first commit

server/routes/auth.js

@@ -0,0 +1,62 @@
+import { Router } from 'express';
+import bcrypt from 'bcryptjs';
+import { getAdmin, updateAdminPassword } from '../db.js';
+import { requireAuth, signToken } from '../auth.js';
+
+const router = Router();
+const loginAttempts = new Map();
+
+function checkRateLimit(ip) {
+  const now = Date.now();
+  const record = loginAttempts.get(ip) || { count: 0, resetAt: now + 60000 };
+  if (now > record.resetAt) {
+    loginAttempts.set(ip, { count: 1, resetAt: now + 60000 });
+    return true;
+  }
+  if (record.count >= 5) return false;
+  record.count++;
+  loginAttempts.set(ip, record);
+  return true;
+}
+
+router.post('/login', (req, res) => {
+  const ip = req.ip;
+  if (!checkRateLimit(ip)) {
+    return res.status(429).json({ error: 'Too many login attempts', code: 'RATE_LIMITED' });
+  }
+
+  const { username, password } = req.body;
+  if (!username || !password) {
+    return res.status(400).json({ error: 'Username and password required', code: 'VALIDATION' });
+  }
+
+  const admin = getAdmin();
+  if (!admin || username !== admin.username || !bcrypt.compareSync(password, admin.passwordHash)) {
+    return res.status(401).json({ error: 'Invalid credentials', code: 'UNAUTHORIZED' });
+  }
+
+  const token = signToken(username);
+  const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
+  res.json({ token, expiresAt });
+});
+
+router.get('/me', requireAuth, (req, res) => {
+  res.json({ username: req.user.username });
+});
+
+router.put('/password', requireAuth, (req, res) => {
+  const { currentPassword, newPassword } = req.body;
+  if (!currentPassword || !newPassword || newPassword.length < 6) {
+    return res.status(400).json({ error: 'Valid current and new password (min 6 chars) required', code: 'VALIDATION' });
+  }
+
+  const admin = getAdmin();
+  if (!bcrypt.compareSync(currentPassword, admin.passwordHash)) {
+    return res.status(401).json({ error: 'Current password is incorrect', code: 'UNAUTHORIZED' });
+  }
+
+  updateAdminPassword(bcrypt.hashSync(newPassword, 12));
+  res.json({ message: 'Password updated' });
+});
+
+export default router;

server/routes/content.js

@@ -0,0 +1,30 @@
+import { Router } from 'express';
+import { getContent, updateSection, updateAllContent } from '../db.js';
+import { requireAuth } from '../auth.js';
+import seedContent from '../seed/default-content.json' with { type: 'json' };
+
+const VALID_SECTIONS = Object.keys(seedContent);
+
+const router = Router();
+
+router.get('/', (_req, res) => {
+  const { content, updatedAt } = getContent();
+  res.json({ ...content, _updatedAt: updatedAt });
+});
+
+router.put('/', requireAuth, (req, res) => {
+  const { _updatedAt, ...content } = req.body;
+  const updatedAt = updateAllContent(content);
+  res.json({ message: 'Content updated', updatedAt });
+});
+
+router.put('/:section', requireAuth, (req, res) => {
+  const { section } = req.params;
+  if (!VALID_SECTIONS.includes(section)) {
+    return res.status(404).json({ error: `Unknown section: ${section}`, code: 'NOT_FOUND' });
+  }
+  const updatedAt = updateSection(section, req.body);
+  res.json({ message: `${section} updated`, updatedAt });
+});
+
+export default router;

server/routes/upload.js

@@ -0,0 +1,49 @@
+import { Router } from 'express';
+import multer from 'multer';
+import path from 'path';
+import fs from 'fs';
+import { fileURLToPath } from 'url';
+import { requireAuth } from '../auth.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const UPLOAD_DIR = process.env.UPLOAD_DIR || path.join(__dirname, '..', 'uploads');
+
+if (!fs.existsSync(UPLOAD_DIR)) {
+  fs.mkdirSync(UPLOAD_DIR, { recursive: true });
+}
+
+const storage = multer.diskStorage({
+  destination: (_req, _file, cb) => cb(null, UPLOAD_DIR),
+  filename: (_req, file, cb) => {
+    const ext = path.extname(file.originalname).toLowerCase();
+    const base = path.basename(file.originalname, ext).replace(/[^a-zA-Z0-9-_]/g, '_').slice(0, 50);
+    cb(null, `${base}-${Date.now()}${ext}`);
+  },
+});
+
+const upload = multer({
+  storage,
+  limits: { fileSize: 50 * 1024 * 1024 },
+  fileFilter: (_req, file, cb) => {
+    const allowed = /^image\/|^video\/mp4$/;
+    if (allowed.test(file.mimetype)) cb(null, true);
+    else cb(new Error('Only images and MP4 videos are allowed'));
+  },
+});
+
+const router = Router();
+
+router.post('/', requireAuth, upload.single('file'), (req, res) => {
+  if (!req.file) {
+    return res.status(400).json({ error: 'No file uploaded', code: 'VALIDATION' });
+  }
+  res.json({ url: `/uploads/${req.file.filename}`, filename: req.file.filename });
+});
+
+router.delete('/:filename', requireAuth, (req, res) => {
+  const filePath = path.join(UPLOAD_DIR, path.basename(req.params.filename));
+  if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
+  res.json({ message: 'File deleted' });
+});
+
+export default router;