Major refactor: auth, bug fixes, security hardening, modular routes
Bug fixes - Sync database.js schema with actual production DB (tarifoptionen shape was wrong; new installs would have broken). - Fix SQL syntax error `SELECT to.*` (reserved keyword) in single- schaltung provision endpoint, plus the dead fallback hierarchy that selected columns that were never in the query. - Fix PUT /api/tarifoptionen/:id writing to non-existent column provision_betrag (should be provision_euro). - Fix race condition in PUT /api/schaltungen/:id where forEach with async db.run inside a transaction could send duplicate responses. - Delete dokumente rows explicitly before deleting schaltung (existing DBs lack ON DELETE CASCADE on dokumente FK). - Replace hardcoded basisBetrag=100 for percent rules; basis is now configurable per rule via the new basis_euro column. Security - Multi-user authentication: users table, bcryptjs, express-session with SQLite store, login/logout/me/setup/change-password endpoints. - Auth gate on all /api/* except /api/auth/*. - CLI to create users: npm run create-user -- <user> <pass> [--admin]. - helmet for security headers. - CORS restricted to ALLOWED_ORIGINS env (default same-origin). - Rate limits: 300/min global, 20/15min on login. - Path-traversal validation on document download/delete. - XSS hardening in frontend: escapeHtml helper applied to all DB-derived innerHTML interpolations; inline onclick handlers that embedded user-controlled strings replaced with data-* attrs + addEventListener. Architecture - Provision calculation centralised in provisionService.js as the single source of truth (was duplicated and inconsistent). - server.js cut from 2138 to ~140 lines; routes split into per- resource modules under routes/. - Promise wrapper db.js for sqlite3 callbacks; async/await in routes. - middleware/ for auth and async error handling. Tests - 14 unit tests for provisionService covering fallback hierarchy, percent calculation, tarifoptionen, hardware logic, employee commission. All green. Config - dotenv loads .env.local at startup (gitignored). - .gitignore extended for sessions.db and .env*. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
kerimatilganandClaude Opus 4.7 committed
1 parent
55ec916f35
commit
4303b00b9b
23 files changed
+2427
-2575
No files matched your search
@@ -0,0 +1,205 @@
|
||||
const express = require('express');
|
||||
const db = require('../db');
|
||||
const asyncHandler = require('../middleware/asyncHandler');
|
||||
|
||||
const router = express.Router();
|
||||
|
||||
// Helper: find or insert a tarifoptionen row matching the new structure's option.
|
||||
// Used by the /multi endpoints to keep the old tarifoptionen table in sync.
|
||||
async function syncLegacyOption(anbieter_id, tarif_id, name, code, provision_euro, beschreibung) {
|
||||
try {
|
||||
await db.run(
|
||||
`INSERT OR IGNORE INTO tarifoptionen (anbieter_id, tarif_id, name, code, provision_euro, beschreibung)
|
||||
VALUES (?, ?, ?, ?, ?, ?)`,
|
||||
[anbieter_id, tarif_id, name, code || null, provision_euro || 0, beschreibung || null]
|
||||
);
|
||||
} catch (err) {
|
||||
console.error('Legacy tarifoption sync failed:', err.message);
|
||||
}
|
||||
}
|
||||
|
||||
// --- Legacy single-tariff API (per-(anbieter,tarif) options) ---
|
||||
|
||||
router.get('/', asyncHandler(async (req, res) => {
|
||||
const rows = await db.all(
|
||||
`SELECT t.*, a.name AS anbieter_name, ta.name AS tarif_name
|
||||
FROM tarifoptionen t
|
||||
JOIN anbieter a ON t.anbieter_id = a.id
|
||||
LEFT JOIN tarife ta ON t.tarif_id = ta.id
|
||||
WHERE t.aktiv = 1
|
||||
ORDER BY a.name, t.tarif_id IS NULL DESC, COALESCE(ta.name, ''), t.name`
|
||||
);
|
||||
res.json(rows);
|
||||
}));
|
||||
|
||||
router.post('/', asyncHandler(async (req, res) => {
|
||||
const { anbieter_id, tarif_id, name, code, provision_euro, beschreibung } = req.body || {};
|
||||
if (!anbieter_id && !tarif_id) {
|
||||
return res.status(400).json({ error: 'Entweder Anbieter oder Tarif muss angegeben werden' });
|
||||
}
|
||||
if (!name || !name.trim()) {
|
||||
return res.status(400).json({ error: 'Name ist erforderlich' });
|
||||
}
|
||||
|
||||
let resolvedAnbieterId = anbieter_id;
|
||||
if (tarif_id && !resolvedAnbieterId) {
|
||||
const tarif = await db.get('SELECT anbieter_id FROM tarife WHERE id = ?', [tarif_id]);
|
||||
if (!tarif) return res.status(404).json({ error: 'Tarif nicht gefunden' });
|
||||
resolvedAnbieterId = tarif.anbieter_id;
|
||||
}
|
||||
|
||||
try {
|
||||
const result = await db.run(
|
||||
`INSERT INTO tarifoptionen (anbieter_id, tarif_id, name, code, provision_euro, beschreibung)
|
||||
VALUES (?, ?, ?, ?, ?, ?)`,
|
||||
[resolvedAnbieterId, tarif_id || null, name.trim(), code || null, provision_euro || 0, beschreibung || null]
|
||||
);
|
||||
res.json({ id: result.lastID, message: 'Tarifoption erfolgreich erstellt' });
|
||||
} catch (err) {
|
||||
if (/UNIQUE/.test(err.message)) {
|
||||
const scope = tarif_id ? 'für diesen Tarif' : 'für diesen Anbieter';
|
||||
return res.status(400).json({ error: `Eine Tarifoption mit diesem Namen existiert bereits ${scope}` });
|
||||
}
|
||||
throw err;
|
||||
}
|
||||
}));
|
||||
|
||||
router.put('/:id', asyncHandler(async (req, res) => {
|
||||
const { id } = req.params;
|
||||
const { name, provision_euro } = req.body || {};
|
||||
if (!name) return res.status(400).json({ error: 'Tarifoption-Name ist erforderlich' });
|
||||
const result = await db.run(
|
||||
'UPDATE tarifoptionen SET name = ?, provision_euro = ? WHERE id = ?',
|
||||
[name, provision_euro || 0, id]
|
||||
);
|
||||
if (result.changes === 0) return res.status(404).json({ error: 'Tarifoption nicht gefunden' });
|
||||
res.json({ message: 'Tarifoption erfolgreich aktualisiert' });
|
||||
}));
|
||||
|
||||
router.delete('/:id', asyncHandler(async (req, res) => {
|
||||
const { id } = req.params;
|
||||
const result = await db.run('DELETE FROM tarifoptionen WHERE id = ?', [id]);
|
||||
if (result.changes === 0) return res.status(404).json({ error: 'Tarifoption nicht gefunden' });
|
||||
res.json({ message: 'Tarifoption erfolgreich gelöscht' });
|
||||
}));
|
||||
|
||||
// --- Multi-tariff API (tarifoptionen_new + tarifoptionen_tarife) ---
|
||||
|
||||
router.get('/multi', asyncHandler(async (req, res) => {
|
||||
const rows = await db.all(
|
||||
`SELECT tn.id, tn.name, tn.code, tn.provision_euro, tn.beschreibung, tn.aktiv, tn.created_at,
|
||||
GROUP_CONCAT(t.name || ' (' || a.name || ')') AS tarif_names,
|
||||
GROUP_CONCAT(t.id) AS tarif_ids
|
||||
FROM tarifoptionen_new tn
|
||||
LEFT JOIN tarifoptionen_tarife tt ON tn.id = tt.tarifoption_id
|
||||
LEFT JOIN tarife t ON tt.tarif_id = t.id
|
||||
LEFT JOIN anbieter a ON t.anbieter_id = a.id
|
||||
WHERE tn.aktiv = 1
|
||||
GROUP BY tn.id, tn.name, tn.code, tn.provision_euro, tn.beschreibung, tn.aktiv, tn.created_at
|
||||
ORDER BY tn.created_at DESC`
|
||||
);
|
||||
res.json(rows);
|
||||
}));
|
||||
|
||||
router.post('/multi', asyncHandler(async (req, res) => {
|
||||
const { anbieter_id, tarif_ids = [], is_anbieter_weit = false, name, code, provision_euro, beschreibung } = req.body || {};
|
||||
if (!anbieter_id || !name) return res.status(400).json({ error: 'Anbieter und Name sind erforderlich' });
|
||||
if (!is_anbieter_weit && (!tarif_ids || tarif_ids.length === 0)) {
|
||||
return res.status(400).json({ error: 'Bei tarif-spezifischen Optionen müssen Tarife ausgewählt werden' });
|
||||
}
|
||||
|
||||
const newId = await db.transaction(async () => {
|
||||
const inserted = await db.run(
|
||||
'INSERT INTO tarifoptionen_new (name, code, provision_euro, beschreibung) VALUES (?, ?, ?, ?)',
|
||||
[name, code || null, provision_euro || 0, beschreibung || null]
|
||||
);
|
||||
const tarifoptionId = inserted.lastID;
|
||||
|
||||
let targetTarifIds = tarif_ids;
|
||||
if (is_anbieter_weit) {
|
||||
const tarifs = await db.all('SELECT id FROM tarife WHERE anbieter_id = ?', [anbieter_id]);
|
||||
targetTarifIds = tarifs.map(t => t.id);
|
||||
}
|
||||
|
||||
for (const tarifId of targetTarifIds) {
|
||||
await db.run(
|
||||
'INSERT INTO tarifoptionen_tarife (tarifoption_id, tarif_id) VALUES (?, ?)',
|
||||
[tarifoptionId, tarifId]
|
||||
);
|
||||
await syncLegacyOption(anbieter_id, tarifId, name, code, provision_euro, beschreibung);
|
||||
}
|
||||
return { id: tarifoptionId, count: targetTarifIds.length };
|
||||
});
|
||||
|
||||
res.json({ id: newId.id, message: 'Tarifoption erfolgreich erstellt', assignments: newId.count });
|
||||
}));
|
||||
|
||||
router.put('/multi/:id', asyncHandler(async (req, res) => {
|
||||
const { id } = req.params;
|
||||
const { name, code, provision_euro, beschreibung, anbieter_id, is_anbieter_weit, tarif_ids } = req.body || {};
|
||||
if (!name) return res.status(400).json({ error: 'Tarifoption-Name ist erforderlich' });
|
||||
|
||||
await db.transaction(async () => {
|
||||
const upd = await db.run(
|
||||
'UPDATE tarifoptionen_new SET name = ?, code = ?, provision_euro = ?, beschreibung = ? WHERE id = ?',
|
||||
[name, code || null, provision_euro || 0, beschreibung || null, id]
|
||||
);
|
||||
if (upd.changes === 0) {
|
||||
const e = new Error('Tarifoption nicht gefunden');
|
||||
e.status = 404;
|
||||
throw e;
|
||||
}
|
||||
await db.run('DELETE FROM tarifoptionen_tarife WHERE tarifoption_id = ?', [id]);
|
||||
// Best-effort cleanup of legacy rows that may have been synced under this name/code.
|
||||
await db.run(
|
||||
'DELETE FROM tarifoptionen WHERE name = ? AND (code = ? OR (code IS NULL AND ? IS NULL))',
|
||||
[name, code || null, code || null]
|
||||
);
|
||||
|
||||
let targetTarifIds = tarif_ids || [];
|
||||
if (is_anbieter_weit && anbieter_id) {
|
||||
const tarifs = await db.all('SELECT id FROM tarife WHERE anbieter_id = ?', [anbieter_id]);
|
||||
targetTarifIds = tarifs.map(t => t.id);
|
||||
}
|
||||
|
||||
for (const tarifId of targetTarifIds) {
|
||||
await db.run(
|
||||
'INSERT INTO tarifoptionen_tarife (tarifoption_id, tarif_id) VALUES (?, ?)',
|
||||
[id, tarifId]
|
||||
);
|
||||
const tarif = await db.get('SELECT anbieter_id FROM tarife WHERE id = ?', [tarifId]);
|
||||
if (tarif) {
|
||||
await syncLegacyOption(tarif.anbieter_id, tarifId, name, code, provision_euro, beschreibung);
|
||||
}
|
||||
}
|
||||
});
|
||||
res.json({ message: 'Tarifoption erfolgreich aktualisiert' });
|
||||
}));
|
||||
|
||||
router.delete('/multi/:id', asyncHandler(async (req, res) => {
|
||||
const { id } = req.params;
|
||||
const option = await db.get('SELECT name, code FROM tarifoptionen_new WHERE id = ?', [id]);
|
||||
if (!option) return res.status(404).json({ error: 'Tarifoption nicht gefunden' });
|
||||
|
||||
await db.transaction(async () => {
|
||||
await db.run('DELETE FROM tarifoptionen_tarife WHERE tarifoption_id = ?', [id]);
|
||||
await db.run(
|
||||
'DELETE FROM tarifoptionen WHERE name = ? AND (code = ? OR (code IS NULL AND ? IS NULL))',
|
||||
[option.name, option.code, option.code]
|
||||
);
|
||||
await db.run('DELETE FROM tarifoptionen_new WHERE id = ?', [id]);
|
||||
});
|
||||
res.json({ message: 'Tarifoption erfolgreich gelöscht' });
|
||||
}));
|
||||
|
||||
// Tariff-specific tarifoption list (used by frontend when adding options to a schaltung)
|
||||
router.get('/tarif/:tarif_id', asyncHandler(async (req, res) => {
|
||||
const { tarif_id } = req.params;
|
||||
const rows = await db.all(
|
||||
'SELECT * FROM tarifoptionen WHERE tarif_id = ? AND aktiv = 1 ORDER BY name',
|
||||
[tarif_id]
|
||||
);
|
||||
res.json(rows);
|
||||
}));
|
||||
|
||||
module.exports = router;
|
||||
Reference in new issue
Block a user