lzstealth/pulse-signage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Activity

Release v2.5.6

Browse Source
This commit is contained in:
lzstealth
2026-08-05 19:38:16 +01:00
parent a8ef35b287
commit 9f831f04bc
161 changed files with 8487 additions and 1295 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/web/routes/admin/users.js
+63 -16
View File
@@ -7,10 +7,15 @@
const formatDashboardDate = deps.formatDashboardDate;
const getAuditUserId = deps.getAuditUserId;
const hashPassword = deps.hashPassword;
const validatePasswordStrength = deps.validatePasswordStrength;
const readArrayField = deps.readArrayField;
const rbacData = deps.rbacData;
const { buildPagination } = require('../../lib/pagination');
const requirePermission = deps.requirePermission;
const { buildDuplicateUserName, buildDuplicateUser } = require('../settings/users/duplicate');
const USER_NAME_MAX_LENGTH = 255;
const USER_USERNAME_MAX_LENGTH = 255;
const LIST_PAGE_SIZE = 25;
@@ -43,10 +48,6 @@
return Number.isInteger(roleId) && roleId > 0;
})));
if (!normalizedRoleIds.length) {
return { ok: false, message: 'Select at least one role.' };
}
if (normalizedRoleIds.some(function (roleId) {
return !validRoleIds.has(roleId);
})) {
@@ -88,6 +89,38 @@
});
});
app.get('/users/:id/duplicate', requirePermission('users.read'), requirePermission('users.create'), async function (req, res, next) {
try {
const userId = Number(req.params.id);
if (!Number.isInteger(userId) || userId <= 0) {
return res.status(400).send('Invalid user.');
}
const user = await rbacData.fetchUserWithRoles(pool, userId);
if (!user) {
return res.status(404).send('User not found.');
}
if (Number(req.currentUser.id) === userId) {
return res.redirect('/users?message=' + encodeURIComponent('Use Add user to create another login for yourself.'));
}
const roles = await fetchRoleOptions();
const duplicateUser = buildDuplicateUser(user, buildDuplicateUserName(user.name));
res.send(pages.renderUsersAddPage(
'Review the copied values and save when ready.',
req.currentUser,
mapRolesForForm(roles, user.roleIds),
{
name: duplicateUser.name
},
'primary'
));
} catch (error) {
next(error);
}
});
app.get('/users/:id/edit', requirePermission('users.update'), async function (req, res, next) {
try {
const userId = Number(req.params.id);
@@ -122,10 +155,11 @@
app.post('/users', requirePermission('users.create'), async function (req, res, next) {
const connection = await pool.getConnection();
try {
const name = String(req.body.name || '').trim();
const username = String(req.body.username || user.username || '').trim();
const name = common.validateMaxLength(req.body.name || '', USER_NAME_MAX_LENGTH, 'Name');
const username = common.validateMaxLength(req.body.username || '', USER_USERNAME_MAX_LENGTH, 'Username');
const password = String(req.body.password || '');
const confirmPassword = String(req.body.confirm_password || '');
const saveAction = String(req.body.save_action || req.body.action || '').trim().toLowerCase();
const selectedRoleIds = readArrayField(req.body, ['role_ids[]', 'role_ids']);
const roleCheck = await validateRoleIds(selectedRoleIds);
const formValues = {
@@ -144,8 +178,9 @@
if (!username) {
return renderValidationError('Username is required.');
}
if (!password || password.length < 8) {
return renderValidationError('Password must be at least 8 characters.');
const passwordStrengthMessage = validatePasswordStrength(password);
if (passwordStrengthMessage) {
return renderValidationError(passwordStrengthMessage);
}
if (password !== confirmPassword) {
return renderValidationError('Passwords do not match.');
@@ -171,6 +206,9 @@
);
await rbacData.syncUserRoles(connection, result.insertId, roleCheck.roleIds);
await connection.commit();
if (saveAction === 'new') {
return res.redirect('/users/new?message=' + encodeURIComponent('User created.'));
}
res.redirect('/users/' + result.insertId + '/edit?message=' + encodeURIComponent('User created.'));
} catch (error) {
try {
@@ -216,11 +254,12 @@
const connection = await pool.getConnection();
try {
const userId = Number(req.params.id);
const name = String(req.body.name || '').trim();
const name = common.validateMaxLength(req.body.name || '', USER_NAME_MAX_LENGTH, 'Name');
const selectedRoleIds = readArrayField(req.body, ['role_ids[]', 'role_ids']);
const password = String(req.body.password || '');
const confirmPassword = String(req.body.confirm_password || '');
const shouldUpdatePassword = Boolean(password || confirmPassword);
const saveAction = String(req.body.save_action || req.body.action || '').trim().toLowerCase();
if (!Number.isInteger(userId) || userId <= 0) {
return res.status(400).send('Invalid user.');
@@ -234,7 +273,7 @@
return res.status(404).send('User not found.');
}
const username = String(req.body.username || user.username || '').trim();
const username = common.validateMaxLength(req.body.username || user.username || '', USER_USERNAME_MAX_LENGTH, 'Username');
const [countRows] = await pool.query('SELECT COUNT(*) AS user_count FROM a_users');
const canDelete = !countRows.length || Number(countRows[0].user_count) > 1;
@@ -256,8 +295,11 @@
if (!username) {
return renderValidationError('Username is required.');
}
if (shouldUpdatePassword && (!password || password.length < 8)) {
return renderValidationError('Password must be at least 8 characters.');
if (shouldUpdatePassword) {
const passwordStrengthMessage = validatePasswordStrength(password);
if (passwordStrengthMessage) {
return renderValidationError(passwordStrengthMessage);
}
}
if (shouldUpdatePassword && password !== confirmPassword) {
return renderValidationError('Passwords do not match.');
@@ -290,6 +332,9 @@
await connection.query('DELETE FROM a_sessions WHERE user_id = ?', [userId]);
}
await connection.commit();
if (saveAction === 'new') {
return res.redirect('/users/new?message=' + encodeURIComponent('User updated.'));
}
res.redirect('/users?message=' + encodeURIComponent('User updated.'));
} catch (error) {
try {
@@ -308,6 +353,7 @@
const userId = Number(req.params.id);
const password = String(req.body.password || '');
const confirmPassword = String(req.body.confirm_password || '');
const editUrl = '/users/' + userId + '/edit';
if (!Number.isInteger(userId) || userId <= 0) {
return res.status(400).send('Invalid user.');
@@ -315,11 +361,12 @@
if (Number(req.currentUser.id) === userId) {
return res.redirect('/account?message=' + encodeURIComponent('Use My Account to change your own password.'));
}
if (!password || password.length < 8) {
return res.redirect('/users?message=' + encodeURIComponent('Password must be at least 8 characters.'));
const passwordStrengthMessage = validatePasswordStrength(password);
if (passwordStrengthMessage) {
return res.redirect(editUrl + '?message=' + encodeURIComponent(passwordStrengthMessage));
}
if (password !== confirmPassword) {
return res.redirect('/users?message=' + encodeURIComponent('Passwords do not match.'));
return res.redirect(editUrl + '?message=' + encodeURIComponent('Passwords do not match.'));
}
const [rows] = await pool.query('SELECT id FROM a_users WHERE id = ? LIMIT 1', [userId]);
@@ -333,7 +380,7 @@
[passwordRecord.hash, passwordRecord.salt, passwordRecord.iterations, getAuditUserId(req), userId]
);
await pool.query('DELETE FROM a_sessions WHERE user_id = ?', [userId]);
res.redirect('/users?message=' + encodeURIComponent('Password updated.'));
res.redirect(editUrl + '?message=' + encodeURIComponent('Password updated.'));
} catch (error) {
next(error);
}