176 lines
5.0 KiB
TypeScript
176 lines
5.0 KiB
TypeScript
import { Router } from 'express';
|
|
import eventsController from '../controllers/events.controller';
|
|
import { authenticate, optionalAuth } from '../middleware/auth.middleware';
|
|
import { requirePermission } from '../middleware/rbac.middleware';
|
|
|
|
const router = Router();
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Categories
|
|
// ---------------------------------------------------------------------------
|
|
|
|
/**
|
|
* GET /api/events/kategorien
|
|
* List all event categories. Any authenticated user can read.
|
|
*/
|
|
router.get('/kategorien', authenticate, eventsController.listKategorien.bind(eventsController));
|
|
|
|
/**
|
|
* POST /api/events/kategorien
|
|
* Create a new category. Requires gruppenfuehrer+.
|
|
*/
|
|
router.post(
|
|
'/kategorien',
|
|
authenticate,
|
|
requirePermission('events:categories'),
|
|
eventsController.createKategorie.bind(eventsController)
|
|
);
|
|
|
|
/**
|
|
* PATCH /api/events/kategorien/:id
|
|
* Update an existing category. Requires gruppenfuehrer+.
|
|
*/
|
|
router.patch(
|
|
'/kategorien/:id',
|
|
authenticate,
|
|
requirePermission('events:categories'),
|
|
eventsController.updateKategorie.bind(eventsController)
|
|
);
|
|
|
|
/**
|
|
* DELETE /api/events/kategorien/:id
|
|
* Delete a category (only if no events reference it). Requires gruppenfuehrer+.
|
|
*/
|
|
router.delete(
|
|
'/kategorien/:id',
|
|
authenticate,
|
|
requirePermission('events:categories'),
|
|
eventsController.deleteKategorie.bind(eventsController)
|
|
);
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Known groups list (used by frontend to populate zielgruppen picker)
|
|
// ---------------------------------------------------------------------------
|
|
|
|
/**
|
|
* GET /api/events/groups
|
|
* Returns the list of known Authentik groups with human-readable labels.
|
|
*/
|
|
router.get('/groups', authenticate, eventsController.getAvailableGroups.bind(eventsController));
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Conflict check — must come before /:id
|
|
// ---------------------------------------------------------------------------
|
|
|
|
/**
|
|
* GET /api/events/conflicts?from=<ISO>&to=<ISO>&excludeId=<uuid>
|
|
* Check for overlapping events in the given time range.
|
|
*/
|
|
router.get('/conflicts', authenticate, eventsController.checkConflicts.bind(eventsController));
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Calendar & upcoming — specific routes must come before /:id
|
|
// ---------------------------------------------------------------------------
|
|
|
|
/**
|
|
* GET /api/events/calendar?from=<ISO>&to=<ISO>
|
|
* Events in a date range, filtered by the requesting user's groups.
|
|
* Optional auth — unauthenticated callers only see alle_gruppen events.
|
|
*/
|
|
router.get('/calendar', optionalAuth, eventsController.getCalendarRange.bind(eventsController));
|
|
|
|
/**
|
|
* GET /api/events/upcoming?limit=10
|
|
* Next N upcoming events visible to the requesting user.
|
|
*/
|
|
router.get('/upcoming', optionalAuth, eventsController.getUpcoming.bind(eventsController));
|
|
|
|
/**
|
|
* GET /api/events/calendar-token
|
|
* Returns (or creates) the user's personal iCal subscribe token + URL.
|
|
* Requires authentication.
|
|
*/
|
|
router.get(
|
|
'/calendar-token',
|
|
authenticate,
|
|
eventsController.getCalendarToken.bind(eventsController)
|
|
);
|
|
|
|
/**
|
|
* GET /api/events/calendar.ics?token=<token>
|
|
* iCal feed — authenticated via per-user opaque token.
|
|
* No Bearer token required; calendar clients use the token query param.
|
|
*/
|
|
router.get(
|
|
'/calendar.ics',
|
|
optionalAuth,
|
|
eventsController.getIcalExport.bind(eventsController)
|
|
);
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Events CRUD
|
|
// ---------------------------------------------------------------------------
|
|
|
|
/**
|
|
* POST /api/events/import
|
|
* Bulk import events from CSV data. Requires gruppenfuehrer+.
|
|
*/
|
|
router.post(
|
|
'/import',
|
|
authenticate,
|
|
requirePermission('events:write'),
|
|
eventsController.importEvents.bind(eventsController)
|
|
);
|
|
|
|
/**
|
|
* POST /api/events
|
|
* Create a new event. Requires gruppenfuehrer+.
|
|
*/
|
|
router.post(
|
|
'/',
|
|
authenticate,
|
|
requirePermission('events:write'),
|
|
eventsController.createEvent.bind(eventsController)
|
|
);
|
|
|
|
/**
|
|
* GET /api/events/:id
|
|
* Single event detail. Any authenticated user.
|
|
*/
|
|
router.get('/:id', authenticate, eventsController.getById.bind(eventsController));
|
|
|
|
/**
|
|
* PATCH /api/events/:id
|
|
* Update an existing event. Requires gruppenfuehrer+.
|
|
*/
|
|
router.patch(
|
|
'/:id',
|
|
authenticate,
|
|
requirePermission('events:write'),
|
|
eventsController.updateEvent.bind(eventsController)
|
|
);
|
|
|
|
/**
|
|
* DELETE /api/events/:id
|
|
* Soft-cancel an event (sets abgesagt=TRUE + reason). Requires gruppenfuehrer+.
|
|
*/
|
|
router.delete(
|
|
'/:id',
|
|
authenticate,
|
|
requirePermission('events:write'),
|
|
eventsController.cancelEvent.bind(eventsController)
|
|
);
|
|
|
|
/**
|
|
* POST /api/events/:id/delete
|
|
* Hard-delete an event permanently. Requires gruppenfuehrer+.
|
|
*/
|
|
router.post(
|
|
'/:id/delete',
|
|
authenticate,
|
|
requirePermission('events:write'),
|
|
eventsController.deleteEvent.bind(eventsController)
|
|
);
|
|
|
|
export default router;
|