35 lines
1.7 KiB
JavaScript
35 lines
1.7 KiB
JavaScript
import { service as defaultService } from "../modules/dashboard/service.js";
|
|
import { makeDashboardApi } from "../modules/dashboard/api.js";
|
|
import { fail, sessionRoute } from "../common/http.js";
|
|
|
|
const requireUser = (fn) => sessionRoute("dashboard", fn);
|
|
|
|
// The browser gets the bare payload; the { message, data } envelope is for the
|
|
// API-key router.
|
|
const send = (res, { status, data }) =>
|
|
status === 200
|
|
? res.json(data)
|
|
: fail(res, status, status === 404 ? "not_found" : "bad_request", data?.error);
|
|
|
|
export function dashboardHandlers({ service = defaultService } = {}) {
|
|
const api = makeDashboardApi(service);
|
|
const route = (fn) => requireUser(async (req, res) => send(res, await fn(req)));
|
|
return {
|
|
summary: route((req) => api.summary(req.query, req.user.id)),
|
|
transactions: route((req) => api.transactions(req.query, req.user.id)),
|
|
series: route((req) => api.series(req.query, req.user.id)),
|
|
verify: route((req) => api.verify(req.query, req.user.id)),
|
|
// View JSON exposes the raw payload (possibly private); the can_view_json
|
|
// capability comes from the user's role in the DB (see getUser).
|
|
event: requireUser(async (req, res) => {
|
|
if (!req.user.canViewJson) return fail(res, 403, "forbidden", "not permitted to view JSON");
|
|
send(res, await api.event({ eventUuid: req.params.eventUuid }, req.user.id));
|
|
}),
|
|
agreement: route((req) => api.agreement({ agreementUuid: req.params.agreementUuid }, req.user.id)),
|
|
details: requireUser(async (req, res) => {
|
|
if (!req.user.canViewJson) return fail(res, 403, "forbidden", "not permitted to view JSON");
|
|
send(res, await api.details({ eventUuid: req.params.eventUuid }, req.user.id));
|
|
})
|
|
};
|
|
}
|