34 lines
1.4 KiB
JavaScript
34 lines
1.4 KiB
JavaScript
'use strict';
|
|
// routes/audit.js — read-only Audit Trail viewer API. Access: full Admin and
|
|
// System Admin roles always; any other user must be granted the 'audit' module.
|
|
const express = require('express');
|
|
const router = express.Router();
|
|
const { verifyToken } = require('../middleware/auth');
|
|
const store = require('../services/auditStore');
|
|
|
|
async function requireAuditView(req, res, next) {
|
|
const u = req.user || {};
|
|
if (u.role === 'admin' || u.role === 'system_admin') return next();
|
|
// Module grant — read fresh from DB (JWT may not carry the modules list).
|
|
try {
|
|
const full = await require('../services/hanaUsers').findById(u.id);
|
|
const mods = Array.isArray(full && full.modules) ? full.modules : [];
|
|
if (mods.includes('audit')) return next();
|
|
} catch (_e) {}
|
|
return res.status(403).json({ success: false, message: 'You do not have access to the Audit Trail.' });
|
|
}
|
|
|
|
router.get('/', verifyToken, requireAuditView, async (req, res) => {
|
|
try {
|
|
const { data, total } = await store.list(req.query);
|
|
res.json({ success: true, data, total });
|
|
} catch (err) { res.status(500).json({ success: false, message: err.message }); }
|
|
});
|
|
|
|
router.get('/facets', verifyToken, requireAuditView, async (req, res) => {
|
|
try { res.json({ success: true, data: await store.facets() }); }
|
|
catch (err) { res.status(500).json({ success: false, message: err.message }); }
|
|
});
|
|
|
|
module.exports = router;
|