DK404/CentralBackend
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: enforce admin-only access for user management routes

Browse Source
This commit is contained in:
seaznCode 2026-01-17 20:06:09 +01:00
parent 1685df8389
commit ffe4461016
4 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
routes/deleteRoutes.js
View File

@ -24,7 +24,7 @@ function forceCompanyForAdmin(req, res, next) {
} }
// DELETE /admin/user/:id (moved from routes/admin.js) // DELETE /admin/user/:id (moved from routes/admin.js)
router.delete('/admin/user/:id', authMiddleware, AdminUserController.deleteUser); router.delete('/admin/user/:id', authMiddleware, adminOnly, AdminUserController.deleteUser);
// DELETE /document-templates/:id (moved from routes/documentTemplates.js) // DELETE /document-templates/:id (moved from routes/documentTemplates.js)
router.delete('/document-templates/:id', authMiddleware, DocumentTemplateController.deleteTemplate); router.delete('/document-templates/:id', authMiddleware, DocumentTemplateController.deleteTemplate);

2
routes/getRoutes.js
View File

@ -54,7 +54,7 @@ router.get('/user/status-progress', authMiddleware, UserStatusController.getStat
router.get('/users/:id/full', authMiddleware, UserController.getFullUserData); router.get('/users/:id/full', authMiddleware, UserController.getFullUserData);
router.get('/user/settings', authMiddleware, UserSettingsController.getSettings); router.get('/user/settings', authMiddleware, UserSettingsController.getSettings);
router.get('/users/:id/permissions', authMiddleware, PermissionController.getUserPermissions); router.get('/users/:id/permissions', authMiddleware, PermissionController.getUserPermissions);
router.get('/admin/users/:id/full', authMiddleware, AdminUserController.getFullUserAccountDetails); router.get('/admin/users/:id/full', authMiddleware, adminOnly, AdminUserController.getFullUserAccountDetails);
router.get('/admin/users/:id/detailed', authMiddleware, requireAdmin, AdminUserController.getDetailedUserInfo); router.get('/admin/users/:id/detailed', authMiddleware, requireAdmin, AdminUserController.getDetailedUserInfo);
router.get('/users/:id/documents', authMiddleware, UserController.getUserDocumentsAndContracts); router.get('/users/:id/documents', authMiddleware, UserController.getUserDocumentsAndContracts);
router.get('/verify-password-reset', (req, res) => { /* Note: was moved from PasswordResetController.verifyPasswordResetToken */ res.status(204).end(); }); // keep placeholder if controller already registered via other verb router.get('/verify-password-reset', (req, res) => { /* Note: was moved from PasswordResetController.verifyPasswordResetToken */ res.status(204).end(); }); // keep placeholder if controller already registered via other verb

4
routes/postRoutes.js
View File

@ -73,8 +73,8 @@ router.post('/profile/personal/complete', authMiddleware, PersonalProfileControl
router.post('/profile/company/complete', authMiddleware, CompanyProfileController.completeProfile); router.post('/profile/company/complete', authMiddleware, CompanyProfileController.completeProfile);
// Admin POSTs (moved from routes/admin.js) // Admin POSTs (moved from routes/admin.js)
router.post('/admin/verify-user/:id', authMiddleware, AdminUserController.verifyUser); router.post('/admin/verify-user/:id', authMiddleware, adminOnly, AdminUserController.verifyUser);
router.post('/admin/send-password-reset/:userId', authMiddleware, async (req, res) => { router.post('/admin/send-password-reset/:userId', authMiddleware, adminOnly, async (req, res) => {
const userId = req.params.userId; const userId = req.params.userId;
// require here to avoid circular/top-level ordering issues // require here to avoid circular/top-level ordering issues
const UnitOfWork = require('../database/UnitOfWork'); const UnitOfWork = require('../database/UnitOfWork');

2
routes/putRoutes.js
View File

@ -17,7 +17,7 @@ function adminOnly(req, res, next) {
} }
// PUT /admin/users/:id/permissions (moved from routes/admin.js) // PUT /admin/users/:id/permissions (moved from routes/admin.js)
router.put('/admin/users/:id/permissions', authMiddleware, AdminUserController.updateUserPermissions); router.put('/admin/users/:id/permissions', authMiddleware, adminOnly, AdminUserController.updateUserPermissions);
// PUT /document-templates/:id (moved from routes/documentTemplates.js) // PUT /document-templates/:id (moved from routes/documentTemplates.js)
router.put('/document-templates/:id', authMiddleware, upload.single('file'), DocumentTemplateController.updateTemplate); router.put('/document-templates/:id', authMiddleware, upload.single('file'), DocumentTemplateController.updateTemplate);