radix-cms 0.1.0 → 1.0.0

package/dist/routes/admin.js

@@ -0,0 +1,808 @@
+"use strict";
+/**************************************************************************************************
+* RadixCMS
+*
+* DESCRIPTION: administration routes, setup, content, users, media, and settings.
+*
+* Copyright (C) 2026 Ultra Spark Software <salve@ultraspark.net>
+* SPDX-License-Identifier: GPL-3.0-or-later
+**************************************************************************************************/
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const bcrypt_1 = __importDefault(require("bcrypt"));
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const multer_1 = __importDefault(require("multer"));
+const db_1 = __importDefault(require("../config/db"));
+const themeScanner_1 = require("../utils/themeScanner");
+const dotenv_1 = __importDefault(require("dotenv"));
+const promise_1 = __importDefault(require("mysql2/promise"));
+const dbInit2_1 = require("../init/dbInit2");
+const nodemailer_1 = __importDefault(require("nodemailer"));
+const versionCheck_1 = require("../utils/versionCheck");
+const adm_zip_1 = __importDefault(require("adm-zip"));
+const router = (0, express_1.Router)();
+function updateEnvVersion(version) {
+    if (!version)
+        return;
+    const envPath = path_1.default.join(process.cwd(), '.env');
+    let envContent = fs_1.default.existsSync(envPath) ? fs_1.default.readFileSync(envPath, 'utf8') : '';
+    const re = /^APP_VERSION=.*$/m;
+    if (re.test(envContent)) {
+        envContent = envContent.replace(re, `APP_VERSION=${version}`);
+    }
+    else {
+        envContent += (envContent ? '\n' : '') + `APP_VERSION=${version}`;
+    }
+    fs_1.default.writeFileSync(envPath, envContent, { encoding: 'utf8' });
+    process.env.APP_VERSION = version;
+}
+// Installation check: if database connection info is missing or the DB is not reachable,
+// route the user into the installer workflow.
+router.use(async (req, res, next) => {
+    if (req.path === '/install' || req.path.startsWith('/setup'))
+        return next();
+    const hasDbConfig = !!(process.env.DB_HOST &&
+        process.env.DB_USER &&
+        process.env.DB_PASSWORD !== undefined &&
+        process.env.DB_NAME);
+    if (!hasDbConfig) {
+        console.warn('[Radix Setup]: Missing database configuration, redirecting to installer.');
+        return res.redirect('/admin/install');
+    }
+    try {
+        // quick probe against the configured pool to determine if DB is working
+        await db_1.default.execute('SELECT 1');
+        return next();
+    }
+    catch (err) {
+        console.warn('[Radix Setup]: Database not reachable, redirecting to installer.');
+        return res.redirect('/admin/install');
+    }
+});
+// --- Install / Setup: Database Connection Form ---
+router.get('/install', (_req, res) => {
+    res.render('admin/setup-db', { error: null, values: {} });
+});
+router.get('/setup/db', (_req, res) => {
+    res.render('admin/setup-db', { error: null, values: {} });
+});
+// POST /admin/setup/db/test - Test DB connection using provided form values without saving to .env
+router.post('/setup/db/test', async (req, res) => {
+    const { dbName, dbUser, dbPass, dbHost, dbPort } = req.body;
+    const cfg = {
+        host: dbHost || '127.0.0.1',
+        user: dbUser || undefined,
+        password: dbPass || undefined,
+        port: Number(dbPort) || 3306,
+        connectTimeout: 3000
+    };
+    let conn;
+    try {
+        conn = await promise_1.default.createConnection(cfg);
+        // if a database name is provided, ensure it exists (querying INFORMATION_SCHEMA) otherwise run simple probe
+        if (dbName) {
+            const [rows] = await conn.query('SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME = ?', [dbName]);
+            if (!rows || (Array.isArray(rows) && rows.length === 0)) {
+                await conn.end();
+                return res.status(400).json({ ok: false, error: `Database '${dbName}' not found or inaccessible.` });
+            }
+        }
+        else {
+            await conn.query('SELECT 1');
+        }
+        await conn.end();
+        return res.json({ ok: true, message: 'Connection successful' });
+    }
+    catch (err) {
+        try {
+            if (conn)
+                await conn.end();
+        }
+        catch (e) { /* ignore */ }
+        return res.status(400).json({ ok: false, error: err.message || String(err) });
+    }
+});
+router.post('/setup/db', async (req, res) => {
+    const { dbName, dbUser, dbPass, dbHost, dbPort, tablePrefix } = req.body;
+    const envPath = path_1.default.join(__dirname, '../../.env');
+    try {
+        // Read existing .env (if any)
+        let envContent = '';
+        if (fs_1.default.existsSync(envPath))
+            envContent = fs_1.default.readFileSync(envPath, 'utf8');
+        const setEnv = (key, value) => {
+            const re = new RegExp(`^${key}=.*$`, 'm');
+            if (re.test(envContent)) {
+                envContent = envContent.replace(re, `${key}=${value}`);
+            }
+            else {
+                envContent += (envContent ? '\n' : '') + `${key}=${value}`;
+            }
+        };
+        setEnv('DB_NAME', dbName || 'radix');
+        setEnv('DB_USER', dbUser || '');
+        setEnv('DB_PASSWORD', dbPass || '');
+        setEnv('DB_HOST', dbHost || '127.0.0.1');
+        if (dbPort)
+            setEnv('DB_PORT', dbPort);
+        if (tablePrefix)
+            setEnv('TABLE_PREFIX', tablePrefix);
+        fs_1.default.writeFileSync(envPath, envContent, { encoding: 'utf8' });
+        // reload env and try to initialize the DB schema — explicitly override process.env with values from the new .env
+        try {
+            const parsedEnv = dotenv_1.default.parse(fs_1.default.readFileSync(envPath, 'utf8'));
+            for (const k of Object.keys(parsedEnv)) {
+                process.env[k] = parsedEnv[k];
+            }
+        }
+        catch (e) {
+            // fall back to regular dotenv config if parsing fails
+            dotenv_1.default.config({ path: envPath });
+        }
+        await (0, dbInit2_1.initDatabase)();
+        return res.redirect('/admin/setup/admin');
+    }
+    catch (err) {
+        console.error('[Radix Setup DB Error]:', err);
+        return res.render('admin/setup-db', { error: String(err), values: req.body });
+    }
+});
+// --- Setup: Admin / Site Info Form ---
+router.get('/setup/admin', (_req, res) => {
+    res.render('admin/setup-admin', { error: null, values: {} });
+});
+router.post('/setup/admin', async (req, res) => {
+    const { siteTitle, username, password, email, searchEngineVisibility } = req.body;
+    try {
+        await (0, dbInit2_1.initDatabase)();
+        const passwordHash = await bcrypt_1.default.hash(password, 10);
+        // create administrator user
+        await db_1.default.execute('INSERT INTO users (username, password, password_hash, email, role, created_at) VALUES (?, ?, ?, ?, ?, NOW())', [username, null, passwordHash, email, 'Administrator']);
+        // save site settings
+        await db_1.default.execute('INSERT INTO settings (setting_key, setting_value) VALUES (?, ?) ON DUPLICATE KEY UPDATE setting_value = VALUES(setting_value)', ['site_title', siteTitle || 'Radix Site']);
+        await db_1.default.execute('INSERT INTO settings (setting_key, setting_value) VALUES (?, ?) ON DUPLICATE KEY UPDATE setting_value = VALUES(setting_value)', ['search_engine_visibility', searchEngineVisibility ? '1' : '0']);
+        return res.redirect('/admin/login');
+    }
+    catch (err) {
+        console.error('[Radix Setup Admin Error]:', err);
+        return res.render('admin/setup-admin', { error: String(err), values: req.body });
+    }
+});
+// ==========================================
+// 1. MIDDLEWARE & HELPER CONFIGURATION
+// ==========================================
+const ROLE_HIERARCHY = {
+    'Administrator': 5,
+    'Manager': 4,
+    'Editor': 3,
+    'Registered': 2,
+    'Unregistered': 1
+};
+// GET /admin/login - Render Login View
+router.get('/login', (req, res) => {
+    res.render('admin/login', { error: null });
+});
+// POST /admin/login - Process Login Form
+router.post('/login', async (req, res) => {
+    const { username, password } = req.body;
+    try {
+        const [rows] = await db_1.default.execute('SELECT * FROM users WHERE username = ? OR email = ?', [username, username]);
+        if (rows.length === 0) {
+            res.render('admin/login', { error: 'Invalid username or password.' });
+            return;
+        }
+        const user = rows[0];
+        const match = await bcrypt_1.default.compare(password, user.password_hash);
+        if (!match) {
+            res.render('admin/login', { error: 'Invalid username or password.' });
+            return;
+        }
+        if (user.role === 'Unregistered') {
+            res.render('admin/login', { error: 'This account is not permitted to log in.' });
+            return;
+        }
+        req.session.user = {
+            id: user.id,
+            username: user.username,
+            email: user.email,
+            role: user.role
+        };
+        if (user.role === 'Registered') {
+            res.redirect('/');
+            return;
+        }
+        res.redirect('/admin');
+    }
+    catch (err) {
+        console.error('[Radix Login Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// GET /admin/logout - Destroy Session
+router.get('/logout', (req, res) => {
+    req.session.destroy(() => {
+        res.redirect('/admin/login');
+    });
+});
+// RBAC Middleware Guard
+function requireRole(minRole) {
+    return (req, res, next) => {
+        const user = req.session?.user;
+        if (!user) {
+            res.redirect('/admin/login');
+            return;
+        }
+        const userLevel = ROLE_HIERARCHY[user.role] || 0;
+        const requiredLevel = ROLE_HIERARCHY[minRole] || 5;
+        if (userLevel < requiredLevel) {
+            res.status(403).render('defaults/403', { message: 'Access Denied: Insufficient Role Privileges.' });
+            return;
+        }
+        next();
+    };
+}
+// Multer Storage Setup
+const UPLOAD_DIR = path_1.default.join(__dirname, '../../public/uploads');
+if (!fs_1.default.existsSync(UPLOAD_DIR)) {
+    fs_1.default.mkdirSync(UPLOAD_DIR, { recursive: true });
+}
+const storage = multer_1.default.diskStorage({
+    destination: (_req, _file, cb) => {
+        cb(null, UPLOAD_DIR);
+    },
+    filename: (_req, file, cb) => {
+        const uniqueSuffix = Date.now() + '-' + Math.round(Math.random() * 1e9);
+        const ext = path_1.default.extname(file.originalname);
+        cb(null, `${file.fieldname}-${uniqueSuffix}${ext}`);
+    }
+});
+const upload = (0, multer_1.default)({
+    storage,
+    limits: { fileSize: 10 * 1024 * 1024 },
+    fileFilter: (_req, file, cb) => {
+        const allowedTypes = /jpeg|jpg|png|gif|webp|svg/;
+        const extname = allowedTypes.test(path_1.default.extname(file.originalname).toLowerCase());
+        const mimetype = allowedTypes.test(file.mimetype);
+        if (extname && mimetype) {
+            return cb(null, true);
+        }
+        cb(new Error('Only image files (JPG, PNG, GIF, WEBP, SVG) are allowed!'));
+    }
+});
+function getMediaFiles() {
+    if (!fs_1.default.existsSync(UPLOAD_DIR))
+        return [];
+    const files = fs_1.default.readdirSync(UPLOAD_DIR);
+    const imageExtensions = ['.jpg', '.jpeg', '.png', '.gif', '.webp', '.svg'];
+    return files
+        .filter(file => imageExtensions.includes(path_1.default.extname(file).toLowerCase()))
+        .map(file => {
+        const stats = fs_1.default.statSync(path_1.default.join(UPLOAD_DIR, file));
+        return {
+            name: file,
+            url: `/uploads/${file}`,
+            size: (stats.size / 1024).toFixed(1) + ' KB',
+            mtime: stats.mtime
+        };
+    })
+        .sort((a, b) => b.mtime.getTime() - a.mtime.getTime());
+}
+// ==========================================
+// 2. DASHBOARD & PAGE MANAGEMENT ROUTES
+// ==========================================
+// GET /admin - Dashboard Overview
+router.get('/', requireRole('Editor'), async (_req, res) => {
+    try {
+        const [totalRows] = await db_1.default.execute('SELECT COUNT(*) AS totalPages FROM pages WHERE status != "Deleted"');
+        const [pubRows] = await db_1.default.execute('SELECT COUNT(*) AS publishedPages FROM pages WHERE status = "Published"');
+        const [draftRows] = await db_1.default.execute('SELECT COUNT(*) AS draftPages FROM pages WHERE status = "Draft"');
+        const [trashRows] = await db_1.default.execute('SELECT COUNT(*) AS trashPages FROM pages WHERE status = "Deleted"');
+        const [userRows] = await db_1.default.execute('SELECT COUNT(*) AS totalUsers FROM users');
+        const pagesDir = path_1.default.join(__dirname, '../../views/pages');
+        let staticFiles = [];
+        if (fs_1.default.existsSync(pagesDir)) {
+            staticFiles = fs_1.default.readdirSync(pagesDir).filter(file => file.endsWith('.ejs'));
+        }
+        res.render('admin/dashboard', {
+            stats: {
+                totalPages: totalRows[0]?.totalPages || 0,
+                publishedPages: pubRows[0]?.publishedPages || 0,
+                draftPages: draftRows[0]?.draftPages || 0,
+                trashPages: trashRows[0]?.trashPages || 0,
+                staticPagesCount: staticFiles.length,
+                totalUsers: userRows[0]?.totalUsers || 0,
+                mediaCount: getMediaFiles().length
+            },
+            user: _req.session?.user
+        });
+    }
+    catch (err) {
+        console.error('[Radix Dashboard Stats Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// GET /admin/pages - Pages Management List
+router.get('/pages', requireRole('Editor'), async (req, res) => {
+    try {
+        const showTrash = req.query.view === 'trash';
+        const statusFilter = showTrash ? 'Deleted' : req.query.status || null;
+        let sql = 'SELECT * FROM pages ';
+        const params = [];
+        if (showTrash) {
+            sql += 'WHERE status = "Deleted" ';
+        }
+        else if (statusFilter) {
+            sql += 'WHERE status = ? ';
+            params.push(statusFilter);
+        }
+        else {
+            sql += 'WHERE status != "Deleted" ';
+        }
+        sql += 'ORDER BY created_at DESC';
+        const [pages] = await db_1.default.execute(sql, params);
+        const pagesDir = path_1.default.join(__dirname, '../../views/pages');
+        let staticSlugs = [];
+        if (fs_1.default.existsSync(pagesDir)) {
+            staticSlugs = fs_1.default.readdirSync(pagesDir)
+                .filter(file => file.endsWith('.ejs'))
+                .map(file => path_1.default.basename(file, '.ejs').toLowerCase());
+        }
+        const pagesWithFlags = pages.map(page => ({
+            ...page,
+            isStaticOverride: staticSlugs.includes(String(page.slug).toLowerCase())
+        }));
+        res.render('admin/pages', {
+            pages: pagesWithFlags,
+            showTrash,
+            currentStatusFilter: statusFilter || 'All',
+            user: req.session?.user
+        });
+    }
+    catch (err) {
+        console.error('[Radix Pages Route Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// GET /admin/create - Render Create Form
+router.get('/create', requireRole('Editor'), async (req, res) => {
+    try {
+        const templates = (0, themeScanner_1.getAvailableTemplates)();
+        res.render('admin/create-page', {
+            templates,
+            user: req.session?.user
+        });
+    }
+    catch (err) {
+        console.error('[Radix Create Page Route Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// POST /admin/create - Process Page Creation
+router.post('/create', requireRole('Editor'), async (req, res) => {
+    const { title, slug, content, template_name, status, min_role, publish_at } = req.body;
+    try {
+        const publishDate = publish_at ? new Date(publish_at) : new Date();
+        const selectedTemplate = template_name && template_name.trim() !== '' ? template_name : 'default';
+        await db_1.default.execute(`INSERT INTO pages (title, slug, content, template_name, status, min_role, publish_at, created_at) 
+       VALUES (?, ?, ?, ?, ?, ?, ?, NOW())`, [
+            title,
+            slug,
+            content || '',
+            selectedTemplate,
+            status || 'Draft',
+            min_role || 'Unregistered',
+            publishDate
+        ]);
+        res.redirect('/admin/pages');
+    }
+    catch (err) {
+        console.error('[Radix Page Creation Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// GET /admin/edit/:id - Render Edit Page Form
+router.get('/edit/:id', requireRole('Editor'), async (req, res) => {
+    try {
+        const [pages] = await db_1.default.execute('SELECT * FROM pages WHERE id = ?', [req.params.id]);
+        if (pages.length === 0) {
+            res.status(404).render('defaults/404');
+            return;
+        }
+        const templates = (0, themeScanner_1.getAvailableTemplates)();
+        res.render('admin/edit-page', {
+            page: pages[0],
+            templates,
+            user: req.session?.user
+        });
+    }
+    catch (err) {
+        console.error('[Radix Edit Fetch Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// POST /admin/edit/:id - Process Edit Page Update
+router.post('/edit/:id', requireRole('Editor'), async (req, res) => {
+    const pageId = req.params.id;
+    const { title, slug, content, template_name, status, min_role, publish_at } = req.body;
+    try {
+        const publishDate = publish_at ? new Date(publish_at) : new Date();
+        await db_1.default.execute(`UPDATE pages 
+       SET title = ?, slug = ?, content = ?, template_name = ?, status = ?, min_role = ?, publish_at = ? 
+       WHERE id = ?`, [
+            title,
+            slug,
+            content || '',
+            template_name || 'default',
+            status || 'Draft',
+            min_role || 'Unregistered',
+            publishDate,
+            pageId
+        ]);
+        res.redirect('/admin/pages');
+    }
+    catch (err) {
+        console.error('[Radix Page Update Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// POST /admin/delete/:id - Soft Delete Page
+router.post('/delete/:id', requireRole('Editor'), async (req, res) => {
+    try {
+        await db_1.default.execute('UPDATE pages SET status = "Deleted" WHERE id = ?', [req.params.id]);
+        res.redirect('/admin/pages');
+    }
+    catch (err) {
+        console.error('[Radix Soft Delete Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// POST /admin/restore/:id - Restore Page from Trash
+router.post('/restore/:id', requireRole('Editor'), async (req, res) => {
+    try {
+        await db_1.default.execute('UPDATE pages SET status = "Draft" WHERE id = ?', [req.params.id]);
+        res.redirect('/admin/pages?view=trash');
+    }
+    catch (err) {
+        console.error('[Radix Restore Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// POST /admin/permanent-delete/:id - Hard Delete Page
+router.post('/permanent-delete/:id', requireRole('Administrator'), async (req, res) => {
+    try {
+        await db_1.default.execute('DELETE FROM pages WHERE id = ? AND status = "Deleted"', [req.params.id]);
+        res.redirect('/admin/pages?view=trash');
+    }
+    catch (err) {
+        console.error('[Radix Permanent Delete Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// ==========================================
+// 3. USER MANAGEMENT & RBAC ROUTES
+// ==========================================
+router.get('/users', requireRole('Administrator'), async (req, res) => {
+    try {
+        const [users] = await db_1.default.execute('SELECT id, username, email, full_name, role, created_at FROM users ORDER BY created_at DESC');
+        res.render('admin/users', {
+            users,
+            user: req.session?.user
+        });
+    }
+    catch (err) {
+        console.error('[Radix User Fetch Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+router.post('/users/create', requireRole('Administrator'), async (req, res) => {
+    const { username, email, full_name, password, role } = req.body;
+    if (!username || !password || !role) {
+        res.status(400).send('Username, password, and role are required.');
+        return;
+    }
+    const validRoles = ['Administrator', 'Manager', 'Editor', 'Registered', 'Unregistered'];
+    if (!validRoles.includes(role)) {
+        res.status(400).send('Invalid role specified.');
+        return;
+    }
+    try {
+        const [existing] = await db_1.default.execute('SELECT id FROM users WHERE username = ? OR (email IS NOT NULL AND email = ? AND email != "")', [username, email || '']);
+        if (existing.length > 0) {
+            res.status(400).send('User with that username or email already exists.');
+            return;
+        }
+        const hashedPassword = await bcrypt_1.default.hash(password, 10);
+        await db_1.default.execute('INSERT INTO users (username, email, full_name, password_hash, role, created_at) VALUES (?, ?, ?, ?, ?, NOW())', [username, email || null, full_name || null, hashedPassword, role]);
+        res.redirect('/admin/users');
+    }
+    catch (err) {
+        console.error('[Radix User Creation Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+router.get('/users/edit/:id', requireRole('Administrator'), async (req, res) => {
+    try {
+        const [users] = await db_1.default.execute('SELECT id, username, email, full_name, role FROM users WHERE id = ?', [req.params.id]);
+        if (users.length === 0) {
+            res.status(404).render('defaults/404');
+            return;
+        }
+        res.render('admin/edit-user', {
+            editUser: users[0],
+            user: req.session?.user
+        });
+    }
+    catch (err) {
+        console.error('[Radix User Edit Fetch Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+router.post('/users/edit/:id', requireRole('Administrator'), async (req, res) => {
+    const userId = req.params.id;
+    const { username, email, full_name, password, role } = req.body;
+    if (!username || !role) {
+        res.status(400).send('Username and role are required.');
+        return;
+    }
+    const validRoles = ['Administrator', 'Manager', 'Editor', 'Registered', 'Unregistered'];
+    if (!validRoles.includes(role)) {
+        res.status(400).send('Invalid role specified.');
+        return;
+    }
+    try {
+        const [existing] = await db_1.default.execute('SELECT id FROM users WHERE (username = ? OR (email IS NOT NULL AND email = ? AND email != "")) AND id != ?', [username, email || '', userId]);
+        if (existing.length > 0) {
+            res.status(400).send('Another user with that username or email already exists.');
+            return;
+        }
+        if (password && password.trim()) {
+            const hashedPassword = await bcrypt_1.default.hash(password, 10);
+            await db_1.default.execute('UPDATE users SET username = ?, email = ?, full_name = ?, role = ?, password_hash = ? WHERE id = ?', [username, email || null, full_name || null, role, hashedPassword, userId]);
+        }
+        else {
+            await db_1.default.execute('UPDATE users SET username = ?, email = ?, full_name = ?, role = ? WHERE id = ?', [username, email || null, full_name || null, role, userId]);
+        }
+        const sessionUser = req.session?.user;
+        if (sessionUser && String(sessionUser.id) === String(userId)) {
+            sessionUser.username = username;
+            sessionUser.role = role;
+        }
+        res.redirect('/admin/users');
+    }
+    catch (err) {
+        console.error('[Radix User Update Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+router.post('/users/update-role', requireRole('Administrator'), async (req, res) => {
+    const { userId, newRole } = req.body;
+    const validRoles = ['Administrator', 'Manager', 'Editor', 'Registered', 'Unregistered'];
+    if (!validRoles.includes(newRole)) {
+        res.status(400).send('Invalid role specified.');
+        return;
+    }
+    try {
+        await db_1.default.execute('UPDATE users SET role = ? WHERE id = ?', [newRole, userId]);
+        res.redirect('/admin/users');
+    }
+    catch (err) {
+        console.error('[Radix Role Update Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+router.post('/users/delete/:id', requireRole('Administrator'), async (req, res) => {
+    const targetUserId = req.params.id;
+    const currentUserId = req.session?.user?.id;
+    if (String(targetUserId) === String(currentUserId)) {
+        res.status(400).send('Security error: You cannot delete your own active administrator account.');
+        return;
+    }
+    try {
+        await db_1.default.execute('DELETE FROM users WHERE id = ?', [targetUserId]);
+        res.redirect('/admin/users');
+    }
+    catch (err) {
+        console.error('[Radix User Delete Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// ==========================================
+// 4. MEDIA LIBRARY ROUTES
+// ==========================================
+router.get('/media', requireRole('Editor'), (req, res) => {
+    const media = getMediaFiles();
+    res.render('admin/media', { media, user: req.session?.user });
+});
+router.post('/media/upload', requireRole('Editor'), upload.single('file'), (req, res) => {
+    if (!req.file) {
+        res.status(400).json({ error: 'No file uploaded.' });
+        return;
+    }
+    res.json({ location: `/uploads/${req.file.filename}` });
+});
+router.post('/media/delete', requireRole('Administrator'), (req, res) => {
+    const { filename } = req.body;
+    if (!filename) {
+        res.status(400).send('Filename required.');
+        return;
+    }
+    const filePath = path_1.default.join(UPLOAD_DIR, path_1.default.basename(filename));
+    if (fs_1.default.existsSync(filePath)) {
+        fs_1.default.unlinkSync(filePath);
+    }
+    res.redirect('/admin/media');
+});
+// ==========================================
+// 5. THEME MANAGEMENT
+// ==========================================
+router.get('/themes', requireRole('Editor'), async (req, res) => {
+    try {
+        const templates = (0, themeScanner_1.getAvailableTemplates)();
+        res.render('admin/themes', {
+            templates,
+            user: req.session?.user
+        });
+    }
+    catch (err) {
+        console.error('[Radix Themes Route Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// ==========================================
+// 6. SETTINGS
+// ==========================================
+// GET /admin/settings - Render Settings Page
+router.get('/settings', requireRole('Administrator'), async (req, res) => {
+    try {
+        const [rows] = await db_1.default.execute('SELECT * FROM settings');
+        const settings = {};
+        rows.forEach(row => {
+            settings[row.setting_key] = row.setting_value || '';
+        });
+        res.render('admin/settings', {
+            settings,
+            message: req.query.msg ? String(req.query.msg) : null,
+            error: req.query.err ? String(req.query.err) : null,
+            user: req.session?.user
+        });
+    }
+    catch (err) {
+        console.error('[Radix Settings GET Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// POST /admin/settings - Save Settings
+router.post('/settings', requireRole('Administrator'), async (req, res) => {
+    const { site_logo, mail_host, mail_port, mail_secure, mail_user, mail_pass, mail_from } = req.body;
+    const updates = [
+        ['site_logo', site_logo || ''],
+        ['mail_host', mail_host || ''],
+        ['mail_port', mail_port || '25'],
+        ['mail_secure', mail_secure === '1' ? '1' : '0'],
+        ['mail_user', mail_user || ''],
+        ['mail_pass', mail_pass || ''],
+        ['mail_from', mail_from || '']
+    ];
+    try {
+        for (const [key, value] of updates) {
+            await db_1.default.execute('INSERT INTO settings (setting_key, setting_value) VALUES (?, ?) ON DUPLICATE KEY UPDATE setting_value = ?', [key, value, value]);
+        }
+        res.redirect('/admin/settings?msg=Settings+saved+successfully.');
+    }
+    catch (err) {
+        console.error('[Radix Settings Save Error]:', err);
+        res.redirect('/admin/settings?err=Failed+to+save+settings.');
+    }
+});
+// POST /admin/settings/test-email - Dispatch SMTP Test Email
+router.post('/settings/test-email', requireRole('Administrator'), async (req, res) => {
+    const { recipient_email } = req.body;
+    if (!recipient_email) {
+        res.redirect('/admin/settings?err=Recipient+email+address+is+required.');
+        return;
+    }
+    try {
+        const [rows] = await db_1.default.execute('SELECT * FROM settings');
+        const cfg = {};
+        rows.forEach(r => { cfg[r.setting_key] = r.setting_value || ''; });
+        const transporter = nodemailer_1.default.createTransport({
+            host: cfg.mail_host || process.env.MAIL_HOST || 'localhost',
+            port: Number(cfg.mail_port || process.env.MAIL_PORT || 25),
+            secure: cfg.mail_secure === '1',
+            auth: cfg.mail_user ? {
+                user: cfg.mail_user,
+                pass: cfg.mail_pass
+            } : undefined,
+            tls: { rejectUnauthorized: false }
+        });
+        await transporter.sendMail({
+            from: cfg.mail_from || `Radix CMS <noreply@${process.env.SITE_URL || 'localhost'}>`,
+            to: recipient_email,
+            subject: 'Radix CMS - SMTP Test Connection',
+            text: 'Congratulations! Your Radix CMS mail server configuration is working correctly.',
+            html: '<h3>Radix CMS Mail Test</h3><p>Your mail server settings are configured correctly.</p>'
+        });
+        res.redirect('/admin/settings?msg=Test+email+sent+successfully+to+' + encodeURIComponent(recipient_email));
+    }
+    catch (err) {
+        console.error('[SMTP Test Error]:', err);
+        res.redirect('/admin/settings?err=' + encodeURIComponent(`Email dispatch failed: ${err.message}`));
+    }
+});
+// ==========================================
+// 7. UPDATES
+// ==========================================
+// GET /admin/updates - Render System Updates Dashboard
+router.get('/updates', requireRole('Editor'), async (req, res) => {
+    try {
+        const updateInfo = await (0, versionCheck_1.checkForUpdates)();
+        res.render('admin/updates', {
+            updateInfo,
+            message: req.query.msg ? String(req.query.msg) : null,
+            error: req.query.err ? String(req.query.err) : null,
+            user: req.session?.user
+        });
+    }
+    catch (err) {
+        console.error('[Radix Updates Route Error]:', err);
+        res.status(500).render('defaults/500');
+    }
+});
+// POST /admin/updates/apply - Download & Overwrite Core Codebase
+router.post('/updates/apply', requireRole('Administrator'), async (req, res) => {
+    const updateInfo = await (0, versionCheck_1.checkForUpdates)();
+    if (!updateInfo.hasUpdate || !updateInfo.details) {
+        res.redirect('/admin/updates?err=' + encodeURIComponent('No update available or release package details missing.'));
+        return;
+    }
+    const fileUrl = `https://vault.ultraspark.net/radix/${updateInfo.details.InstallFile}`;
+    const zipPath = path_1.default.join(process.cwd(), 'temp_update.zip');
+    const extractDir = path_1.default.join(process.cwd(), 'temp_update_extract');
+    try {
+        // 1. Download zip archive
+        const response = await fetch(fileUrl);
+        if (!response.ok)
+            throw new Error(`Download failed with status ${response.status}`);
+        const arrayBuffer = await response.arrayBuffer();
+        await fs_1.default.promises.writeFile(zipPath, Buffer.from(arrayBuffer));
+        // 2. Extract contents
+        const zip = new adm_zip_1.default(zipPath);
+        zip.extractAllTo(extractDir, true);
+        // 3. Overwrite codebase excluding environment and runtime assets
+        const protectedPaths = ['.env', 'node_modules', 'uploads', 'temp_update.zip', 'temp_update_extract'];
+        const copyFolderRecursive = async (src, dest) => {
+            const entries = await fs_1.default.promises.readdir(src, { withFileTypes: true });
+            for (const entry of entries) {
+                if (protectedPaths.includes(entry.name))
+                    continue;
+                const srcPath = path_1.default.join(src, entry.name);
+                const destPath = path_1.default.join(dest, entry.name);
+                if (entry.isDirectory()) {
+                    await fs_1.default.promises.mkdir(destPath, { recursive: true });
+                    await copyFolderRecursive(srcPath, destPath);
+                }
+                else {
+                    await fs_1.default.promises.copyFile(srcPath, destPath);
+                }
+            }
+        };
+        await copyFolderRecursive(extractDir, process.cwd());
+        updateEnvVersion(updateInfo.remoteVersion);
+        // 4. Clean up temporary files
+        await fs_1.default.promises.unlink(zipPath).catch(() => { });
+        await fs_1.default.promises.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+        res.redirect('/admin/updates?msg=' + encodeURIComponent('System updated successfully! Restart application process to reflect server changes.'));
+    }
+    catch (err) {
+        console.error('[Update Apply Error]:', err);
+        // Cleanup on failure
+        await fs_1.default.promises.unlink(zipPath).catch(() => { });
+        await fs_1.default.promises.rm(extractDir, { recursive: true, force: true }).catch(() => { });
+        res.redirect('/admin/updates?err=' + encodeURIComponent(`Update execution failed: ${err.message}`));
+    }
+});
+exports.default = router;