status(403).json({
|
||||
error: 'Advanced user has no site assigned. Ask an admin to assign a site.',
|
||||
});
|
||||
}
|
||||
|
||||
// Resolve the target site from the request
|
||||
let targetSiteId;
|
||||
try {
|
||||
targetSiteId = getSiteIdFn(req);
|
||||
} catch (_) {
|
||||
targetSiteId = null;
|
||||
}
|
||||
|
||||
if (!targetSiteId || targetSiteId !== perm.site_id) {
|
||||
return res.status(403).json({
|
||||
error: 'You can only modify your assigned site.',
|
||||
});
|
||||
}
|
||||
|
||||
// Attach for downstream use
|
||||
req.permittedSiteId = perm.site_id;
|
||||
next();
|
||||
};
|
||||
}
|
||||
|
||||
module.exports = { requireRole, requireWriteAccess, TIERS };
|
||||
@@ -2,8 +2,25 @@ const express = require('express');
|
||||
const { v4: uuidv4 } = require('uuid');
|
||||
const db = require('../db');
|
||||
const { logAudit } = require('../audit');
|
||||
const { requireWriteAccess } = require('../middleware/rbac');
|
||||
const router = express.Router();
|
||||
|
||||
const siteIdFromComponentBody = req => {
|
||||
if (!req.body.rack_id) return null;
|
||||
const rack = db.prepare('SELECT room_id FROM racks WHERE id=?').get(req.body.rack_id);
|
||||
if (!rack?.room_id) return null;
|
||||
const r = db.prepare('SELECT site_id FROM rooms WHERE id=?').get(rack.room_id);
|
||||
return r?.site_id;
|
||||
};
|
||||
const siteIdFromComponentPk = req => {
|
||||
const c = db.prepare('SELECT rack_id FROM components WHERE id=?').get(req.params.id ?? req.params.componentId);
|
||||
if (!c?.rack_id) return null;
|
||||
const rack = db.prepare('SELECT room_id FROM racks WHERE id=?').get(c.rack_id);
|
||||
if (!rack?.room_id) return null;
|
||||
const r = db.prepare('SELECT site_id FROM rooms WHERE id=?').get(rack.room_id);
|
||||
return r?.site_id;
|
||||
};
|
||||
|
||||
function checkPositionOverlap(rackId, position, heightUnits, excludeId = null) {
|
||||
const end = position + heightUnits - 1;
|
||||
const existing = db.prepare(`
|
||||
@@ -54,7 +71,7 @@ router.get('/:id', (req, res) => {
|
||||
});
|
||||
|
||||
// POST /api/components
|
||||
router.post('/', (req, res) => {
|
||||
router.post('/', requireWriteAccess(siteIdFromComponentBody), (req, res) => {
|
||||
const {
|
||||
rack_id, name, type, position, height_units,
|
||||
manufacturer, model, serial_number, asset_tag,
|
||||
@@ -103,7 +120,7 @@ router.post('/', (req, res) => {
|
||||
});
|
||||
|
||||
// PUT /api/components/:id
|
||||
router.put('/:id', (req, res) => {
|
||||
router.put('/:id', requireWriteAccess(siteIdFromComponentPk), (req, res) => {
|
||||
const component = db.prepare('SELECT * FROM components WHERE id = ?').get(req.params.id);
|
||||
if (!component) return res.status(404).json({ error: 'Component not found' });
|
||||
|
||||
@@ -162,7 +179,7 @@ router.put('/:id', (req, res) => {
|
||||
});
|
||||
|
||||
// DELETE /api/components/:id
|
||||
router.delete('/:id', (req, res) => {
|
||||
router.delete('/:id', requireWriteAccess(siteIdFromComponentPk), (req, res) => {
|
||||
const component = db.prepare('SELECT * FROM components WHERE id = ?').get(req.params.id);
|
||||
if (!component) return res.status(404).json({ error: 'Component not found' });
|
||||
|
||||
@@ -180,7 +197,7 @@ router.get('/:id/ports', (req, res) => {
|
||||
});
|
||||
|
||||
// POST /api/components/:id/ports
|
||||
router.post('/:id/ports', (req, res) => {
|
||||
router.post('/:id/ports', requireWriteAccess(siteIdFromComponentPk), (req, res) => {
|
||||
const component = db.prepare('SELECT id, type, port_count FROM components WHERE id = ?').get(req.params.id);
|
||||
if (!component) return res.status(404).json({ error: 'Component not found' });
|
||||
|
||||
@@ -216,7 +233,7 @@ router.post('/:id/ports', (req, res) => {
|
||||
});
|
||||
|
||||
// PUT /api/components/:componentId/ports/:portId
|
||||
router.put('/:componentId/ports/:portId', (req, res) => {
|
||||
router.put('/:componentId/ports/:portId', requireWriteAccess(siteIdFromComponentPk), (req, res) => {
|
||||
const port = db.prepare('SELECT * FROM ports WHERE id = ? AND component_id = ?').get(req.params.portId, req.params.componentId);
|
||||
if (!port) return res.status(404).json({ error: 'Port not found' });
|
||||
|
||||
@@ -249,7 +266,7 @@ router.put('/:componentId/ports/:portId', (req, res) => {
|
||||
});
|
||||
|
||||
// DELETE /api/components/:componentId/ports/:portId
|
||||
router.delete('/:componentId/ports/:portId', (req, res) => {
|
||||
router.delete('/:componentId/ports/:portId', requireWriteAccess(siteIdFromComponentPk), (req, res) => {
|
||||
db.prepare('DELETE FROM ports WHERE id = ? AND component_id = ?').run(req.params.portId, req.params.componentId);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
@@ -2,8 +2,21 @@ const express = require('express');
|
||||
const { v4: uuidv4 } = require('uuid');
|
||||
const db = require('../db');
|
||||
const { logAudit } = require('../audit');
|
||||
const { requireWriteAccess } = require('../middleware/rbac');
|
||||
const router = express.Router();
|
||||
|
||||
const siteIdFromRackBody = req => {
|
||||
if (!req.body.room_id) return null;
|
||||
const r = db.prepare('SELECT site_id FROM rooms WHERE id=?').get(req.body.room_id);
|
||||
return r?.site_id;
|
||||
};
|
||||
const siteIdFromRackPk = req => {
|
||||
const rack = db.prepare('SELECT room_id FROM racks WHERE id=?').get(req.params.id);
|
||||
if (!rack?.room_id) return null;
|
||||
const r = db.prepare('SELECT site_id FROM rooms WHERE id=?').get(rack.room_id);
|
||||
return r?.site_id;
|
||||
};
|
||||
|
||||
// GET /api/racks?roomId=
|
||||
router.get('/', (req, res) => {
|
||||
const { roomId } = req.query;
|
||||
@@ -45,7 +58,7 @@ router.get('/:id', (req, res) => {
|
||||
});
|
||||
|
||||
// POST /api/racks
|
||||
router.post('/', (req, res) => {
|
||||
router.post('/', requireWriteAccess(siteIdFromRackBody), (req, res) => {
|
||||
const { room_id, name, total_units, manufacturer, model, notes } = req.body;
|
||||
if (!name) return res.status(400).json({ error: 'name is required' });
|
||||
|
||||
@@ -66,7 +79,7 @@ router.post('/', (req, res) => {
|
||||
});
|
||||
|
||||
// PUT /api/racks/:id
|
||||
router.put('/:id', (req, res) => {
|
||||
router.put('/:id', requireWriteAccess(siteIdFromRackPk), (req, res) => {
|
||||
const rack = db.prepare('SELECT * FROM racks WHERE id = ?').get(req.params.id);
|
||||
if (!rack) return res.status(404).json({ error: 'Rack not found' });
|
||||
|
||||
@@ -98,7 +111,7 @@ router.put('/:id', (req, res) => {
|
||||
});
|
||||
|
||||
// DELETE /api/racks/:id
|
||||
router.delete('/:id', (req, res) => {
|
||||
router.delete('/:id', requireWriteAccess(siteIdFromRackPk), (req, res) => {
|
||||
const rack = db.prepare('SELECT * FROM racks WHERE id = ?').get(req.params.id);
|
||||
if (!rack) return res.status(404).json({ error: 'Rack not found' });
|
||||
|
||||
|
||||
@@ -2,8 +2,16 @@ const express = require('express');
|
||||
const { v4: uuidv4 } = require('uuid');
|
||||
const db = require('../db');
|
||||
const { logAudit } = require('../audit');
|
||||
const { requireWriteAccess } = require('../middleware/rbac');
|
||||
const router = express.Router();
|
||||
|
||||
// Resolvers for site_id from a room id or room body
|
||||
const siteIdFromRoomId = req => req.body.site_id;
|
||||
const siteIdFromRoomPk = req => {
|
||||
const r = db.prepare('SELECT site_id FROM rooms WHERE id=?').get(req.params.id);
|
||||
return r?.site_id;
|
||||
};
|
||||
|
||||
// GET /api/rooms?siteId=
|
||||
router.get('/', (req, res) => {
|
||||
const { siteId } = req.query;
|
||||
@@ -39,7 +47,7 @@ router.get('/:id', (req, res) => {
|
||||
});
|
||||
|
||||
// POST /api/rooms
|
||||
router.post('/', (req, res) => {
|
||||
router.post('/', requireWriteAccess(siteIdFromRoomId), (req, res) => {
|
||||
const { site_id, name, notes } = req.body;
|
||||
if (!site_id || !name) return res.status(400).json({ error: 'site_id and name are required' });
|
||||
|
||||
@@ -56,7 +64,7 @@ router.post('/', (req, res) => {
|
||||
});
|
||||
|
||||
// PUT /api/rooms/:id
|
||||
router.put('/:id', (req, res) => {
|
||||
router.put('/:id', requireWriteAccess(siteIdFromRoomPk), (req, res) => {
|
||||
const room = db.prepare('SELECT * FROM rooms WHERE id = ?').get(req.params.id);
|
||||
if (!room) return res.status(404).json({ error: 'Room not found' });
|
||||
|
||||
@@ -78,7 +86,7 @@ router.put('/:id', (req, res) => {
|
||||
});
|
||||
|
||||
// DELETE /api/rooms/:id
|
||||
router.delete('/:id', (req, res) => {
|
||||
router.delete('/:id', requireWriteAccess(siteIdFromRoomPk), (req, res) => {
|
||||
const room = db.prepare('SELECT * FROM rooms WHERE id = ?').get(req.params.id);
|
||||
if (!room) return res.status(404).json({ error: 'Room not found' });
|
||||
|
||||
|
||||
@@ -2,8 +2,12 @@ const express = require('express');
|
||||
const { v4: uuidv4 } = require('uuid');
|
||||
const db = require('../db');
|
||||
const { logAudit } = require('../audit');
|
||||
const { requireRole, requireWriteAccess } = require('../middleware/rbac');
|
||||
const router = express.Router();
|
||||
|
||||
// For advanced users: the site itself IS the permission boundary
|
||||
// PUT is allowed if they own that site; POST (create) and DELETE are admin-only.
|
||||
|
||||
// GET /api/sites
|
||||
router.get('/', (req, res) => {
|
||||
const sites = db.prepare(`
|
||||
@@ -33,8 +37,8 @@ router.get('/:id', (req, res) => {
|
||||
res.json({ ...site, rooms });
|
||||
});
|
||||
|
||||
// POST /api/sites
|
||||
router.post('/', (req, res) => {
|
||||
// POST /api/sites — admin only (creating a new site is a structural change)
|
||||
router.post('/', requireRole('admin'), (req, res) => {
|
||||
const { name, location, notes } = req.body;
|
||||
if (!name) return res.status(400).json({ error: 'Name is required' });
|
||||
|
||||
@@ -47,8 +51,8 @@ router.post('/', (req, res) => {
|
||||
res.status(201).json(created);
|
||||
});
|
||||
|
||||
// PUT /api/sites/:id
|
||||
router.put('/:id', (req, res) => {
|
||||
// PUT /api/sites/:id — admin always; advanced only if this is their assigned site
|
||||
router.put('/:id', requireWriteAccess(req => req.params.id), (req, res) => {
|
||||
const site = db.prepare('SELECT * FROM sites WHERE id = ?').get(req.params.id);
|
||||
if (!site) return res.status(404).json({ error: 'Site not found' });
|
||||
|
||||
@@ -71,8 +75,8 @@ router.put('/:id', (req, res) => {
|
||||
res.json(db.prepare('SELECT * FROM sites WHERE id = ?').get(req.params.id));
|
||||
});
|
||||
|
||||
// DELETE /api/sites/:id
|
||||
router.delete('/:id', (req, res) => {
|
||||
// DELETE /api/sites/:id — admin only
|
||||
router.delete('/:id', requireRole('admin'), (req, res) => {
|
||||
const site = db.prepare('SELECT * FROM sites WHERE id = ?').get(req.params.id);
|
||||
if (!site) return res.status(404).json({ error: 'Site not found' });
|
||||
|
||||
|
||||
@@ -1,40 +1,121 @@
|
||||
/**
|
||||
* /api/users
|
||||
*
|
||||
* Manages NetworkView users. Authentication is expected to be handled by
|
||||
* the external main app; this API accepts an `x-user-id` / `x-username`
|
||||
* header (set by the gateway after verifying the bearer token) and an
|
||||
* `x-api-key` header for direct service-to-service calls.
|
||||
* Manages NetworkView users. The GET / endpoint merges data from:
|
||||
* 1. The local NV users table (api_key status, site_permissions)
|
||||
* 2. The portal's /api/internal/nv-users endpoint (all portal users with NV access)
|
||||
*
|
||||
* Roles: admin | editor | viewer
|
||||
* This ensures portal users appear in Settings even before their first NV login.
|
||||
*/
|
||||
|
||||
const express = require('express');
|
||||
const { v4: uuidv4 } = require('uuid');
|
||||
const crypto = require('crypto');
|
||||
const http = require('http');
|
||||
const db = require('../db');
|
||||
const { logAudit } = require('../audit');
|
||||
const { requireRole } = require('../middleware/rbac');
|
||||
const router = express.Router();
|
||||
|
||||
// ── Config ────────────────────────────────────────────────────────────────────
|
||||
const PORTAL_URL = process.env.PORTAL_INTERNAL_URL || 'http://localhost:5001';
|
||||
const INTERNAL_TOKEN = process.env.INTERNAL_SYNC_SECRET || 'change-this-internal-secret';
|
||||
|
||||
// ── Helpers ──────────────────────────────────────────────────────────────────
|
||||
|
||||
const safeUser = u => ({
|
||||
id: u.id,
|
||||
username: u.username,
|
||||
email: u.email,
|
||||
role: u.role,
|
||||
is_active: u.is_active,
|
||||
has_api_key: !!u.api_key,
|
||||
created_at: u.created_at,
|
||||
updated_at: u.updated_at,
|
||||
});
|
||||
const safeUser = u => {
|
||||
const perm = db.prepare(
|
||||
'SELECT sp.site_id, s.name AS site_name FROM site_permissions sp LEFT JOIN sites s ON s.id = sp.site_id WHERE sp.user_id = ?'
|
||||
).get(u.id);
|
||||
return {
|
||||
id: u.id,
|
||||
username: u.username,
|
||||
email: u.email,
|
||||
role: u.role,
|
||||
is_active: Boolean(u.is_active),
|
||||
has_api_key: !!u.api_key,
|
||||
site_permission: perm ? { site_id: perm.site_id, site_name: perm.site_name } : null,
|
||||
created_at: u.created_at,
|
||||
updated_at: u.updated_at,
|
||||
};
|
||||
};
|
||||
|
||||
/** Fetch portal NV-users list. Returns [] on any error (best-effort). */
|
||||
function fetchPortalUsers() {
|
||||
return new Promise(resolve => {
|
||||
const url = new URL('/api/internal/nv-users', PORTAL_URL);
|
||||
const req = http.request(
|
||||
{ hostname: url.hostname, port: url.port || 80, path: url.pathname,
|
||||
method: 'GET', headers: { 'X-Internal-Token': INTERNAL_TOKEN } },
|
||||
res => {
|
||||
let body = '';
|
||||
res.on('data', c => { body += c; });
|
||||
res.on('end', () => {
|
||||
try { resolve(res.statusCode === 200 ? JSON.parse(body) : []); }
|
||||
catch (_) { resolve([]); }
|
||||
});
|
||||
}
|
||||
);
|
||||
req.on('error', () => resolve([]));
|
||||
req.setTimeout(3000, () => { req.destroy(); resolve([]); });
|
||||
req.end();
|
||||
});
|
||||
}
|
||||
|
||||
// ── GET /api/users ────────────────────────────────────────────────────────────
|
||||
router.get('/', (req, res) => {
|
||||
const users = db.prepare('SELECT * FROM users ORDER BY username').all();
|
||||
res.json(users.map(safeUser));
|
||||
// Merges portal users (with NV access) and local NV user rows.
|
||||
router.get('/', async (req, res) => {
|
||||
// Local NV users keyed by username
|
||||
const localUsers = db.prepare('SELECT * FROM users ORDER BY username').all();
|
||||
const localByUsername = Object.fromEntries(localUsers.map(u => [u.username, u]));
|
||||
|
||||
// Portal users (all who have NV access)
|
||||
const portalUsers = await fetchPortalUsers();
|
||||
|
||||
const seen = new Set();
|
||||
const result = [];
|
||||
|
||||
for (const pu of portalUsers) {
|
||||
seen.add(pu.username);
|
||||
const local = localByUsername[pu.username];
|
||||
|
||||
if (local) {
|
||||
// Merge: use portal role (source of truth) but keep NV-local extras
|
||||
result.push(safeUser({ ...local, role: _mapPortalRole(pu.nv_role) }));
|
||||
} else {
|
||||
// Portal user not yet in NV — show with no local extras
|
||||
const perm = null;
|
||||
result.push({
|
||||
id: pu.portal_id,
|
||||
username: pu.username,
|
||||
email: pu.email,
|
||||
role: _mapPortalRole(pu.nv_role),
|
||||
is_active: true,
|
||||
has_api_key: false,
|
||||
site_permission: null,
|
||||
created_at: null,
|
||||
updated_at: null,
|
||||
not_yet_synced: true, // hint for UI
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// Include any local-only users not in portal (e.g. API-key-only accounts)
|
||||
for (const u of localUsers) {
|
||||
if (!seen.has(u.username)) result.push(safeUser(u));
|
||||
}
|
||||
|
||||
result.sort((a, b) => a.username.localeCompare(b.username));
|
||||
res.json(result);
|
||||
});
|
||||
|
||||
/** Map portal role string → NV local role string */
|
||||
function _mapPortalRole(role) {
|
||||
if (role === 'admin') return 'admin';
|
||||
if (role === 'advanced') return 'advanced';
|
||||
return 'viewer';
|
||||
}
|
||||
|
||||
// ── GET /api/users/:id ────────────────────────────────────────────────────────
|
||||
router.get('/:id', (req, res) => {
|
||||
const user = db.prepare('SELECT * FROM users WHERE id = ?').get(req.params.id);
|
||||
@@ -113,6 +194,41 @@ router.delete('/:id', (req, res) => {
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ── GET /api/users/:id/site-permission ───────────────────────────────────────
|
||||
router.get('/:id/site-permission', requireRole('admin'), (req, res) => {
|
||||
const user = db.prepare('SELECT id FROM users WHERE id = ?').get(req.params.id);
|
||||
if (!user) return res.status(404).json({ error: 'User not found' });
|
||||
const perm = db.prepare(
|
||||
'SELECT sp.site_id, s.name AS site_name FROM site_permissions sp LEFT JOIN sites s ON s.id = sp.site_id WHERE sp.user_id = ?'
|
||||
).get(req.params.id);
|
||||
res.json(perm ?? { site_id: null, site_name: null });
|
||||
});
|
||||
|
||||
// ── PUT /api/users/:id/site-permission ───────────────────────────────────────
|
||||
// Body: { site_id: "<uuid>" } or { site_id: null } to clear
|
||||
router.put('/:id/site-permission', requireRole('admin'), (req, res) => {
|
||||
const user = db.prepare('SELECT id, username FROM users WHERE id = ?').get(req.params.id);
|
||||
if (!user) return res.status(404).json({ error: 'User not found' });
|
||||
|
||||
const { site_id } = req.body;
|
||||
|
||||
if (!site_id) {
|
||||
db.prepare('DELETE FROM site_permissions WHERE user_id = ?').run(req.params.id);
|
||||
logAudit(req, { action: 'update', entityType: 'user', entityId: user.id, entityName: user.username, changes: 'site_permission cleared' });
|
||||
return res.json({ ok: true, site_id: null });
|
||||
}
|
||||
|
||||
const site = db.prepare('SELECT id, name FROM sites WHERE id = ?').get(site_id);
|
||||
if (!site) return res.status(404).json({ error: 'Site not found' });
|
||||
|
||||
db.prepare(
|
||||
'INSERT INTO site_permissions (user_id, site_id) VALUES (?, ?) ON CONFLICT(user_id) DO UPDATE SET site_id=excluded.site_id, granted_at=CURRENT_TIMESTAMP'
|
||||
).run(req.params.id, site_id);
|
||||
|
||||
logAudit(req, { action: 'update', entityType: 'user', entityId: user.id, entityName: user.username, changes: `site_permission set to ${site.name}` });
|
||||
res.json({ ok: true, site_id, site_name: site.name });
|
||||
});
|
||||
|
||||
// ── POST /api/users/:id/api-key (generate / rotate) ─────────────────────────
|
||||
router.post('/:id/api-key', (req, res) => {
|
||||
const user = db.prepare('SELECT * FROM users WHERE id = ?').get(req.params.id);
|
||||
|
||||
Reference in New Issue
Block a user