cannaiq/backend/dist/routes/api-permissions.js

"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
const express_1 = require("express");
const middleware_1 = require("../auth/middleware");
const migrate_1 = require("../db/migrate");
const crypto_1 = __importDefault(require("crypto"));
const router = (0, express_1.Router)();
router.use(middleware_1.authMiddleware);
// Generate secure random API key (64-character hex)
function generateApiKey() {
    return crypto_1.default.randomBytes(32).toString('hex');
}
// Get all API permissions
router.get('/', (0, middleware_1.requireRole)('superadmin', 'admin'), async (req, res) => {
    try {
        const result = await migrate_1.pool.query(`
      SELECT *
      FROM wp_dutchie_api_permissions
      ORDER BY created_at DESC
    `);
        res.json({ permissions: result.rows });
    }
    catch (error) {
        console.error('Error fetching API permissions:', error);
        res.status(500).json({ error: 'Failed to fetch API permissions' });
    }
});
// Get all dispensaries for dropdown (must be before /:id to avoid route conflict)
router.get('/dispensaries', (0, middleware_1.requireRole)('superadmin', 'admin'), async (req, res) => {
    try {
        const result = await migrate_1.pool.query(`
      SELECT id, name
      FROM dispensaries
      ORDER BY name
    `);
        res.json({ dispensaries: result.rows });
    }
    catch (error) {
        console.error('Error fetching dispensaries:', error);
        res.status(500).json({ error: 'Failed to fetch dispensaries' });
    }
});
// Get single API permission
router.get('/:id', (0, middleware_1.requireRole)('superadmin', 'admin'), async (req, res) => {
    try {
        const { id } = req.params;
        const result = await migrate_1.pool.query(`
      SELECT *
      FROM wp_dutchie_api_permissions
      WHERE id = $1
    `, [id]);
        if (result.rows.length === 0) {
            return res.status(404).json({ error: 'Permission not found' });
        }
        res.json({ permission: result.rows[0] });
    }
    catch (error) {
        console.error('Error fetching API permission:', error);
        res.status(500).json({ error: 'Failed to fetch API permission' });
    }
});
// Create new API permission
router.post('/', (0, middleware_1.requireRole)('superadmin', 'admin'), async (req, res) => {
    try {
        // Support both store_id (existing) and dispensary_id (for compatibility)
        const { user_name, allowed_ips, allowed_domains, store_id, dispensary_id } = req.body;
        const storeIdToUse = store_id || dispensary_id;
        if (!user_name) {
            return res.status(400).json({ error: 'User name is required' });
        }
        if (!storeIdToUse) {
            return res.status(400).json({ error: 'Store/Dispensary is required' });
        }
        // Get dispensary name for display
        const dispensaryResult = await migrate_1.pool.query('SELECT name FROM dispensaries WHERE id = $1', [storeIdToUse]);
        if (dispensaryResult.rows.length === 0) {
            return res.status(400).json({ error: 'Invalid store/dispensary ID' });
        }
        const storeName = dispensaryResult.rows[0].name;
        const apiKey = generateApiKey();
        const result = await migrate_1.pool.query(`
      INSERT INTO wp_dutchie_api_permissions (
        user_name,
        api_key,
        allowed_ips,
        allowed_domains,
        is_active,
        store_id,
        store_name
      )
      VALUES ($1, $2, $3, $4, 1, $5, $6)
      RETURNING *
    `, [
            user_name,
            apiKey,
            allowed_ips || null,
            allowed_domains || null,
            storeIdToUse,
            storeName
        ]);
        res.status(201).json({
            permission: result.rows[0],
            message: 'API permission created successfully. Save the API key securely - it cannot be retrieved later.'
        });
    }
    catch (error) {
        console.error('Error creating API permission:', error);
        res.status(500).json({ error: 'Failed to create API permission' });
    }
});
// Update API permission
router.put('/:id', (0, middleware_1.requireRole)('superadmin', 'admin'), async (req, res) => {
    try {
        const { id } = req.params;
        const { user_name, allowed_ips, allowed_domains, is_active } = req.body;
        const result = await migrate_1.pool.query(`
      UPDATE wp_dutchie_api_permissions
      SET
        user_name = COALESCE($1, user_name),
        allowed_ips = COALESCE($2, allowed_ips),
        allowed_domains = COALESCE($3, allowed_domains),
        is_active = COALESCE($4, is_active)
      WHERE id = $5
      RETURNING *
    `, [user_name, allowed_ips, allowed_domains, is_active, id]);
        if (result.rows.length === 0) {
            return res.status(404).json({ error: 'Permission not found' });
        }
        res.json({ permission: result.rows[0] });
    }
    catch (error) {
        console.error('Error updating API permission:', error);
        res.status(500).json({ error: 'Failed to update API permission' });
    }
});
// Toggle permission active status
router.patch('/:id/toggle', (0, middleware_1.requireRole)('superadmin', 'admin'), async (req, res) => {
    try {
        const { id } = req.params;
        const result = await migrate_1.pool.query(`
      UPDATE wp_dutchie_api_permissions
      SET is_active = NOT is_active
      WHERE id = $1
      RETURNING *
    `, [id]);
        if (result.rows.length === 0) {
            return res.status(404).json({ error: 'Permission not found' });
        }
        res.json({ permission: result.rows[0] });
    }
    catch (error) {
        console.error('Error toggling API permission:', error);
        res.status(500).json({ error: 'Failed to toggle API permission' });
    }
});
// Delete API permission
router.delete('/:id', (0, middleware_1.requireRole)('superadmin'), async (req, res) => {
    try {
        const { id } = req.params;
        const result = await migrate_1.pool.query('DELETE FROM wp_dutchie_api_permissions WHERE id = $1 RETURNING *', [id]);
        if (result.rows.length === 0) {
            return res.status(404).json({ error: 'Permission not found' });
        }
        res.json({ message: 'API permission deleted successfully' });
    }
    catch (error) {
        console.error('Error deleting API permission:', error);
        res.status(500).json({ error: 'Failed to delete API permission' });
    }
});
exports.default = router;