feat: JSON API voor React SPA onder /api/spa + 401-json voor /api paden
This commit is contained in:
mo
@@ -0,0 +1,41 @@
|
||||
const express = require('express');
|
||||
const router = express.Router();
|
||||
const bcrypt = require('bcryptjs');
|
||||
const { getDb, logAudit } = require('../../db');
|
||||
|
||||
// POST /api/spa/auth/login — JSON login, zet sessie
|
||||
router.post('/login', (req, res) => {
|
||||
const { username, password } = req.body || {};
|
||||
if (!username || !password) {
|
||||
return res.status(400).json({ error: 'Gebruikersnaam en wachtwoord zijn verplicht' });
|
||||
}
|
||||
const db = getDb();
|
||||
const user = db.prepare('SELECT * FROM users WHERE username = ?').get(username);
|
||||
if (!user || !bcrypt.compareSync(password, user.password_hash)) {
|
||||
return res.status(401).json({ error: 'Ongeldige gebruikersnaam of wachtwoord' });
|
||||
}
|
||||
req.session.userId = user.id;
|
||||
req.session.username = user.username;
|
||||
logAudit(user.id, user.username, 'user_login', 'user', user.id, `${user.username} ingelogd via SPA`);
|
||||
res.json({ id: user.id, username: user.username, role: user.role, email: user.email || '' });
|
||||
});
|
||||
|
||||
// POST /api/spa/auth/logout
|
||||
router.post('/logout', (req, res) => {
|
||||
req.session.destroy(() => {
|
||||
res.json({ ok: true });
|
||||
});
|
||||
});
|
||||
|
||||
// GET /api/spa/auth/me — huidige gebruiker (ook voor sessie-check bij opstarten SPA)
|
||||
router.get('/me', (req, res) => {
|
||||
if (!req.session || !req.session.userId) {
|
||||
return res.status(401).json({ error: 'Niet ingelogd' });
|
||||
}
|
||||
const db = getDb();
|
||||
const user = db.prepare('SELECT id, username, email, role FROM users WHERE id = ?').get(req.session.userId);
|
||||
if (!user) return res.status(401).json({ error: 'Niet ingelogd' });
|
||||
res.json(user);
|
||||
});
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,189 @@
|
||||
const express = require('express');
|
||||
const router = express.Router();
|
||||
const { getDb, logAudit } = require('../../db');
|
||||
|
||||
// ============ CLIENTS ============
|
||||
|
||||
router.get('/clients', (req, res) => {
|
||||
const db = getDb();
|
||||
const { status, search } = req.query;
|
||||
let sql = `SELECT c.*,
|
||||
(SELECT COUNT(*) FROM engagements e WHERE e.client_id = c.id) as engagement_count,
|
||||
(SELECT MAX(a.created_at) FROM assessments a WHERE a.client_id = c.id) as last_assessment
|
||||
FROM clients c WHERE 1=1`;
|
||||
const params = [];
|
||||
if (status) { sql += ' AND c.status = ?'; params.push(status); }
|
||||
if (search) { sql += ' AND (c.name LIKE ? OR c.contact_name LIKE ? OR c.industry LIKE ?)'; params.push(`%${search}%`, `%${search}%`, `%${search}%`); }
|
||||
sql += ' ORDER BY c.updated_at DESC';
|
||||
res.json(db.prepare(sql).all(...params));
|
||||
});
|
||||
|
||||
router.post('/clients', (req, res) => {
|
||||
const db = getDb();
|
||||
const { name, industry, website, contact_name, contact_email, contact_phone, status, source, notes } = req.body;
|
||||
if (!name || !name.trim()) return res.status(400).json({ error: 'Bedrijfsnaam is verplicht' });
|
||||
const result = db.prepare(`INSERT INTO clients (name, industry, website, contact_name, contact_email, contact_phone, status, source, notes)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(name, industry, website, contact_name, contact_email, contact_phone, status || 'lead', source, notes);
|
||||
logAudit(req.session.userId, req.session.username, 'client_created', 'client', result.lastInsertRowid, `Client ${name} aangemaakt via SPA`);
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.get('/clients/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const client = db.prepare('SELECT * FROM clients WHERE id = ?').get(req.params.id);
|
||||
if (!client) return res.status(404).json({ error: 'Client niet gevonden' });
|
||||
res.json({
|
||||
client,
|
||||
engagements: db.prepare('SELECT * FROM engagements WHERE client_id = ? ORDER BY created_at DESC').all(req.params.id),
|
||||
assessments: db.prepare('SELECT id, client_id, engagement_id, created_at FROM assessments WHERE client_id = ? ORDER BY created_at DESC').all(req.params.id),
|
||||
advice: db.prepare('SELECT * FROM advice_log WHERE client_id = ? AND dismissed = 0 ORDER BY created_at DESC').all(req.params.id),
|
||||
diagrams: db.prepare('SELECT id, name, description, diagram_type, updated_at, created_at FROM data_diagrams WHERE client_id = ? ORDER BY updated_at DESC').all(req.params.id),
|
||||
notes: db.prepare('SELECT * FROM client_notes WHERE client_id = ? ORDER BY created_at DESC').all(req.params.id),
|
||||
files: db.prepare('SELECT id, client_id, original_name, mime_type, file_size, created_at FROM client_files WHERE client_id = ? ORDER BY created_at DESC').all(req.params.id),
|
||||
timeEntries: db.prepare('SELECT t.*, u.username FROM time_entries t LEFT JOIN users u ON u.id = t.user_id WHERE t.client_id = ? ORDER BY t.date DESC').all(req.params.id),
|
||||
invoices: db.prepare('SELECT * FROM invoices WHERE client_id = ? ORDER BY created_at DESC').all(req.params.id)
|
||||
});
|
||||
});
|
||||
|
||||
router.put('/clients/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const { name, industry, website, contact_name, contact_email, contact_phone, status, source, notes } = req.body;
|
||||
if (!name || !name.trim()) return res.status(400).json({ error: 'Bedrijfsnaam is verplicht' });
|
||||
db.prepare(`UPDATE clients SET name=?, industry=?, website=?, contact_name=?, contact_email=?, contact_phone=?, status=?, source=?, notes=?, updated_at=datetime('now') WHERE id=?`)
|
||||
.run(name, industry, website, contact_name, contact_email, contact_phone, status, source, notes, req.params.id);
|
||||
logAudit(req.session.userId, req.session.username, 'client_updated', 'client', req.params.id, `Client ${name} bijgewerkt via SPA`);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/clients/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM clients WHERE id = ?').run(req.params.id);
|
||||
logAudit(req.session.userId, req.session.username, 'client_deleted', 'client', req.params.id, 'Client verwijderd via SPA');
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.post('/clients/:id/advice/:adviceId/dismiss', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('UPDATE advice_log SET dismissed = 1 WHERE id = ? AND client_id = ?').run(req.params.adviceId, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ---- Client notes ----
|
||||
router.post('/clients/:id/notes', (req, res) => {
|
||||
const db = getDb();
|
||||
const { content } = req.body;
|
||||
if (!content || !content.trim()) return res.status(400).json({ error: 'Notitie is leeg' });
|
||||
const result = db.prepare('INSERT INTO client_notes (client_id, content, created_by) VALUES (?, ?, ?)')
|
||||
.run(req.params.id, content.trim(), req.session.username || '');
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.delete('/clients/:id/notes/:noteId', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM client_notes WHERE id = ? AND client_id = ?').run(req.params.noteId, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ============ ENGAGEMENTS ============
|
||||
|
||||
router.get('/engagements', (req, res) => {
|
||||
const db = getDb();
|
||||
const { type, status, client_id } = req.query;
|
||||
let sql = `SELECT e.*, c.name as client_name,
|
||||
(SELECT COUNT(*) FROM tasks t WHERE t.engagement_id = e.id) as task_count
|
||||
FROM engagements e JOIN clients c ON c.id = e.client_id WHERE 1=1`;
|
||||
const params = [];
|
||||
if (type) { sql += ' AND e.type = ?'; params.push(type); }
|
||||
if (status) { sql += ' AND e.status = ?'; params.push(status); }
|
||||
if (client_id) { sql += ' AND e.client_id = ?'; params.push(client_id); }
|
||||
sql += ' ORDER BY e.created_at DESC';
|
||||
res.json(db.prepare(sql).all(...params));
|
||||
});
|
||||
|
||||
router.post('/engagements', (req, res) => {
|
||||
const db = getDb();
|
||||
const { client_id, type, title, description, start_date, end_date, status } = req.body;
|
||||
if (!client_id || !type || !title) return res.status(400).json({ error: 'Client, type en titel zijn verplicht' });
|
||||
const result = db.prepare(`INSERT INTO engagements (client_id, type, title, description, start_date, end_date, status)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?)`).run(client_id, type, title, description, start_date, end_date, status || 'planned');
|
||||
logAudit(req.session.userId, req.session.username, 'engagement_created', 'engagement', result.lastInsertRowid, `Engagement ${title} aangemaakt via SPA`);
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.get('/engagements/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const engagement = db.prepare('SELECT e.*, c.name as client_name FROM engagements e JOIN clients c ON c.id = e.client_id WHERE e.id = ?').get(req.params.id);
|
||||
if (!engagement) return res.status(404).json({ error: 'Engagement niet gevonden' });
|
||||
res.json({
|
||||
engagement,
|
||||
tasks: db.prepare('SELECT * FROM tasks WHERE engagement_id = ? ORDER BY created_at DESC').all(req.params.id),
|
||||
timeEntries: db.prepare('SELECT t.*, u.username FROM time_entries t LEFT JOIN users u ON u.id = t.user_id WHERE t.engagement_id = ? ORDER BY t.date DESC').all(req.params.id)
|
||||
});
|
||||
});
|
||||
|
||||
router.put('/engagements/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const { type, title, description, start_date, end_date, status, outcome } = req.body;
|
||||
db.prepare(`UPDATE engagements SET type=?, title=?, description=?, start_date=?, end_date=?, status=?, outcome=?, updated_at=datetime('now') WHERE id=?`)
|
||||
.run(type, title, description, start_date, end_date, status, outcome, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.post('/engagements/:id/status', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare("UPDATE engagements SET status=?, updated_at=datetime('now') WHERE id=?").run(req.body.status, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/engagements/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM engagements WHERE id = ?').run(req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ============ TASKS ============
|
||||
|
||||
router.get('/tasks', (req, res) => {
|
||||
const db = getDb();
|
||||
const tasks = db.prepare(`
|
||||
SELECT t.*, e.title as engagement_title, e.id as engagement_id, c.name as client_name, c.id as client_id
|
||||
FROM tasks t
|
||||
JOIN engagements e ON e.id = t.engagement_id
|
||||
JOIN clients c ON c.id = e.client_id
|
||||
ORDER BY CASE t.status WHEN 'in_progress' THEN 0 WHEN 'todo' THEN 1 WHEN 'done' THEN 2 ELSE 3 END,
|
||||
CASE t.priority WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 ELSE 3 END,
|
||||
t.due_date IS NULL, t.due_date
|
||||
`).all();
|
||||
res.json(tasks);
|
||||
});
|
||||
|
||||
router.post('/tasks', (req, res) => {
|
||||
const db = getDb();
|
||||
const { engagement_id, title, description, priority, due_date, status } = req.body;
|
||||
if (!engagement_id || !title) return res.status(400).json({ error: 'Engagement en titel zijn verplicht' });
|
||||
const result = db.prepare('INSERT INTO tasks (engagement_id, title, description, priority, due_date, status) VALUES (?,?,?,?,?,?)')
|
||||
.run(engagement_id, title, description || '', priority || 'medium', due_date || null, status || 'todo');
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.post('/tasks/:id/status', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare("UPDATE tasks SET status=?, updated_at=datetime('now') WHERE id=?").run(req.body.status, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.put('/tasks/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const { title, description, priority, due_date, status } = req.body;
|
||||
db.prepare("UPDATE tasks SET title=?, description=?, priority=?, due_date=?, status=?, updated_at=datetime('now') WHERE id=?")
|
||||
.run(title, description, priority, due_date, status, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/tasks/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM tasks WHERE id = ?').run(req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,195 @@
|
||||
const express = require('express');
|
||||
const router = express.Router();
|
||||
const { getDb, logAudit } = require('../../db');
|
||||
const emailService = require('../../email');
|
||||
|
||||
// ============ TIME ENTRIES ============
|
||||
|
||||
router.get('/time', (req, res) => {
|
||||
const db = getDb();
|
||||
const { client_id, date_from, date_to } = req.query;
|
||||
let sql = `
|
||||
SELECT t.*, c.name as client_name, e.title as engagement_title, u.username
|
||||
FROM time_entries t
|
||||
LEFT JOIN clients c ON c.id = t.client_id
|
||||
LEFT JOIN engagements e ON e.id = t.engagement_id
|
||||
LEFT JOIN users u ON u.id = t.user_id
|
||||
WHERE 1=1`;
|
||||
const params = [];
|
||||
if (client_id) { sql += ' AND t.client_id = ?'; params.push(client_id); }
|
||||
if (date_from) { sql += ' AND t.date >= ?'; params.push(date_from); }
|
||||
if (date_to) { sql += ' AND t.date <= ?'; params.push(date_to); }
|
||||
sql += ' ORDER BY t.date DESC, t.created_at DESC';
|
||||
const entries = db.prepare(sql).all(...params);
|
||||
res.json({
|
||||
entries,
|
||||
totalHours: entries.reduce((s, e) => s + e.hours, 0),
|
||||
billableHours: entries.filter(e => e.billable).reduce((s, e) => s + e.hours, 0)
|
||||
});
|
||||
});
|
||||
|
||||
router.post('/time', (req, res) => {
|
||||
const db = getDb();
|
||||
const { client_id, engagement_id, date, hours, description, billable, hourly_rate } = req.body;
|
||||
if (!date || !hours) return res.status(400).json({ error: 'Datum en uren zijn verplicht' });
|
||||
const result = db.prepare('INSERT INTO time_entries (user_id, client_id, engagement_id, date, hours, description, billable, hourly_rate) VALUES (?,?,?,?,?,?,?,?)')
|
||||
.run(req.session.userId, client_id || null, engagement_id || null, date, parseFloat(hours), description || '', billable ? 1 : 0, parseFloat(hourly_rate) || 150.0);
|
||||
logAudit(req.session.userId, req.session.username, 'time_entry_created', 'time_entry', result.lastInsertRowid, `${hours}u geregistreerd op ${date} via SPA`);
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.put('/time/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const { client_id, engagement_id, date, hours, description, billable, hourly_rate } = req.body;
|
||||
db.prepare("UPDATE time_entries SET client_id=?, engagement_id=?, date=?, hours=?, description=?, billable=?, hourly_rate=?, updated_at=datetime('now') WHERE id=?")
|
||||
.run(client_id || null, engagement_id || null, date, parseFloat(hours), description || '', billable ? 1 : 0, parseFloat(hourly_rate) || 150.0, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/time/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM time_entries WHERE id = ?').run(req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// Factuur genereren uit billable uren
|
||||
router.post('/time/create-invoice', (req, res) => {
|
||||
const db = getDb();
|
||||
const { client_id, date_from, date_to } = req.body;
|
||||
if (!client_id) return res.status(400).json({ error: 'Client is verplicht' });
|
||||
const entries = db.prepare(`
|
||||
SELECT t.*, e.title as engagement_title
|
||||
FROM time_entries t
|
||||
LEFT JOIN engagements e ON e.id = t.engagement_id
|
||||
WHERE t.client_id = ? AND t.billable = 1
|
||||
AND (? IS NULL OR t.date >= ?) AND (? IS NULL OR t.date <= ?)
|
||||
`).all(client_id, date_from || null, date_from || null, date_to || null, date_to || null);
|
||||
if (entries.length === 0) return res.status(400).json({ error: 'Geen facturabele uren gevonden' });
|
||||
const totalHours = entries.reduce((s, e) => s + e.hours, 0);
|
||||
const rate = entries[0].hourly_rate || 150;
|
||||
const subtotal = totalHours * rate;
|
||||
const tax = subtotal * 0.21;
|
||||
const count = db.prepare('SELECT COUNT(*) as cnt FROM invoices').get().cnt + 1;
|
||||
const number = `FACT-${new Date().getFullYear()}-${String(count).padStart(4, '0')}`;
|
||||
const date = new Date().toISOString().split('T')[0];
|
||||
const result = db.prepare('INSERT INTO invoices (client_id, number, status, date, due_date, subtotal, tax, total, notes) VALUES (?,?,?,?,?,?,?,?,?)')
|
||||
.run(client_id, number, 'draft', date, '', subtotal, tax, subtotal + tax, `Factuur gegenereerd uit ${entries.length} tijdregistraties`);
|
||||
const invoiceId = result.lastInsertRowid;
|
||||
const insert = db.prepare('INSERT INTO invoice_items (invoice_id, description, quantity, unit_price, total) VALUES (?,?,?,?,?)');
|
||||
entries.forEach(e => {
|
||||
const lineTotal = e.hours * (e.hourly_rate || rate);
|
||||
insert.run(invoiceId, `${e.date} - ${e.engagement_title || 'Werkzaamheden'}: ${e.description || ''}`, e.hours, e.hourly_rate || rate, lineTotal);
|
||||
});
|
||||
logAudit(req.session.userId, req.session.username, 'invoice_from_time', 'invoice', invoiceId, `Factuur ${number} gemaakt uit ${entries.length} uren via SPA`);
|
||||
res.status(201).json({ id: invoiceId, number });
|
||||
});
|
||||
|
||||
// ============ INVOICES ============
|
||||
|
||||
router.get('/invoices', (req, res) => {
|
||||
const db = getDb();
|
||||
const invoices = db.prepare(`
|
||||
SELECT i.*, c.name as client_name
|
||||
FROM invoices i JOIN clients c ON c.id = i.client_id
|
||||
ORDER BY i.created_at DESC
|
||||
`).all();
|
||||
res.json({
|
||||
invoices,
|
||||
totalOutstanding: invoices.filter(i => i.status === 'sent' || i.status === 'overdue').reduce((s, i) => s + i.total, 0),
|
||||
totalPaid: invoices.filter(i => i.status === 'paid').reduce((s, i) => s + i.total, 0)
|
||||
});
|
||||
});
|
||||
|
||||
router.post('/invoices', (req, res) => {
|
||||
const db = getDb();
|
||||
const { client_id, date, due_date, notes, items, subtotal, tax } = req.body;
|
||||
if (!client_id) return res.status(400).json({ error: 'Client is verplicht' });
|
||||
const count = db.prepare('SELECT COUNT(*) as cnt FROM invoices').get().cnt + 1;
|
||||
const number = `FACT-${new Date().getFullYear()}-${String(count).padStart(4, '0')}`;
|
||||
const sub = parseFloat(subtotal) || 0;
|
||||
const taxAmt = parseFloat(tax) || 0;
|
||||
const result = db.prepare('INSERT INTO invoices (client_id, number, status, date, due_date, subtotal, tax, total, notes) VALUES (?,?,?,?,?,?,?,?,?)')
|
||||
.run(client_id, number, 'draft', date || new Date().toISOString().split('T')[0], due_date || '', sub, taxAmt, sub + taxAmt, notes || '');
|
||||
const invoiceId = result.lastInsertRowid;
|
||||
if (items && Array.isArray(items)) {
|
||||
const insert = db.prepare('INSERT INTO invoice_items (invoice_id, description, quantity, unit_price, total) VALUES (?,?,?,?,?)');
|
||||
for (const item of items) {
|
||||
if (item.description) {
|
||||
const itemTotal = (parseFloat(item.quantity) || 1) * (parseFloat(item.unit_price) || 0);
|
||||
insert.run(invoiceId, item.description, parseFloat(item.quantity) || 1, parseFloat(item.unit_price) || 0, itemTotal);
|
||||
}
|
||||
}
|
||||
}
|
||||
logAudit(req.session.userId, req.session.username, 'invoice_created', 'invoice', invoiceId, `Factuur ${number} aangemaakt via SPA`);
|
||||
res.status(201).json({ id: invoiceId, number });
|
||||
});
|
||||
|
||||
router.get('/invoices/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const invoice = db.prepare('SELECT i.*, c.name as client_name, c.contact_name, c.contact_email, c.contact_phone, c.website FROM invoices i JOIN clients c ON c.id = i.client_id WHERE i.id = ?').get(req.params.id);
|
||||
if (!invoice) return res.status(404).json({ error: 'Factuur niet gevonden' });
|
||||
const items = db.prepare('SELECT * FROM invoice_items WHERE invoice_id = ?').all(req.params.id);
|
||||
res.json({ invoice, items });
|
||||
});
|
||||
|
||||
router.post('/invoices/:id/status', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare("UPDATE invoices SET status=?, updated_at=datetime('now') WHERE id=?").run(req.body.status, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/invoices/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM invoices WHERE id = ?').run(req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.post('/invoices/:id/send-email', async (req, res) => {
|
||||
const db = getDb();
|
||||
const invoice = db.prepare('SELECT i.*, c.name as client_name, c.contact_email FROM invoices i JOIN clients c ON c.id = i.client_id WHERE i.id = ?').get(req.params.id);
|
||||
if (!invoice) return res.status(404).json({ error: 'Factuur niet gevonden' });
|
||||
const account = db.prepare('SELECT * FROM email_accounts WHERE user_id = ? AND active = 1 LIMIT 1').get(req.session.userId);
|
||||
if (!account) return res.status(400).json({ error: 'Geen e-mailaccount geconfigureerd' });
|
||||
const items = db.prepare('SELECT * FROM invoice_items WHERE invoice_id = ?').all(req.params.id);
|
||||
let text = `Factuur ${invoice.number}\n\nClient: ${invoice.client_name}\nDatum: ${invoice.date}\nVervaldatum: ${invoice.due_date || '-'}\n\n`;
|
||||
items.forEach(item => { text += `${item.description} x${item.quantity} EUR ${(item.unit_price || 0).toFixed(2)} EUR ${(item.total || 0).toFixed(2)}\n`; });
|
||||
text += `\nSubtotaal: EUR ${(invoice.subtotal || 0).toFixed(2)}\nBTW: EUR ${(invoice.tax || 0).toFixed(2)}\nTotaal: EUR ${(invoice.total || 0).toFixed(2)}\n\nMek-Tech Consulting`;
|
||||
const to = invoice.contact_email || account.email;
|
||||
try {
|
||||
await emailService.sendEmail(account.id, to, `Factuur ${invoice.number}`, text, text.replace(/\n/g, '<br>'));
|
||||
logAudit(req.session.userId, req.session.username, 'invoice_emailed', 'invoice', invoice.id, `Factuur ${invoice.number} gemaild naar ${to}`);
|
||||
db.prepare("UPDATE invoices SET status='sent', updated_at=datetime('now') WHERE id=?").run(req.params.id);
|
||||
res.json({ ok: true });
|
||||
} catch (e) {
|
||||
res.status(500).json({ error: e.message });
|
||||
}
|
||||
});
|
||||
|
||||
// ============ FINANCE OVERZICHT ============
|
||||
|
||||
router.get('/finance', (req, res) => {
|
||||
const db = getDb();
|
||||
const year = parseInt(req.query.year) || new Date().getFullYear();
|
||||
const timeStats = db.prepare(`
|
||||
SELECT strftime('%m', date) as month, SUM(hours) as hours,
|
||||
SUM(CASE WHEN billable = 1 THEN hours ELSE 0 END) as billable_hours
|
||||
FROM time_entries WHERE strftime('%Y', date) = ?
|
||||
GROUP BY month ORDER BY month
|
||||
`).all(String(year));
|
||||
const invoiceStats = db.prepare(`
|
||||
SELECT strftime('%m', date) as month,
|
||||
SUM(CASE WHEN status = 'paid' THEN total ELSE 0 END) as paid,
|
||||
SUM(CASE WHEN status IN ('sent','overdue') THEN total ELSE 0 END) as outstanding
|
||||
FROM invoices WHERE strftime('%Y', date) = ?
|
||||
GROUP BY month ORDER BY month
|
||||
`).all(String(year));
|
||||
const totals = {
|
||||
hoursThisYear: db.prepare("SELECT COALESCE(SUM(hours),0) as s FROM time_entries WHERE strftime('%Y', date) = ?").get(String(year)).s,
|
||||
paidThisYear: db.prepare("SELECT COALESCE(SUM(total),0) as s FROM invoices WHERE status='paid' AND strftime('%Y', date) = ?").get(String(year)).s,
|
||||
outstanding: db.prepare("SELECT COALESCE(SUM(total),0) as s FROM invoices WHERE status IN ('sent','overdue')").get().s,
|
||||
draftTotal: db.prepare("SELECT COALESCE(SUM(total),0) as s FROM invoices WHERE status='draft'").get().s
|
||||
};
|
||||
res.json({ year, timeStats, invoiceStats, totals });
|
||||
});
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,122 @@
|
||||
const express = require('express');
|
||||
const router = express.Router();
|
||||
const { getDb, getSettings } = require('../../db');
|
||||
const { getServicesStatus } = require('../../lib/services');
|
||||
|
||||
// ---- Auth is publiek (login), rest vereist sessie ----
|
||||
router.use('/auth', require('./auth'));
|
||||
|
||||
// Sessie-guard voor alle andere /api/spa routes: 401 JSON (nooit redirect)
|
||||
router.use((req, res, next) => {
|
||||
if (!req.session || !req.session.userId) {
|
||||
return res.status(401).json({ error: 'Niet ingelogd' });
|
||||
}
|
||||
next();
|
||||
});
|
||||
|
||||
router.use(require('./crm'));
|
||||
router.use(require('./finance'));
|
||||
for (const mod of ['./infra', './misc']) {
|
||||
try { router.use(require(mod)); } catch (e) { console.warn(`SPA module ${mod} niet geladen:`, e.message); }
|
||||
}
|
||||
|
||||
// ============ DASHBOARD (geaggregeerde data voor SPA-home) ============
|
||||
router.get('/dashboard', async (req, res) => {
|
||||
try {
|
||||
const db = getDb();
|
||||
|
||||
const clients = db.prepare(`
|
||||
SELECT c.*,
|
||||
(SELECT COUNT(*) FROM engagements e WHERE e.client_id = c.id) as engagement_count,
|
||||
(SELECT COUNT(*) FROM engagements e WHERE e.client_id = c.id AND e.status = 'in_progress') as active_engagements,
|
||||
(SELECT MAX(a.created_at) FROM assessments a WHERE a.client_id = c.id) as last_assessment
|
||||
FROM clients c ORDER BY c.updated_at DESC LIMIT 12
|
||||
`).all();
|
||||
|
||||
const stats = {
|
||||
totalClients: db.prepare('SELECT COUNT(*) as cnt FROM clients').get().cnt,
|
||||
activeClients: db.prepare("SELECT COUNT(*) as cnt FROM clients WHERE status='active'").get().cnt,
|
||||
leads: db.prepare("SELECT COUNT(*) as cnt FROM clients WHERE status='lead'").get().cnt,
|
||||
activeEngagements: db.prepare("SELECT COUNT(*) as cnt FROM engagements WHERE status='in_progress'").get().cnt,
|
||||
totalTasks: db.prepare('SELECT COUNT(*) as cnt FROM tasks').get().cnt,
|
||||
completedTasks: db.prepare("SELECT COUNT(*) as cnt FROM tasks WHERE status='done'").get().cnt,
|
||||
overdueTasks: db.prepare("SELECT COUNT(*) as cnt FROM tasks WHERE status IN ('todo','in_progress') AND due_date < date('now')").get().cnt,
|
||||
totalRacks: db.prepare('SELECT COUNT(*) as cnt FROM racks').get().cnt,
|
||||
totalDiagrams: db.prepare('SELECT COUNT(*) as cnt FROM data_diagrams').get().cnt,
|
||||
totalNetworkDevices: db.prepare('SELECT COUNT(*) as cnt FROM network_devices').get().cnt,
|
||||
totalHours: db.prepare('SELECT COALESCE(SUM(hours),0) as h FROM time_entries').get().h,
|
||||
billableHours: db.prepare('SELECT COALESCE(SUM(hours),0) as h FROM time_entries WHERE billable=1').get().h,
|
||||
totalInvoiced: db.prepare("SELECT COALESCE(SUM(total),0) as t FROM invoices WHERE status != 'draft'").get().t,
|
||||
totalPaid: db.prepare("SELECT COALESCE(SUM(total),0) as t FROM invoices WHERE status='paid'").get().t,
|
||||
totalOutstanding: db.prepare("SELECT COALESCE(SUM(total),0) as t FROM invoices WHERE status IN ('sent','overdue')").get().t
|
||||
};
|
||||
try { stats.datacenters = db.prepare('SELECT COUNT(*) as cnt FROM datacenters').get().cnt; } catch (e) { stats.datacenters = 0; }
|
||||
try { stats.marketCompanies = db.prepare('SELECT COUNT(*) as cnt FROM tech_companies').get().cnt; } catch (e) { stats.marketCompanies = 0; }
|
||||
|
||||
const recentEngagements = db.prepare(`
|
||||
SELECT e.*, c.name as client_name FROM engagements e JOIN clients c ON c.id = e.client_id
|
||||
ORDER BY e.updated_at DESC LIMIT 8
|
||||
`).all();
|
||||
|
||||
const upcomingTasks = db.prepare(`
|
||||
SELECT t.*, e.title as engagement_title, c.name as client_name
|
||||
FROM tasks t JOIN engagements e ON e.id = t.engagement_id JOIN clients c ON c.id = e.client_id
|
||||
WHERE t.status IN ('todo','in_progress')
|
||||
ORDER BY t.due_date IS NULL, t.due_date, CASE t.priority WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 ELSE 3 END
|
||||
LIMIT 10
|
||||
`).all();
|
||||
|
||||
const recentInvoices = db.prepare(`
|
||||
SELECT i.*, c.name as client_name FROM invoices i JOIN clients c ON c.id = i.client_id
|
||||
ORDER BY i.created_at DESC LIMIT 6
|
||||
`).all();
|
||||
|
||||
const engagementByType = db.prepare('SELECT type, COUNT(*) as cnt FROM engagements GROUP BY type ORDER BY cnt DESC').all();
|
||||
const engagementByStatus = db.prepare('SELECT status, COUNT(*) as cnt FROM engagements GROUP BY status ORDER BY cnt DESC').all();
|
||||
const clientsByStatus = db.prepare('SELECT status, COUNT(*) as cnt FROM clients GROUP BY status').all();
|
||||
const invoicesByStatus = db.prepare('SELECT status, COUNT(*) as cnt, COALESCE(SUM(total),0) as total FROM invoices GROUP BY status').all();
|
||||
|
||||
// Uren per maand (afgelopen 6 maanden) voor grafiek
|
||||
const hoursByMonth = db.prepare(`
|
||||
SELECT strftime('%Y-%m', date) as month, SUM(hours) as hours,
|
||||
SUM(CASE WHEN billable=1 THEN hours ELSE 0 END) as billable
|
||||
FROM time_entries
|
||||
WHERE date >= date('now', '-6 months', 'start of month')
|
||||
GROUP BY month ORDER BY month
|
||||
`).all();
|
||||
|
||||
// Omzet per maand (afgelopen 6 maanden)
|
||||
const revenueByMonth = db.prepare(`
|
||||
SELECT strftime('%Y-%m', date) as month,
|
||||
SUM(CASE WHEN status='paid' THEN total ELSE 0 END) as paid,
|
||||
SUM(CASE WHEN status IN ('sent','overdue') THEN total ELSE 0 END) as outstanding
|
||||
FROM invoices
|
||||
WHERE date >= date('now', '-6 months', 'start of month')
|
||||
GROUP BY month ORDER BY month
|
||||
`).all();
|
||||
|
||||
const activeAdvice = db.prepare(`
|
||||
SELECT a.*, c.name as client_name
|
||||
FROM advice_log a JOIN clients c ON c.id = a.client_id
|
||||
WHERE a.dismissed = 0
|
||||
ORDER BY CASE a.priority WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 ELSE 3 END, a.created_at DESC
|
||||
LIMIT 8
|
||||
`).all();
|
||||
|
||||
const recentAudit = db.prepare('SELECT * FROM audit_log ORDER BY created_at DESC LIMIT 8').all();
|
||||
|
||||
let servicesStatus = {};
|
||||
try { servicesStatus = await getServicesStatus(); } catch (e) { servicesStatus = {}; }
|
||||
|
||||
res.json({
|
||||
stats, clients, recentEngagements, upcomingTasks, recentInvoices,
|
||||
engagementByType, engagementByStatus, clientsByStatus, invoicesByStatus,
|
||||
hoursByMonth, revenueByMonth, activeAdvice, recentAudit, servicesStatus,
|
||||
settings: { brand_name: getSettings().brand_name, showcase_url: getSettings().showcase_url }
|
||||
});
|
||||
} catch (e) {
|
||||
res.status(500).json({ error: e.message });
|
||||
}
|
||||
});
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,213 @@
|
||||
const express = require('express');
|
||||
const router = express.Router();
|
||||
const { getDb, logAudit } = require('../db');
|
||||
|
||||
// ============ RACKS ============
|
||||
|
||||
router.get('/racks', (req, res) => {
|
||||
const db = getDb();
|
||||
res.json(db.prepare(`
|
||||
SELECT r.*, c.name as client_name,
|
||||
(SELECT COUNT(*) FROM rack_devices d WHERE d.rack_id = r.id) as device_count
|
||||
FROM racks r JOIN clients c ON c.id = r.client_id
|
||||
ORDER BY r.updated_at DESC
|
||||
`).all());
|
||||
});
|
||||
|
||||
router.post('/racks', (req, res) => {
|
||||
const db = getDb();
|
||||
const { client_id, name, location, datacenter, total_units, notes } = req.body;
|
||||
if (!client_id || !name || !name.trim()) return res.status(400).json({ error: 'Client en naam zijn verplicht' });
|
||||
const result = db.prepare(`INSERT INTO racks (client_id, name, location, datacenter, total_units, notes)
|
||||
VALUES (?, ?, ?, ?, ?, ?)`).run(client_id, name.trim(), location || null, datacenter || null, total_units || 42, notes || null);
|
||||
logAudit(req.session.userId, req.session.username, 'rack_created', 'rack', result.lastInsertRowid, `Rack ${name} aangemaakt via SPA`);
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.get('/racks/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const rack = db.prepare('SELECT r.*, c.name as client_name FROM racks r JOIN clients c ON c.id = r.client_id WHERE r.id = ?').get(req.params.id);
|
||||
if (!rack) return res.status(404).json({ error: 'Rack niet gevonden' });
|
||||
res.json({
|
||||
rack,
|
||||
devices: db.prepare('SELECT * FROM rack_devices WHERE rack_id = ? ORDER BY position_u').all(req.params.id)
|
||||
});
|
||||
});
|
||||
|
||||
router.put('/racks/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const { name, location, datacenter, total_units, notes } = req.body;
|
||||
if (!name || !name.trim()) return res.status(400).json({ error: 'Naam is verplicht' });
|
||||
db.prepare(`UPDATE racks SET name=?, location=?, datacenter=?, total_units=?, notes=?, updated_at=datetime('now') WHERE id=?`)
|
||||
.run(name, location, datacenter, total_units, notes, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/racks/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM racks WHERE id = ?').run(req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ---- Rack devices ----
|
||||
|
||||
router.post('/racks/:id/devices', (req, res) => {
|
||||
const db = getDb();
|
||||
const { name, device_type, model, manufacturer, position_u, height_u, specs, mgmt_ip, notes, serial, asset_tag, status } = req.body;
|
||||
if (!name || !name.trim() || !position_u) return res.status(400).json({ error: 'Naam en positie (U) zijn verplicht' });
|
||||
const result = db.prepare(`INSERT INTO rack_devices (rack_id, name, device_type, model, manufacturer, position_u, height_u, specs, mgmt_ip, notes, serial, asset_tag, status)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
|
||||
.run(req.params.id, name.trim(), device_type || 'server', model || null, manufacturer || null, position_u, height_u || 1,
|
||||
specs || null, mgmt_ip || null, notes || null, serial || '', asset_tag || '', status || 'active');
|
||||
logAudit(req.session.userId, req.session.username, 'rack_device_created', 'rack_device', result.lastInsertRowid, `Rack device ${name} aangemaakt via SPA`);
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.put('/racks/devices/:deviceId', (req, res) => {
|
||||
const db = getDb();
|
||||
const { name, device_type, model, manufacturer, position_u, height_u, specs, mgmt_ip, notes, serial, asset_tag, status } = req.body;
|
||||
db.prepare(`UPDATE rack_devices SET name=?, device_type=?, model=?, manufacturer=?, position_u=?, height_u=?, specs=?, mgmt_ip=?, notes=?, serial=?, asset_tag=?, status=?, updated_at=datetime('now') WHERE id=?`)
|
||||
.run(name, device_type, model, manufacturer, position_u, height_u, specs, mgmt_ip, notes, serial, asset_tag, status, req.params.deviceId);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/racks/devices/:deviceId', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM rack_devices WHERE id = ?').run(req.params.deviceId);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ============ NETWORK DEVICES ============
|
||||
|
||||
router.get('/networking/devices', (req, res) => {
|
||||
const db = getDb();
|
||||
res.json(db.prepare(`
|
||||
SELECT nd.*, c.name as client_name
|
||||
FROM network_devices nd JOIN clients c ON c.id = nd.client_id
|
||||
ORDER BY nd.updated_at DESC
|
||||
`).all());
|
||||
});
|
||||
|
||||
router.post('/networking/devices', (req, res) => {
|
||||
const db = getDb();
|
||||
const { client_id, name, device_type, model, manufacturer, ip_address, mgmt_ip, ports_count, os_version, notes, status } = req.body;
|
||||
if (!client_id || !name || !name.trim() || !device_type) return res.status(400).json({ error: 'Client, naam en type zijn verplicht' });
|
||||
const result = db.prepare(`INSERT INTO network_devices (client_id, name, device_type, model, manufacturer, ip_address, mgmt_ip, ports_count, os_version, notes, status)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
|
||||
.run(client_id, name.trim(), device_type, model || null, manufacturer || null, ip_address || null, mgmt_ip || null,
|
||||
ports_count || 24, os_version || null, notes || null, status || 'active');
|
||||
logAudit(req.session.userId, req.session.username, 'network_device_created', 'network_device', result.lastInsertRowid, `Netwerkdevice ${name} aangemaakt via SPA`);
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.get('/networking/devices/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const device = db.prepare('SELECT nd.*, c.name as client_name FROM network_devices nd JOIN clients c ON c.id = nd.client_id WHERE nd.id = ?').get(req.params.id);
|
||||
if (!device) return res.status(404).json({ error: 'Netwerkdevice niet gevonden' });
|
||||
res.json({
|
||||
device,
|
||||
connections: db.prepare(`SELECT * FROM network_connections
|
||||
WHERE (from_type = 'network_device' AND from_id = ?) OR (to_type = 'network_device' AND to_id = ?)
|
||||
ORDER BY created_at DESC`).all(req.params.id, req.params.id)
|
||||
});
|
||||
});
|
||||
|
||||
router.put('/networking/devices/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const { name, device_type, model, manufacturer, ip_address, mgmt_ip, ports_count, os_version, notes, status } = req.body;
|
||||
db.prepare(`UPDATE network_devices SET name=?, device_type=?, model=?, manufacturer=?, ip_address=?, mgmt_ip=?, ports_count=?, os_version=?, notes=?, status=?, updated_at=datetime('now') WHERE id=?`)
|
||||
.run(name, device_type, model, manufacturer, ip_address, mgmt_ip, ports_count, os_version, notes, status, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/networking/devices/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM network_devices WHERE id = ?').run(req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ============ NETWORK CONNECTIONS ============
|
||||
|
||||
router.get('/networking/connections', (req, res) => {
|
||||
const db = getDb();
|
||||
res.json(db.prepare(`
|
||||
SELECT nc.*, c.name as client_name
|
||||
FROM network_connections nc JOIN clients c ON c.id = nc.client_id
|
||||
ORDER BY nc.created_at DESC
|
||||
`).all());
|
||||
});
|
||||
|
||||
router.post('/networking/connections', (req, res) => {
|
||||
const db = getDb();
|
||||
const { client_id, name, from_type, from_id, from_port, to_type, to_id, to_port, media_type, speed, vlan, status, notes } = req.body;
|
||||
if (!client_id || !from_type || !to_type) return res.status(400).json({ error: 'Client, bron- en doeltype zijn verplicht' });
|
||||
const result = db.prepare(`INSERT INTO network_connections (client_id, name, from_type, from_id, from_port, to_type, to_id, to_port, media_type, speed, vlan, status, notes)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
|
||||
.run(client_id, name || null, from_type, from_id || null, from_port || null, to_type, to_id || null, to_port || null,
|
||||
media_type || 'copper', speed || '1GbE', vlan || null, status || 'active', notes || null);
|
||||
logAudit(req.session.userId, req.session.username, 'network_connection_created', 'network_connection', result.lastInsertRowid, 'Netwerkverbinding aangemaakt via SPA');
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.put('/networking/connections/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const { name, from_type, from_id, from_port, to_type, to_id, to_port, media_type, speed, vlan, status, notes } = req.body;
|
||||
db.prepare(`UPDATE network_connections SET name=?, from_type=?, from_id=?, from_port=?, to_type=?, to_id=?, to_port=?, media_type=?, speed=?, vlan=?, status=?, notes=? WHERE id=?`)
|
||||
.run(name, from_type, from_id, from_port, to_type, to_id, to_port, media_type, speed, vlan, status, notes, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/networking/connections/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM network_connections WHERE id = ?').run(req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ============ DIAGRAMS ============
|
||||
|
||||
router.get('/diagrams', (req, res) => {
|
||||
const db = getDb();
|
||||
res.json(db.prepare(`
|
||||
SELECT d.id, d.client_id, d.name, d.description, d.diagram_type, d.engagement_id, d.rack_id, d.created_at, d.updated_at, c.name as client_name
|
||||
FROM data_diagrams d JOIN clients c ON c.id = d.client_id
|
||||
ORDER BY d.updated_at DESC
|
||||
`).all());
|
||||
});
|
||||
|
||||
router.get('/diagrams/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const diagram = db.prepare('SELECT * FROM data_diagrams WHERE id = ?').get(req.params.id);
|
||||
if (!diagram) return res.status(404).json({ error: 'Diagram niet gevonden' });
|
||||
let nodes = [], edges = [];
|
||||
try { nodes = JSON.parse(diagram.nodes || '[]'); } catch (e) { nodes = []; }
|
||||
try { edges = JSON.parse(diagram.edges || '[]'); } catch (e) { edges = []; }
|
||||
res.json({ ...diagram, nodes, edges });
|
||||
});
|
||||
|
||||
router.post('/diagrams', (req, res) => {
|
||||
const db = getDb();
|
||||
const { client_id, name, description, diagram_type, nodes, edges, engagement_id, rack_id } = req.body;
|
||||
if (!client_id || !name || !name.trim()) return res.status(400).json({ error: 'Client en naam zijn verplicht' });
|
||||
const result = db.prepare(`INSERT INTO data_diagrams (client_id, name, description, diagram_type, nodes, edges, engagement_id, rack_id)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
|
||||
.run(client_id, name.trim(), description || null, diagram_type || 'data_architecture',
|
||||
JSON.stringify(nodes || []), JSON.stringify(edges || []), engagement_id || null, rack_id || null);
|
||||
logAudit(req.session.userId, req.session.username, 'diagram_created', 'diagram', result.lastInsertRowid, `Diagram ${name} aangemaakt via SPA`);
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.put('/diagrams/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const { name, description, diagram_type, nodes, edges, engagement_id, rack_id } = req.body;
|
||||
db.prepare(`UPDATE data_diagrams SET name=?, description=?, diagram_type=?, nodes=?, edges=?, engagement_id=?, rack_id=?, updated_at=datetime('now') WHERE id=?`)
|
||||
.run(name, description, diagram_type, JSON.stringify(nodes || []), JSON.stringify(edges || []), engagement_id || null, rack_id || null, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/diagrams/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM data_diagrams WHERE id = ?').run(req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,536 @@
|
||||
const express = require('express');
|
||||
const router = express.Router();
|
||||
const bcrypt = require('bcryptjs');
|
||||
// Let op: vanuit routes/spa/ is het juiste pad '../../db' (er is geen routes/db.js)
|
||||
const { getDb, logAudit, getSettings, updateSetting } = require('../../db');
|
||||
const { PROVIDER_PRESETS, getProviders, getProvider, saveProvider, deleteProvider, chatCompletion } = require('../../lib/ai');
|
||||
const { createBackup, listBackups, deleteBackup } = require('../../lib/backup');
|
||||
const emailService = require('../../email');
|
||||
|
||||
// Lazy CREATE TABLE (kopie uit routes/projects.js) zodat de tabellen zeker bestaan
|
||||
try {
|
||||
const db = getDb();
|
||||
db.exec(`
|
||||
CREATE TABLE IF NOT EXISTS projects (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
name TEXT NOT NULL,
|
||||
description TEXT,
|
||||
client_id INTEGER,
|
||||
start_date TEXT,
|
||||
end_date TEXT,
|
||||
status TEXT DEFAULT 'planning',
|
||||
priority TEXT DEFAULT 'medium',
|
||||
budget REAL,
|
||||
created_at TEXT DEFAULT CURRENT_TIMESTAMP,
|
||||
updated_at TEXT DEFAULT CURRENT_TIMESTAMP,
|
||||
FOREIGN KEY (client_id) REFERENCES clients(id)
|
||||
)
|
||||
`);
|
||||
db.exec(`
|
||||
CREATE TABLE IF NOT EXISTS project_tasks (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
project_id INTEGER NOT NULL,
|
||||
title TEXT NOT NULL,
|
||||
description TEXT,
|
||||
status TEXT DEFAULT 'todo',
|
||||
priority TEXT DEFAULT 'medium',
|
||||
assignee_id INTEGER,
|
||||
start_date TEXT,
|
||||
due_date TEXT,
|
||||
progress INTEGER DEFAULT 0,
|
||||
created_at TEXT DEFAULT CURRENT_TIMESTAMP,
|
||||
updated_at TEXT DEFAULT CURRENT_TIMESTAMP,
|
||||
FOREIGN KEY (project_id) REFERENCES projects(id),
|
||||
FOREIGN KEY (assignee_id) REFERENCES users(id)
|
||||
)
|
||||
`);
|
||||
db.exec(`
|
||||
CREATE TABLE IF NOT EXISTS project_milestones (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
project_id INTEGER NOT NULL,
|
||||
name TEXT NOT NULL,
|
||||
target_date TEXT,
|
||||
status TEXT DEFAULT 'pending',
|
||||
created_at TEXT DEFAULT CURRENT_TIMESTAMP,
|
||||
FOREIGN KEY (project_id) REFERENCES projects(id)
|
||||
)
|
||||
`);
|
||||
} catch (e) { /* tabellen bestaan al of db nog niet klaar */ }
|
||||
|
||||
function requireAdmin(req, res, next) {
|
||||
const db = getDb();
|
||||
const user = db.prepare('SELECT * FROM users WHERE id = ?').get(req.session.userId);
|
||||
if (!user || user.role !== 'admin') return res.status(403).json({ error: 'Alleen voor admins' });
|
||||
next();
|
||||
}
|
||||
|
||||
// ============ CALENDAR ============
|
||||
|
||||
router.get('/calendar', (req, res) => {
|
||||
const db = getDb();
|
||||
const events = db.prepare(`
|
||||
SELECT e.*, c.name as client_name
|
||||
FROM calendar_events e
|
||||
LEFT JOIN clients c ON c.id = e.client_id
|
||||
ORDER BY e.start_time DESC
|
||||
`).all();
|
||||
res.json(events);
|
||||
});
|
||||
|
||||
router.post('/calendar', (req, res) => {
|
||||
const db = getDb();
|
||||
const { title, description, client_id, engagement_id, event_type, start_time, end_time, all_day, color } = req.body;
|
||||
if (!title || !start_time || !end_time) return res.status(400).json({ error: 'Titel, start- en eindtijd zijn verplicht' });
|
||||
const result = db.prepare('INSERT INTO calendar_events (user_id, client_id, engagement_id, title, description, event_type, start_time, end_time, all_day, color) VALUES (?,?,?,?,?,?,?,?,?,?)')
|
||||
.run(req.session.userId, client_id || null, engagement_id || null, title, description || '', event_type || 'meeting', start_time, end_time, (all_day === true || all_day === 1 || all_day === '1') ? 1 : 0, color || '#58a6ff');
|
||||
logAudit(req.session.userId, req.session.username, 'event_created', 'calendar_event', result.lastInsertRowid, `Event "${title}" aangemaakt via SPA`);
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.put('/calendar/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const { title, description, client_id, engagement_id, event_type, start_time, end_time, all_day, color } = req.body;
|
||||
if (!title) return res.status(400).json({ error: 'Titel is verplicht' });
|
||||
db.prepare("UPDATE calendar_events SET title=?, description=?, client_id=?, engagement_id=?, event_type=?, start_time=?, end_time=?, all_day=?, color=?, updated_at=datetime('now') WHERE id=?")
|
||||
.run(title, description, client_id || null, engagement_id || null, event_type, start_time, end_time, (all_day === true || all_day === 1 || all_day === '1') ? 1 : 0, color, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/calendar/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM calendar_events WHERE id = ?').run(req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ============ PROJECTS ============
|
||||
|
||||
router.get('/projects', (req, res) => {
|
||||
const db = getDb();
|
||||
const projects = db.prepare(`
|
||||
SELECT p.*, c.name as client_name,
|
||||
(SELECT COUNT(*) FROM project_tasks t WHERE t.project_id=p.id) as task_count,
|
||||
(SELECT COUNT(*) FROM project_tasks t WHERE t.project_id=p.id AND t.status='done') as done_count
|
||||
FROM projects p
|
||||
LEFT JOIN clients c ON c.id=p.client_id
|
||||
ORDER BY p.updated_at DESC
|
||||
`).all();
|
||||
res.json(projects);
|
||||
});
|
||||
|
||||
router.post('/projects', (req, res) => {
|
||||
const db = getDb();
|
||||
const { name, description, client_id, start_date, end_date, status, priority, budget } = req.body;
|
||||
if (!name || !name.trim()) return res.status(400).json({ error: 'Projectnaam is verplicht' });
|
||||
const result = db.prepare('INSERT INTO projects (name, description, client_id, start_date, end_date, status, priority, budget) VALUES (?,?,?,?,?,?,?,?)')
|
||||
.run(name, description || '', client_id || null, start_date || null, end_date || null, status || 'planning', priority || 'medium', budget || null);
|
||||
logAudit(req.session.userId, req.session.username, 'project_created', 'project', result.lastInsertRowid, `Project ${name} aangemaakt via SPA`);
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.get('/projects/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const project = db.prepare(`
|
||||
SELECT p.*, c.name as client_name
|
||||
FROM projects p
|
||||
LEFT JOIN clients c ON c.id = p.client_id
|
||||
WHERE p.id = ?
|
||||
`).get(req.params.id);
|
||||
if (!project) return res.status(404).json({ error: 'Project niet gevonden' });
|
||||
res.json({
|
||||
project,
|
||||
tasks: db.prepare(`
|
||||
SELECT pt.*, u.username as assignee_name
|
||||
FROM project_tasks pt
|
||||
LEFT JOIN users u ON u.id = pt.assignee_id
|
||||
WHERE pt.project_id = ?
|
||||
ORDER BY pt.due_date ASC
|
||||
`).all(req.params.id),
|
||||
milestones: db.prepare('SELECT * FROM project_milestones WHERE project_id = ? ORDER BY target_date ASC').all(req.params.id)
|
||||
});
|
||||
});
|
||||
|
||||
router.put('/projects/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const { name, description, client_id, start_date, end_date, status, priority, budget } = req.body;
|
||||
if (!name || !name.trim()) return res.status(400).json({ error: 'Projectnaam is verplicht' });
|
||||
db.prepare('UPDATE projects SET name=?, description=?, client_id=?, start_date=?, end_date=?, status=?, priority=?, budget=?, updated_at=CURRENT_TIMESTAMP WHERE id=?')
|
||||
.run(name, description || '', client_id || null, start_date || null, end_date || null, status, priority, budget || null, req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/projects/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM project_tasks WHERE project_id = ?').run(req.params.id);
|
||||
db.prepare('DELETE FROM project_milestones WHERE project_id = ?').run(req.params.id);
|
||||
db.prepare('DELETE FROM projects WHERE id = ?').run(req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.post('/projects/:id/tasks', (req, res) => {
|
||||
const db = getDb();
|
||||
const { title, description, assignee_id, status, priority, progress, due_date } = req.body;
|
||||
if (!title || !title.trim()) return res.status(400).json({ error: 'Titel is verplicht' });
|
||||
const result = db.prepare('INSERT INTO project_tasks (project_id, title, description, assignee_id, status, priority, progress, due_date) VALUES (?,?,?,?,?,?,?,?)')
|
||||
.run(req.params.id, title, description || '', assignee_id || null, status || 'todo', priority || 'medium', progress || 0, due_date || null);
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.post('/projects/tasks/:taskId/status', (req, res) => {
|
||||
const db = getDb();
|
||||
const { status } = req.body;
|
||||
const progress = status === 'done' ? 100 : status === 'in_progress' ? 50 : 0;
|
||||
db.prepare('UPDATE project_tasks SET status = ?, progress = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?')
|
||||
.run(status, progress, req.params.taskId);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.post('/projects/tasks/:taskId/progress', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('UPDATE project_tasks SET progress = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?')
|
||||
.run(req.body.progress, req.params.taskId);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/projects/tasks/:taskId', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('DELETE FROM project_tasks WHERE id = ?').run(req.params.taskId);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ============ NOTIFICATIONS ============
|
||||
|
||||
router.get('/notifications', (req, res) => {
|
||||
const db = getDb();
|
||||
const notifications = db.prepare('SELECT * FROM notifications WHERE user_id = ? OR user_id IS NULL ORDER BY created_at DESC LIMIT 100').all(req.session.userId);
|
||||
const unread = notifications.filter(n => !n.read).length;
|
||||
res.json({ notifications, unread });
|
||||
});
|
||||
|
||||
router.post('/notifications/:id/read', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('UPDATE notifications SET read=1 WHERE id=? AND (user_id=? OR user_id IS NULL)').run(req.params.id, req.session.userId);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.post('/notifications/read-all', (req, res) => {
|
||||
const db = getDb();
|
||||
db.prepare('UPDATE notifications SET read=1 WHERE user_id=? AND read=0').run(req.session.userId);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ============ SEARCH ============
|
||||
|
||||
router.get('/search', (req, res) => {
|
||||
const db = getDb();
|
||||
const q = (req.query.q || '').trim();
|
||||
if (!q) return res.json({ clients: [], engagements: [], tasks: [], diagrams: [], notes: [] });
|
||||
const like = `%${q}%`;
|
||||
|
||||
const clients = db.prepare('SELECT id, name, industry, status FROM clients WHERE name LIKE ? OR industry LIKE ? OR contact_name LIKE ? LIMIT 10').all(like, like, like);
|
||||
|
||||
const engagements = db.prepare('SELECT e.id, e.title, e.type, e.status, c.name as client_name FROM engagements e JOIN clients c ON c.id = e.client_id WHERE e.title LIKE ? OR e.description LIKE ? LIMIT 10').all(like, like);
|
||||
|
||||
const tasks = db.prepare('SELECT t.id, t.title, t.status, t.priority, e.title as engagement_title, c.name as client_name FROM tasks t JOIN engagements e ON e.id = t.engagement_id JOIN clients c ON c.id = e.client_id WHERE t.title LIKE ? LIMIT 10').all(like);
|
||||
|
||||
const diagrams = db.prepare('SELECT d.id, d.name, d.diagram_type, c.name as client_name FROM data_diagrams d JOIN clients c ON c.id = d.client_id WHERE d.name LIKE ? LIMIT 5').all(like);
|
||||
|
||||
const notes = db.prepare('SELECT n.id, n.content, n.created_at, c.name as client_name, c.id as client_id FROM client_notes n JOIN clients c ON c.id = n.client_id WHERE n.content LIKE ? LIMIT 5').all(like);
|
||||
|
||||
res.json({ clients, engagements, tasks, diagrams, notes });
|
||||
});
|
||||
|
||||
// ============ SETTINGS ============
|
||||
|
||||
const ALLOWED_SETTING_KEYS = ['brand_name', 'language', 'theme', 'default_page', 'auto_refresh', 'items_per_page', 'showcase_url', 'smtp_host', 'smtp_port', 'smtp_user', 'smtp_pass', 'smtp_from', 'slack_webhook'];
|
||||
|
||||
router.get('/settings', (req, res) => {
|
||||
const settings = getSettings();
|
||||
const masked = {};
|
||||
for (const [k, v] of Object.entries(settings)) {
|
||||
masked[k] = /pass|secret|key/i.test(k) ? (v ? '••••••••' : '') : v;
|
||||
}
|
||||
res.json(masked);
|
||||
});
|
||||
|
||||
router.post('/settings', (req, res) => {
|
||||
const body = req.body || {};
|
||||
for (const key of ALLOWED_SETTING_KEYS) {
|
||||
if (!(key in body)) continue;
|
||||
const value = body[key];
|
||||
if (value === '••••••••') continue; // gemaskeerde waarde niet opslaan
|
||||
updateSetting(key, value);
|
||||
}
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ============ USERS (admin-only) ============
|
||||
|
||||
router.get('/users', requireAdmin, (req, res) => {
|
||||
const db = getDb();
|
||||
res.json(db.prepare('SELECT id, username, email, role, created_at FROM users ORDER BY username').all());
|
||||
});
|
||||
|
||||
router.post('/users', requireAdmin, (req, res) => {
|
||||
const db = getDb();
|
||||
const { username, password, email, role } = req.body;
|
||||
if (!username || !password) return res.status(400).json({ error: 'Gebruikersnaam en wachtwoord zijn verplicht' });
|
||||
const existing = db.prepare('SELECT id FROM users WHERE username = ?').get(username);
|
||||
if (existing) return res.status(400).json({ error: 'Gebruikersnaam bestaat al' });
|
||||
const hash = bcrypt.hashSync(password, 10);
|
||||
const result = db.prepare('INSERT INTO users (username, password_hash, email, role) VALUES (?, ?, ?, ?)').run(username, hash, email || '', role || 'viewer');
|
||||
db.prepare('INSERT INTO user_settings (user_id) VALUES (?)').run(result.lastInsertRowid);
|
||||
logAudit(req.session.userId, req.session.username, 'user_created', 'user', result.lastInsertRowid, `Gebruiker ${username} aangemaakt via SPA`);
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
router.put('/users/:id', requireAdmin, (req, res) => {
|
||||
const db = getDb();
|
||||
const { email, role, password } = req.body;
|
||||
const editUser = db.prepare('SELECT id, username, email, role FROM users WHERE id = ?').get(req.params.id);
|
||||
if (!editUser) return res.status(404).json({ error: 'Gebruiker niet gevonden' });
|
||||
if (password && password.trim()) {
|
||||
const hash = bcrypt.hashSync(password, 10);
|
||||
db.prepare('UPDATE users SET password_hash=?, email=?, role=? WHERE id=?').run(hash, email || '', role, req.params.id);
|
||||
} else {
|
||||
db.prepare('UPDATE users SET email=?, role=? WHERE id=?').run(email || '', role, req.params.id);
|
||||
}
|
||||
logAudit(req.session.userId, req.session.username, 'user_updated', 'user', req.params.id, `Gebruiker ${editUser.username} bijgewerkt via SPA`);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.delete('/users/:id', requireAdmin, (req, res) => {
|
||||
const db = getDb();
|
||||
if (Number(req.params.id) === Number(req.session.userId)) return res.status(400).json({ error: 'Je kunt jezelf niet verwijderen' });
|
||||
db.prepare('DELETE FROM users WHERE id = ?').run(req.params.id);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ============ AUDIT ============
|
||||
|
||||
router.get('/audit', (req, res) => {
|
||||
const db = getDb();
|
||||
const page = parseInt(req.query.page) || 1;
|
||||
const limit = 50;
|
||||
const offset = (page - 1) * limit;
|
||||
const total = db.prepare('SELECT COUNT(*) as cnt FROM audit_log').get().cnt;
|
||||
const entries = db.prepare('SELECT * FROM audit_log ORDER BY created_at DESC LIMIT ? OFFSET ?').all(limit, offset);
|
||||
res.json({ entries, page, totalPages: Math.ceil(total / limit), total });
|
||||
});
|
||||
|
||||
// ============ BACKUP (admin-only) ============
|
||||
|
||||
router.get('/backup', requireAdmin, (req, res) => {
|
||||
res.json(listBackups());
|
||||
});
|
||||
|
||||
router.post('/backup/create', requireAdmin, (req, res) => {
|
||||
try {
|
||||
const backup = createBackup();
|
||||
logAudit(req.session.userId, req.session.username, 'backup_create', 'system', 0, backup.filename);
|
||||
res.status(201).json({ filename: backup.filename });
|
||||
} catch (e) {
|
||||
res.status(500).json({ error: 'Backup mislukt: ' + e.message });
|
||||
}
|
||||
});
|
||||
|
||||
router.post('/backup/delete/:filename', requireAdmin, (req, res) => {
|
||||
if (!deleteBackup(req.params.filename)) return res.status(404).json({ error: 'Backup niet gevonden' });
|
||||
logAudit(req.session.userId, req.session.username, 'backup_delete', 'system', 0, req.params.filename);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// ============ MARKET ============
|
||||
|
||||
router.get('/market/datacenters', (req, res) => {
|
||||
const db = getDb();
|
||||
const { search, vendor, region, type, sort } = req.query;
|
||||
let sql = 'SELECT * FROM datacenters WHERE 1=1';
|
||||
const params = [];
|
||||
if (search) { sql += ' AND (name LIKE ? OR operator LIKE ? OR city LIKE ? OR network_vendors LIKE ? OR server_vendors LIKE ? OR storage_vendors LIKE ?)'; const s = '%'+search+'%'; params.push(s,s,s,s,s,s); }
|
||||
if (vendor) { sql += ' AND (network_vendors LIKE ? OR server_vendors LIKE ? OR storage_vendors LIKE ?)'; const v = '%'+vendor+'%'; params.push(v,v,v); }
|
||||
if (region) { sql += ' AND region LIKE ?'; params.push('%'+region+'%'); }
|
||||
if (type) { sql += ' AND type = ?'; params.push(type); }
|
||||
sql += ' ORDER BY ' + (sort === 'name' ? 'name' : 'power_mw DESC');
|
||||
res.json(db.prepare(sql).all(...params));
|
||||
});
|
||||
|
||||
router.get('/market/companies', (req, res) => {
|
||||
const db = getDb();
|
||||
const { search, industry, data_warehouse, city, sort } = req.query;
|
||||
let sql = 'SELECT * FROM tech_companies WHERE 1=1';
|
||||
const params = [];
|
||||
if (search) { sql += ' AND (name LIKE ? OR industry LIKE ? OR city LIKE ? OR data_warehouse LIKE ? OR bi_tools LIKE ? OR cloud_provider LIKE ? OR ai_ml LIKE ? OR database_vendor LIKE ?)'; const s = '%'+search+'%'; params.push(s,s,s,s,s,s,s,s); }
|
||||
if (industry) { sql += ' AND industry LIKE ?'; params.push('%'+industry+'%'); }
|
||||
if (data_warehouse) { sql += ' AND data_warehouse LIKE ?'; params.push('%'+data_warehouse+'%'); }
|
||||
if (city) { sql += ' AND city LIKE ?'; params.push('%'+city+'%'); }
|
||||
sql += ' ORDER BY ' + (sort === 'name' ? 'name' : sort === 'employees' ? 'employees DESC' : 'lead_score DESC');
|
||||
res.json(db.prepare(sql).all(...params));
|
||||
});
|
||||
|
||||
router.get('/market/filters', (req, res) => {
|
||||
const db = getDb();
|
||||
const allDcs = db.prepare('SELECT * FROM datacenters').all();
|
||||
const allCompanies = db.prepare('SELECT * FROM tech_companies').all();
|
||||
res.json({
|
||||
regions: [...new Set(allDcs.map(d => d.region).filter(Boolean))].sort(),
|
||||
types: [...new Set(allDcs.map(d => d.type).filter(Boolean))].sort(),
|
||||
vendors: [...new Set(allDcs.flatMap(d => ((d.network_vendors||'')+','+(d.server_vendors||'')+','+(d.storage_vendors||'')).split(',').map(s=>s.trim()).filter(Boolean)))].sort(),
|
||||
industries: [...new Set(allCompanies.map(c => c.industry).filter(Boolean))].sort(),
|
||||
cities: [...new Set(allCompanies.map(c => c.city).filter(Boolean))].sort(),
|
||||
data_warehouses: [...new Set(allCompanies.flatMap(c => (c.data_warehouse||'').split(',').map(s=>s.trim()).filter(Boolean)))].sort()
|
||||
});
|
||||
});
|
||||
|
||||
// ============ AI ============
|
||||
|
||||
function maskApiKey(key) {
|
||||
if (!key) return '';
|
||||
return '...' + key.slice(-4);
|
||||
}
|
||||
|
||||
router.get('/ai/providers', (req, res) => {
|
||||
const providers = getProviders().map(p => ({
|
||||
...p,
|
||||
api_key: maskApiKey(getProvider(p.id)?.api_key)
|
||||
}));
|
||||
res.json(providers);
|
||||
});
|
||||
|
||||
router.post('/ai/providers', (req, res) => {
|
||||
const { id, name, provider_type, api_key, base_url, default_model, is_active, is_default } = req.body;
|
||||
const preset = PROVIDER_PRESETS[provider_type] || PROVIDER_PRESETS.custom;
|
||||
let key = api_key || '';
|
||||
if (id && (!key || key.includes('...'))) {
|
||||
const existing = getProvider(id);
|
||||
key = existing ? (existing.api_key || '') : '';
|
||||
}
|
||||
const savedId = saveProvider({
|
||||
id: id ? parseInt(id, 10) : null,
|
||||
name: name || preset.label,
|
||||
provider_type: provider_type || 'openrouter',
|
||||
api_key: key,
|
||||
base_url: base_url || preset.base_url,
|
||||
default_model: default_model || preset.models[0] || '',
|
||||
is_active: is_active === true || is_active === 1 || is_active === '1',
|
||||
is_default: is_default === true || is_default === 1 || is_default === '1'
|
||||
});
|
||||
logAudit(req.session.userId, req.session.username, 'ai_provider_saved', 'ai_provider', savedId, name || preset.label);
|
||||
if (id) return res.json({ ok: true, id: savedId });
|
||||
res.status(201).json({ id: savedId });
|
||||
});
|
||||
|
||||
router.delete('/ai/providers/:id', (req, res) => {
|
||||
deleteProvider(req.params.id);
|
||||
logAudit(req.session.userId, req.session.username, 'ai_provider_deleted', 'ai_provider', req.params.id, '');
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
router.post('/ai/chat', async (req, res) => {
|
||||
try {
|
||||
const { message, client_id, provider_id } = req.body;
|
||||
if (!message || !message.trim()) return res.status(400).json({ error: 'Bericht is verplicht' });
|
||||
const result = await chatCompletion([{ role: 'user', content: message }], {
|
||||
providerId: provider_id ? parseInt(provider_id, 10) : null
|
||||
});
|
||||
const content = result.choices?.[0]?.message?.content || '';
|
||||
if (client_id) {
|
||||
getDb().prepare('INSERT INTO client_notes (client_id, content, created_by) VALUES (?, ?, ?)')
|
||||
.run(client_id, `[AI] ${content.slice(0, 2000)}`, req.session.username || 'ai');
|
||||
}
|
||||
res.json({ content, model: result.model });
|
||||
} catch (e) {
|
||||
res.status(500).json({ error: e.message });
|
||||
}
|
||||
});
|
||||
|
||||
// ============ EMAIL ============
|
||||
|
||||
function getActiveAccount(userId) {
|
||||
const db = getDb();
|
||||
return db.prepare('SELECT * FROM email_accounts WHERE user_id = ? AND active = 1 LIMIT 1').get(userId);
|
||||
}
|
||||
|
||||
router.get('/email/messages', (req, res) => {
|
||||
const db = getDb();
|
||||
const messages = db.prepare(`
|
||||
SELECT m.*, a.email as account_email
|
||||
FROM email_messages m
|
||||
JOIN email_accounts a ON a.id = m.account_id
|
||||
WHERE a.user_id = ?
|
||||
ORDER BY m.date DESC LIMIT 50
|
||||
`).all(req.session.userId);
|
||||
res.json(messages);
|
||||
});
|
||||
|
||||
router.get('/email/messages/:id', (req, res) => {
|
||||
const db = getDb();
|
||||
const msg = db.prepare(`
|
||||
SELECT m.*, a.email as account_email
|
||||
FROM email_messages m
|
||||
JOIN email_accounts a ON a.id = m.account_id
|
||||
WHERE m.id = ? AND a.user_id = ?
|
||||
`).get(req.params.id, req.session.userId);
|
||||
if (!msg) return res.status(404).json({ error: 'Bericht niet gevonden' });
|
||||
db.prepare('UPDATE email_messages SET seen = 1 WHERE id = ?').run(req.params.id);
|
||||
msg.seen = 1;
|
||||
res.json(msg);
|
||||
});
|
||||
|
||||
router.post('/email/sync', async (req, res) => {
|
||||
const account = getActiveAccount(req.session.userId);
|
||||
if (!account) return res.status(400).json({ error: 'Geen actief email account geconfigureerd' });
|
||||
try {
|
||||
await emailService.fetchAndStoreMessages(account.id, 'INBOX', 50);
|
||||
logAudit(req.session.userId, req.session.username, 'email_sync', 'email', account.id, 'Email inbox gesynchroniseerd via SPA');
|
||||
res.json({ ok: true });
|
||||
} catch (e) {
|
||||
res.status(500).json({ error: e.message });
|
||||
}
|
||||
});
|
||||
|
||||
router.post('/email/send', async (req, res) => {
|
||||
const account = getActiveAccount(req.session.userId);
|
||||
if (!account) return res.status(400).json({ error: 'Geen actief email account geconfigureerd' });
|
||||
const { to, cc, bcc, subject, text, html } = req.body;
|
||||
if (!to || !subject) return res.status(400).json({ error: 'Ontvanger en onderwerp zijn verplicht' });
|
||||
try {
|
||||
await emailService.sendEmail(account.id, to, subject, text, html, cc, bcc);
|
||||
logAudit(req.session.userId, req.session.username, 'email_sent', 'email', account.id, `Email naar ${to}: ${subject}`);
|
||||
res.json({ ok: true });
|
||||
} catch (e) {
|
||||
res.status(500).json({ error: e.message });
|
||||
}
|
||||
});
|
||||
|
||||
router.get('/email/accounts', (req, res) => {
|
||||
const db = getDb();
|
||||
const accounts = db.prepare('SELECT id, email, name, imap_host, imap_port, imap_secure, imap_user, smtp_host, smtp_port, smtp_secure, smtp_user, active, created_at FROM email_accounts WHERE user_id = ?').all(req.session.userId);
|
||||
res.json(accounts);
|
||||
});
|
||||
|
||||
router.post('/email/accounts', (req, res) => {
|
||||
const db = getDb();
|
||||
const { id, email, name, imap_host, imap_port, imap_secure, imap_user, imap_pass, smtp_host, smtp_port, smtp_secure, smtp_user, smtp_pass } = req.body;
|
||||
if (!email || !imap_host || !imap_user) return res.status(400).json({ error: 'Email, IMAP host en gebruiker zijn verplicht' });
|
||||
const imapSecure = (imap_secure === true || imap_secure === 1 || imap_secure === '1') ? 1 : 0;
|
||||
const smtpSecure = (smtp_secure === true || smtp_secure === 1 || smtp_secure === '1') ? 1 : 0;
|
||||
if (id) {
|
||||
const existing = db.prepare('SELECT * FROM email_accounts WHERE id = ? AND user_id = ?').get(id, req.session.userId);
|
||||
if (!existing) return res.status(404).json({ error: 'Account niet gevonden' });
|
||||
db.prepare(`UPDATE email_accounts SET email=?, name=?, imap_host=?, imap_port=?, imap_secure=?, imap_user=?, imap_pass=?, smtp_host=?, smtp_port=?, smtp_secure=?, smtp_user=?, smtp_pass=? WHERE id=? AND user_id=?`)
|
||||
.run(email, name || '', imap_host, parseInt(imap_port) || 993, imapSecure, imap_user,
|
||||
imap_pass || existing.imap_pass, smtp_host || imap_host, parseInt(smtp_port) || 587, smtpSecure,
|
||||
smtp_user || imap_user, smtp_pass || existing.smtp_pass, id, req.session.userId);
|
||||
return res.json({ ok: true, id: Number(id) });
|
||||
}
|
||||
if (!imap_pass) return res.status(400).json({ error: 'IMAP wachtwoord is verplicht' });
|
||||
const result = db.prepare(`INSERT INTO email_accounts (user_id, email, name, imap_host, imap_port, imap_secure, imap_user, imap_pass, smtp_host, smtp_port, smtp_secure, smtp_user, smtp_pass)
|
||||
VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)`).run(
|
||||
req.session.userId, email, name || '', imap_host, parseInt(imap_port) || 993, imapSecure,
|
||||
imap_user, imap_pass, smtp_host || imap_host, parseInt(smtp_port) || 587, smtpSecure,
|
||||
smtp_user || imap_user, smtp_pass || imap_pass
|
||||
);
|
||||
res.status(201).json({ id: result.lastInsertRowid });
|
||||
});
|
||||
|
||||
module.exports = router;
|
||||
@@ -50,6 +50,10 @@ app.use((req, res, next) => {
|
||||
const publicPaths = ['/login', '/auth/login', '/css/dynamic.css', '/js/theme.js', '/health'];
|
||||
const publicPrefixes = ['/wachtwoord-vergeten', '/wachtwoord-reset/', '/css/', '/js/', '/health'];
|
||||
if (!publicPaths.includes(req.path) && !publicPrefixes.some(p => req.path.startsWith(p)) && !req.session.userId) {
|
||||
// API-aanroepen krijgen 401 JSON i.p.v. een HTML-redirect (o.a. voor de React SPA)
|
||||
if (req.path.startsWith('/api/')) {
|
||||
return res.status(401).json({ error: 'Niet ingelogd' });
|
||||
}
|
||||
return res.redirect('/login');
|
||||
}
|
||||
res.locals.user = req.session.userId ? { username: req.session.username } : null;
|
||||
@@ -172,6 +176,20 @@ app.use('/reports', require('./routes/reports'));
|
||||
app.use('/integrations', require('./routes/integrations'));
|
||||
app.use('/ai', require('./routes/ai'));
|
||||
app.use('/api/v1', require('./routes/api'));
|
||||
app.use('/api/spa', require('./routes/spa'));
|
||||
|
||||
// ---- React SPA (production build in public/spa) ----
|
||||
const spaDir = path.join(__dirname, 'public', 'spa');
|
||||
if (require('fs').existsSync(spaDir)) {
|
||||
app.use('/app', express.static(spaDir));
|
||||
// History-API fallback: alle niet-bestand paden onder /app -> index.html
|
||||
app.get('/app/*', (req, res) => {
|
||||
res.sendFile(path.join(spaDir, 'index.html'));
|
||||
});
|
||||
app.get('/app', (req, res) => {
|
||||
res.sendFile(path.join(spaDir, 'index.html'));
|
||||
});
|
||||
}
|
||||
|
||||
app.get('/health', async (req, res) => {
|
||||
try {
|
||||
|
||||
Reference in New Issue
Block a user