u
This commit is contained in:
seb
385
src/api/routes/companyuser.js
Normal file
385
src/api/routes/companyuser.js
Normal file
@@ -0,0 +1,385 @@
|
||||
import * as db from '../../db/companyuser.js';
|
||||
import { clearCachedUser } from '../middleware/auth.js';
|
||||
import { emit } from '../sse.js';
|
||||
|
||||
// #region Helpers
|
||||
|
||||
function requireSelectedCompany(req) {
|
||||
const companyId = req.user?.selectedCompanyId;
|
||||
if (companyId == null) {
|
||||
return { error: 'No company selected' };
|
||||
}
|
||||
return { companyId };
|
||||
}
|
||||
|
||||
function parsePositiveInt(val, field = 'id') {
|
||||
const id = Number(val);
|
||||
if (!Number.isInteger(id) || id <= 0) {
|
||||
return { error: `${field} is required` };
|
||||
}
|
||||
return { id };
|
||||
}
|
||||
|
||||
function companyuserErrorStatus(error) {
|
||||
if (error.message === 'No company selected') return 400;
|
||||
if (error.message === 'Not authorized') return 403;
|
||||
if (error.message === 'Company not found') return 404;
|
||||
if (error.message === 'Company user not found') return 404;
|
||||
if (error.message === 'User not found') return 404;
|
||||
if (error.message === 'Invalid role') return 400;
|
||||
if (error.message === 'Invalid email') return 400;
|
||||
if (error.message === 'User already in company') return 409;
|
||||
if (error.message === 'Cannot demote the last admin') return 409;
|
||||
if (error.message === 'Cannot remove the last admin') return 409;
|
||||
return 500;
|
||||
}
|
||||
|
||||
// #endregion
|
||||
|
||||
/**
|
||||
* Registers company user (membership) routes. All routes require the caller
|
||||
* to be an admin of the selected company.
|
||||
* @param {import('express').Application} app
|
||||
* @param {string} [basePath='']
|
||||
*/
|
||||
export function register(app, basePath = '') {
|
||||
/**
|
||||
* @openapi
|
||||
* /companyuser:
|
||||
* get:
|
||||
* tags: [CompanyUser]
|
||||
* summary: List company users
|
||||
* description: Lists the members of the selected company with their role. Admin only.
|
||||
* security:
|
||||
* - cookieAuth: []
|
||||
* x-markdown: companyuser/list.md
|
||||
* responses:
|
||||
* 200:
|
||||
* description: Company members
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* properties:
|
||||
* companyusers:
|
||||
* type: array
|
||||
* items:
|
||||
* $ref: '#/components/schemas/CompanyUser'
|
||||
* 400:
|
||||
* description: No company selected
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 401:
|
||||
* description: Unauthorized
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 403:
|
||||
* description: Not authorized (admin of the selected company required)
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
*/
|
||||
// #region GET /companyuser
|
||||
|
||||
app.get(`${basePath}/companyuser`, async (req, res) => {
|
||||
const selected = requireSelectedCompany(req);
|
||||
if (selected.error) {
|
||||
return res.status(400).json({ error: selected.error });
|
||||
}
|
||||
|
||||
try {
|
||||
const companyusers = await db.list(req.user.id);
|
||||
res.status(200).json({ companyusers });
|
||||
} catch (error) {
|
||||
const status = companyuserErrorStatus(error);
|
||||
if (status === 500) console.error('List company users failed:', error);
|
||||
res.status(status).json({ error: error.message });
|
||||
}
|
||||
});
|
||||
|
||||
// #endregion
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /companyuser:
|
||||
* post:
|
||||
* tags: [CompanyUser]
|
||||
* summary: Add an existing user to the company
|
||||
* description: |
|
||||
* Adds an existing (registered) user, identified by email, to the selected company. Admin only.
|
||||
* The added user can then switch to this company via `PUT /auth/selected-company`.
|
||||
* For emails that are not registered yet use `POST /autoinvite`.
|
||||
* security:
|
||||
* - cookieAuth: []
|
||||
* x-signals: [companyuser]
|
||||
* x-markdown: companyuser/create.md
|
||||
* requestBody:
|
||||
* required: true
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* required: [email]
|
||||
* properties:
|
||||
* email:
|
||||
* type: string
|
||||
* role:
|
||||
* type: string
|
||||
* enum: [admin, user]
|
||||
* default: user
|
||||
* example:
|
||||
* email: colleague@example.com
|
||||
* role: user
|
||||
* responses:
|
||||
* 201:
|
||||
* description: Created company user
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* properties:
|
||||
* companyuser:
|
||||
* $ref: '#/components/schemas/CompanyUser'
|
||||
* 400:
|
||||
* description: No company selected, invalid email or invalid role
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 401:
|
||||
* description: Unauthorized
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 403:
|
||||
* description: Not authorized (admin of the selected company required)
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 404:
|
||||
* description: No registered user with this email
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 409:
|
||||
* description: User already in company
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
*/
|
||||
// #region POST /companyuser
|
||||
|
||||
app.post(`${basePath}/companyuser`, async (req, res) => {
|
||||
const selected = requireSelectedCompany(req);
|
||||
if (selected.error) {
|
||||
return res.status(400).json({ error: selected.error });
|
||||
}
|
||||
|
||||
try {
|
||||
const companyuser = await db.addByEmail(req.user.id, {
|
||||
email: req.body?.email,
|
||||
role: req.body?.role,
|
||||
});
|
||||
emit('companyuser', { companyId: selected.companyId });
|
||||
res.status(201).json({ companyuser });
|
||||
} catch (error) {
|
||||
const status = companyuserErrorStatus(error);
|
||||
if (status === 500) console.error('Add company user failed:', error);
|
||||
res.status(status).json({ error: error.message });
|
||||
}
|
||||
});
|
||||
|
||||
// #endregion
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /companyuser/{id}:
|
||||
* patch:
|
||||
* tags: [CompanyUser]
|
||||
* summary: Change a company user's role
|
||||
* description: Changes the role of a member of the selected company. The last admin cannot be demoted. Admin only.
|
||||
* security:
|
||||
* - cookieAuth: []
|
||||
* x-signals: [companyuser]
|
||||
* x-markdown: companyuser/update.md
|
||||
* parameters:
|
||||
* - in: path
|
||||
* name: id
|
||||
* required: true
|
||||
* schema:
|
||||
* type: integer
|
||||
* requestBody:
|
||||
* required: true
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* required: [role]
|
||||
* properties:
|
||||
* role:
|
||||
* type: string
|
||||
* enum: [admin, user]
|
||||
* responses:
|
||||
* 200:
|
||||
* description: Updated company user
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* properties:
|
||||
* companyuser:
|
||||
* type: object
|
||||
* properties:
|
||||
* id:
|
||||
* type: integer
|
||||
* googleAuthId:
|
||||
* type: integer
|
||||
* role:
|
||||
* type: string
|
||||
* enum: [admin, user]
|
||||
* 400:
|
||||
* description: Invalid id, role or no company selected
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 401:
|
||||
* description: Unauthorized
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 403:
|
||||
* description: Not authorized (admin of the selected company required)
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 404:
|
||||
* description: Company user not found
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 409:
|
||||
* description: Cannot demote the last admin
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
*/
|
||||
// #region PATCH /companyuser/:id
|
||||
|
||||
app.patch(`${basePath}/companyuser/:id`, async (req, res) => {
|
||||
const selected = requireSelectedCompany(req);
|
||||
if (selected.error) {
|
||||
return res.status(400).json({ error: selected.error });
|
||||
}
|
||||
const parsedId = parsePositiveInt(req.params.id);
|
||||
if (parsedId.error) {
|
||||
return res.status(400).json({ error: parsedId.error });
|
||||
}
|
||||
|
||||
try {
|
||||
const companyuser = await db.setRole(req.user.id, parsedId.id, req.body?.role);
|
||||
clearCachedUser(companyuser.googleAuthId);
|
||||
emit('companyuser', { companyId: selected.companyId });
|
||||
res.status(200).json({ companyuser });
|
||||
} catch (error) {
|
||||
const status = companyuserErrorStatus(error);
|
||||
if (status === 500) console.error('Update company user failed:', error);
|
||||
res.status(status).json({ error: error.message });
|
||||
}
|
||||
});
|
||||
|
||||
// #endregion
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /companyuser/{id}:
|
||||
* delete:
|
||||
* tags: [CompanyUser]
|
||||
* summary: Remove a user from the company
|
||||
* description: |
|
||||
* Removes a member from the selected company. History entries stay but lose their author link;
|
||||
* if the removed user had this company selected, their selection is cleared.
|
||||
* The last admin cannot be removed. Admin only.
|
||||
* security:
|
||||
* - cookieAuth: []
|
||||
* x-signals: [companyuser]
|
||||
* x-markdown: companyuser/delete.md
|
||||
* parameters:
|
||||
* - in: path
|
||||
* name: id
|
||||
* required: true
|
||||
* schema:
|
||||
* type: integer
|
||||
* responses:
|
||||
* 204:
|
||||
* description: Removed
|
||||
* 400:
|
||||
* description: Invalid id or no company selected
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 401:
|
||||
* description: Unauthorized
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 403:
|
||||
* description: Not authorized (admin of the selected company required)
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 404:
|
||||
* description: Company user not found
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
* 409:
|
||||
* description: Cannot remove the last admin
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* $ref: '#/components/schemas/Error'
|
||||
*/
|
||||
// #region DELETE /companyuser/:id
|
||||
|
||||
app.delete(`${basePath}/companyuser/:id`, async (req, res) => {
|
||||
const selected = requireSelectedCompany(req);
|
||||
if (selected.error) {
|
||||
return res.status(400).json({ error: selected.error });
|
||||
}
|
||||
const parsedId = parsePositiveInt(req.params.id);
|
||||
if (parsedId.error) {
|
||||
return res.status(400).json({ error: parsedId.error });
|
||||
}
|
||||
|
||||
try {
|
||||
const removed = await db.remove(req.user.id, parsedId.id);
|
||||
clearCachedUser(removed.googleAuthId);
|
||||
emit('companyuser', { companyId: selected.companyId });
|
||||
res.sendStatus(204);
|
||||
} catch (error) {
|
||||
const status = companyuserErrorStatus(error);
|
||||
if (status === 500) console.error('Remove company user failed:', error);
|
||||
res.status(status).json({ error: error.message });
|
||||
}
|
||||
});
|
||||
|
||||
// #endregion
|
||||
}
|
||||
Reference in New Issue
Block a user