@intranefr/superbackend 1.4.3

package/src/controllers/globalSettings.controller.js

@@ -0,0 +1,252 @@
+const GlobalSetting = require('../models/GlobalSetting');
+const { encryptString, decryptString } = require('../utils/encryption');
+const globalSettingsService = require('../services/globalSettings.service');
+const { clearOrgRolesCache } = require('../utils/orgRoles');
+
+const redactSetting = (setting) => {
+  if (!setting) return setting;
+  if (setting.type !== 'encrypted') return setting;
+  return {
+    ...setting,
+    value: '********',
+  };
+};
+
+// GET /api/admin/settings/:key/reveal - Get decrypted value for an encrypted setting
+exports.revealSetting = async (req, res) => {
+  try {
+    const { key } = req.params;
+
+    const setting = await GlobalSetting.findOne({ key }).lean();
+
+    if (!setting) {
+      return res.status(404).json({
+        error: `Setting with key '${key}' not found.`,
+      });
+    }
+
+    if (setting.type === 'encrypted') {
+      try {
+        const payload = JSON.parse(setting.value);
+        const decrypted = decryptString(payload);
+        return res.json({
+          key: setting.key,
+          type: setting.type,
+          value: decrypted,
+        });
+      } catch (e) {
+        console.error(`Error decrypting setting ${key}:`, e);
+        return res.status(500).json({ error: 'Failed to decrypt setting' });
+      }
+    }
+
+    // For non-encrypted settings, just return current value
+    return res.json({
+      key: setting.key,
+      type: setting.type,
+      value: setting.value,
+    });
+  } catch (error) {
+    console.error('Error revealing setting:', error);
+    res.status(500).json({ error: 'Failed to reveal setting' });
+  }
+};
+
+// GET /api/admin/settings - Get all global settings
+exports.getAllSettings = async (req, res) => {
+  try {
+    const settings = await GlobalSetting.find().sort({ key: 1 }).lean();
+    res.json(settings.map(redactSetting));
+  } catch (error) {
+    console.error('Error fetching global settings:', error);
+    res.status(500).json({ error: 'Failed to fetch global settings' });
+  }
+};
+
+// GET /api/admin/settings/:key - Get specific setting
+exports.getSetting = async (req, res) => {
+  try {
+    const { key } = req.params;
+    
+    const setting = await GlobalSetting.findOne({ key }).lean();
+    
+    if (!setting) {
+      return res.status(404).json({ 
+        error: `Setting with key '${key}' not found.` 
+      });
+    }
+    
+    res.json(redactSetting(setting));
+  } catch (error) {
+    console.error('Error fetching setting:', error);
+    res.status(500).json({ error: 'Failed to fetch setting' });
+  }
+};
+
+// PUT /api/admin/settings/:key - Update setting
+exports.updateSetting = async (req, res) => {
+  try {
+    const { key } = req.params;
+    const { value } = req.body;
+    
+    if (value === undefined) {
+      return res.status(400).json({ error: 'Value is required' });
+    }
+    
+    const setting = await GlobalSetting.findOne({ key });
+    
+    if (!setting) {
+      return res.status(404).json({ 
+        error: `Setting with key '${key}' not found.` 
+      });
+    }
+    
+    // Validate value based on type
+    if (setting.type === 'boolean') {
+      if (value !== 'true' && value !== 'false') {
+        return res.status(400).json({ 
+          error: 'Boolean setting must be "true" or "false"' 
+        });
+      }
+    } else if (setting.type === 'number') {
+      if (isNaN(Number(value))) {
+        return res.status(400).json({ 
+          error: 'Number setting must be a valid number' 
+        });
+      }
+    } else if (setting.type === 'json') {
+      try {
+        JSON.parse(value);
+      } catch (e) {
+        return res.status(400).json({ 
+          error: 'JSON setting must be valid JSON' 
+        });
+      }
+    }
+    
+    if (setting.type === 'encrypted') {
+      const encryptedPayload = encryptString(value);
+      setting.value = JSON.stringify(encryptedPayload);
+    } else {
+      setting.value = value;
+    }
+    await setting.save();
+
+    globalSettingsService.clearSettingsCache();
+    if (key === 'ORG_ROLES_JSON') {
+      clearOrgRolesCache();
+    }
+    
+    res.json(redactSetting(setting.toObject()));
+  } catch (error) {
+    console.error('Error updating setting:', error);
+    res.status(500).json({ error: 'Failed to update setting' });
+  }
+};
+
+// POST /api/admin/settings - Create new setting
+exports.createSetting = async (req, res) => {
+  try {
+    const { key, value, type, description, templateVariables, public: isPublic } = req.body;
+    
+    if (!key || !value || !type || !description) {
+      return res.status(400).json({ 
+        error: 'key, value, type, and description are required' 
+      });
+    }
+    
+    // Check if setting already exists
+    const existingSetting = await GlobalSetting.findOne({ key });
+    if (existingSetting) {
+      return res.status(409).json({ 
+        error: `Setting with key '${key}' already exists.` 
+      });
+    }
+
+    if (type === 'encrypted' && isPublic) {
+      return res.status(400).json({ error: 'Encrypted settings cannot be public' });
+    }
+
+    const storedValue =
+      type === 'encrypted' ? JSON.stringify(encryptString(value)) : value;
+    
+    const setting = await GlobalSetting.create({
+      key,
+      value: storedValue,
+      type,
+      description,
+      templateVariables: templateVariables || [],
+      public: isPublic || false
+    });
+
+    globalSettingsService.clearSettingsCache();
+    if (key === 'ORG_ROLES_JSON') {
+      clearOrgRolesCache();
+    }
+    
+    res.status(201).json(redactSetting(setting.toObject()));
+  } catch (error) {
+    console.error('Error creating setting:', error);
+    res.status(500).json({ error: 'Failed to create setting' });
+  }
+};
+
+// DELETE /api/admin/settings/:key - Delete setting
+exports.deleteSetting = async (req, res) => {
+  try {
+    const { key } = req.params;
+    
+    const setting = await GlobalSetting.findOneAndDelete({ key });
+    
+    if (!setting) {
+      return res.status(404).json({ 
+        error: `Setting with key '${key}' not found.` 
+      });
+    }
+
+    globalSettingsService.clearSettingsCache();
+    if (key === 'ORG_ROLES_JSON') {
+      clearOrgRolesCache();
+    }
+    
+    res.status(204).send();
+  } catch (error) {
+    console.error('Error deleting setting:', error);
+    res.status(500).json({ error: 'Failed to delete setting' });
+  }
+};
+
+// Helper function to get setting value (for internal use)
+exports.getSettingValue = async (key, defaultValue = null) => {
+  try {
+    const setting = await GlobalSetting.findOne({ key }).lean();
+    if (!setting) return defaultValue;
+    if (setting.type !== 'encrypted') return setting.value;
+
+    try {
+      const payload = JSON.parse(setting.value);
+      return decryptString(payload);
+    } catch (e) {
+      console.error(`Error decrypting setting ${key}:`, e);
+      return defaultValue;
+    }
+  } catch (error) {
+    console.error(`Error getting setting ${key}:`, error);
+    return defaultValue;
+  }
+};
+
+// GET /api/settings/public - Get public settings (no auth required)
+exports.getPublicSettings = async (req, res) => {
+  try {
+    const settings = await GlobalSetting.find({ public: true })
+      .select('key value type description')
+      .sort({ key: 1 })
+      .lean();
+    
+    res.json(settings);
+  } catch (error) {
+    console.error('Error fetching public settings:', error);
+    res.status(500).json({ error: 'Failed to fetch public settings' });
+  }
+};

package/src/controllers/headlessCrud.controller.js

@@ -0,0 +1,126 @@
+const { getDynamicModel } = require('../services/headlessModels.service');
+
+function getOperationFromRequest(req) {
+  const method = String(req.method || '').toUpperCase();
+  if (method === 'GET') return 'read';
+  if (method === 'POST') return 'create';
+  if (method === 'PUT' || method === 'PATCH') return 'update';
+  if (method === 'DELETE') return 'delete';
+  return null;
+}
+
+function parseJsonMaybe(value) {
+  if (value === undefined || value === null) return null;
+  if (typeof value !== 'string') return value;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    return null;
+  }
+}
+
+async function maybePopulate(Model, query, populateParam) {
+  const populate = String(populateParam || '').trim();
+  if (!populate) return query;
+
+  const fields = populate
+    .split(',')
+    .map((f) => f.trim())
+    .filter((f) => f);
+
+  for (const field of fields) {
+    query = query.populate(field);
+  }
+
+  return query;
+}
+
+exports.list = async (req, res) => {
+  try {
+    const { modelCode } = req.params;
+    const Model = await getDynamicModel(modelCode);
+
+    const limit = Math.min(Number(req.query.limit || 50) || 50, 200);
+    const skip = Number(req.query.skip || 0) || 0;
+    const sort = parseJsonMaybe(req.query.sort) || { updatedAt: -1 };
+    const filter = parseJsonMaybe(req.query.filter) || {};
+
+    let q = Model.find(filter).sort(sort).skip(skip).limit(limit);
+    q = await maybePopulate(Model, q, req.query.populate);
+
+    const items = await q.lean();
+    const total = await Model.countDocuments(filter);
+
+    return res.json({ items, total, limit, skip });
+  } catch (error) {
+    console.error('Error listing headless items:', error);
+    return res.status(500).json({ error: 'Failed to list items' });
+  }
+};
+
+exports.get = async (req, res) => {
+  try {
+    const { modelCode, id } = req.params;
+    const Model = await getDynamicModel(modelCode);
+
+    let q = Model.findById(id);
+    q = await maybePopulate(Model, q, req.query.populate);
+    const item = await q.lean();
+
+    if (!item) return res.status(404).json({ error: 'Item not found' });
+    return res.json({ item });
+  } catch (error) {
+    console.error('Error fetching headless item:', error);
+    return res.status(500).json({ error: 'Failed to fetch item' });
+  }
+};
+
+exports.create = async (req, res) => {
+  try {
+    const { modelCode } = req.params;
+    const Model = await getDynamicModel(modelCode);
+
+    const doc = await Model.create(req.body || {});
+    return res.status(201).json({ item: doc.toObject() });
+  } catch (error) {
+    console.error('Error creating headless item:', error);
+    return res.status(500).json({ error: 'Failed to create item' });
+  }
+};
+
+exports.update = async (req, res) => {
+  try {
+    const { modelCode, id } = req.params;
+    const Model = await getDynamicModel(modelCode);
+
+    const updated = await Model.findByIdAndUpdate(id, req.body || {}, {
+      new: true,
+      runValidators: false,
+    });
+
+    if (!updated) return res.status(404).json({ error: 'Item not found' });
+    return res.json({ item: updated.toObject() });
+  } catch (error) {
+    console.error('Error updating headless item:', error);
+    return res.status(500).json({ error: 'Failed to update item' });
+  }
+};
+
+exports.remove = async (req, res) => {
+  try {
+    const { modelCode, id } = req.params;
+    const Model = await getDynamicModel(modelCode);
+
+    const deleted = await Model.findByIdAndDelete(id);
+    if (!deleted) return res.status(404).json({ error: 'Item not found' });
+
+    return res.json({ success: true });
+  } catch (error) {
+    console.error('Error deleting headless item:', error);
+    return res.status(500).json({ error: 'Failed to delete item' });
+  }
+};
+
+exports._getOperationFromRequest = getOperationFromRequest;

package/src/controllers/i18n.controller.js

@@ -0,0 +1,12 @@
+const i18nService = require('../services/i18n.service');
+
+exports.getBundle = async (req, res) => {
+  try {
+    const locale = req.query.locale;
+    const bundle = await i18nService.getBundle(locale);
+    res.json(bundle);
+  } catch (error) {
+    console.error('Error building i18n bundle:', error);
+    res.status(500).json({ error: 'Failed to build i18n bundle' });
+  }
+};

package/src/controllers/invite.controller.js

@@ -0,0 +1,249 @@
+const Invite = require('../models/Invite');
+const Organization = require('../models/Organization');
+const OrganizationMember = require('../models/OrganizationMember');
+const User = require('../models/User');
+const emailService = require('../services/email.service');
+const bcrypt = require('bcryptjs');
+const { isValidOrgRole, getAllowedOrgRoles, getDefaultOrgRole } = require('../utils/orgRoles');
+
+const INVITE_EXPIRY_DAYS = 7;
+
+exports.createInvite = async (req, res) => {
+  try {
+    const defaultRole = await getDefaultOrgRole();
+    const { email, role = defaultRole } = req.body;
+
+    if (!email) {
+      return res.status(400).json({ error: 'Email is required' });
+    }
+
+    if (!(await isValidOrgRole(role))) {
+      const allowed = await getAllowedOrgRoles();
+      return res.status(400).json({ error: 'Invalid role', allowedRoles: allowed });
+    }
+
+    const normalizedEmail = email.toLowerCase().trim();
+
+    const existingUser = await User.findOne({ email: normalizedEmail });
+    if (existingUser) {
+      const existingMember = await OrganizationMember.findOne({
+        orgId: req.org._id,
+        userId: existingUser._id,
+        status: 'active'
+      });
+      if (existingMember) {
+        return res.status(409).json({ error: 'User is already a member' });
+      }
+    }
+
+    const existingInvite = await Invite.findOne({
+      email: normalizedEmail,
+      orgId: req.org._id,
+      status: 'pending'
+    });
+    if (existingInvite) {
+      return res.status(409).json({ error: 'Invite already pending for this email' });
+    }
+
+    const { token, tokenHash } = Invite.generateToken();
+    const expiresAt = new Date(Date.now() + INVITE_EXPIRY_DAYS * 24 * 60 * 60 * 1000);
+
+    const invite = await Invite.create({
+      email: normalizedEmail,
+      tokenHash,
+      expiresAt,
+      createdByUserId: req.user._id,
+      orgId: req.org._id,
+      role
+    });
+
+    const inviteLink = `${process.env.PUBLIC_URL || 'http://localhost:3000'}/accept-invite?token=${token}`;
+
+    try {
+      await emailService.sendEmail({
+        to: normalizedEmail,
+        subject: `You're invited to join ${req.org.name}`,
+        html: `<p>You've been invited to join <strong>${req.org.name}</strong> as a ${role}.</p>
+          <p><a href="${inviteLink}">Click here to accept the invitation</a></p>
+          <p>This invite expires in ${INVITE_EXPIRY_DAYS} days.</p>
+          <p>If you didn't expect this invitation, you can ignore this email.</p>`
+      });
+    } catch (emailError) {
+      console.error('Failed to send invite email:', emailError);
+    }
+
+    res.status(201).json({
+      message: 'Invite created successfully',
+      invite: {
+        _id: invite._id,
+        email: invite.email,
+        role: invite.role,
+        expiresAt: invite.expiresAt,
+        createdAt: invite.createdAt
+      }
+    });
+  } catch (error) {
+    console.error('Error creating invite:', error);
+    res.status(500).json({ error: 'Failed to create invite' });
+  }
+};
+
+exports.listInvites = async (req, res) => {
+  try {
+    const invites = await Invite.find({
+      orgId: req.org._id,
+      status: 'pending'
+    }).select('-tokenHash');
+
+    res.json({ invites });
+  } catch (error) {
+    console.error('Error listing invites:', error);
+    res.status(500).json({ error: 'Failed to list invites' });
+  }
+};
+
+exports.revokeInvite = async (req, res) => {
+  try {
+    const { inviteId } = req.params;
+
+    const invite = await Invite.findOne({
+      _id: inviteId,
+      orgId: req.org._id,
+      status: 'pending'
+    });
+
+    if (!invite) {
+      return res.status(404).json({ error: 'Invite not found' });
+    }
+
+    invite.status = 'revoked';
+    await invite.save();
+
+    res.json({ message: 'Invite revoked successfully' });
+  } catch (error) {
+    console.error('Error revoking invite:', error);
+    res.status(500).json({ error: 'Failed to revoke invite' });
+  }
+};
+
+exports.acceptInvite = async (req, res) => {
+  try {
+    const { token, name, password } = req.body;
+
+    if (!token) {
+      return res.status(400).json({ error: 'Token is required' });
+    }
+
+    const tokenHash = Invite.hashToken(token);
+    const invite = await Invite.findOne({ tokenHash }).populate('orgId');
+
+    if (!invite) {
+      return res.status(404).json({ error: 'Invalid invite token' });
+    }
+
+    if (invite.status !== 'pending') {
+      return res.status(400).json({ error: `Invite has been ${invite.status}` });
+    }
+
+    if (invite.expiresAt < new Date()) {
+      invite.status = 'expired';
+      await invite.save();
+      return res.status(400).json({ error: 'Invite has expired' });
+    }
+
+    let user = await User.findOne({ email: invite.email });
+
+    if (!user) {
+      if (!password || password.length < 6) {
+        return res.status(400).json({ error: 'Password required (min 6 characters) for new account' });
+      }
+
+      user = await User.create({
+        email: invite.email,
+        passwordHash: password,
+        name: name?.trim()
+      });
+    }
+
+    const existingMember = await OrganizationMember.findOne({
+      orgId: invite.orgId._id,
+      userId: user._id
+    });
+
+    if (existingMember) {
+      if (existingMember.status === 'active') {
+        invite.status = 'accepted';
+        await invite.save();
+        return res.status(409).json({ error: 'Already a member of this organization' });
+      }
+      existingMember.status = 'active';
+      existingMember.role = invite.role;
+      await existingMember.save();
+    } else {
+      await OrganizationMember.create({
+        orgId: invite.orgId._id,
+        userId: user._id,
+        role: invite.role
+      });
+    }
+
+    invite.status = 'accepted';
+    await invite.save();
+
+    res.json({
+      message: 'Invite accepted successfully',
+      org: {
+        _id: invite.orgId._id,
+        name: invite.orgId.name,
+        slug: invite.orgId.slug
+      },
+      isNewUser: !user.createdAt || (new Date() - user.createdAt) < 5000
+    });
+  } catch (error) {
+    console.error('Error accepting invite:', error);
+    res.status(500).json({ error: 'Failed to accept invite' });
+  }
+};
+
+exports.getInviteInfo = async (req, res) => {
+  try {
+    const { token } = req.query;
+
+    if (!token) {
+      return res.status(400).json({ error: 'Token is required' });
+    }
+
+    const tokenHash = Invite.hashToken(token);
+    const invite = await Invite.findOne({ tokenHash }).populate('orgId', 'name slug');
+
+    if (!invite) {
+      return res.status(404).json({ error: 'Invalid invite token' });
+    }
+
+    if (invite.status !== 'pending') {
+      return res.status(400).json({ error: `Invite has been ${invite.status}` });
+    }
+
+    if (invite.expiresAt < new Date()) {
+      return res.status(400).json({ error: 'Invite has expired' });
+    }
+
+    const existingUser = await User.findOne({ email: invite.email });
+
+    res.json({
+      invite: {
+        email: invite.email,
+        role: invite.role,
+        expiresAt: invite.expiresAt,
+        org: {
+          name: invite.orgId.name,
+          slug: invite.orgId.slug
+        }
+      },
+      userExists: !!existingUser
+    });
+  } catch (error) {
+    console.error('Error getting invite info:', error);
+    res.status(500).json({ error: 'Failed to get invite info' });
+  }
+};

package/src/controllers/jsonConfigs.controller.js

@@ -0,0 +1,19 @@
+const { getJsonConfigPublicPayload } = require('../services/jsonConfigs.service');
+
+exports.getPublic = async (req, res) => {
+  try {
+    const slug = String(req.params.slug || '').trim();
+    const raw = req.query?.raw === 'true' || req.query?.raw === '1';
+
+    const payload = await getJsonConfigPublicPayload(slug, { raw });
+    return res.json(payload);
+  } catch (error) {
+    const code = error?.code;
+    if (code === 'NOT_FOUND') {
+      return res.status(404).json({ error: 'Not found' });
+    }
+
+    console.error('Error fetching public JSON config:', error);
+    return res.status(500).json({ error: error?.message || 'Failed to fetch config' });
+  }
+};