@intranefr/superbackend 1.5.2 → 1.6.3

package/src/controllers/waitingList.controller.js

@@ -1,4 +1,4 @@
-const WaitingList = require('../models/WaitingList');
+const waitingListService = require('../services/waitingListJson.service');
 const { validateEmail, sanitizeString } = require('../utils/validation');
 
 // Subscribe to waiting list
@@ -31,36 +31,51 @@ exports.subscribe = async (req, res) => {
       });
     }
 
-    // Check if email already exists
-    const existingEntry = await WaitingList.findOne({ email: sanitizedEmail.toLowerCase() });
-    if (existingEntry) {
-      return res.status(409).json({ 
-        error: 'This email is already on our waiting list',
-        field: 'email'
+    // Check if email already exists and create new entry using JSON Configs service
+    try {
+      const waitingListEntry = await waitingListService.addWaitingListEntry({
+        email: sanitizedEmail.toLowerCase(),
+        type: sanitizedType.trim(),
+        referralSource: sanitizeString(referralSource) || 'website'
       });
-    }
-
-    // Create new waiting list entry
-    const waitingListEntry = new WaitingList({
-      email: sanitizedEmail.toLowerCase(),
-      type: sanitizedType.trim(),
-      referralSource: sanitizeString(referralSource) || 'website'
-    });
 
-    await waitingListEntry.save();
+      // Return success response without sensitive data
+      const response = { ...waitingListEntry };
+      delete response.email; // Don't return email in response for privacy
 
-    // Return success response without sensitive data
-    const response = waitingListEntry.toJSON();
-    delete response.email; // Don't return email in response for privacy
-
-    res.status(201).json({
-      message: 'Successfully joined the waiting list!',
-      data: response
-    });
+      res.status(201).json({
+        message: 'Successfully joined the waiting list!',
+        data: response
+      });
+    } catch (serviceError) {
+      // Handle validation and duplicate errors from service
+      if (serviceError.code === 'VALIDATION') {
+        return res.status(400).json({ 
+          error: serviceError.message,
+          field: 'general'
+        });
+      }
+      
+      if (serviceError.code === 'DUPLICATE_EMAIL' || serviceError.code === 'DUPLICATE' || serviceError.message.includes('already exists')) {
+        return res.status(409).json({ 
+          error: 'This email is already on our waiting list',
+          field: 'email'
+        });
+      }
+
+      if (serviceError.code === 'INITIALIZATION_FAILED') {
+        return res.status(500).json({ 
+          error: 'Service temporarily unavailable - please try again',
+          field: 'general'
+        });
+      }
+      
+      throw serviceError; // Re-throw for general error handling
+    }
   } catch (error) {
     console.error('Waiting list subscription error:', error);
     
-    // Handle specific MongoDB errors
+    // Handle specific errors
     if (error.code === 11000) {
       return res.status(409).json({ 
         error: 'This email is already on our waiting list',
@@ -86,35 +101,10 @@ exports.subscribe = async (req, res) => {
 // Get waiting list stats (public)
 exports.getStats = async (req, res) => {
   try {
-    const totalSubscribers = await WaitingList.countDocuments({ status: 'active' });
-
-    const typeAgg = await WaitingList.aggregate([
-      { $match: { status: 'active' } },
-      { $group: { _id: '$type', count: { $sum: 1 } } },
-      { $sort: { count: -1, _id: 1 } },
-    ]);
-
-    const typeCounts = (typeAgg || []).reduce((acc, row) => {
-      if (!row?._id) return acc;
-      acc[String(row._id)] = row.count || 0;
-      return acc;
-    }, {});
-
-    // Backward compatibility fields (legacy UI/tests)
-    const buyerCount = (typeCounts.buyer || 0) + (typeCounts.both || 0);
-    const sellerCount = (typeCounts.seller || 0) + (typeCounts.both || 0);
-
-    // Add some mock growth data for demonstration
-    const growthThisWeek = Math.floor(totalSubscribers * 0.05); // 5% growth
+    // Use JSON Configs service for cached statistics
+    const stats = await waitingListService.getWaitingListStats();
     
-    res.json({
-      totalSubscribers,
-      buyerCount,
-      sellerCount,
-      typeCounts,
-      growthThisWeek,
-      lastUpdated: new Date().toISOString()
-    });
+    res.json(stats);
   } catch (error) {
     console.error('Waiting list stats error:', error);
     res.status(500).json({ 
@@ -135,31 +125,19 @@ exports.adminList = async (req, res) => {
       offset = 0,
     } = req.query;
 
-    const query = {};
-    if (status) query.status = String(status);
-    if (type) query.type = String(type);
-    if (email) query.email = String(email).trim().toLowerCase();
-
     const parsedLimit = Math.min(500, Math.max(1, parseInt(limit, 10) || 50));
     const parsedOffset = Math.max(0, parseInt(offset, 10) || 0);
 
-    const entries = await WaitingList.find(query)
-      .sort({ createdAt: -1 })
-      .limit(parsedLimit)
-      .skip(parsedOffset)
-      .select('email type status referralSource createdAt updatedAt')
-      .lean();
-
-    const total = await WaitingList.countDocuments(query);
-
-    return res.json({
-      entries,
-      pagination: {
-        total,
-        limit: parsedLimit,
-        offset: parsedOffset,
-      },
+    // Use JSON Configs service for admin data with filtering and pagination
+    const result = await waitingListService.getWaitingListEntriesAdmin({
+      status,
+      type,
+      email,
+      limit: parsedLimit,
+      offset: parsedOffset
     });
+
+    return res.json(result);
   } catch (error) {
     console.error('Waiting list admin list error:', error);
     return res.status(500).json({ error: 'Failed to list entries' });

package/src/helpers/mongooseHelper.js

@@ -83,7 +83,7 @@ class MongooseHelper {
       const uri = this.getMongoUri();
       const options = this.getConnectionOptions();
       
-      console.log(`[MongooseHelper] Connecting to MongoDB...`);
+      if (!process.env.TUI_MODE) console.log(`[MongooseHelper] Connecting to MongoDB...`);
       
       // Clear any existing connection
       if (mongoose.connection.readyState !== 0) {
@@ -94,7 +94,7 @@ class MongooseHelper {
       
       this.isConnected = true;
       
-      console.log(`[MongooseHelper] ✅ Connected to MongoDB`);
+      if (!process.env.TUI_MODE) console.log(`[MongooseHelper] ✅ Connected to MongoDB`);
       
       // Setup connection error handling
       mongoose.connection.on('error', (error) => {
@@ -104,13 +104,13 @@ class MongooseHelper {
       });
 
       mongoose.connection.on('disconnected', () => {
-        console.log('[MongooseHelper] Disconnected from MongoDB');
+        if (!process.env.TUI_MODE) console.log('[MongooseHelper] Disconnected from MongoDB');
         this.isConnected = false;
         this.connectionPromise = null;
       });
 
       mongoose.connection.on('reconnected', () => {
-        console.log('[MongooseHelper] Reconnected to MongoDB');
+        if (!process.env.TUI_MODE) console.log('[MongooseHelper] Reconnected to MongoDB');
         this.isConnected = true;
       });
 
@@ -136,7 +136,7 @@ class MongooseHelper {
     if (this.connectionCount <= 0) {
       try {
         await mongoose.disconnect();
-        console.log('[MongooseHelper] ✅ Disconnected from MongoDB');
+        if (!process.env.TUI_MODE) console.log('[MongooseHelper] ✅ Disconnected from MongoDB');
       } catch (error) {
         console.error('[MongooseHelper] Disconnect error:', error);
       } finally {
@@ -155,7 +155,7 @@ class MongooseHelper {
     try {
       if (mongoose.connection.readyState !== 0) {
         await mongoose.disconnect();
-        console.log('[MongooseHelper] ✅ Force disconnected from MongoDB');
+        if (!process.env.TUI_MODE) console.log('[MongooseHelper] ✅ Force disconnected from MongoDB');
       }
     } catch (error) {
       console.error('[MongooseHelper] Force disconnect error:', error);

package/src/helpers/scriptBase.js

@@ -55,13 +55,13 @@ class ScriptBase {
     });
 
     try {
-      console.log(`[${this.name}] Starting script execution...`);
+      if (!process.env.TUI_MODE) console.log(`[${this.name}] Starting script execution...`);
       
       const executionPromise = this._executeWithConnection();
       const result = await Promise.race([executionPromise, timeoutPromise]);
 
       const duration = Date.now() - this.startTime;
-      console.log(`[${this.name}] ✅ Completed in ${duration}ms`);
+      if (!process.env.TUI_MODE) console.log(`[${this.name}] ✅ Completed in ${duration}ms`);
       
       return result;
     } catch (error) {

package/src/middleware/auth.js

@@ -70,4 +70,74 @@ const requireAdmin = (req, res, next) => {
   next();
 };
 
-module.exports = { authenticate, basicAuth, requireAdmin };
+// Admin session authentication middleware - checks session for authenticated admin user
+const adminSessionAuth = (req, res, next) => {
+  // Check if session exists and user is authenticated
+  if (!req.session || !req.session.authenticated) {
+    // Store the originally requested URL for redirect after login
+    req.session = req.session || {};
+    req.session.returnTo = req.originalUrl;
+    
+    // For API routes, return JSON error
+    if (req.xhr || req.headers.accept?.includes('application/json')) {
+      return res.status(401).json({ 
+        error: "Authentication required", 
+        redirectTo: `${req.adminPath || '/admin'}/login` 
+      });
+    }
+    
+    // For web routes, redirect to login page
+    return res.redirect(`${req.adminPath || '/admin'}/login`);
+  }
+
+  // Verify session is still valid (check login time)
+  const loginTime = new Date(req.session.loginTime);
+  const now = new Date();
+  const sessionAge = (now - loginTime) / (1000 * 60 * 60); // hours
+  
+  // Session expires after 24 hours
+  if (sessionAge > 24) {
+    req.session.destroy((err) => {
+      if (err) console.error('Error destroying expired session:', err);
+    });
+    
+    if (req.xhr || req.headers.accept?.includes('application/json')) {
+      return res.status(401).json({ 
+        error: "Session expired", 
+        redirectTo: `${req.adminPath || '/admin'}/login` 
+      });
+    }
+    
+    return res.redirect(`${req.adminPath || '/admin'}/login?error=Session expired`);
+  }
+
+  // Attach user info to request for consistency with other auth middleware
+  req.user = {
+    authenticated: true,
+    authType: req.session.authType,
+    role: req.session.role
+  };
+
+  if (req.session.authType === 'iam') {
+    req.user.id = req.session.userId;
+    req.user.email = req.session.email;
+    req.user.name = req.session.name;
+  } else {
+    req.user.username = req.session.username;
+  }
+
+  next();
+};
+
+// Admin authentication middleware that supports both session and basic auth
+const adminAuth = (req, res, next) => {
+  // First try session authentication
+  if (req.session && req.session.authenticated) {
+    return adminSessionAuth(req, res, next);
+  }
+  
+  // Fallback to basic auth for backward compatibility
+  return basicAuth(req, res, next);
+};
+
+module.exports = { authenticate, basicAuth, requireAdmin, adminSessionAuth, adminAuth };

package/src/middleware/rbac.js

@@ -56,7 +56,69 @@ function requireRight(requiredRight, options = {}) {
   };
 }
 
+/**
+ * Middleware for module-level access control in admin panel
+ * Checks specific permissions for admin modules like audit, users, etc.
+ */
+function requireModuleAccess(moduleId, action = 'read') {
+  return async (req, res, next) => {
+    try {
+      // Check for basic auth superadmin bypass
+      if (isBasicAuthSuperAdmin(req)) {
+        return next();
+      }
+
+      // Get user ID from session
+      const userId = req.session?.authData?.userId;
+      if (!userId) {
+        return res.redirect(`${req.adminPath || '/admin'}/login`);
+      }
+
+      // Check RBAC permission for specific module
+      const hasAccess = await rbacService.checkRight({
+        userId,
+        orgId: null, // Global admin permissions
+        right: `admin_panel__${moduleId}:${action}`
+      });
+
+      if (!hasAccess.allowed) {
+        // For API routes, return JSON error
+        if (req.path.startsWith('/api/')) {
+          return res.status(403).json({
+            error: 'Access denied',
+            reason: hasAccess.reason,
+            required: `admin_panel__${moduleId}:${action}`,
+            moduleId,
+            action
+          });
+        }
+
+        // For page routes, render 403 page
+        return res.status(403).render('admin-403', {
+          moduleId,
+          action,
+          required: `admin_panel__${moduleId}:${action}`,
+          reason: hasAccess.reason,
+          user: req.session.authData,
+          adminPath: req.adminPath || '/admin'
+        });
+      }
+
+      next();
+    } catch (error) {
+      console.error('Module access check error:', error);
+      
+      if (req.path.startsWith('/api/')) {
+        return res.status(500).json({ error: 'Access check failed' });
+      } else {
+        return res.status(500).send('Access check failed');
+      }
+    }
+  };
+}
+
 module.exports = {
   requireRight,
+  requireModuleAccess,
   isBasicAuthSuperAdmin,
 };