initial commit

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/routes/admin/roles.ts

@@ -0,0 +1,130 @@
+import { FastifyInstance } from 'fastify';
+import prisma from '../../config/database';
+import { requirePermission } from '../../middleware/auth';
+import { logAudit } from '../../services/audit';
+import { success, error, parseId } from '../../utils/response';
+
+export default async function rolesRoutes(fastify: FastifyInstance): Promise<void> {
+  // GET /api/admin/roles
+  fastify.get('/', { preHandler: requirePermission('settings.roles') }, async (request, reply) => {
+    const roles = await prisma.roles.findMany({
+      include: {
+        role_permissions: {
+          include: { permissions: true },
+        },
+      },
+      orderBy: { id: 'asc' },
+    });
+
+    const data = roles.map(r => ({
+      ...r,
+      permissions: r.role_permissions.map(rp => rp.permissions),
+    }));
+
+    return success(reply, data);
+  });
+
+  // GET /api/admin/roles/permissions
+  fastify.get('/permissions', { preHandler: requirePermission('settings.roles') }, async (_request, reply) => {
+    const permissions = await prisma.permissions.findMany({ orderBy: { module: 'asc' } });
+    return success(reply, permissions);
+  });
+
+  // POST /api/admin/roles
+  fastify.post('/', { preHandler: requirePermission('settings.roles') }, async (request, reply) => {
+    const body = request.body as Record<string, unknown>;
+
+    const role = await prisma.roles.create({
+      data: {
+        name: String(body.name),
+        display_name: String(body.display_name),
+        description: body.description ? String(body.description) : null,
+      },
+    });
+
+    if (Array.isArray(body.permission_ids)) {
+      await prisma.role_permissions.createMany({
+        data: (body.permission_ids as number[]).map((pid) => ({
+          role_id: role.id,
+          permission_id: pid,
+        })),
+      });
+    }
+
+    await logAudit({
+      request,
+      authData: request.authData,
+      action: 'create',
+      entityType: 'role',
+      entityId: role.id,
+      description: `Vytvořena role ${role.name}`,
+    });
+
+    return success(reply, { id: role.id }, 201, 'Role byla vytvořena');
+  });
+
+  // PUT /api/admin/roles/:id
+  fastify.put<{ Params: { id: string } }>('/:id', { preHandler: requirePermission('settings.roles') }, async (request, reply) => {
+    const id = parseId(request.params.id, reply);
+    if (id === null) return;
+    const body = request.body as Record<string, unknown>;
+
+    const existing = await prisma.roles.findUnique({ where: { id } });
+    if (!existing) return error(reply, 'Role nenalezena', 404);
+
+    await prisma.roles.update({
+      where: { id },
+      data: {
+        display_name: body.display_name ? String(body.display_name) : undefined,
+        description: body.description !== undefined ? String(body.description) : undefined,
+      },
+    });
+
+    if (Array.isArray(body.permission_ids)) {
+      await prisma.role_permissions.deleteMany({ where: { role_id: id } });
+      await prisma.role_permissions.createMany({
+        data: (body.permission_ids as number[]).map((pid) => ({
+          role_id: id,
+          permission_id: pid,
+        })),
+      });
+    }
+
+    await logAudit({
+      request,
+      authData: request.authData,
+      action: 'update',
+      entityType: 'role',
+      entityId: id,
+      description: `Upravena role ${existing.name}`,
+    });
+
+    return success(reply, { id }, 200, 'Role byla aktualizována');
+  });
+
+  // DELETE /api/admin/roles/:id
+  fastify.delete<{ Params: { id: string } }>('/:id', { preHandler: requirePermission('settings.roles') }, async (request, reply) => {
+    const id = parseId(request.params.id, reply);
+    if (id === null) return;
+
+    const existing = await prisma.roles.findUnique({ where: { id } });
+    if (!existing) return error(reply, 'Role nenalezena', 404);
+
+    if (existing.name === 'admin') {
+      return error(reply, 'Nelze smazat roli admin', 400);
+    }
+
+    await prisma.roles.delete({ where: { id } });
+
+    await logAudit({
+      request,
+      authData: request.authData,
+      action: 'delete',
+      entityType: 'role',
+      entityId: id,
+      description: `Smazána role ${existing.name}`,
+    });
+
+    return success(reply, { id }, 200, 'Role byla smazána');
+  });
+}