47b68e672b
- Allow members to create todos, companies, projects - Auto-assign creator to resources (companyUsers, projectUsers, todoUsers) - Add public /api/users endpoint for all authenticated users - Make phone field optional in personal contacts (schema + validation) - Update todo routes to use checkTodoAccess for updates Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
63 lines
1.6 KiB
JavaScript
63 lines
1.6 KiB
JavaScript
import express from 'express';
|
|
import * as todoController from '../controllers/todo.controller.js';
|
|
import { authenticate } from '../middlewares/auth/authMiddleware.js';
|
|
import { requireAdmin } from '../middlewares/auth/roleMiddleware.js';
|
|
import { checkTodoAccess } from '../middlewares/auth/resourceAccessMiddleware.js';
|
|
import { validateBody, validateParams } from '../middlewares/security/validateInput.js';
|
|
import { createTodoSchema, updateTodoSchema } from '../validators/crm.validators.js';
|
|
import { z } from 'zod';
|
|
|
|
const router = express.Router();
|
|
|
|
// All todo routes require authentication
|
|
router.use(authenticate);
|
|
|
|
/**
|
|
* Todo management
|
|
*/
|
|
|
|
// Get all todos
|
|
router.get('/', todoController.getAllTodos);
|
|
|
|
// Get todo by ID
|
|
router.get(
|
|
'/:todoId',
|
|
validateParams(z.object({ todoId: z.string().uuid() })),
|
|
checkTodoAccess,
|
|
todoController.getTodoById
|
|
);
|
|
|
|
// Create new todo (any authenticated user)
|
|
router.post(
|
|
'/',
|
|
validateBody(createTodoSchema),
|
|
todoController.createTodo
|
|
);
|
|
|
|
// Update todo (user must have access to the todo)
|
|
router.patch(
|
|
'/:todoId',
|
|
validateParams(z.object({ todoId: z.string().uuid() })),
|
|
checkTodoAccess,
|
|
validateBody(updateTodoSchema),
|
|
todoController.updateTodo
|
|
);
|
|
|
|
// Delete todo (admin only)
|
|
router.delete(
|
|
'/:todoId',
|
|
requireAdmin,
|
|
validateParams(z.object({ todoId: z.string().uuid() })),
|
|
todoController.deleteTodo
|
|
);
|
|
|
|
// Toggle todo completion status
|
|
router.patch(
|
|
'/:todoId/toggle',
|
|
validateParams(z.object({ todoId: z.string().uuid() })),
|
|
checkTodoAccess,
|
|
todoController.toggleTodo
|
|
);
|
|
|
|
export default router;
|