85 lines
4.3 KiB
JavaScript
85 lines
4.3 KiB
JavaScript
const bcrypt = require('bcryptjs');
|
||
|
||
let db;
|
||
|
||
function init(database) { db = database; }
|
||
|
||
function setupRoutes(app, auth) {
|
||
const { authenticateToken, requireAdmin } = auth;
|
||
|
||
app.get('/api/admin/users', authenticateToken, requireAdmin, (req, res) => {
|
||
db.all(`SELECT id, login, full_name, role, created_at FROM users ORDER BY id`, (err, rows) => {
|
||
if (err) return res.status(500).json({ error: 'Ошибка БД' });
|
||
res.json(rows);
|
||
});
|
||
});
|
||
|
||
app.post('/api/admin/users', authenticateToken, requireAdmin, (req, res) => {
|
||
const { login, password, full_name, role } = req.body;
|
||
if (!login || !password) return res.status(400).json({ error: 'Логин и пароль обязательны' });
|
||
const hash = bcrypt.hashSync(password, 10);
|
||
const stmt = db.prepare(`INSERT INTO users (login, password_hash, full_name, role) VALUES (?, ?, ?, ?)`);
|
||
stmt.run(login, hash, full_name || '', role || 'admin', function(err) {
|
||
if (err) {
|
||
if (err.message.includes('UNIQUE')) return res.status(409).json({ error: 'Пользователь с таким логином уже существует' });
|
||
return res.status(500).json({ error: 'Ошибка создания' });
|
||
}
|
||
db.get(`SELECT id, login, full_name, role, created_at FROM users WHERE id = ?`, [this.lastID], (e2, row) => {
|
||
res.status(201).json(row);
|
||
});
|
||
});
|
||
stmt.finalize();
|
||
});
|
||
|
||
app.put('/api/admin/users/:id', authenticateToken, requireAdmin, (req, res) => {
|
||
const id = parseInt(req.params.id);
|
||
if (isNaN(id)) return res.status(400).json({ error: 'Неверный ID' });
|
||
const { login, password, full_name, role } = req.body;
|
||
|
||
if (password) {
|
||
const hash = bcrypt.hashSync(password, 10);
|
||
const stmt = db.prepare(`UPDATE users SET login = ?, password_hash = ?, full_name = ?, role = ? WHERE id = ?`);
|
||
stmt.run(login, hash, full_name || '', role || 'admin', id, function(err) {
|
||
if (err) return res.status(500).json({ error: 'Ошибка обновления' });
|
||
if (this.changes === 0) return res.status(404).json({ error: 'Не найдено' });
|
||
db.get(`SELECT id, login, full_name, role, created_at FROM users WHERE id = ?`, [id], (e2, row) => {
|
||
res.json(row);
|
||
});
|
||
});
|
||
stmt.finalize();
|
||
} else {
|
||
const stmt = db.prepare(`UPDATE users SET login = ?, full_name = ?, role = ? WHERE id = ?`);
|
||
stmt.run(login, full_name || '', role || 'admin', id, function(err) {
|
||
if (err) return res.status(500).json({ error: 'Ошибка обновления' });
|
||
if (this.changes === 0) return res.status(404).json({ error: 'Не найдено' });
|
||
db.get(`SELECT id, login, full_name, role, created_at FROM users WHERE id = ?`, [id], (e2, row) => {
|
||
res.json(row);
|
||
});
|
||
});
|
||
stmt.finalize();
|
||
}
|
||
});
|
||
|
||
app.delete('/api/admin/users/:id', authenticateToken, requireAdmin, (req, res) => {
|
||
const id = parseInt(req.params.id);
|
||
if (isNaN(id)) return res.status(400).json({ error: 'Неверный ID' });
|
||
if (id === req.user.id) return res.status(400).json({ error: 'Нельзя удалить самого себя' });
|
||
|
||
const superadmin = process.env.ADMIN_USERNAME || 'admin';
|
||
db.get(`SELECT login FROM users WHERE id = ?`, [id], (e1, row) => {
|
||
if (row && row.login === superadmin) {
|
||
return res.status(400).json({ error: 'Нельзя удалить суперадминистратора из .env' });
|
||
}
|
||
const stmt = db.prepare(`DELETE FROM users WHERE id = ?`);
|
||
stmt.run(id, function(err) {
|
||
if (err) return res.status(500).json({ error: 'Ошибка удаления' });
|
||
if (this.changes === 0) return res.status(404).json({ error: 'Не найдено' });
|
||
res.json({ message: 'Пользователь удалён' });
|
||
});
|
||
stmt.finalize();
|
||
});
|
||
});
|
||
}
|
||
|
||
module.exports = { init, setupRoutes };
|