Files
prov/routes/tarifoptionen.js
kerimatilganandClaude Opus 4.7 4303b00b9b Major refactor: auth, bug fixes, security hardening, modular routes
Bug fixes
- Sync database.js schema with actual production DB (tarifoptionen
  shape was wrong; new installs would have broken).
- Fix SQL syntax error `SELECT to.*` (reserved keyword) in single-
  schaltung provision endpoint, plus the dead fallback hierarchy
  that selected columns that were never in the query.
- Fix PUT /api/tarifoptionen/:id writing to non-existent column
  provision_betrag (should be provision_euro).
- Fix race condition in PUT /api/schaltungen/:id where forEach with
  async db.run inside a transaction could send duplicate responses.
- Delete dokumente rows explicitly before deleting schaltung
  (existing DBs lack ON DELETE CASCADE on dokumente FK).
- Replace hardcoded basisBetrag=100 for percent rules; basis is now
  configurable per rule via the new basis_euro column.

Security
- Multi-user authentication: users table, bcryptjs, express-session
  with SQLite store, login/logout/me/setup/change-password endpoints.
- Auth gate on all /api/* except /api/auth/*.
- CLI to create users: npm run create-user -- <user> <pass> [--admin].
- helmet for security headers.
- CORS restricted to ALLOWED_ORIGINS env (default same-origin).
- Rate limits: 300/min global, 20/15min on login.
- Path-traversal validation on document download/delete.
- XSS hardening in frontend: escapeHtml helper applied to all
  DB-derived innerHTML interpolations; inline onclick handlers that
  embedded user-controlled strings replaced with data-* attrs +
  addEventListener.

Architecture
- Provision calculation centralised in provisionService.js as the
  single source of truth (was duplicated and inconsistent).
- server.js cut from 2138 to ~140 lines; routes split into per-
  resource modules under routes/.
- Promise wrapper db.js for sqlite3 callbacks; async/await in routes.
- middleware/ for auth and async error handling.

Tests
- 14 unit tests for provisionService covering fallback hierarchy,
  percent calculation, tarifoptionen, hardware logic, employee
  commission. All green.

Config
- dotenv loads .env.local at startup (gitignored).
- .gitignore extended for sessions.db and .env*.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-14 21:43:19 +02:00

206 lines
8.9 KiB
JavaScript

const express = require('express');
const db = require('../db');
const asyncHandler = require('../middleware/asyncHandler');
const router = express.Router();
// Helper: find or insert a tarifoptionen row matching the new structure's option.
// Used by the /multi endpoints to keep the old tarifoptionen table in sync.
async function syncLegacyOption(anbieter_id, tarif_id, name, code, provision_euro, beschreibung) {
try {
await db.run(
`INSERT OR IGNORE INTO tarifoptionen (anbieter_id, tarif_id, name, code, provision_euro, beschreibung)
VALUES (?, ?, ?, ?, ?, ?)`,
[anbieter_id, tarif_id, name, code || null, provision_euro || 0, beschreibung || null]
);
} catch (err) {
console.error('Legacy tarifoption sync failed:', err.message);
}
}
// --- Legacy single-tariff API (per-(anbieter,tarif) options) ---
router.get('/', asyncHandler(async (req, res) => {
const rows = await db.all(
`SELECT t.*, a.name AS anbieter_name, ta.name AS tarif_name
FROM tarifoptionen t
JOIN anbieter a ON t.anbieter_id = a.id
LEFT JOIN tarife ta ON t.tarif_id = ta.id
WHERE t.aktiv = 1
ORDER BY a.name, t.tarif_id IS NULL DESC, COALESCE(ta.name, ''), t.name`
);
res.json(rows);
}));
router.post('/', asyncHandler(async (req, res) => {
const { anbieter_id, tarif_id, name, code, provision_euro, beschreibung } = req.body || {};
if (!anbieter_id && !tarif_id) {
return res.status(400).json({ error: 'Entweder Anbieter oder Tarif muss angegeben werden' });
}
if (!name || !name.trim()) {
return res.status(400).json({ error: 'Name ist erforderlich' });
}
let resolvedAnbieterId = anbieter_id;
if (tarif_id && !resolvedAnbieterId) {
const tarif = await db.get('SELECT anbieter_id FROM tarife WHERE id = ?', [tarif_id]);
if (!tarif) return res.status(404).json({ error: 'Tarif nicht gefunden' });
resolvedAnbieterId = tarif.anbieter_id;
}
try {
const result = await db.run(
`INSERT INTO tarifoptionen (anbieter_id, tarif_id, name, code, provision_euro, beschreibung)
VALUES (?, ?, ?, ?, ?, ?)`,
[resolvedAnbieterId, tarif_id || null, name.trim(), code || null, provision_euro || 0, beschreibung || null]
);
res.json({ id: result.lastID, message: 'Tarifoption erfolgreich erstellt' });
} catch (err) {
if (/UNIQUE/.test(err.message)) {
const scope = tarif_id ? 'für diesen Tarif' : 'für diesen Anbieter';
return res.status(400).json({ error: `Eine Tarifoption mit diesem Namen existiert bereits ${scope}` });
}
throw err;
}
}));
router.put('/:id', asyncHandler(async (req, res) => {
const { id } = req.params;
const { name, provision_euro } = req.body || {};
if (!name) return res.status(400).json({ error: 'Tarifoption-Name ist erforderlich' });
const result = await db.run(
'UPDATE tarifoptionen SET name = ?, provision_euro = ? WHERE id = ?',
[name, provision_euro || 0, id]
);
if (result.changes === 0) return res.status(404).json({ error: 'Tarifoption nicht gefunden' });
res.json({ message: 'Tarifoption erfolgreich aktualisiert' });
}));
router.delete('/:id', asyncHandler(async (req, res) => {
const { id } = req.params;
const result = await db.run('DELETE FROM tarifoptionen WHERE id = ?', [id]);
if (result.changes === 0) return res.status(404).json({ error: 'Tarifoption nicht gefunden' });
res.json({ message: 'Tarifoption erfolgreich gelöscht' });
}));
// --- Multi-tariff API (tarifoptionen_new + tarifoptionen_tarife) ---
router.get('/multi', asyncHandler(async (req, res) => {
const rows = await db.all(
`SELECT tn.id, tn.name, tn.code, tn.provision_euro, tn.beschreibung, tn.aktiv, tn.created_at,
GROUP_CONCAT(t.name || ' (' || a.name || ')') AS tarif_names,
GROUP_CONCAT(t.id) AS tarif_ids
FROM tarifoptionen_new tn
LEFT JOIN tarifoptionen_tarife tt ON tn.id = tt.tarifoption_id
LEFT JOIN tarife t ON tt.tarif_id = t.id
LEFT JOIN anbieter a ON t.anbieter_id = a.id
WHERE tn.aktiv = 1
GROUP BY tn.id, tn.name, tn.code, tn.provision_euro, tn.beschreibung, tn.aktiv, tn.created_at
ORDER BY tn.created_at DESC`
);
res.json(rows);
}));
router.post('/multi', asyncHandler(async (req, res) => {
const { anbieter_id, tarif_ids = [], is_anbieter_weit = false, name, code, provision_euro, beschreibung } = req.body || {};
if (!anbieter_id || !name) return res.status(400).json({ error: 'Anbieter und Name sind erforderlich' });
if (!is_anbieter_weit && (!tarif_ids || tarif_ids.length === 0)) {
return res.status(400).json({ error: 'Bei tarif-spezifischen Optionen müssen Tarife ausgewählt werden' });
}
const newId = await db.transaction(async () => {
const inserted = await db.run(
'INSERT INTO tarifoptionen_new (name, code, provision_euro, beschreibung) VALUES (?, ?, ?, ?)',
[name, code || null, provision_euro || 0, beschreibung || null]
);
const tarifoptionId = inserted.lastID;
let targetTarifIds = tarif_ids;
if (is_anbieter_weit) {
const tarifs = await db.all('SELECT id FROM tarife WHERE anbieter_id = ?', [anbieter_id]);
targetTarifIds = tarifs.map(t => t.id);
}
for (const tarifId of targetTarifIds) {
await db.run(
'INSERT INTO tarifoptionen_tarife (tarifoption_id, tarif_id) VALUES (?, ?)',
[tarifoptionId, tarifId]
);
await syncLegacyOption(anbieter_id, tarifId, name, code, provision_euro, beschreibung);
}
return { id: tarifoptionId, count: targetTarifIds.length };
});
res.json({ id: newId.id, message: 'Tarifoption erfolgreich erstellt', assignments: newId.count });
}));
router.put('/multi/:id', asyncHandler(async (req, res) => {
const { id } = req.params;
const { name, code, provision_euro, beschreibung, anbieter_id, is_anbieter_weit, tarif_ids } = req.body || {};
if (!name) return res.status(400).json({ error: 'Tarifoption-Name ist erforderlich' });
await db.transaction(async () => {
const upd = await db.run(
'UPDATE tarifoptionen_new SET name = ?, code = ?, provision_euro = ?, beschreibung = ? WHERE id = ?',
[name, code || null, provision_euro || 0, beschreibung || null, id]
);
if (upd.changes === 0) {
const e = new Error('Tarifoption nicht gefunden');
e.status = 404;
throw e;
}
await db.run('DELETE FROM tarifoptionen_tarife WHERE tarifoption_id = ?', [id]);
// Best-effort cleanup of legacy rows that may have been synced under this name/code.
await db.run(
'DELETE FROM tarifoptionen WHERE name = ? AND (code = ? OR (code IS NULL AND ? IS NULL))',
[name, code || null, code || null]
);
let targetTarifIds = tarif_ids || [];
if (is_anbieter_weit && anbieter_id) {
const tarifs = await db.all('SELECT id FROM tarife WHERE anbieter_id = ?', [anbieter_id]);
targetTarifIds = tarifs.map(t => t.id);
}
for (const tarifId of targetTarifIds) {
await db.run(
'INSERT INTO tarifoptionen_tarife (tarifoption_id, tarif_id) VALUES (?, ?)',
[id, tarifId]
);
const tarif = await db.get('SELECT anbieter_id FROM tarife WHERE id = ?', [tarifId]);
if (tarif) {
await syncLegacyOption(tarif.anbieter_id, tarifId, name, code, provision_euro, beschreibung);
}
}
});
res.json({ message: 'Tarifoption erfolgreich aktualisiert' });
}));
router.delete('/multi/:id', asyncHandler(async (req, res) => {
const { id } = req.params;
const option = await db.get('SELECT name, code FROM tarifoptionen_new WHERE id = ?', [id]);
if (!option) return res.status(404).json({ error: 'Tarifoption nicht gefunden' });
await db.transaction(async () => {
await db.run('DELETE FROM tarifoptionen_tarife WHERE tarifoption_id = ?', [id]);
await db.run(
'DELETE FROM tarifoptionen WHERE name = ? AND (code = ? OR (code IS NULL AND ? IS NULL))',
[option.name, option.code, option.code]
);
await db.run('DELETE FROM tarifoptionen_new WHERE id = ?', [id]);
});
res.json({ message: 'Tarifoption erfolgreich gelöscht' });
}));
// Tariff-specific tarifoption list (used by frontend when adding options to a schaltung)
router.get('/tarif/:tarif_id', asyncHandler(async (req, res) => {
const { tarif_id } = req.params;
const rows = await db.all(
'SELECT * FROM tarifoptionen WHERE tarif_id = ? AND aktiv = 1 ORDER BY name',
[tarif_id]
);
res.json(rows);
}));
module.exports = router;