EduBox Dev
a414f03a59
- Configure tailscale serve automatically for each instance on Windows userspace networking. - Add local UI buttons: start/stop/reset/delete instances (stop/start preserve volumes). - Clean shutdown: stop tailscaled and instances, notify server with instance_stopped. - Restart tailscaled on agent boot using persisted state when pre-auth key is absent. - Sync instance stopped/deleted status to dashboard (server/lib/websocket.ts). - Security: include prior authz/scoping changes across API routes, ephemeral pre-auth keys, ACL policy, internal API key. - Update SUIVI_VPN_ONDEMAND.md and docs/ONBOARDING_CLIENT.md. - Bump agent version to 0.3.5.
98 lines
3.3 KiB
TypeScript
98 lines
3.3 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { prisma } from "@/lib/prisma";
|
|
import { requireAuth, requireRole, forbidden } from "@/lib/api-auth";
|
|
|
|
function templateAccessWhere(user: { role: string; establishmentId?: string }, establishmentId?: string | null) {
|
|
if (user.role === "superadmin" && establishmentId) {
|
|
return { OR: [{ isPublic: true }, { establishmentId }] };
|
|
}
|
|
if (user.establishmentId) {
|
|
return { OR: [{ isPublic: true }, { establishmentId: user.establishmentId }] };
|
|
}
|
|
return { isPublic: true };
|
|
}
|
|
|
|
async function canManageTemplate(user: { role: string; establishmentId?: string }, id: string) {
|
|
if (user.role === "superadmin") return true;
|
|
const template = await prisma.template.findUnique({ where: { id } });
|
|
if (!template) return false;
|
|
return template.establishmentId === user.establishmentId;
|
|
}
|
|
|
|
export async function GET(req: NextRequest) {
|
|
const user = await requireAuth();
|
|
if (user instanceof NextResponse) return user;
|
|
|
|
const { searchParams } = new URL(req.url);
|
|
const requestedEst = searchParams.get("establishmentId");
|
|
|
|
const where = user.role === "superadmin" && !requestedEst ? {} : templateAccessWhere(user, requestedEst);
|
|
|
|
const templates = await prisma.template.findMany({
|
|
where,
|
|
orderBy: { createdAt: "desc" },
|
|
});
|
|
return NextResponse.json(templates);
|
|
}
|
|
|
|
export async function POST(req: NextRequest) {
|
|
const user = await requireAuth();
|
|
if (user instanceof NextResponse) return user;
|
|
|
|
const denied = requireRole(user, "superadmin", "admin");
|
|
if (denied) return denied;
|
|
|
|
const body = await req.json();
|
|
let { name, type, dockerImage, composeConfig, isPublic, establishmentId, createdBy } = body;
|
|
|
|
if (user.role !== "superadmin") {
|
|
if (establishmentId && establishmentId !== user.establishmentId) {
|
|
return forbidden();
|
|
}
|
|
establishmentId = user.establishmentId;
|
|
}
|
|
|
|
const template = await prisma.template.create({
|
|
data: { name, type, dockerImage, composeConfig, isPublic, establishmentId, createdBy },
|
|
});
|
|
return NextResponse.json(template, { status: 201 });
|
|
}
|
|
|
|
export async function PUT(req: NextRequest) {
|
|
const user = await requireAuth();
|
|
if (user instanceof NextResponse) return user;
|
|
|
|
const denied = requireRole(user, "superadmin", "admin");
|
|
if (denied) return denied;
|
|
|
|
const body = await req.json();
|
|
const { id, ...data } = body;
|
|
if (!id) return NextResponse.json({ error: "Missing id" }, { status: 400 });
|
|
|
|
if (!(await canManageTemplate(user, id))) return forbidden();
|
|
|
|
if (user.role !== "superadmin" && data.establishmentId && data.establishmentId !== user.establishmentId) {
|
|
return forbidden();
|
|
}
|
|
|
|
const template = await prisma.template.update({ where: { id }, data });
|
|
return NextResponse.json(template);
|
|
}
|
|
|
|
export async function DELETE(req: NextRequest) {
|
|
const user = await requireAuth();
|
|
if (user instanceof NextResponse) return user;
|
|
|
|
const denied = requireRole(user, "superadmin", "admin");
|
|
if (denied) return denied;
|
|
|
|
const { searchParams } = new URL(req.url);
|
|
const id = searchParams.get("id");
|
|
if (!id) return NextResponse.json({ error: "Missing id" }, { status: 400 });
|
|
|
|
if (!(await canManageTemplate(user, id))) return forbidden();
|
|
|
|
await prisma.template.delete({ where: { id } });
|
|
return NextResponse.json({ ok: true });
|
|
}
|