Meik/Pickup-Config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: restrict admin areas and show mobile pickups

Browse Source 
Limit monitoring and journal access to admins, reduce regular-user navigation,
and show the latest pickup directly in mobile configuration cards.
This commit is contained in:
Meik
2026-08-05 20:10:22 +02:00
parent 713f52caa0
commit a64bfe2d3f
10 changed files with 103 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
server.js
View File

@@ -1020,7 +1020,7 @@ app.get('/api/location/nearest-store', requireAuth, async (req, res) => {
}
});
app.get('/api/store-watch/regions', requireAuth, async (req, res) => {
app.get('/api/store-watch/regions', requireAuth, requireAdmin, async (req, res) => {
try {
const details = await fetchProfileWithCache(req.session);
const regions = Array.isArray(details?.regions)
@@ -1033,7 +1033,7 @@ app.get('/api/store-watch/regions', requireAuth, async (req, res) => {
}
});
app.get('/api/store-watch/regions/:regionId/stores', requireAuth, async (req, res) => {
app.get('/api/store-watch/regions/:regionId/stores', requireAuth, requireAdmin, async (req, res) => {
const { regionId } = req.params;
if (!regionId) {
return res.status(400).json({ error: 'Region-ID fehlt' });
@@ -1086,12 +1086,12 @@ app.get('/api/store-watch/regions/:regionId/stores', requireAuth, async (req, re
});
});
app.get('/api/store-watch/subscriptions', requireAuth, (req, res) => {
app.get('/api/store-watch/subscriptions', requireAuth, requireAdmin, (req, res) => {
const stores = readStoreWatch(req.session.profile.id);
res.json({ stores });
});
app.post('/api/store-watch/subscriptions', requireAuth, (req, res) => {
app.post('/api/store-watch/subscriptions', requireAuth, requireAdmin, (req, res) => {
if (!req.body || !Array.isArray(req.body.stores)) {
return res.status(400).json({ error: 'Erwartet eine Liste von Betrieben' });
}
@@ -1121,7 +1121,7 @@ app.post('/api/store-watch/subscriptions', requireAuth, (req, res) => {
res.json({ success: true, stores: persisted });
});
app.post('/api/store-watch/check', requireAuth, async (req, res) => {
app.post('/api/store-watch/check', requireAuth, requireAdmin, async (req, res) => {
try {
maintenanceMode.ensureInactive('Ad-hoc-Store-Watch ist während des Wartungsmodus deaktiviert.');
const settings = adminConfig.readSettings();
@@ -1191,7 +1191,7 @@ app.post('/api/user/preferences/location', requireAuth, (req, res) => {
res.json({ location: updated.location });
});
app.get('/api/journal', requireAuth, (req, res) => {
app.get('/api/journal', requireAuth, requireAdmin, (req, res) => {
const entries = readJournal(req.session.profile.id);
const normalized = entries.map((entry) => ({
...entry,
@@ -1205,7 +1205,7 @@ app.get('/api/journal', requireAuth, (req, res) => {
res.json(normalized);
});
app.post('/api/journal', requireAuth, (req, res) => {
app.post('/api/journal', requireAuth, requireAdmin, (req, res) => {
const profileId = req.session.profile.id;
const { storeId, storeName, pickupDate, note, reminder, images } = req.body || {};
if (!storeId || !pickupDate) {
@@ -1276,7 +1276,7 @@ app.post('/api/journal', requireAuth, (req, res) => {
});
});
app.put('/api/journal/:id', requireAuth, (req, res) => {
app.put('/api/journal/:id', requireAuth, requireAdmin, (req, res) => {
const profileId = req.session.profile.id;
const { storeId, storeName, pickupDate, note, reminder, images, keepImageIds } = req.body || {};
if (!storeId || !pickupDate) {
@@ -1358,7 +1358,7 @@ app.put('/api/journal/:id', requireAuth, (req, res) => {
});
});
app.delete('/api/journal/:id', requireAuth, (req, res) => {
app.delete('/api/journal/:id', requireAuth, requireAdmin, (req, res) => {
const profileId = req.session.profile.id;
const entries = readJournal(profileId);
const filtered = entries.filter((entry) => entry.id !== req.params.id);
@@ -1373,7 +1373,7 @@ app.delete('/api/journal/:id', requireAuth, (req, res) => {
res.json({ success: true });
});
app.get('/api/journal/images/:imageId', requireAuth, (req, res) => {
app.get('/api/journal/images/:imageId', requireAuth, requireAdmin, (req, res) => {
const profileId = req.session.profile.id;
const entries = readJournal(profileId);
const imageEntry = entries