diff --git a/src/hooks.server.ts b/src/hooks.server.ts index 6e4794d..d8db728 100644 --- a/src/hooks.server.ts +++ b/src/hooks.server.ts @@ -1,7 +1,7 @@ import { sequelize } from '$lib/server/database'; import type { Handle } from '@sveltejs/kit'; import { env } from '$env/dynamic/public'; -import { hasSession } from '$lib/server/session'; +import { getSession } from '$lib/server/session'; // make sure that the database and tables exist await sequelize.sync(); @@ -11,7 +11,7 @@ export const handle: Handle = async ({ event, resolve }) => { event.url.pathname.startsWith(`${env.PUBLIC_BASE_PATH}/admin`) && event.url.pathname != `${env.PUBLIC_BASE_PATH}/admin/login` ) { - if (!hasSession(event.cookies.get('session') || '')) { + if (getSession(event.cookies.get('session') || '') == null) { return new Response(null, { status: 302, headers: { diff --git a/src/lib/components/Input/Badges.svelte b/src/lib/components/Input/Badges.svelte new file mode 100644 index 0000000..fd5e789 --- /dev/null +++ b/src/lib/components/Input/Badges.svelte @@ -0,0 +1,53 @@ + + +
+ +
+ {#each value as badge, i} + {#if Object.values(available).indexOf(badge) !== -1} +
+ + {Object.keys(available)[Object.values(available).indexOf(badge)]} +
+ {/if} + {/each} +
+
diff --git a/src/lib/components/Input/Input.svelte b/src/lib/components/Input/Input.svelte index 7e4ee9e..8a9999a 100644 --- a/src/lib/components/Input/Input.svelte +++ b/src/lib/components/Input/Input.svelte @@ -3,10 +3,11 @@ + +{#if $page.url.pathname !== `${env.PUBLIC_BASE_PATH}/admin/login`} +
+
+ +
+
+ +
+
+{:else} +
+ +
+{/if} diff --git a/src/routes/admin/+page.svelte b/src/routes/admin/+page.svelte new file mode 100644 index 0000000..e69de29 diff --git a/src/routes/admin/admin/+layout.svelte b/src/routes/admin/admin/+layout.svelte new file mode 100644 index 0000000..c281020 --- /dev/null +++ b/src/routes/admin/admin/+layout.svelte @@ -0,0 +1,3 @@ +
+ +
diff --git a/src/routes/admin/admin/+page.server.ts b/src/routes/admin/admin/+page.server.ts new file mode 100644 index 0000000..f90019b --- /dev/null +++ b/src/routes/admin/admin/+page.server.ts @@ -0,0 +1,11 @@ +import type { PageServerLoad } from './$types'; +import { Admin } from '$lib/server/database'; +import { getSession } from '$lib/server/session'; + +export const load: PageServerLoad = async ({ cookies }) => { + const admins = await Admin.findAll({ attributes: { exclude: ['password'] } }); + return { + admins: JSON.parse(JSON.stringify(admins)), + permissions: getSession(cookies.get('session') || '')!.value + }; +}; diff --git a/src/routes/admin/admin/+page.svelte b/src/routes/admin/admin/+page.svelte new file mode 100644 index 0000000..8b7797b --- /dev/null +++ b/src/routes/admin/admin/+page.svelte @@ -0,0 +1,222 @@ + + + + + + + + + + + + + + + + + + + {#each data.admins as admin, i} + + + + + + + + {/each} + + + + + + + + +
+ BenutzernamePasswortBerechtigungen +
{i} +
+ {#if admin.edit} + + + {:else} + + + {/if} +
+
{data.admins.length} + +
+ + + + diff --git a/src/routes/admin/admin/+server.ts b/src/routes/admin/admin/+server.ts new file mode 100644 index 0000000..78ecd39 --- /dev/null +++ b/src/routes/admin/admin/+server.ts @@ -0,0 +1,80 @@ +import type { RequestHandler } from '@sveltejs/kit'; +import { Permissions } from '$lib/permissions'; +import { getSession } from '$lib/server/session'; +import { Admin } from '$lib/server/database'; + +export const POST = (async ({ request, cookies }) => { + if (getSession(cookies, [Permissions.AdminWrite]) == null) { + return new Response(null, { + status: 401 + }); + } + + const data = await request.json(); + const username = data['username'] as string | null; + const password = data['password'] as string | null; + const permissions = data['permissions'] as number | null; + + if (username == null || password == null || permissions == null) { + return new Response(null, { + status: 400 + }); + } + + const admin = await Admin.create({ + username: username, + password: password, + permissions: new Permissions(permissions) + }); + + return new Response(JSON.stringify(admin), { + status: 201 + }); +}) satisfies RequestHandler; + +export const PATCH = (async ({ request, cookies }) => { + if (getSession(cookies, [Permissions.AdminWrite]) == null) { + return new Response(null, { + status: 401 + }); + } + + const data = await request.json(); + const id = data['id'] as string | null; + + if (id == null) { + return new Response(null, { + status: 400 + }); + } + + const updatePayload: { [key: string]: any } = {}; + if (data['username']) updatePayload.username = data['username']; + if (data['password']) updatePayload.password = data['password']; + if (data['permissions']) updatePayload.permissions = data['permissions']; + + await Admin.update(updatePayload, { where: { id: id } }); + + return new Response(); +}) satisfies RequestHandler; + +export const DELETE = (async ({ request, cookies }) => { + if (getSession(cookies, [Permissions.AdminWrite]) == null) { + return new Response(null, { + status: 401 + }); + } + + const data = await request.json(); + const id = data['id'] as string | null; + + if (id == null) { + return new Response(null, { + status: 400 + }); + } + + await Admin.destroy({ where: { id: id } }); + + return new Response(); +}) satisfies RequestHandler; diff --git a/src/routes/admin/login/+page.svelte b/src/routes/admin/login/+page.svelte index 3a6a4ed..ac1285a 100644 --- a/src/routes/admin/login/+page.svelte +++ b/src/routes/admin/login/+page.svelte @@ -83,4 +83,6 @@ - + + Nutzername oder Passwort falsch + diff --git a/src/routes/admin/login/+server.ts b/src/routes/admin/login/+server.ts index 8287b9e..0254eff 100644 --- a/src/routes/admin/login/+server.ts +++ b/src/routes/admin/login/+server.ts @@ -3,6 +3,7 @@ import { Admin } from '$lib/server/database'; import { env as publicEnv } from '$env/dynamic/public'; import { env } from '$env/dynamic/private'; import { addSession } from '$lib/server/session'; +import { Permissions } from '$lib/permissions'; export const POST = (async ({ request, cookies }) => { const data = await request.formData(); @@ -11,7 +12,7 @@ export const POST = (async ({ request, cookies }) => { if (username == null || password == null) { return new Response(null, { - status: 403 + status: 401 }); } @@ -21,7 +22,7 @@ export const POST = (async ({ request, cookies }) => { username == env.ADMIN_USER && password == env.ADMIN_PASSWORD ) { - cookies.set('session', addSession(), { + cookies.set('session', addSession(new Permissions(Permissions.allPermissions())), { path: `${publicEnv.PUBLIC_BASE_PATH}/admin`, maxAge: 60 * 60 * 24 * 90, httpOnly: true, @@ -32,7 +33,7 @@ export const POST = (async ({ request, cookies }) => { const user = await Admin.findOne({ where: { username: username } }); if (user && user.validatePassword(password)) { - cookies.set('session', addSession(), { + cookies.set('session', addSession(user.permissions), { path: `${publicEnv.PUBLIC_BASE_PATH}/admin`, maxAge: 60 * 60 * 24 * 90, httpOnly: true, @@ -41,7 +42,7 @@ export const POST = (async ({ request, cookies }) => { return new Response(); } else { return new Response(null, { - status: 403 + status: 401 }); } }) satisfies RequestHandler;