feat(backend): multi-tenant refactor + Geraete + Kundenbilder
Middleware:
- requireTenant prueft tenant_id, Status und Demo-Ablauf (autom. Status-Update)
- requireSuperAdmin fuer cross-tenant Endpoints
- JWT enthaelt jetzt tenant_id
Auth:
- Login: SuperAdmin (tenant_id=NULL) ODER tenant-scoped User
- Demo-Ablaufs-Check beim Login
Neue Routes:
- /api/tenants (SuperAdmin: Demo-Accounts anlegen mit 30-Tage-Default,
Mail-Invite via Resend, Sample-Daten-Seed automatisch,
verlaengern, deaktivieren)
- /api/geraete (Seriennummern-Verwaltung mit Kunde-Zuordnung)
- /api/kunden-bilder/:kunde_id (Foto-Upload, max 5/Kunde)
Bestehende Routes:
- alle tenant_id-scoped (SELECT/UPDATE/DELETE)
- kunden: anlieferungshinweis + lieferzeit_bis Felder
- Cross-tenant-Refs (kunde_id/artikel_id) werden gegen Tenant validiert
Lib:
- lib/mail.js (Resend, mit Dev-Fallback)
- lib/seed.js (5 Kunden, 3 Artikel, 6 Lieferungen, 2 Geraete)
- scripts/bootstrap.js (legt SuperAdmin aus env-Vars beim Start an)
server.js: neue Routes + bootstrap-Call
This commit is contained in:
christian
@@ -1,126 +1,100 @@
|
||||
import express from 'express';
|
||||
import { body, validationResult } from 'express-validator';
|
||||
import pool from '../config/database.js';
|
||||
import { authenticateToken } from '../middleware/auth.js';
|
||||
import { authenticateToken, requireTenant } from '../middleware/auth.js';
|
||||
|
||||
const router = express.Router();
|
||||
router.use(authenticateToken, requireTenant);
|
||||
|
||||
// Alle Routen erfordern Authentifizierung
|
||||
router.use(authenticateToken);
|
||||
|
||||
// GET alle Kunden
|
||||
router.get('/', async (req, res) => {
|
||||
try {
|
||||
const [rows] = await pool.query(
|
||||
'SELECT * FROM kunden ORDER BY name ASC'
|
||||
'SELECT * FROM kunden WHERE tenant_id = ? ORDER BY name ASC',
|
||||
[req.user.tenant_id]
|
||||
);
|
||||
res.json(rows);
|
||||
} catch (error) {
|
||||
console.error('Fehler beim Abrufen der Kunden:', error);
|
||||
res.status(500).json({ error: 'Serverfehler' });
|
||||
}
|
||||
} catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
|
||||
});
|
||||
|
||||
// GET einzelner Kunde
|
||||
router.get('/:id', async (req, res) => {
|
||||
try {
|
||||
const [rows] = await pool.query(
|
||||
'SELECT * FROM kunden WHERE id = ?',
|
||||
[req.params.id]
|
||||
'SELECT * FROM kunden WHERE id = ? AND tenant_id = ?',
|
||||
[req.params.id, req.user.tenant_id]
|
||||
);
|
||||
|
||||
if (rows.length === 0) {
|
||||
return res.status(404).json({ error: 'Kunde nicht gefunden' });
|
||||
}
|
||||
|
||||
res.json(rows[0]);
|
||||
} catch (error) {
|
||||
console.error('Fehler beim Abrufen des Kunden:', error);
|
||||
res.status(500).json({ error: 'Serverfehler' });
|
||||
}
|
||||
if (rows.length === 0) return res.status(404).json({ error: 'Kunde nicht gefunden' });
|
||||
const [bilder] = await pool.query(
|
||||
'SELECT id, dateiname, beschreibung, sortierung FROM kunden_bilder WHERE kunde_id = ? AND tenant_id = ? ORDER BY sortierung, erstellt_am',
|
||||
[req.params.id, req.user.tenant_id]
|
||||
);
|
||||
res.json({ ...rows[0], bilder });
|
||||
} catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
|
||||
});
|
||||
|
||||
// POST neuer Kunde
|
||||
router.post('/', [
|
||||
body('name').notEmpty().trim(),
|
||||
body('email').optional().isEmail().normalizeEmail(),
|
||||
body('telefon').optional().trim(),
|
||||
body('adresse').optional().trim(),
|
||||
body('ansprechpartner').optional().trim(),
|
||||
body('notiz').optional().trim(),
|
||||
body('anrede').optional().isIn(['Herr', 'Frau', 'Firma', ''])
|
||||
body('email').optional({ checkFalsy: true }).isEmail().normalizeEmail(),
|
||||
body('lieferzeit_bis').optional({ checkFalsy: true }).matches(/^\d{1,2}:\d{2}$/),
|
||||
body('anrede').optional({ checkFalsy: true }).isIn(['Herr', 'Frau', 'Firma'])
|
||||
], async (req, res) => {
|
||||
const errors = validationResult(req);
|
||||
if (!errors.isEmpty()) {
|
||||
return res.status(400).json({ errors: errors.array() });
|
||||
}
|
||||
|
||||
const { name, email, telefon, adresse, ansprechpartner, notiz, anrede } = req.body;
|
||||
|
||||
if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
|
||||
const { name, email, telefon, adresse, ansprechpartner, notiz, anrede,
|
||||
anlieferungshinweis, lieferzeit_bis } = req.body;
|
||||
try {
|
||||
const [result] = await pool.query(
|
||||
'INSERT INTO kunden (name, email, telefon, adresse, ansprechpartner, notiz, anrede) VALUES (?, ?, ?, ?, ?, ?, ?)',
|
||||
[name, email || null, telefon || null, adresse || null, ansprechpartner || null, notiz || null, anrede || null]
|
||||
`INSERT INTO kunden (id, tenant_id, name, email, telefon, adresse, ansprechpartner, notiz, anrede,
|
||||
anlieferungshinweis, lieferzeit_bis)
|
||||
VALUES (UUID(), ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
|
||||
[req.user.tenant_id, name, email || null, telefon || null, adresse || null,
|
||||
ansprechpartner || null, notiz || null, anrede || null,
|
||||
anlieferungshinweis || null, lieferzeit_bis || null]
|
||||
);
|
||||
|
||||
const [newKunde] = await pool.query('SELECT * FROM kunden WHERE id = ?', [result.insertId]);
|
||||
res.status(201).json(newKunde[0]);
|
||||
} catch (error) {
|
||||
console.error('Fehler beim Anlegen des Kunden:', error);
|
||||
// Re-fetch via tenant + name (id ist UUID, neuer Wert kennen wir nicht direkt)
|
||||
const [rows] = await pool.query(
|
||||
'SELECT * FROM kunden WHERE tenant_id = ? ORDER BY erstellt_am DESC LIMIT 1',
|
||||
[req.user.tenant_id]
|
||||
);
|
||||
res.status(201).json(rows[0]);
|
||||
} catch (e) {
|
||||
console.error('POST kunden:', e);
|
||||
res.status(500).json({ error: 'Serverfehler' });
|
||||
}
|
||||
});
|
||||
|
||||
// PUT Kunde aktualisieren
|
||||
router.put('/:id', [
|
||||
body('name').notEmpty().trim(),
|
||||
body('email').optional().isEmail().normalizeEmail(),
|
||||
body('telefon').optional().trim(),
|
||||
body('adresse').optional().trim(),
|
||||
body('ansprechpartner').optional().trim(),
|
||||
body('notiz').optional().trim(),
|
||||
body('anrede').optional().isIn(['Herr', 'Frau', 'Firma', ''])
|
||||
body('email').optional({ checkFalsy: true }).isEmail().normalizeEmail(),
|
||||
body('lieferzeit_bis').optional({ checkFalsy: true }).matches(/^\d{1,2}:\d{2}$/),
|
||||
body('anrede').optional({ checkFalsy: true }).isIn(['Herr', 'Frau', 'Firma'])
|
||||
], async (req, res) => {
|
||||
const errors = validationResult(req);
|
||||
if (!errors.isEmpty()) {
|
||||
return res.status(400).json({ errors: errors.array() });
|
||||
}
|
||||
|
||||
const { name, email, telefon, adresse, ansprechpartner, notiz, anrede } = req.body;
|
||||
|
||||
if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
|
||||
const { name, email, telefon, adresse, ansprechpartner, notiz, anrede,
|
||||
anlieferungshinweis, lieferzeit_bis } = req.body;
|
||||
try {
|
||||
await pool.query(
|
||||
'UPDATE kunden SET name = ?, email = ?, telefon = ?, adresse = ?, ansprechpartner = ?, notiz = ?, anrede = ? WHERE id = ?',
|
||||
[name, email || null, telefon || null, adresse || null, ansprechpartner || null, notiz || null, anrede || null, req.params.id]
|
||||
const [r] = await pool.query(
|
||||
`UPDATE kunden SET name=?, email=?, telefon=?, adresse=?, ansprechpartner=?, notiz=?, anrede=?,
|
||||
anlieferungshinweis=?, lieferzeit_bis=?
|
||||
WHERE id=? AND tenant_id=?`,
|
||||
[name, email || null, telefon || null, adresse || null, ansprechpartner || null,
|
||||
notiz || null, anrede || null, anlieferungshinweis || null, lieferzeit_bis || null,
|
||||
req.params.id, req.user.tenant_id]
|
||||
);
|
||||
|
||||
const [updated] = await pool.query('SELECT * FROM kunden WHERE id = ?', [req.params.id]);
|
||||
|
||||
if (updated.length === 0) {
|
||||
return res.status(404).json({ error: 'Kunde nicht gefunden' });
|
||||
}
|
||||
|
||||
res.json(updated[0]);
|
||||
} catch (error) {
|
||||
console.error('Fehler beim Aktualisieren des Kunden:', error);
|
||||
res.status(500).json({ error: 'Serverfehler' });
|
||||
}
|
||||
if (r.affectedRows === 0) return res.status(404).json({ error: 'Kunde nicht gefunden' });
|
||||
const [rows] = await pool.query('SELECT * FROM kunden WHERE id = ? AND tenant_id = ?',
|
||||
[req.params.id, req.user.tenant_id]);
|
||||
res.json(rows[0]);
|
||||
} catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
|
||||
});
|
||||
|
||||
// DELETE Kunde
|
||||
router.delete('/:id', async (req, res) => {
|
||||
try {
|
||||
const [result] = await pool.query('DELETE FROM kunden WHERE id = ?', [req.params.id]);
|
||||
|
||||
if (result.affectedRows === 0) {
|
||||
return res.status(404).json({ error: 'Kunde nicht gefunden' });
|
||||
}
|
||||
|
||||
res.json({ message: 'Kunde erfolgreich gelöscht' });
|
||||
} catch (error) {
|
||||
console.error('Fehler beim Löschen des Kunden:', error);
|
||||
res.status(500).json({ error: 'Serverfehler' });
|
||||
}
|
||||
const [r] = await pool.query('DELETE FROM kunden WHERE id=? AND tenant_id=?',
|
||||
[req.params.id, req.user.tenant_id]);
|
||||
if (r.affectedRows === 0) return res.status(404).json({ error: 'Kunde nicht gefunden' });
|
||||
res.json({ message: 'Kunde geloescht' });
|
||||
} catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
|
||||
});
|
||||
|
||||
export default router;
|
||||
|
||||
Reference in New Issue
Block a user