Press n or j to go to the next uncovered block, b, p or k for the previous block.
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 | 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x | const express = require('express');
const path = require('path');
const jwt = require('jsonwebtoken');
const User = require('../models/User');
const router = express.Router();
const JWT_SECRET = process.env.JWT_SECRET;
function getPlans() {
return require(path.join(__dirname, '..', 'plans-config.json')).plans;
}
async function authenticateToken(req, res, next) {
const authHeader = req.headers['authorization'];
const token = authHeader && authHeader.split(' ')[1];
if (!token) return res.status(401).json({ success: false, message: 'Access token required' });
try {
const decoded = jwt.verify(token, JWT_SECRET);
const user = await User.findById(decoded.userId);
if (!user || !user.isActive) return res.status(401).json({ success: false, message: 'Invalid user' });
req.user = user;
next();
} catch {
return res.status(403).json({ success: false, message: 'Invalid token' });
}
}
async function requireAdmin(req, res, next) {
if (!req.user || req.user.role !== 'admin') {
return res.status(403).json({ success: false, message: 'Admin access required' });
}
next();
}
// Auth optionnelle : si l'utilisateur est admin, on inclut aussi les plans non-publics
async function optionalAuth(req, res, next) {
const authHeader = req.headers['authorization'];
const token = authHeader && authHeader.split(' ')[1];
if (!token) return next();
try {
const decoded = jwt.verify(token, JWT_SECRET);
const user = await User.findById(decoded.userId);
if (user && user.isActive) {
req.user = user;
}
next();
} catch {
next();
}
}
router.get('/plans', optionalAuth, async (req, res) => {
try {
const isAdmin = req.user?.role === 'admin';
// specific_limit ("Sur mesure") est une carte dédiée codée en dur dans le frontend,
// on ne l'expose donc pas ici pour éviter le doublon.
const plans = getPlans()
.filter(p => p.code !== 'specific_limit' && (isAdmin || p.isPublic))
.sort((a, b) => a.sortOrder - b.sortOrder);
res.json({ success: true, data: plans });
} catch (error) {
console.error('[Plans] Error:', error.message);
res.status(500).json({ success: false, message: 'Error listing plans' });
}
});
router.get('/admin/plans', authenticateToken, requireAdmin, async (req, res) => {
try {
const plans = getPlans().sort((a, b) => a.sortOrder - b.sortOrder);
res.json({ success: true, data: plans });
} catch (error) {
console.error('[Plans/Admin] Error:', error.message);
res.status(500).json({ success: false, message: 'Error listing plans' });
}
});
module.exports = router;
|