addition of new dashboard

backend/http/dashboard.js

@@ -0,0 +1,34 @@
+import { service as defaultService } from "../modules/dashboard/service.js";
+import { makeDashboardApi } from "../modules/dashboard/api.js";
+import { fail, sessionRoute } from "../common/http.js";
+
+const requireUser = (fn) => sessionRoute("dashboard", fn);
+
+// The browser gets the bare payload; the { message, data } envelope is for the
+// API-key router.
+const send = (res, { status, data }) =>
+  status === 200
+    ? res.json(data)
+    : fail(res, status, status === 404 ? "not_found" : "bad_request", data?.error);
+
+export function dashboardHandlers({ service = defaultService } = {}) {
+  const api = makeDashboardApi(service);
+  const route = (fn) => requireUser(async (req, res) => send(res, await fn(req)));
+  return {
+    summary: route((req) => api.summary(req.query, req.user.id)),
+    transactions: route((req) => api.transactions(req.query, req.user.id)),
+    series: route((req) => api.series(req.query, req.user.id)),
+    verify: route((req) => api.verify(req.query, req.user.id)),
+    // View JSON exposes the raw payload (possibly private); the can_view_json
+    // capability comes from the user's role in the DB (see getUser).
+    event: requireUser(async (req, res) => {
+      if (!req.user.canViewJson) return fail(res, 403, "forbidden", "not permitted to view JSON");
+      send(res, await api.event({ eventUuid: req.params.eventUuid }, req.user.id));
+    }),
+    agreement: route((req) => api.agreement({ agreementUuid: req.params.agreementUuid }, req.user.id)),
+    details: requireUser(async (req, res) => {
+      if (!req.user.canViewJson) return fail(res, 403, "forbidden", "not permitted to view JSON");
+      send(res, await api.details({ eventUuid: req.params.eventUuid }, req.user.id));
+    })
+  };
+}