101 lines
2.9 KiB
TypeScript
101 lines
2.9 KiB
TypeScript
import postgres from 'npm:postgres@3.4.4';
|
|
import bcrypt from 'npm:bcryptjs@2.4.3';
|
|
import jwt from 'npm:jsonwebtoken@9.0.2';
|
|
|
|
function getDb() {
|
|
return postgres({
|
|
host: Deno.env.get('PG_HOST'),
|
|
port: parseInt(Deno.env.get('PG_PORT') || '5432'),
|
|
user: Deno.env.get('PG_USER'),
|
|
password: Deno.env.get('PG_PASSWORD'),
|
|
database: Deno.env.get('PG_DBNAME'),
|
|
ssl: false,
|
|
max: 1,
|
|
});
|
|
}
|
|
|
|
function verifyToken(body) {
|
|
const token = body._auth_token;
|
|
if (!token) {
|
|
return { error: true, status: 401, message: 'Neautorizovaný prístup' };
|
|
}
|
|
try {
|
|
return jwt.verify(token, Deno.env.get('JWT_SECRET'));
|
|
} catch {
|
|
return { error: true, status: 401, message: 'Neplatný token' };
|
|
}
|
|
}
|
|
|
|
Deno.serve(async (req) => {
|
|
const sql = getDb();
|
|
|
|
try {
|
|
const body = await req.json();
|
|
const user = verifyToken(body);
|
|
|
|
if (user.error) {
|
|
await sql.end();
|
|
return Response.json({ error: user.message }, { status: user.status });
|
|
}
|
|
|
|
if (user.role !== 'admin') {
|
|
await sql.end();
|
|
return Response.json({ error: 'Prístup len pre administrátora' }, { status: 403 });
|
|
}
|
|
|
|
const { action } = body;
|
|
|
|
if (action === 'list') {
|
|
const users = await sql`
|
|
SELECT id, email, full_name, role, created_at
|
|
FROM app_users
|
|
ORDER BY created_at DESC
|
|
`;
|
|
await sql.end();
|
|
return Response.json({ users });
|
|
}
|
|
|
|
if (action === 'create') {
|
|
const { email, password, full_name, role } = body;
|
|
if (!email || !password) {
|
|
await sql.end();
|
|
return Response.json({ error: 'Email a heslo sú povinné' }, { status: 400 });
|
|
}
|
|
const hash = await bcrypt.hash(password, 10);
|
|
const result = await sql`
|
|
INSERT INTO app_users (email, password_hash, full_name, role)
|
|
VALUES (${email}, ${hash}, ${full_name || ''}, ${role || 'user'})
|
|
RETURNING id
|
|
`;
|
|
await sql.end();
|
|
return Response.json({ success: true, id: result[0].id });
|
|
}
|
|
|
|
if (action === 'delete') {
|
|
if (body.userId === user.id) {
|
|
await sql.end();
|
|
return Response.json({ error: 'Nemôžete vymazať vlastný účet' }, { status: 400 });
|
|
}
|
|
await sql`DELETE FROM app_users WHERE id = ${body.userId}`;
|
|
await sql.end();
|
|
return Response.json({ success: true });
|
|
}
|
|
|
|
if (action === 'changePassword') {
|
|
if (!body.newPassword) {
|
|
await sql.end();
|
|
return Response.json({ error: 'Nové heslo je povinné' }, { status: 400 });
|
|
}
|
|
const hash = await bcrypt.hash(body.newPassword, 10);
|
|
await sql`UPDATE app_users SET password_hash = ${hash} WHERE id = ${body.userId}`;
|
|
await sql.end();
|
|
return Response.json({ success: true });
|
|
}
|
|
|
|
await sql.end();
|
|
return Response.json({ error: 'Neznáma akcia' }, { status: 400 });
|
|
} catch (error) {
|
|
await sql.end();
|
|
return Response.json({ error: error.message }, { status: 500 });
|
|
}
|
|
}); |