blaisadmin
1280 lines
40 KiB
TypeScript
1280 lines
40 KiB
TypeScript
import crypto from 'crypto';
|
|
import axios from 'axios';
|
|
import bcrypt from 'bcryptjs';
|
|
import cors from 'cors';
|
|
import dotenv from 'dotenv';
|
|
import express from 'express';
|
|
import helmet from 'helmet';
|
|
import rateLimit from 'express-rate-limit';
|
|
import morgan from 'morgan';
|
|
import pg from 'pg';
|
|
|
|
dotenv.config();
|
|
|
|
type UserRow = {
|
|
id: string;
|
|
email: string;
|
|
name: string;
|
|
};
|
|
|
|
type ProfileRow = {
|
|
id: string;
|
|
name: string;
|
|
};
|
|
|
|
type SessionRow = {
|
|
id: string;
|
|
user_id: string;
|
|
active_profile_id: string | null;
|
|
expires_at: string;
|
|
};
|
|
|
|
type ProviderConfigRow = {
|
|
provider_key: string;
|
|
display_name: string;
|
|
protocol: string;
|
|
client_id: string | null;
|
|
client_secret: string | null;
|
|
authorization_endpoint: string | null;
|
|
token_endpoint: string | null;
|
|
userinfo_endpoint: string | null;
|
|
issuer: string | null;
|
|
scopes: string;
|
|
enabled: boolean;
|
|
};
|
|
|
|
type DashboardSummaryRow = {
|
|
totalFirearms: number;
|
|
totalAmmoRounds: number;
|
|
firearmsInvestment: string;
|
|
ammoInvestment: string;
|
|
configuredCalibers: number;
|
|
};
|
|
|
|
type FirearmRow = {
|
|
id: string;
|
|
manufacturer: string;
|
|
model: string;
|
|
category: string;
|
|
caliber: string;
|
|
serial_number: string;
|
|
purchase_price: string;
|
|
acquired_on: string | null;
|
|
image_url: string | null;
|
|
notes: string | null;
|
|
};
|
|
|
|
type CaliberRow = {
|
|
id: string;
|
|
name: string;
|
|
is_default: boolean;
|
|
is_active: boolean;
|
|
};
|
|
|
|
type AmmoInventoryRow = {
|
|
caliber_id: string;
|
|
caliber_name: string;
|
|
rounds_on_hand: number;
|
|
cost_per_round: string;
|
|
};
|
|
|
|
type AuthContext = {
|
|
user: UserRow;
|
|
session: SessionRow;
|
|
token: string;
|
|
};
|
|
|
|
declare global {
|
|
namespace Express {
|
|
interface Request {
|
|
auth?: AuthContext;
|
|
}
|
|
}
|
|
}
|
|
|
|
const app = express();
|
|
const port = Number(process.env.PORT ?? 5000);
|
|
const databaseUrl =
|
|
process.env.DATABASE_URL ||
|
|
`postgresql://${process.env.POSTGRES_USER}:${process.env.POSTGRES_PASSWORD}@localhost:5432/${process.env.POSTGRES_DB}`;
|
|
const frontendUrl = process.env.FRONTEND_URL || 'http://localhost:3000';
|
|
const apiBaseUrl = process.env.API_BASE_URL || 'http://localhost:5000/api';
|
|
const allowRegistration = (process.env.ALLOW_REGISTRATION ?? 'true').toLowerCase() !== 'false';
|
|
const { Pool } = pg;
|
|
const pool = new Pool({ connectionString: databaseUrl });
|
|
|
|
const defaultCalibers = ['9mm', '.22 LR', '5.56 NATO', '.308 Win', '12 Gauge', '.45 ACP'];
|
|
const firearmCategories = ['Handgun', 'Rifle', 'Shotgun', 'PCC', 'Other'];
|
|
const sessionHours = 24 * 7;
|
|
|
|
const allowedOrigins = (process.env.FRONTEND_URL ?? 'http://localhost:3000,http://localhost:5173')
|
|
.split(',')
|
|
.map((origin) => origin.trim())
|
|
.filter(Boolean);
|
|
|
|
const formatCurrency = (value: string | number | null): number => Number(value ?? 0);
|
|
|
|
const getString = (value: unknown, fieldName: string, required = true): string => {
|
|
if (typeof value !== 'string') {
|
|
if (required) {
|
|
throw new Error(`${fieldName} is required`);
|
|
}
|
|
|
|
return '';
|
|
}
|
|
|
|
const trimmed = value.trim();
|
|
|
|
if (!trimmed && required) {
|
|
throw new Error(`${fieldName} is required`);
|
|
}
|
|
|
|
return trimmed;
|
|
};
|
|
|
|
const getOptionalString = (value: unknown): string | null => {
|
|
if (typeof value !== 'string') {
|
|
return null;
|
|
}
|
|
|
|
const trimmed = value.trim();
|
|
return trimmed ? trimmed : null;
|
|
};
|
|
|
|
const getNumber = (value: unknown, fieldName: string): number => {
|
|
const parsed = typeof value === 'number' ? value : Number(value);
|
|
|
|
if (!Number.isFinite(parsed)) {
|
|
throw new Error(`${fieldName} must be a valid number`);
|
|
}
|
|
|
|
return parsed;
|
|
};
|
|
|
|
const normalizeEmail = (email: string) => email.trim().toLowerCase();
|
|
const hashToken = (token: string) => crypto.createHash('sha256').update(token).digest('hex');
|
|
const createSessionToken = () => crypto.randomBytes(32).toString('hex');
|
|
const isUuid = (value: string) => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
|
|
|
|
const normalizeFirearm = (row: FirearmRow) => ({
|
|
id: row.id,
|
|
manufacturer: row.manufacturer,
|
|
model: row.model,
|
|
category: row.category,
|
|
caliber: row.caliber,
|
|
serialNumber: row.serial_number,
|
|
purchasePrice: formatCurrency(row.purchase_price),
|
|
acquiredOn: row.acquired_on,
|
|
imageUrl: row.image_url,
|
|
notes: row.notes,
|
|
});
|
|
|
|
const normalizeCaliber = (row: CaliberRow) => ({
|
|
id: row.id,
|
|
name: row.name,
|
|
isDefault: row.is_default,
|
|
isActive: row.is_active,
|
|
});
|
|
|
|
const normalizeAmmoInventory = (row: AmmoInventoryRow) => ({
|
|
caliberId: row.caliber_id,
|
|
caliber: row.caliber_name,
|
|
roundsOnHand: Number(row.rounds_on_hand || 0),
|
|
costPerRound: formatCurrency(row.cost_per_round),
|
|
totalValue: Number(row.rounds_on_hand || 0) * formatCurrency(row.cost_per_round),
|
|
});
|
|
|
|
const serializeProvider = (provider: ProviderConfigRow) => ({
|
|
providerKey: provider.provider_key,
|
|
displayName: provider.display_name,
|
|
protocol: provider.protocol,
|
|
clientId: provider.client_id ?? '',
|
|
clientSecret: provider.client_secret ?? '',
|
|
authorizationEndpoint: provider.authorization_endpoint ?? '',
|
|
tokenEndpoint: provider.token_endpoint ?? '',
|
|
userinfoEndpoint: provider.userinfo_endpoint ?? '',
|
|
issuer: provider.issuer ?? '',
|
|
scopes: provider.scopes,
|
|
enabled: provider.enabled,
|
|
});
|
|
|
|
const decodeJwtPayload = (token: string) => {
|
|
const segments = token.split('.');
|
|
|
|
if (segments.length < 2) {
|
|
return null;
|
|
}
|
|
|
|
const payload = segments[1].replace(/-/g, '+').replace(/_/g, '/');
|
|
const padded = payload.padEnd(Math.ceil(payload.length / 4) * 4, '=');
|
|
|
|
try {
|
|
return JSON.parse(Buffer.from(padded, 'base64').toString('utf8')) as Record<string, unknown>;
|
|
} catch {
|
|
return null;
|
|
}
|
|
};
|
|
|
|
const ensureSchema = async () => {
|
|
await pool.query(`
|
|
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
|
|
CREATE TABLE IF NOT EXISTS users (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
email VARCHAR(255) UNIQUE NOT NULL,
|
|
password_hash VARCHAR(255),
|
|
name VARCHAR(255) NOT NULL,
|
|
created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
|
|
updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS profiles (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
name VARCHAR(255) NOT NULL,
|
|
created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
|
|
UNIQUE (user_id, name)
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS auth_sessions (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
active_profile_id UUID REFERENCES profiles(id) ON DELETE SET NULL,
|
|
token_hash VARCHAR(255) NOT NULL UNIQUE,
|
|
expires_at TIMESTAMPTZ NOT NULL,
|
|
created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS auth_provider_configs (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
provider_key VARCHAR(100) NOT NULL UNIQUE,
|
|
display_name VARCHAR(255) NOT NULL,
|
|
protocol VARCHAR(50) NOT NULL DEFAULT 'oidc',
|
|
client_id TEXT,
|
|
client_secret TEXT,
|
|
authorization_endpoint TEXT,
|
|
token_endpoint TEXT,
|
|
userinfo_endpoint TEXT,
|
|
issuer TEXT,
|
|
scopes TEXT NOT NULL DEFAULT 'openid profile email',
|
|
enabled BOOLEAN NOT NULL DEFAULT FALSE,
|
|
created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
|
|
updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS auth_identities (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
provider_key VARCHAR(100) NOT NULL REFERENCES auth_provider_configs(provider_key) ON DELETE CASCADE,
|
|
provider_subject TEXT NOT NULL,
|
|
email VARCHAR(255),
|
|
created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
|
|
UNIQUE (provider_key, provider_subject)
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS oauth_states (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
provider_key VARCHAR(100) NOT NULL REFERENCES auth_provider_configs(provider_key) ON DELETE CASCADE,
|
|
state_code VARCHAR(255) NOT NULL UNIQUE,
|
|
redirect_uri TEXT NOT NULL,
|
|
created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS calibers (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
profile_id UUID NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
|
|
name VARCHAR(40) NOT NULL,
|
|
is_default BOOLEAN NOT NULL DEFAULT FALSE,
|
|
is_active BOOLEAN NOT NULL DEFAULT TRUE,
|
|
created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
|
|
UNIQUE (profile_id, name)
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS firearms (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
profile_id UUID NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
|
|
manufacturer VARCHAR(120) NOT NULL,
|
|
model VARCHAR(120) NOT NULL,
|
|
category VARCHAR(80) NOT NULL,
|
|
caliber VARCHAR(40) NOT NULL,
|
|
serial_number VARCHAR(120) NOT NULL,
|
|
purchase_price NUMERIC(10, 2) NOT NULL DEFAULT 0,
|
|
acquired_on DATE,
|
|
image_url TEXT,
|
|
notes TEXT,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS ammo_inventory (
|
|
profile_id UUID NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
|
|
caliber_id UUID NOT NULL REFERENCES calibers(id) ON DELETE CASCADE,
|
|
rounds_on_hand INT NOT NULL DEFAULT 0 CHECK (rounds_on_hand >= 0),
|
|
cost_per_round NUMERIC(10, 2) NOT NULL DEFAULT 0,
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
PRIMARY KEY (profile_id, caliber_id)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);
|
|
CREATE INDEX IF NOT EXISTS idx_profiles_user_id ON profiles(user_id);
|
|
CREATE INDEX IF NOT EXISTS idx_auth_sessions_user_id ON auth_sessions(user_id);
|
|
CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires_at ON auth_sessions(expires_at);
|
|
CREATE INDEX IF NOT EXISTS idx_calibers_profile_id ON calibers(profile_id);
|
|
CREATE INDEX IF NOT EXISTS idx_firearms_profile_id ON firearms(profile_id);
|
|
`);
|
|
|
|
const providers = [
|
|
{
|
|
providerKey: 'google',
|
|
displayName: 'Google',
|
|
authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
|
|
tokenEndpoint: 'https://oauth2.googleapis.com/token',
|
|
userinfoEndpoint: 'https://openidconnect.googleapis.com/v1/userinfo',
|
|
issuer: 'https://accounts.google.com',
|
|
},
|
|
{
|
|
providerKey: 'entra',
|
|
displayName: 'Microsoft Entra ID',
|
|
authorizationEndpoint: '',
|
|
tokenEndpoint: '',
|
|
userinfoEndpoint: 'https://graph.microsoft.com/oidc/userinfo',
|
|
issuer: '',
|
|
},
|
|
{
|
|
providerKey: 'oidc',
|
|
displayName: 'Custom OIDC',
|
|
authorizationEndpoint: '',
|
|
tokenEndpoint: '',
|
|
userinfoEndpoint: '',
|
|
issuer: '',
|
|
},
|
|
];
|
|
|
|
for (const provider of providers) {
|
|
await pool.query(
|
|
`INSERT INTO auth_provider_configs
|
|
(provider_key, display_name, protocol, authorization_endpoint, token_endpoint, userinfo_endpoint, issuer, scopes, enabled)
|
|
VALUES ($1, $2, 'oidc', $3, $4, $5, $6, 'openid profile email', FALSE)
|
|
ON CONFLICT (provider_key) DO NOTHING`,
|
|
[
|
|
provider.providerKey,
|
|
provider.displayName,
|
|
provider.authorizationEndpoint,
|
|
provider.tokenEndpoint,
|
|
provider.userinfoEndpoint,
|
|
provider.issuer,
|
|
],
|
|
);
|
|
}
|
|
};
|
|
|
|
const ensureProfileDefaults = async (profileId: string) => {
|
|
for (const caliber of defaultCalibers) {
|
|
const caliberResult = await pool.query<CaliberRow>(
|
|
`INSERT INTO calibers (profile_id, name, is_default, is_active)
|
|
VALUES ($1, $2, TRUE, TRUE)
|
|
ON CONFLICT (profile_id, name) DO UPDATE
|
|
SET is_default = TRUE
|
|
RETURNING id, name, is_default, is_active`,
|
|
[profileId, caliber],
|
|
);
|
|
|
|
await pool.query(
|
|
`INSERT INTO ammo_inventory (profile_id, caliber_id, rounds_on_hand, cost_per_round)
|
|
VALUES ($1, $2, 0, 0)
|
|
ON CONFLICT (profile_id, caliber_id) DO NOTHING`,
|
|
[profileId, caliberResult.rows[0].id],
|
|
);
|
|
}
|
|
};
|
|
|
|
const getUserProfiles = async (userId: string) => {
|
|
const result = await pool.query<ProfileRow>(
|
|
'SELECT id, name FROM profiles WHERE user_id = $1 ORDER BY created_at ASC',
|
|
[userId],
|
|
);
|
|
|
|
return result.rows;
|
|
};
|
|
|
|
const ensureDefaultProfile = async (userId: string, userName: string) => {
|
|
const profiles = await getUserProfiles(userId);
|
|
|
|
if (profiles.length > 0) {
|
|
await ensureProfileDefaults(profiles[0].id);
|
|
return profiles[0];
|
|
}
|
|
|
|
const created = await pool.query<ProfileRow>(
|
|
'INSERT INTO profiles (user_id, name) VALUES ($1, $2) RETURNING id, name',
|
|
[userId, `${userName.split(' ')[0] || 'Primary'} Arsenal`],
|
|
);
|
|
|
|
await ensureProfileDefaults(created.rows[0].id);
|
|
return created.rows[0];
|
|
};
|
|
|
|
const createSession = async (userId: string, activeProfileId: string) => {
|
|
const token = createSessionToken();
|
|
const tokenHash = hashToken(token);
|
|
const expiresAt = new Date(Date.now() + sessionHours * 60 * 60 * 1000);
|
|
|
|
const result = await pool.query<SessionRow>(
|
|
`INSERT INTO auth_sessions (user_id, active_profile_id, token_hash, expires_at)
|
|
VALUES ($1, $2, $3, $4)
|
|
RETURNING id, user_id, active_profile_id, expires_at`,
|
|
[userId, activeProfileId, tokenHash, expiresAt.toISOString()],
|
|
);
|
|
|
|
return {
|
|
token,
|
|
session: result.rows[0],
|
|
};
|
|
};
|
|
|
|
const getSessionFromToken = async (rawToken: string) => {
|
|
const tokenHash = hashToken(rawToken);
|
|
const result = await pool.query<SessionRow & { email: string; name: string }>(
|
|
`SELECT s.id, s.user_id, s.active_profile_id, s.expires_at, u.email, u.name
|
|
FROM auth_sessions s
|
|
JOIN users u ON u.id = s.user_id
|
|
WHERE s.token_hash = $1 AND s.expires_at > NOW()`,
|
|
[tokenHash],
|
|
);
|
|
|
|
if ((result.rowCount ?? 0) === 0) {
|
|
return null;
|
|
}
|
|
|
|
return {
|
|
user: {
|
|
id: result.rows[0].user_id,
|
|
email: result.rows[0].email,
|
|
name: result.rows[0].name,
|
|
},
|
|
session: {
|
|
id: result.rows[0].id,
|
|
user_id: result.rows[0].user_id,
|
|
active_profile_id: result.rows[0].active_profile_id,
|
|
expires_at: result.rows[0].expires_at,
|
|
},
|
|
};
|
|
};
|
|
|
|
const getAuthProvider = async (providerKey: string) => {
|
|
const result = await pool.query<ProviderConfigRow>(
|
|
`SELECT provider_key, display_name, protocol, client_id, client_secret,
|
|
authorization_endpoint, token_endpoint, userinfo_endpoint, issuer, scopes, enabled
|
|
FROM auth_provider_configs
|
|
WHERE provider_key = $1`,
|
|
[providerKey],
|
|
);
|
|
|
|
return result.rows[0] ?? null;
|
|
};
|
|
|
|
const buildDashboard = async (profileId: string) => {
|
|
await ensureProfileDefaults(profileId);
|
|
|
|
const [summaryResult, firearmsResult, calibersResult, ammoResult] = await Promise.all([
|
|
pool.query<DashboardSummaryRow>(
|
|
`SELECT
|
|
(SELECT COUNT(*)::int FROM firearms WHERE profile_id = $1) AS "totalFirearms",
|
|
COALESCE((SELECT SUM(rounds_on_hand)::int FROM ammo_inventory WHERE profile_id = $1), 0) AS "totalAmmoRounds",
|
|
COALESCE((SELECT SUM(purchase_price) FROM firearms WHERE profile_id = $1), 0) AS "firearmsInvestment",
|
|
COALESCE((SELECT SUM(rounds_on_hand * cost_per_round) FROM ammo_inventory WHERE profile_id = $1), 0) AS "ammoInvestment",
|
|
(SELECT COUNT(*)::int FROM calibers WHERE profile_id = $1 AND is_active = TRUE) AS "configuredCalibers"`,
|
|
[profileId],
|
|
),
|
|
pool.query<FirearmRow>(
|
|
`SELECT id, manufacturer, model, category, caliber, serial_number, purchase_price, acquired_on, image_url, notes
|
|
FROM firearms
|
|
WHERE profile_id = $1
|
|
ORDER BY acquired_on DESC NULLS LAST, created_at DESC`,
|
|
[profileId],
|
|
),
|
|
pool.query<CaliberRow>(
|
|
`SELECT id, name, is_default, is_active
|
|
FROM calibers
|
|
WHERE profile_id = $1
|
|
ORDER BY is_active DESC, is_default DESC, name ASC`,
|
|
[profileId],
|
|
),
|
|
pool.query<AmmoInventoryRow>(
|
|
`SELECT ai.caliber_id, c.name AS caliber_name, ai.rounds_on_hand, ai.cost_per_round
|
|
FROM ammo_inventory ai
|
|
INNER JOIN calibers c ON c.id = ai.caliber_id
|
|
WHERE ai.profile_id = $1 AND c.profile_id = $1 AND c.is_active = TRUE
|
|
ORDER BY c.name ASC`,
|
|
[profileId],
|
|
),
|
|
]);
|
|
|
|
const summary = summaryResult.rows[0];
|
|
|
|
return {
|
|
summary: {
|
|
totalFirearms: Number(summary.totalFirearms || 0),
|
|
totalAmmoRounds: Number(summary.totalAmmoRounds || 0),
|
|
firearmsInvestment: formatCurrency(summary.firearmsInvestment),
|
|
ammoInvestment: formatCurrency(summary.ammoInvestment),
|
|
configuredCalibers: Number(summary.configuredCalibers || 0),
|
|
},
|
|
firearms: firearmsResult.rows.map(normalizeFirearm),
|
|
calibers: calibersResult.rows.map(normalizeCaliber),
|
|
ammoInventory: ammoResult.rows.map(normalizeAmmoInventory),
|
|
defaultCalibers,
|
|
};
|
|
};
|
|
|
|
const resolveProfileId = async (req: express.Request) => {
|
|
const requestedProfileId = String(req.header('x-profile-id') || '');
|
|
|
|
if (requestedProfileId && isUuid(requestedProfileId)) {
|
|
const result = await pool.query<ProfileRow>(
|
|
'SELECT id, name FROM profiles WHERE id = $1 AND user_id = $2',
|
|
[requestedProfileId, req.auth!.user.id],
|
|
);
|
|
|
|
if ((result.rowCount ?? 0) > 0) {
|
|
await ensureProfileDefaults(requestedProfileId);
|
|
await pool.query('UPDATE auth_sessions SET active_profile_id = $1 WHERE id = $2', [
|
|
requestedProfileId,
|
|
req.auth!.session.id,
|
|
]);
|
|
req.auth!.session.active_profile_id = requestedProfileId;
|
|
return requestedProfileId;
|
|
}
|
|
}
|
|
|
|
if (req.auth!.session.active_profile_id) {
|
|
await ensureProfileDefaults(req.auth!.session.active_profile_id);
|
|
return req.auth!.session.active_profile_id;
|
|
}
|
|
|
|
const fallbackProfile = await ensureDefaultProfile(req.auth!.user.id, req.auth!.user.name);
|
|
await pool.query('UPDATE auth_sessions SET active_profile_id = $1 WHERE id = $2', [
|
|
fallbackProfile.id,
|
|
req.auth!.session.id,
|
|
]);
|
|
req.auth!.session.active_profile_id = fallbackProfile.id;
|
|
return fallbackProfile.id;
|
|
};
|
|
|
|
const requireAuth = async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
|
try {
|
|
const header = req.header('authorization');
|
|
const token = header?.startsWith('Bearer ') ? header.slice(7) : '';
|
|
|
|
if (!token) {
|
|
res.status(401).json({ error: 'Authentication required' });
|
|
return;
|
|
}
|
|
|
|
const sessionData = await getSessionFromToken(token);
|
|
|
|
if (!sessionData) {
|
|
res.status(401).json({ error: 'Session expired or invalid' });
|
|
return;
|
|
}
|
|
|
|
req.auth = {
|
|
user: sessionData.user,
|
|
session: sessionData.session,
|
|
token,
|
|
};
|
|
|
|
next();
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
};
|
|
|
|
app.use(helmet());
|
|
app.use(
|
|
cors({
|
|
origin(origin, callback) {
|
|
if (!origin || allowedOrigins.includes(origin)) {
|
|
callback(null, true);
|
|
return;
|
|
}
|
|
|
|
callback(new Error('Origin not allowed by CORS'));
|
|
},
|
|
}),
|
|
);
|
|
app.use(
|
|
rateLimit({
|
|
windowMs: 15 * 60 * 1000,
|
|
max: 250,
|
|
standardHeaders: true,
|
|
legacyHeaders: false,
|
|
}),
|
|
);
|
|
app.use(morgan('combined'));
|
|
app.use(express.json());
|
|
|
|
app.get('/health', async (_req, res, next) => {
|
|
try {
|
|
const result = await pool.query('SELECT NOW() AS now');
|
|
res.json({ status: 'ok', database: 'connected', timestamp: result.rows[0].now });
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.get('/api', (_req, res) => {
|
|
res.json({
|
|
name: 'Arsenal IQ API',
|
|
version: '3.0.0',
|
|
allowRegistration,
|
|
resources: [
|
|
'/api/auth/login',
|
|
'/api/auth/register',
|
|
'/api/dashboard',
|
|
'/api/firearms',
|
|
'/api/calibers',
|
|
'/api/ammo',
|
|
],
|
|
});
|
|
});
|
|
|
|
app.get('/api/auth/providers', async (_req, res, next) => {
|
|
try {
|
|
const result = await pool.query<ProviderConfigRow>(
|
|
`SELECT provider_key, display_name, protocol, client_id, client_secret,
|
|
authorization_endpoint, token_endpoint, userinfo_endpoint, issuer, scopes, enabled
|
|
FROM auth_provider_configs
|
|
WHERE enabled = TRUE
|
|
ORDER BY display_name ASC`,
|
|
);
|
|
|
|
res.json(
|
|
result.rows.map((provider) => ({
|
|
providerKey: provider.provider_key,
|
|
displayName: provider.display_name,
|
|
})),
|
|
);
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.post('/api/auth/register', async (req, res, next) => {
|
|
try {
|
|
if (!allowRegistration) {
|
|
res.status(403).json({ error: 'Registration is disabled' });
|
|
return;
|
|
}
|
|
|
|
const email = normalizeEmail(getString(req.body?.email, 'email'));
|
|
const password = getString(req.body?.password, 'password');
|
|
const name = getString(req.body?.name, 'name');
|
|
|
|
const existing = await pool.query('SELECT id FROM users WHERE email = $1', [email]);
|
|
|
|
if ((existing.rowCount ?? 0) > 0) {
|
|
res.status(409).json({ error: 'An account with that email already exists' });
|
|
return;
|
|
}
|
|
|
|
const passwordHash = await bcrypt.hash(password, 10);
|
|
const userResult = await pool.query<UserRow>(
|
|
'INSERT INTO users (email, password_hash, name) VALUES ($1, $2, $3) RETURNING id, email, name',
|
|
[email, passwordHash, name],
|
|
);
|
|
|
|
const user = userResult.rows[0];
|
|
const profile = await ensureDefaultProfile(user.id, user.name);
|
|
const { token, session } = await createSession(user.id, profile.id);
|
|
|
|
res.status(201).json({
|
|
token,
|
|
user,
|
|
profiles: [profile],
|
|
activeProfileId: session.active_profile_id,
|
|
});
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.post('/api/auth/login', async (req, res, next) => {
|
|
try {
|
|
const email = normalizeEmail(getString(req.body?.email, 'email'));
|
|
const password = getString(req.body?.password, 'password');
|
|
const result = await pool.query<UserRow & { password_hash: string | null }>(
|
|
'SELECT id, email, name, password_hash FROM users WHERE email = $1',
|
|
[email],
|
|
);
|
|
|
|
if ((result.rowCount ?? 0) === 0) {
|
|
res.status(401).json({ error: 'Invalid credentials' });
|
|
return;
|
|
}
|
|
|
|
const user = result.rows[0];
|
|
|
|
if (!user.password_hash) {
|
|
res.status(401).json({ error: 'This account uses SSO. Use your identity provider to sign in.' });
|
|
return;
|
|
}
|
|
|
|
const valid = await bcrypt.compare(password, user.password_hash);
|
|
|
|
if (!valid) {
|
|
res.status(401).json({ error: 'Invalid credentials' });
|
|
return;
|
|
}
|
|
|
|
const profile = await ensureDefaultProfile(user.id, user.name);
|
|
const { token, session } = await createSession(user.id, profile.id);
|
|
const profiles = await getUserProfiles(user.id);
|
|
|
|
res.json({
|
|
token,
|
|
user: { id: user.id, email: user.email, name: user.name },
|
|
profiles,
|
|
activeProfileId: session.active_profile_id,
|
|
});
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.post('/api/auth/logout', requireAuth, async (req, res, next) => {
|
|
try {
|
|
await pool.query('DELETE FROM auth_sessions WHERE id = $1', [req.auth!.session.id]);
|
|
res.status(204).send();
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.get('/api/auth/me', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const activeProfileId = await resolveProfileId(req);
|
|
const profiles = await getUserProfiles(req.auth!.user.id);
|
|
|
|
res.json({
|
|
user: req.auth!.user,
|
|
profiles,
|
|
activeProfileId,
|
|
});
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.get('/api/auth/sso/:providerKey/start', async (req, res, next) => {
|
|
try {
|
|
const provider = await getAuthProvider(req.params.providerKey);
|
|
|
|
if (!provider?.enabled) {
|
|
res.status(404).json({ error: 'SSO provider is not enabled' });
|
|
return;
|
|
}
|
|
|
|
if (!provider.client_id || !provider.authorization_endpoint) {
|
|
res.status(400).json({ error: 'SSO provider is not fully configured' });
|
|
return;
|
|
}
|
|
|
|
const state = crypto.randomBytes(24).toString('hex');
|
|
const redirectUri = `${apiBaseUrl}/auth/sso/${provider.provider_key}/callback`;
|
|
await pool.query(
|
|
'INSERT INTO oauth_states (provider_key, state_code, redirect_uri) VALUES ($1, $2, $3)',
|
|
[provider.provider_key, state, redirectUri],
|
|
);
|
|
|
|
const url = new URL(provider.authorization_endpoint);
|
|
url.searchParams.set('client_id', provider.client_id);
|
|
url.searchParams.set('redirect_uri', redirectUri);
|
|
url.searchParams.set('response_type', 'code');
|
|
url.searchParams.set('scope', provider.scopes || 'openid profile email');
|
|
url.searchParams.set('state', state);
|
|
|
|
if (provider.provider_key === 'google') {
|
|
url.searchParams.set('access_type', 'offline');
|
|
url.searchParams.set('prompt', 'select_account');
|
|
}
|
|
|
|
res.json({ authorizationUrl: url.toString() });
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.get('/api/auth/sso/:providerKey/callback', async (req, res, next) => {
|
|
try {
|
|
const provider = await getAuthProvider(req.params.providerKey);
|
|
const code = String(req.query.code || '');
|
|
const state = String(req.query.state || '');
|
|
|
|
if (!provider?.enabled || !code || !state) {
|
|
res.status(400).send('Invalid SSO callback');
|
|
return;
|
|
}
|
|
|
|
const stateResult = await pool.query<{ redirect_uri: string }>(
|
|
'SELECT redirect_uri FROM oauth_states WHERE provider_key = $1 AND state_code = $2',
|
|
[provider.provider_key, state],
|
|
);
|
|
|
|
if ((stateResult.rowCount ?? 0) === 0) {
|
|
res.status(400).send('Invalid or expired SSO state');
|
|
return;
|
|
}
|
|
|
|
await pool.query('DELETE FROM oauth_states WHERE provider_key = $1 AND state_code = $2', [
|
|
provider.provider_key,
|
|
state,
|
|
]);
|
|
|
|
if (!provider.client_id || !provider.client_secret || !provider.token_endpoint) {
|
|
res.status(400).send('Provider is missing token configuration');
|
|
return;
|
|
}
|
|
|
|
const redirectUri = stateResult.rows[0].redirect_uri;
|
|
const tokenResponse = await axios.post(
|
|
provider.token_endpoint,
|
|
new URLSearchParams({
|
|
grant_type: 'authorization_code',
|
|
code,
|
|
redirect_uri: redirectUri,
|
|
client_id: provider.client_id,
|
|
client_secret: provider.client_secret,
|
|
}),
|
|
{ headers: { 'Content-Type': 'application/x-www-form-urlencoded' } },
|
|
);
|
|
|
|
const accessToken = String(tokenResponse.data.access_token || '');
|
|
const idToken = tokenResponse.data.id_token ? String(tokenResponse.data.id_token) : '';
|
|
let userinfo: Record<string, unknown> = {};
|
|
|
|
if (provider.userinfo_endpoint && accessToken) {
|
|
const userinfoResponse = await axios.get(provider.userinfo_endpoint, {
|
|
headers: { Authorization: `Bearer ${accessToken}` },
|
|
});
|
|
userinfo = userinfoResponse.data as Record<string, unknown>;
|
|
} else if (idToken) {
|
|
userinfo = decodeJwtPayload(idToken) ?? {};
|
|
}
|
|
|
|
const subject = String(userinfo.sub || '');
|
|
const email = normalizeEmail(String(userinfo.email || ''));
|
|
const name =
|
|
String(userinfo.name || '').trim() ||
|
|
`${String(userinfo.given_name || '').trim()} ${String(userinfo.family_name || '').trim()}`.trim() ||
|
|
email ||
|
|
`${provider.display_name} User`;
|
|
|
|
if (!subject || !email) {
|
|
res.status(400).send('Provider did not return a subject and email');
|
|
return;
|
|
}
|
|
|
|
const identityResult = await pool.query<{ user_id: string }>(
|
|
'SELECT user_id FROM auth_identities WHERE provider_key = $1 AND provider_subject = $2',
|
|
[provider.provider_key, subject],
|
|
);
|
|
|
|
let userId = identityResult.rows[0]?.user_id;
|
|
|
|
if (!userId) {
|
|
const existingUser = await pool.query<UserRow>('SELECT id, email, name FROM users WHERE email = $1', [email]);
|
|
|
|
if ((existingUser.rowCount ?? 0) > 0) {
|
|
userId = existingUser.rows[0].id;
|
|
} else {
|
|
const createdUser = await pool.query<UserRow>(
|
|
'INSERT INTO users (email, password_hash, name) VALUES ($1, NULL, $2) RETURNING id, email, name',
|
|
[email, name],
|
|
);
|
|
userId = createdUser.rows[0].id;
|
|
}
|
|
|
|
await pool.query(
|
|
`INSERT INTO auth_identities (user_id, provider_key, provider_subject, email)
|
|
VALUES ($1, $2, $3, $4)
|
|
ON CONFLICT (provider_key, provider_subject) DO NOTHING`,
|
|
[userId, provider.provider_key, subject, email],
|
|
);
|
|
}
|
|
|
|
const userResult = await pool.query<UserRow>('SELECT id, email, name FROM users WHERE id = $1', [userId]);
|
|
const user = userResult.rows[0];
|
|
const profile = await ensureDefaultProfile(user.id, user.name);
|
|
const { token } = await createSession(user.id, profile.id);
|
|
|
|
res.redirect(`${frontendUrl}/?token=${encodeURIComponent(token)}`);
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.get('/api/profiles', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const profiles = await getUserProfiles(req.auth!.user.id);
|
|
res.json({ profiles, activeProfileId: await resolveProfileId(req) });
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.post('/api/profiles', requireAuth, async (req, res, next) => {
|
|
try {
|
|
res.status(403).json({ error: 'Multiple profiles are disabled. Each user has a single arsenal.' });
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.post('/api/profiles/select', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const activeProfileId = await resolveProfileId(req);
|
|
res.json({ activeProfileId });
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.get('/api/settings/auth-providers', requireAuth, async (_req, res, next) => {
|
|
try {
|
|
const result = await pool.query<ProviderConfigRow>(
|
|
`SELECT provider_key, display_name, protocol, client_id, client_secret,
|
|
authorization_endpoint, token_endpoint, userinfo_endpoint, issuer, scopes, enabled
|
|
FROM auth_provider_configs
|
|
ORDER BY display_name ASC`,
|
|
);
|
|
|
|
res.json(result.rows.map(serializeProvider));
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.put('/api/settings/auth-providers/:providerKey', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const providerKey = getString(req.params.providerKey, 'providerKey');
|
|
const existing = await getAuthProvider(providerKey);
|
|
|
|
if (!existing) {
|
|
res.status(404).json({ error: 'Provider not found' });
|
|
return;
|
|
}
|
|
|
|
await pool.query(
|
|
`UPDATE auth_provider_configs
|
|
SET display_name = $2,
|
|
protocol = $3,
|
|
client_id = $4,
|
|
client_secret = $5,
|
|
authorization_endpoint = $6,
|
|
token_endpoint = $7,
|
|
userinfo_endpoint = $8,
|
|
issuer = $9,
|
|
scopes = $10,
|
|
enabled = $11,
|
|
updated_at = NOW()
|
|
WHERE provider_key = $1`,
|
|
[
|
|
providerKey,
|
|
String(req.body?.displayName || existing.display_name),
|
|
String(req.body?.protocol || existing.protocol),
|
|
String(req.body?.clientId ?? existing.client_id ?? ''),
|
|
typeof req.body?.clientSecret === 'string' ? req.body.clientSecret : (existing.client_secret ?? ''),
|
|
String(req.body?.authorizationEndpoint ?? existing.authorization_endpoint ?? ''),
|
|
String(req.body?.tokenEndpoint ?? existing.token_endpoint ?? ''),
|
|
String(req.body?.userinfoEndpoint ?? existing.userinfo_endpoint ?? ''),
|
|
String(req.body?.issuer ?? existing.issuer ?? ''),
|
|
String(req.body?.scopes ?? existing.scopes ?? 'openid profile email'),
|
|
Boolean(req.body?.enabled),
|
|
],
|
|
);
|
|
|
|
const updated = await getAuthProvider(providerKey);
|
|
res.json(serializeProvider(updated!));
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.get('/api/dashboard', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const activeProfileId = await resolveProfileId(req);
|
|
const profiles = await getUserProfiles(req.auth!.user.id);
|
|
const dashboard = await buildDashboard(activeProfileId);
|
|
|
|
res.json({
|
|
user: req.auth!.user,
|
|
profiles,
|
|
activeProfileId,
|
|
...dashboard,
|
|
});
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.get('/api/firearms', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const profileId = await resolveProfileId(req);
|
|
const result = await pool.query<FirearmRow>(
|
|
`SELECT id, manufacturer, model, category, caliber, serial_number, purchase_price, acquired_on, image_url, notes
|
|
FROM firearms
|
|
WHERE profile_id = $1
|
|
ORDER BY acquired_on DESC NULLS LAST, created_at DESC`,
|
|
[profileId],
|
|
);
|
|
|
|
res.json(result.rows.map(normalizeFirearm));
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.post('/api/firearms', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const profileId = await resolveProfileId(req);
|
|
const manufacturer = getString(req.body?.manufacturer, 'manufacturer');
|
|
const model = getString(req.body?.model, 'model');
|
|
const category = getString(req.body?.category, 'category');
|
|
const caliber = getString(req.body?.caliber, 'caliber');
|
|
const serialNumber = getString(req.body?.serialNumber, 'serialNumber');
|
|
const purchasePrice = getNumber(req.body?.purchasePrice, 'purchasePrice');
|
|
const acquiredOn = getOptionalString(req.body?.acquiredOn);
|
|
const imageUrl = getOptionalString(req.body?.imageUrl);
|
|
const notes = getOptionalString(req.body?.notes);
|
|
|
|
if (!firearmCategories.includes(category)) {
|
|
res.status(400).json({ error: 'Unsupported firearm category' });
|
|
return;
|
|
}
|
|
|
|
const result = await pool.query<FirearmRow>(
|
|
`INSERT INTO firearms (profile_id, manufacturer, model, category, caliber, serial_number, purchase_price, acquired_on, image_url, notes)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
|
|
RETURNING id, manufacturer, model, category, caliber, serial_number, purchase_price, acquired_on, image_url, notes`,
|
|
[profileId, manufacturer, model, category, caliber, serialNumber, purchasePrice, acquiredOn, imageUrl, notes],
|
|
);
|
|
|
|
res.status(201).json(normalizeFirearm(result.rows[0]));
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.put('/api/firearms/:id', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const profileId = await resolveProfileId(req);
|
|
const manufacturer = getString(req.body?.manufacturer, 'manufacturer');
|
|
const model = getString(req.body?.model, 'model');
|
|
const category = getString(req.body?.category, 'category');
|
|
const caliber = getString(req.body?.caliber, 'caliber');
|
|
const serialNumber = getString(req.body?.serialNumber, 'serialNumber');
|
|
const purchasePrice = getNumber(req.body?.purchasePrice, 'purchasePrice');
|
|
const acquiredOn = getOptionalString(req.body?.acquiredOn);
|
|
const imageUrl = getOptionalString(req.body?.imageUrl);
|
|
const notes = getOptionalString(req.body?.notes);
|
|
|
|
const result = await pool.query<FirearmRow>(
|
|
`UPDATE firearms
|
|
SET manufacturer = $3,
|
|
model = $4,
|
|
category = $5,
|
|
caliber = $6,
|
|
serial_number = $7,
|
|
purchase_price = $8,
|
|
acquired_on = $9,
|
|
image_url = $10,
|
|
notes = $11,
|
|
updated_at = CURRENT_TIMESTAMP
|
|
WHERE id = $1 AND profile_id = $2
|
|
RETURNING id, manufacturer, model, category, caliber, serial_number, purchase_price, acquired_on, image_url, notes`,
|
|
[req.params.id, profileId, manufacturer, model, category, caliber, serialNumber, purchasePrice, acquiredOn, imageUrl, notes],
|
|
);
|
|
|
|
if ((result.rowCount ?? 0) === 0) {
|
|
res.status(404).json({ error: 'Firearm not found' });
|
|
return;
|
|
}
|
|
|
|
res.json(normalizeFirearm(result.rows[0]));
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.delete('/api/firearms/:id', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const profileId = await resolveProfileId(req);
|
|
const result = await pool.query('DELETE FROM firearms WHERE id = $1 AND profile_id = $2', [
|
|
req.params.id,
|
|
profileId,
|
|
]);
|
|
|
|
if ((result.rowCount ?? 0) === 0) {
|
|
res.status(404).json({ error: 'Firearm not found' });
|
|
return;
|
|
}
|
|
|
|
res.status(204).send();
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.get('/api/calibers', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const profileId = await resolveProfileId(req);
|
|
const result = await pool.query<CaliberRow>(
|
|
`SELECT id, name, is_default, is_active
|
|
FROM calibers
|
|
WHERE profile_id = $1
|
|
ORDER BY is_active DESC, is_default DESC, name ASC`,
|
|
[profileId],
|
|
);
|
|
|
|
res.json({
|
|
configured: result.rows.filter((row) => row.is_active).map(normalizeCaliber),
|
|
availableDefaults: defaultCalibers.filter(
|
|
(name) => !result.rows.some((row) => row.name === name && row.is_active),
|
|
),
|
|
});
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.post('/api/calibers', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const profileId = await resolveProfileId(req);
|
|
const name = getString(req.body?.name, 'name');
|
|
|
|
const result = await pool.query<CaliberRow>(
|
|
`INSERT INTO calibers (profile_id, name, is_default, is_active)
|
|
VALUES ($1, $2, $3, TRUE)
|
|
ON CONFLICT (profile_id, name) DO UPDATE
|
|
SET is_active = TRUE
|
|
RETURNING id, name, is_default, is_active`,
|
|
[profileId, name, defaultCalibers.includes(name)],
|
|
);
|
|
|
|
await pool.query(
|
|
`INSERT INTO ammo_inventory (profile_id, caliber_id, rounds_on_hand, cost_per_round)
|
|
VALUES ($1, $2, 0, 0)
|
|
ON CONFLICT (profile_id, caliber_id) DO NOTHING`,
|
|
[profileId, result.rows[0].id],
|
|
);
|
|
|
|
res.status(201).json(normalizeCaliber(result.rows[0]));
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.patch('/api/calibers/:id', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const profileId = await resolveProfileId(req);
|
|
const isActive = Boolean(req.body?.isActive);
|
|
const result = await pool.query<CaliberRow>(
|
|
`UPDATE calibers
|
|
SET is_active = $3
|
|
WHERE id = $1 AND profile_id = $2
|
|
RETURNING id, name, is_default, is_active`,
|
|
[req.params.id, profileId, isActive],
|
|
);
|
|
|
|
if ((result.rowCount ?? 0) === 0) {
|
|
res.status(404).json({ error: 'Caliber not found' });
|
|
return;
|
|
}
|
|
|
|
if (isActive) {
|
|
await pool.query(
|
|
`INSERT INTO ammo_inventory (profile_id, caliber_id, rounds_on_hand, cost_per_round)
|
|
VALUES ($1, $2, 0, 0)
|
|
ON CONFLICT (profile_id, caliber_id) DO NOTHING`,
|
|
[profileId, req.params.id],
|
|
);
|
|
}
|
|
|
|
res.json(normalizeCaliber(result.rows[0]));
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.get('/api/ammo', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const profileId = await resolveProfileId(req);
|
|
const result = await pool.query<AmmoInventoryRow>(
|
|
`SELECT ai.caliber_id, c.name AS caliber_name, ai.rounds_on_hand, ai.cost_per_round
|
|
FROM ammo_inventory ai
|
|
INNER JOIN calibers c ON c.id = ai.caliber_id
|
|
WHERE ai.profile_id = $1 AND c.profile_id = $1 AND c.is_active = TRUE
|
|
ORDER BY c.name ASC`,
|
|
[profileId],
|
|
);
|
|
|
|
res.json(result.rows.map(normalizeAmmoInventory));
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.patch('/api/ammo/:caliberId', requireAuth, async (req, res, next) => {
|
|
try {
|
|
const profileId = await resolveProfileId(req);
|
|
const rounds = getNumber(req.body?.rounds, 'rounds');
|
|
const costPerRound = req.body?.costPerRound == null ? null : getNumber(req.body?.costPerRound, 'costPerRound');
|
|
|
|
const result = await pool.query<AmmoInventoryRow>(
|
|
`UPDATE ammo_inventory ai
|
|
SET rounds_on_hand = GREATEST(0, ai.rounds_on_hand + $3),
|
|
cost_per_round = CASE WHEN $4::numeric IS NULL THEN ai.cost_per_round ELSE $4 END,
|
|
updated_at = CURRENT_TIMESTAMP
|
|
FROM calibers c
|
|
WHERE ai.caliber_id = $2
|
|
AND ai.profile_id = $1
|
|
AND c.id = ai.caliber_id
|
|
AND c.profile_id = $1
|
|
RETURNING ai.caliber_id, c.name AS caliber_name, ai.rounds_on_hand, ai.cost_per_round`,
|
|
[profileId, req.params.caliberId, rounds, costPerRound],
|
|
);
|
|
|
|
if ((result.rowCount ?? 0) === 0) {
|
|
res.status(404).json({ error: 'Ammo inventory not found' });
|
|
return;
|
|
}
|
|
|
|
res.json(normalizeAmmoInventory(result.rows[0]));
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.use((_req, res) => {
|
|
res.status(404).json({ error: 'Route not found' });
|
|
});
|
|
|
|
app.use((error: Error, _req: express.Request, res: express.Response, _next: express.NextFunction) => {
|
|
console.error(error);
|
|
res.status(500).json({
|
|
error: process.env.NODE_ENV === 'production' ? 'Internal server error' : error.message,
|
|
});
|
|
});
|
|
|
|
void ensureSchema()
|
|
.then(() => {
|
|
app.listen(port, () => {
|
|
console.log(`Arsenal IQ API listening on http://localhost:${port}`);
|
|
});
|
|
})
|
|
.catch((error) => {
|
|
console.error('Failed to initialize schema', error);
|
|
process.exit(1);
|
|
});
|