first commit

routes/mailLogs.js

@@ -0,0 +1,28 @@
+'use strict';
+// routes/mailLogs.js — read-only Mail Log viewer API. Access: full Admin and
+// System Admin roles always; any other user must be granted the 'mail_log'
+// module. Mirrors routes/audit.js exactly.
+const express = require('express');
+const router  = express.Router();
+const { verifyToken } = require('../middleware/auth');
+const store = require('../services/mailLogStore');
+
+async function requireMailLogView(req, res, next) {
+  const u = req.user || {};
+  if (u.role === 'admin' || u.role === 'system_admin') return next();
+  try {
+    const full = await require('../services/hanaUsers').findById(u.id);
+    const mods = Array.isArray(full && full.modules) ? full.modules : [];
+    if (mods.includes('mail_log')) return next();
+  } catch (_e) {}
+  return res.status(403).json({ success: false, message: 'You do not have access to the Mail Log.' });
+}
+
+router.get('/', verifyToken, requireMailLogView, async (req, res) => {
+  try {
+    const { data, total } = await store.list(req.query);
+    res.json({ success: true, data, total });
+  } catch (err) { res.status(500).json({ success: false, message: err.message }); }
+});
+
+module.exports = router;