96 lines
4.2 KiB
JavaScript
96 lines
4.2 KiB
JavaScript
/* =====================================================================
|
|
routes/roles.js — Rollen erstellen/umbenennen/verwalten
|
|
|
|
Die Owner-Rolle existiert absichtlich NICHT in dieser Tabelle — sie ist
|
|
fest an POSTFACH_CODE gebunden und kann hier weder erstellt, verändert
|
|
noch gelöscht werden (siehe Anforderungsdokument: "Meine persönliche
|
|
Hauptadministrator-Rolle bleibt davon ausgeschlossen").
|
|
===================================================================== */
|
|
import { generateId, nowIso } from "../lib/crypto.js";
|
|
import { isValidPermissionKey, hasPermission } from "../lib/permissions.js";
|
|
import { logAction } from "../lib/audit.js";
|
|
import { json } from "../lib/http.js";
|
|
|
|
function canManageRoles(session) {
|
|
if (!session) return false;
|
|
if (session.isOwner) return true;
|
|
return (
|
|
hasPermission(session.permissions, session.overrides, "TEAM_CREATE_ROLE") ||
|
|
hasPermission(session.permissions, session.overrides, "TEAM_EDIT_PERMISSIONS")
|
|
);
|
|
}
|
|
|
|
function canViewRoles(session) {
|
|
if (!session) return false;
|
|
if (session.isOwner) return true;
|
|
return (
|
|
canManageRoles(session) ||
|
|
hasPermission(session.permissions, session.overrides, "TEAM_ASSIGN_ROLE") ||
|
|
hasPermission(session.permissions, session.overrides, "TEAM_VIEW")
|
|
);
|
|
}
|
|
|
|
function sanitizePermissions(list) {
|
|
if (!Array.isArray(list)) return [];
|
|
return [...new Set(list.filter((k) => typeof k === "string" && isValidPermissionKey(k)))];
|
|
}
|
|
|
|
export async function listRoles(env, session) {
|
|
if (!canViewRoles(session)) return json({ ok: false, error: "Keine Berechtigung." }, 403);
|
|
const rows = await env.DB.prepare(`SELECT * FROM roles ORDER BY created_at ASC`).all();
|
|
const roles = (rows.results || []).map((r) => ({ ...r, permissions: JSON.parse(r.permissions || "[]") }));
|
|
return json({ ok: true, roles });
|
|
}
|
|
|
|
export async function createRole(request, env, session) {
|
|
if (!canManageRoles(session)) return json({ ok: false, error: "Keine Berechtigung." }, 403);
|
|
const body = await request.json().catch(() => ({}));
|
|
const name = String(body.name || "").trim().slice(0, 60);
|
|
if (!name) return json({ ok: false, error: "Name fehlt." }, 400);
|
|
const permissions = sanitizePermissions(body.permissions);
|
|
const id = generateId();
|
|
|
|
await env.DB.prepare(`INSERT INTO roles (id, name, permissions, created_at) VALUES (?, ?, ?, ?)`)
|
|
.bind(id, name, JSON.stringify(permissions), nowIso())
|
|
.run();
|
|
|
|
await logAction(env, session.actor, "role.create", id, { name, permissions });
|
|
return json({ ok: true, role: { id, name, permissions } });
|
|
}
|
|
|
|
export async function updateRole(request, env, session) {
|
|
if (!canManageRoles(session)) return json({ ok: false, error: "Keine Berechtigung." }, 403);
|
|
const body = await request.json().catch(() => ({}));
|
|
const id = String(body.id || "");
|
|
if (!id) return json({ ok: false, error: "id fehlt." }, 400);
|
|
|
|
const existing = await env.DB.prepare(`SELECT * FROM roles WHERE id = ?`).bind(id).first();
|
|
if (!existing) return json({ ok: false, error: "Rolle nicht gefunden." }, 404);
|
|
|
|
const name = body.name !== undefined ? String(body.name).trim().slice(0, 60) || existing.name : existing.name;
|
|
const permissions = body.permissions !== undefined ? sanitizePermissions(body.permissions) : JSON.parse(existing.permissions || "[]");
|
|
|
|
await env.DB.prepare(`UPDATE roles SET name = ?, permissions = ? WHERE id = ?`)
|
|
.bind(name, JSON.stringify(permissions), id)
|
|
.run();
|
|
|
|
await logAction(env, session.actor, "role.update", id, { name, permissions });
|
|
return json({ ok: true });
|
|
}
|
|
|
|
export async function deleteRole(request, env, session) {
|
|
if (!canManageRoles(session)) return json({ ok: false, error: "Keine Berechtigung." }, 403);
|
|
const body = await request.json().catch(() => ({}));
|
|
const id = String(body.id || "");
|
|
if (!id) return json({ ok: false, error: "id fehlt." }, 400);
|
|
|
|
const inUse = await env.DB.prepare(`SELECT COUNT(*) as n FROM users WHERE role_id = ?`).bind(id).first();
|
|
if (inUse && inUse.n > 0) {
|
|
return json({ ok: false, error: "Rolle ist noch Personen zugewiesen — erst umziehen." }, 400);
|
|
}
|
|
|
|
await env.DB.prepare(`DELETE FROM roles WHERE id = ?`).bind(id).run();
|
|
await logAction(env, session.actor, "role.delete", id, null);
|
|
return json({ ok: true });
|
|
}
|