Paddy
bf7be65b03
Jenkins Production Deployment
Reviewed-on: #12 Co-authored-by: Patrick Müller <mail@pmueller.me> Co-committed-by: Patrick Müller <mail@pmueller.me>
49 lines
1.8 KiB
TypeScript
49 lines
1.8 KiB
TypeScript
import express, {Request, Response} from 'express';
|
|
import {requireAppAccess, requireSignedIn} from './admin.middleware.js';
|
|
import {usersAdminRouter} from './users/users.admin.router.js';
|
|
import {invitationsRouter} from './invitations/invitations.router.js';
|
|
|
|
/**
|
|
* The admin module's JSON routes. Deliberately *not* the better-auth handler:
|
|
* that one is mounted separately in app.ts, ahead of express.json(), because it
|
|
* needs the raw request body stream.
|
|
*
|
|
* Mounted at /admin, so the tree is:
|
|
* /admin/me any signed-in account
|
|
* /admin/users/* admin permission
|
|
* /admin/invitations/* admin permission
|
|
*/
|
|
export const adminRouter = express.Router();
|
|
|
|
/**
|
|
* @swagger
|
|
* /admin/me:
|
|
* get:
|
|
* summary: The current user's identity and app permissions
|
|
* description: Used by every frontend to decide what to show. The API remains the real gate.
|
|
* tags: [admin]
|
|
* responses:
|
|
* 200:
|
|
* description: Success
|
|
* 401:
|
|
* description: Not signed in
|
|
* 403:
|
|
* description: Account disabled
|
|
*/
|
|
adminRouter.get('/me', requireSignedIn, (req: Request, res: Response) => {
|
|
res.status(200).send({
|
|
id: res.locals.admin.id,
|
|
email: res.locals.admin.email,
|
|
fullName: res.locals.admin.displayName,
|
|
// `permissions` is the full (app, role) truth; `apps` is the distinct
|
|
// apps within it. Both are sent because the three frontends only ever ask
|
|
// "may I show this app?", and keeping `apps` means a finer permission can
|
|
// land here without a coordinated deploy of all of them.
|
|
permissions: res.locals.admin.permissions,
|
|
apps: res.locals.admin.apps
|
|
});
|
|
});
|
|
|
|
adminRouter.use('/users', requireAppAccess('admin'), usersAdminRouter);
|
|
adminRouter.use('/invitations', requireAppAccess('admin'), invitationsRouter);
|