77 lines
2.9 KiB
JavaScript
77 lines
2.9 KiB
JavaScript
// Read-only user preview controls.
|
|
|
|
const { hasPermission } = require('#src/rbac');
|
|
|
|
module.exports = function registerViewAsRoutes(app, deps) {
|
|
const pool = deps.pool;
|
|
const requirePermission = deps.requirePermission;
|
|
const startViewAsUser = deps.startViewAsUser;
|
|
const stopViewAsUser = deps.stopViewAsUser;
|
|
const recordRequestAuditEvent = deps.recordRequestAuditEvent;
|
|
|
|
app.post('/settings/users/:id/view-as', requirePermission('users.read'), requirePermission('impersonate.allow'), async function (req, res, next) {
|
|
try {
|
|
const actor = req.authenticatedUser || req.currentUser && req.currentUser.authenticatedUser || req.currentUser;
|
|
const targetUserId = Number(req.params.id);
|
|
if (!actor || !hasPermission(actor, 'impersonate.allow') || req.currentUser && req.currentUser.isViewingAs) {
|
|
return res.sendStatus(403);
|
|
}
|
|
if (!Number.isInteger(targetUserId) || targetUserId <= 0 || targetUserId === Number(actor.id)) {
|
|
return res.status(400).send('Choose another user to preview.');
|
|
}
|
|
|
|
const [rows] = await pool.query('SELECT id, name, username FROM a_users WHERE id = ? LIMIT 1', [targetUserId]);
|
|
if (!rows.length) {
|
|
return res.sendStatus(404);
|
|
}
|
|
|
|
const target = rows[0];
|
|
const started = await startViewAsUser(pool, req, actor.id, targetUserId);
|
|
if (!started) {
|
|
return res.status(409).send('The preview could not be started. Sign in again and retry.');
|
|
}
|
|
if (typeof recordRequestAuditEvent === 'function') {
|
|
await recordRequestAuditEvent(pool, req, {
|
|
category: 'users',
|
|
eventType: 'user.view_as_started',
|
|
actorUserId: actor.id,
|
|
targetType: 'user',
|
|
targetId: targetUserId,
|
|
targetLabel: target.username,
|
|
details: { expiresInMinutes: 15 }
|
|
});
|
|
}
|
|
res.redirect('/dashboard');
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
app.post('/settings/view-as/stop', async function (req, res, next) {
|
|
try {
|
|
const actor = req.authenticatedUser || req.currentUser && req.currentUser.authenticatedUser;
|
|
if (!actor || !req.currentUser || !req.currentUser.isViewingAs) {
|
|
return res.redirect('/dashboard');
|
|
}
|
|
|
|
const target = req.currentUser;
|
|
const stopped = await stopViewAsUser(pool, req, actor.id);
|
|
if (!stopped) {
|
|
return res.status(409).send('The preview has already ended. Refresh the page to continue.');
|
|
}
|
|
if (typeof recordRequestAuditEvent === 'function') {
|
|
await recordRequestAuditEvent(pool, req, {
|
|
category: 'users',
|
|
eventType: 'user.view_as_stopped',
|
|
actorUserId: actor.id,
|
|
targetType: 'user',
|
|
targetId: target.id,
|
|
targetLabel: target.username
|
|
});
|
|
}
|
|
res.redirect('/settings/users');
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
});
|
|
}; |