5266f36820
All checks were successful
Build & Push Docker Image / build-and-push (push) Successful in 1m53s
494 lines
18 KiB
JavaScript
494 lines
18 KiB
JavaScript
const express = require('express');
|
|
const cookieParser = require('cookie-parser');
|
|
const jwt = require('jsonwebtoken');
|
|
const bcrypt = require('bcryptjs');
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
const { execFile } = require('child_process');
|
|
const archiver = require('archiver');
|
|
const db = require('./database');
|
|
|
|
const app = express();
|
|
const JWT_SECRET = process.env.JWT_SECRET;
|
|
if (!JWT_SECRET) {
|
|
throw new Error('JWT_SECRET must be set before starting the server');
|
|
}
|
|
const PUBLIC_DIR = path.join(__dirname, '../public');
|
|
const DEFAULT_FULLS_DIR = path.join(PUBLIC_DIR, 'images/fulls');
|
|
const DEFAULT_THUMBS_DIR = path.join(PUBLIC_DIR, 'images/thumbs');
|
|
const DEV_FULLS_DIR = path.join(__dirname, '../images/fulls');
|
|
const DEV_THUMBS_DIR = path.join(__dirname, '../images/thumbs');
|
|
const FULLS_DIR = process.env.FULLS_DIR || (fs.existsSync(DEFAULT_FULLS_DIR) ? DEFAULT_FULLS_DIR : DEV_FULLS_DIR);
|
|
const THUMBS_DIR = process.env.THUMBS_DIR || (fs.existsSync(DEFAULT_THUMBS_DIR) ? DEFAULT_THUMBS_DIR : DEV_THUMBS_DIR);
|
|
const SYNC_IMAGE = process.env.SYNC_IMAGE || 'git.mischlabs.de/mrdiderot/photography:latest';
|
|
const SYNC_CONTAINER = process.env.SYNC_CONTAINER || 'photography-website';
|
|
const IMAGE_RE = /\.(jpg|jpeg|png|gif|webp)$/i;
|
|
let syncInProgress = false;
|
|
|
|
console.log('Using full-size images at', FULLS_DIR);
|
|
console.log('Using thumbnails at', THUMBS_DIR);
|
|
|
|
app.use(express.json());
|
|
app.use(express.urlencoded({ extended: true }));
|
|
app.use(cookieParser());
|
|
|
|
// ==================== MIDDLEWARE ====================
|
|
|
|
function authMiddleware(req, res, next) {
|
|
const token = req.cookies.token;
|
|
if (!token) { req.user = null; return next(); }
|
|
jwt.verify(token, JWT_SECRET, (err, decoded) => {
|
|
if (err) { req.user = null; return next(); }
|
|
// Client-Ablauf pruefen (30 Tage)
|
|
if (decoded.role === 'client' && decoded.created_at) {
|
|
const expires = new Date(decoded.created_at);
|
|
expires.setDate(expires.getDate() + 30);
|
|
if (new Date() > expires) {
|
|
res.clearCookie('token');
|
|
req.user = null;
|
|
return next();
|
|
}
|
|
}
|
|
req.user = decoded;
|
|
next();
|
|
});
|
|
}
|
|
|
|
function requireAuth(req, res, next) {
|
|
if (!req.user) return res.status(401).json({ error: 'Not logged in' });
|
|
next();
|
|
}
|
|
|
|
function requireAdmin(req, res, next) {
|
|
if (!req.user || req.user.role !== 'admin') {
|
|
return res.status(403).json({ error: 'Forbidden' });
|
|
}
|
|
next();
|
|
}
|
|
|
|
app.use(authMiddleware);
|
|
|
|
// ==================== HELPER ====================
|
|
|
|
function listImagesInDir(dir) {
|
|
try {
|
|
const files = fs.readdirSync(dir);
|
|
return files.filter(f => IMAGE_RE.test(f) && fs.statSync(path.join(dir, f)).isFile());
|
|
} catch (e) {
|
|
return [];
|
|
}
|
|
}
|
|
|
|
function listSubfolders(dir) {
|
|
try {
|
|
return fs.readdirSync(dir).filter(f => {
|
|
try { return fs.statSync(path.join(dir, f)).isDirectory(); }
|
|
catch (e) { return false; }
|
|
});
|
|
} catch (e) {
|
|
return [];
|
|
}
|
|
}
|
|
|
|
function isSafePath(baseDir, requestedPath) {
|
|
const resolvedBase = path.resolve(baseDir);
|
|
const resolvedPath = path.resolve(resolvedBase, requestedPath);
|
|
return resolvedPath === resolvedBase || resolvedPath.startsWith(resolvedBase + path.sep);
|
|
}
|
|
|
|
function hasAssignedFolder(userId, folder, callback) {
|
|
db.get(
|
|
'SELECT 1 FROM user_folders WHERE user_id = ? AND folder_name = ?',
|
|
[userId, folder],
|
|
(err, row) => callback(!err && !!row)
|
|
);
|
|
}
|
|
|
|
function serveProtectedImage(req, res) {
|
|
const kind = req.params[0];
|
|
const relativePath = req.params[1] || '';
|
|
const baseDir = kind === 'thumbs' ? THUMBS_DIR : FULLS_DIR;
|
|
const segments = relativePath.split('/').filter(Boolean);
|
|
const fileName = segments[segments.length - 1];
|
|
|
|
if (!fileName || !IMAGE_RE.test(fileName) || !isSafePath(baseDir, relativePath)) {
|
|
return res.status(404).end();
|
|
}
|
|
|
|
const absolutePath = path.resolve(baseDir, relativePath);
|
|
if (!fs.existsSync(absolutePath) || !fs.statSync(absolutePath).isFile()) {
|
|
return res.status(404).end();
|
|
}
|
|
|
|
// Bilder direkt im Root-Verzeichnis sind oeffentlich. Kundenordner sind geschuetzt.
|
|
if (segments.length === 1) {
|
|
return res.sendFile(absolutePath);
|
|
}
|
|
|
|
if (!req.user) {
|
|
return res.status(401).json({ error: 'Not logged in' });
|
|
}
|
|
|
|
if (req.user.role === 'admin') {
|
|
return res.sendFile(absolutePath);
|
|
}
|
|
|
|
hasAssignedFolder(req.user.id, segments[0], (allowed) => {
|
|
if (!allowed) return res.status(403).json({ error: 'Forbidden' });
|
|
res.sendFile(absolutePath);
|
|
});
|
|
}
|
|
|
|
function runDocker(args, callback) {
|
|
execFile('docker', args, { timeout: 5 * 60 * 1000 }, (err, stdout, stderr) => {
|
|
callback(err, `${stdout || ''}${stderr || ''}`.trim());
|
|
});
|
|
}
|
|
|
|
// ==================== AUTH API ====================
|
|
|
|
app.post('/api/auth/login', (req, res) => {
|
|
const { username, password } = req.body;
|
|
db.get('SELECT * FROM users WHERE username = ?', [username], (err, user) => {
|
|
if (err) return res.status(500).json({ error: 'DB Error' });
|
|
if (!user || !bcrypt.compareSync(password, user.password_hash)) {
|
|
return res.status(401).json({ error: 'Invalid credentials' });
|
|
}
|
|
// Client-Ablauf pruefen
|
|
if (user.role === 'client' && user.created_at) {
|
|
const expires = new Date(user.created_at);
|
|
expires.setDate(expires.getDate() + 30);
|
|
if (new Date() > expires) {
|
|
return res.status(401).json({ error: 'Account abgelaufen' });
|
|
}
|
|
}
|
|
const token = jwt.sign(
|
|
{ id: user.id, username: user.username, role: user.role, created_at: user.created_at },
|
|
JWT_SECRET, { expiresIn: '7d' }
|
|
);
|
|
res.cookie('token', token, { httpOnly: true, sameSite: 'strict', maxAge: 7 * 24 * 60 * 60 * 1000 });
|
|
res.json({ success: true, role: user.role });
|
|
});
|
|
});
|
|
|
|
app.post('/api/auth/logout', (req, res) => {
|
|
res.clearCookie('token');
|
|
res.json({ success: true });
|
|
});
|
|
|
|
app.get('/api/auth/me', (req, res) => {
|
|
if (!req.user) return res.status(401).json({ error: 'Not logged in' });
|
|
res.json(req.user);
|
|
});
|
|
|
|
app.post('/api/auth/change-password', requireAuth, (req, res) => {
|
|
const { old_password, new_password } = req.body;
|
|
if (!new_password || new_password.length < 4) {
|
|
return res.status(400).json({ error: 'Passwort muss mindestens 4 Zeichen lang sein' });
|
|
}
|
|
db.get('SELECT * FROM users WHERE id = ?', [req.user.id], (err, user) => {
|
|
if (err || !user) return res.status(500).json({ error: 'DB Error' });
|
|
if (!bcrypt.compareSync(old_password, user.password_hash)) {
|
|
return res.status(401).json({ error: 'Altes Passwort ist falsch' });
|
|
}
|
|
const hash = bcrypt.hashSync(new_password, 10);
|
|
db.run('UPDATE users SET password_hash = ? WHERE id = ?', [hash, user.id], (err) => {
|
|
if (err) return res.status(500).json({ error: 'DB Error' });
|
|
res.json({ success: true });
|
|
});
|
|
});
|
|
});
|
|
|
|
// ==================== IMAGE LISTING ====================
|
|
|
|
app.get('/images/fulls/', (req, res) => {
|
|
// Root-Bilder sind immer oeffentlich
|
|
const rootImages = listImagesInDir(FULLS_DIR).map(name => ({
|
|
name, type: 'file', folder: null
|
|
}));
|
|
|
|
// Nicht eingeloggt: nur Root-Bilder
|
|
if (!req.user) return res.json(rootImages);
|
|
|
|
const folders = listSubfolders(FULLS_DIR);
|
|
|
|
// Admin: Nur Root-Bilder (damit die Startseite sauber bleibt)
|
|
if (req.user.role === 'admin') {
|
|
return res.json(rootImages);
|
|
}
|
|
|
|
// User/Client: NUR zugewiesene Ordner (keine Root-Bilder untermischen)
|
|
db.all('SELECT folder_name FROM user_folders WHERE user_id = ?', [req.user.id], (err, rows) => {
|
|
const assignedFolders = err ? [] : rows.map(r => r.folder_name);
|
|
const result = [];
|
|
assignedFolders.forEach(folder => {
|
|
if (folders.includes(folder)) {
|
|
listImagesInDir(path.join(FULLS_DIR, folder)).forEach(name => {
|
|
result.push({ name, type: 'file', folder });
|
|
});
|
|
}
|
|
});
|
|
return res.json(result);
|
|
});
|
|
});
|
|
|
|
// ==================== ADMIN API ====================
|
|
|
|
app.get('/api/admin/users', requireAdmin, (req, res) => {
|
|
db.all('SELECT id, username, role, created_at FROM users', (err, rows) => {
|
|
if (err) {
|
|
console.error('User-Abfrage fehlgeschlagen:', err.message);
|
|
// Fallback: einfache Abfrage ohne neue Spalten
|
|
return db.all('SELECT * FROM users', (err2, rows2) => {
|
|
if (err2) return res.status(500).json({ error: 'DB Error: ' + err2.message });
|
|
res.json(rows2.map(u => ({ id: u.id, username: u.username, role: u.role || 'client', created_at: u.created_at || null })));
|
|
});
|
|
}
|
|
// Ablaufdatum berechnen fuer Clients
|
|
const result = rows.map(u => {
|
|
const out = { ...u };
|
|
if (u.role === 'client' && u.created_at) {
|
|
const expires = new Date(u.created_at);
|
|
expires.setDate(expires.getDate() + 30);
|
|
out.expires_at = expires.toISOString();
|
|
out.expired = new Date() > expires;
|
|
}
|
|
return out;
|
|
});
|
|
res.json(result);
|
|
});
|
|
});
|
|
|
|
app.post('/api/admin/users', requireAdmin, (req, res) => {
|
|
const { username, password, role } = req.body;
|
|
if (!username || !password) return res.status(400).json({ error: 'Username und Passwort erforderlich' });
|
|
const validRoles = ['admin', 'user', 'client'];
|
|
const userRole = validRoles.includes(role) ? role : 'client';
|
|
const hash = bcrypt.hashSync(password, 10);
|
|
db.run('INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)', [username, hash, userRole], function(err) {
|
|
if (err) return res.status(400).json({ error: err.message });
|
|
res.json({ success: true, id: this.lastID });
|
|
});
|
|
});
|
|
|
|
app.delete('/api/admin/users/:id', requireAdmin, (req, res) => {
|
|
const userId = parseInt(req.params.id);
|
|
// Sich selbst loeschen verhindern
|
|
if (userId === req.user.id) {
|
|
return res.status(400).json({ error: 'Du kannst dich nicht selbst loeschen' });
|
|
}
|
|
db.run('DELETE FROM users WHERE id = ?', [userId], (err) => {
|
|
if (err) return res.status(500).json({ error: 'DB Error' });
|
|
db.run('DELETE FROM user_folders WHERE user_id = ?', [userId]);
|
|
res.json({ success: true });
|
|
});
|
|
});
|
|
|
|
app.put('/api/admin/users/:id/password', requireAdmin, (req, res) => {
|
|
const { new_password } = req.body;
|
|
if (!new_password || new_password.length < 4) {
|
|
return res.status(400).json({ error: 'Passwort muss mindestens 4 Zeichen lang sein' });
|
|
}
|
|
const hash = bcrypt.hashSync(new_password, 10);
|
|
db.run('UPDATE users SET password_hash = ? WHERE id = ?', [hash, parseInt(req.params.id)], (err) => {
|
|
if (err) return res.status(500).json({ error: 'DB Error' });
|
|
res.json({ success: true });
|
|
});
|
|
});
|
|
|
|
// Ordner-Verwaltung
|
|
app.get('/api/admin/folders', requireAdmin, (req, res) => {
|
|
res.json(listSubfolders(FULLS_DIR));
|
|
});
|
|
|
|
app.get('/api/admin/assign', requireAdmin, (req, res) => {
|
|
const userId = req.query.user_id;
|
|
if (userId) {
|
|
db.all('SELECT folder_name FROM user_folders WHERE user_id = ?', [userId], (err, rows) => {
|
|
res.json(err ? [] : rows.map(r => r.folder_name));
|
|
});
|
|
} else {
|
|
db.all('SELECT * FROM user_folders', (err, rows) => {
|
|
res.json(err ? [] : rows);
|
|
});
|
|
}
|
|
});
|
|
|
|
app.post('/api/admin/assign', requireAdmin, (req, res) => {
|
|
const { user_id, folders } = req.body;
|
|
if (!user_id) return res.status(400).json({ error: 'user_id erforderlich' });
|
|
const folderList = Array.isArray(folders) ? folders : [];
|
|
db.serialize(() => {
|
|
db.run('DELETE FROM user_folders WHERE user_id = ?', [user_id]);
|
|
const stmt = db.prepare('INSERT INTO user_folders (user_id, folder_name) VALUES (?, ?)');
|
|
folderList.forEach(name => stmt.run(user_id, name));
|
|
stmt.finalize();
|
|
res.json({ success: true });
|
|
});
|
|
});
|
|
|
|
app.post('/api/admin/sync', requireAdmin, (req, res) => {
|
|
if (syncInProgress) {
|
|
return res.status(409).json({ error: 'Sync laeuft bereits' });
|
|
}
|
|
|
|
syncInProgress = true;
|
|
runDocker(['pull', SYNC_IMAGE], (pullErr, pullOutput) => {
|
|
syncInProgress = false;
|
|
|
|
if (pullErr) {
|
|
console.error('Sync pull failed:', pullOutput || pullErr.message);
|
|
return res.status(500).json({
|
|
error: 'Docker pull fehlgeschlagen',
|
|
details: pullOutput || pullErr.message
|
|
});
|
|
}
|
|
|
|
res.json({
|
|
success: true,
|
|
message: 'Neues Image geladen. Container startet neu.',
|
|
output: pullOutput
|
|
});
|
|
|
|
setTimeout(() => {
|
|
runDocker(['restart', SYNC_CONTAINER], (restartErr, restartOutput) => {
|
|
if (restartErr) {
|
|
console.error('Sync restart failed:', restartOutput || restartErr.message);
|
|
return;
|
|
}
|
|
console.log('Sync restart complete:', restartOutput);
|
|
});
|
|
}, 500);
|
|
});
|
|
});
|
|
|
|
// ==================== DOWNLOAD API ====================
|
|
|
|
function isValidName(name) {
|
|
return name && !name.includes('/') && !name.includes('\\') && !name.includes('..');
|
|
}
|
|
|
|
app.post('/api/download/selected', (req, res) => {
|
|
const { images } = req.body;
|
|
if (!Array.isArray(images) || images.length === 0) {
|
|
return res.status(400).json({ error: 'Keine Bilder ausgewaehlt' });
|
|
}
|
|
|
|
// Alle Bilder validieren und Zugriff pruefen
|
|
let pending = images.length;
|
|
const verified = [];
|
|
let responded = false;
|
|
|
|
images.forEach((img, idx) => {
|
|
if (responded) return;
|
|
const name = img.name;
|
|
const folder = img.folder || null;
|
|
|
|
// Dateiname + Ordnername validieren
|
|
if (!isValidName(name) || !IMAGE_RE.test(name) || (folder && !isValidName(folder))) {
|
|
responded = true;
|
|
return res.status(400).json({ error: 'Ungueltiger Dateiname' });
|
|
}
|
|
|
|
const checkAccess = (ok) => {
|
|
if (responded) return;
|
|
if (!ok) {
|
|
responded = true;
|
|
return res.status(403).json({ error: 'Kein Zugriff auf: ' + name });
|
|
}
|
|
verified[idx] = img;
|
|
pending--;
|
|
if (pending === 0) sendFiles();
|
|
};
|
|
|
|
if (!folder) {
|
|
// Root-Bild: fuer alle zugaenglich
|
|
const filePath = path.join(FULLS_DIR, name);
|
|
checkAccess(fs.existsSync(filePath));
|
|
} else {
|
|
// Ordner-Bild: nur wenn User den Ordner zugewiesen hat
|
|
if (!req.user) return checkAccess(false);
|
|
db.get('SELECT 1 FROM user_folders WHERE user_id = ? AND folder_name = ?',
|
|
[req.user.id, folder], (err, row) => {
|
|
if (err || !row) return checkAccess(false);
|
|
const filePath = path.join(FULLS_DIR, folder, name);
|
|
checkAccess(fs.existsSync(filePath));
|
|
});
|
|
}
|
|
});
|
|
|
|
function sendFiles() {
|
|
if (verified.length <= 3) {
|
|
// Einzelne Downloads: URLs zurueckgeben
|
|
const urls = verified.map(img => {
|
|
const prefix = img.folder ? encodeURIComponent(img.folder) + '/' : '';
|
|
return '/images/fulls/' + prefix + encodeURIComponent(img.name);
|
|
});
|
|
return res.json({ mode: 'individual', urls });
|
|
}
|
|
|
|
// 4+ Bilder: ZIP streamen
|
|
res.setHeader('Content-Type', 'application/zip');
|
|
res.setHeader('Content-Disposition', 'attachment; filename="mischkomposition-auswahl.zip"');
|
|
const archive = archiver('zip', { zlib: { level: 5 } });
|
|
archive.on('error', () => {
|
|
if (!res.headersSent) res.status(500).json({ error: 'ZIP-Fehler' });
|
|
});
|
|
archive.pipe(res);
|
|
verified.forEach(img => {
|
|
const filePath = img.folder
|
|
? path.join(FULLS_DIR, img.folder, img.name)
|
|
: path.join(FULLS_DIR, img.name);
|
|
archive.file(filePath, { name: img.name });
|
|
});
|
|
archive.finalize();
|
|
}
|
|
});
|
|
|
|
app.get('/api/download/folder/:folderName', (req, res) => {
|
|
const folderName = req.params.folderName;
|
|
if (!isValidName(folderName)) {
|
|
return res.status(400).json({ error: 'Ungueltiger Ordnername' });
|
|
}
|
|
if (!req.user) {
|
|
return res.status(401).json({ error: 'Nicht eingeloggt' });
|
|
}
|
|
db.get('SELECT 1 FROM user_folders WHERE user_id = ? AND folder_name = ?',
|
|
[req.user.id, folderName], (err, row) => {
|
|
if (err || !row) {
|
|
return res.status(403).json({ error: 'Kein Zugriff auf diesen Ordner' });
|
|
}
|
|
const folderPath = path.join(FULLS_DIR, folderName);
|
|
const images = listImagesInDir(folderPath);
|
|
if (images.length === 0) {
|
|
return res.status(404).json({ error: 'Keine Bilder im Ordner' });
|
|
}
|
|
res.setHeader('Content-Type', 'application/zip');
|
|
res.setHeader('Content-Disposition', 'attachment; filename="' + encodeURIComponent(folderName) + '.zip"');
|
|
const archive = archiver('zip', { zlib: { level: 5 } });
|
|
archive.on('error', () => {
|
|
if (!res.headersSent) res.status(500).json({ error: 'ZIP-Fehler' });
|
|
});
|
|
archive.pipe(res);
|
|
images.forEach(name => {
|
|
archive.file(path.join(folderPath, name), { name });
|
|
});
|
|
archive.finalize();
|
|
});
|
|
});
|
|
|
|
// ==================== STATIC FILES ====================
|
|
|
|
app.get(/^\/images\/(fulls|thumbs)\/(.+)$/, serveProtectedImage);
|
|
|
|
app.use(express.static(PUBLIC_DIR));
|
|
|
|
app.get('*', (req, res) => {
|
|
res.sendFile(path.join(PUBLIC_DIR, 'index.html'));
|
|
});
|
|
|
|
const PORT = 8090;
|
|
app.listen(PORT, () => {
|
|
console.log(`Mischkomposition Backend on port ${PORT}`);
|
|
});
|