AI Bot
206 lines
7.7 KiB
JavaScript
206 lines
7.7 KiB
JavaScript
const express = require('express');
|
|
const cors = require('cors');
|
|
const bcrypt = require('bcrypt');
|
|
const jwt = require('jsonwebtoken');
|
|
const { v4: uuidv4 } = require('uuid');
|
|
const multer = require('multer');
|
|
const path = require('path');
|
|
const fs = require('fs');
|
|
|
|
const { db, run, get, all } = require('./database');
|
|
|
|
const app = express();
|
|
app.use(cors());
|
|
app.use(express.json({ limit: '500mb' }));
|
|
app.use(express.urlencoded({ limit: '500mb', extended: true }));
|
|
|
|
const JWT_SECRET = 'viz-3d-local-secret-key-1234';
|
|
|
|
// Ensure uploads dir exists
|
|
const uploadsDir = path.join(__dirname, 'uploads');
|
|
if (!fs.existsSync(uploadsDir)) {
|
|
fs.mkdirSync(uploadsDir, { recursive: true });
|
|
}
|
|
|
|
app.use('/uploads', express.static(uploadsDir));
|
|
|
|
// Multer storage
|
|
const storage = multer.diskStorage({
|
|
destination: function (req, file, cb) {
|
|
cb(null, uploadsDir);
|
|
},
|
|
filename: function (req, file, cb) {
|
|
const uniqueSuffix = Date.now() + '-' + Math.round(Math.random() * 1E9);
|
|
cb(null, uniqueSuffix + '-' + file.originalname);
|
|
}
|
|
});
|
|
const upload = multer({ storage: storage });
|
|
|
|
// --- AUTH MIDDLEWARE ---
|
|
const authenticate = (req, res, next) => {
|
|
const authHeader = req.headers.authorization;
|
|
if (!authHeader) return res.status(401).json({ error: 'No token provided' });
|
|
const token = authHeader.split(' ')[1];
|
|
jwt.verify(token, JWT_SECRET, (err, decoded) => {
|
|
if (err) return res.status(401).json({ error: 'Invalid token' });
|
|
req.user = decoded;
|
|
next();
|
|
});
|
|
};
|
|
|
|
// --- ROUTES ---
|
|
|
|
// 1. Auth Register
|
|
app.post('/api/auth/register', async (req, res) => {
|
|
const { email, password } = req.body;
|
|
if (!email || !password) return res.status(400).json({ error: 'Email and password required' });
|
|
try {
|
|
const existing = await get('SELECT * FROM profiles WHERE email = ?', [email]);
|
|
if (existing) return res.status(400).json({ error: 'User already exists' });
|
|
|
|
const hash = await bcrypt.hash(password, 10);
|
|
const id = uuidv4();
|
|
// First user becomes admin and is automatically active
|
|
const countRow = await get('SELECT COUNT(*) as count FROM profiles');
|
|
const role = countRow.count === 0 ? 'admin' : 'user';
|
|
const is_active = countRow.count === 0 ? 1 : 0;
|
|
|
|
await run(
|
|
'INSERT INTO profiles (id, email, password_hash, role, api_credits, storage_limit_mb, is_active) VALUES (?, ?, ?, ?, ?, ?, ?)',
|
|
[id, email, hash, role, 10, 500, is_active]
|
|
);
|
|
|
|
if (is_active === 0) {
|
|
return res.json({ status: 'pending', message: 'Account created. Please contact an administrator to activate your account.' });
|
|
}
|
|
|
|
const token = jwt.sign({ id, email, role }, JWT_SECRET, { expiresIn: '7d' });
|
|
const profile = await get('SELECT id, email, role, api_credits, storage_limit_mb, is_active FROM profiles WHERE id = ?', [id]);
|
|
res.json({ status: 'active', token, profile });
|
|
} catch (err) {
|
|
res.status(500).json({ error: err.message });
|
|
}
|
|
});
|
|
|
|
// 2. Auth Login
|
|
app.post('/api/auth/login', async (req, res) => {
|
|
const { email, password } = req.body;
|
|
try {
|
|
const user = await get('SELECT * FROM profiles WHERE email = ?', [email]);
|
|
if (!user) return res.status(400).json({ error: 'Invalid credentials' });
|
|
|
|
const valid = await bcrypt.compare(password, user.password_hash);
|
|
if (!valid) return res.status(400).json({ error: 'Invalid credentials' });
|
|
|
|
if (user.is_active === 0) {
|
|
return res.status(403).json({ error: 'Account pending admin approval. Please contact an administrator.' });
|
|
}
|
|
|
|
const token = jwt.sign({ id: user.id, email: user.email, role: user.role }, JWT_SECRET, { expiresIn: '7d' });
|
|
const profile = { id: user.id, email: user.email, role: user.role, api_credits: user.api_credits, storage_limit_mb: user.storage_limit_mb, is_active: user.is_active };
|
|
res.json({ token, profile });
|
|
} catch (err) {
|
|
res.status(500).json({ error: err.message });
|
|
}
|
|
});
|
|
|
|
// 3. Auth Me
|
|
app.get('/api/auth/me', authenticate, async (req, res) => {
|
|
try {
|
|
const profile = await get('SELECT id, email, role, api_credits, storage_limit_mb, is_active FROM profiles WHERE id = ?', [req.user.id]);
|
|
res.json({ profile });
|
|
} catch (err) {
|
|
res.status(500).json({ error: err.message });
|
|
}
|
|
});
|
|
|
|
// 4. Get all projects for user
|
|
app.get('/api/projects', authenticate, async (req, res) => {
|
|
try {
|
|
const projects = await all('SELECT id, name FROM projects WHERE user_id = ?', [req.user.id]);
|
|
res.json({ projects });
|
|
} catch (err) {
|
|
res.status(500).json({ error: err.message });
|
|
}
|
|
});
|
|
|
|
// 5. Get project by ID
|
|
app.get('/api/projects/:id', authenticate, async (req, res) => {
|
|
try {
|
|
const project = await get('SELECT * FROM projects WHERE id = ? AND user_id = ?', [req.params.id, req.user.id]);
|
|
if (!project) return res.status(404).json({ error: 'Project not found' });
|
|
if (project.scene_data) {
|
|
project.scene_data = JSON.parse(project.scene_data);
|
|
}
|
|
res.json({ project });
|
|
} catch (err) {
|
|
res.status(500).json({ error: err.message });
|
|
}
|
|
});
|
|
|
|
// 6. Save (create or update) project
|
|
app.post('/api/projects', authenticate, async (req, res) => {
|
|
const { id, name, scene_data } = req.body;
|
|
const projectId = id || uuidv4();
|
|
try {
|
|
const existing = await get('SELECT * FROM projects WHERE id = ?', [projectId]);
|
|
if (existing) {
|
|
if (existing.user_id !== req.user.id) return res.status(403).json({ error: 'Forbidden' });
|
|
await run('UPDATE projects SET name = ?, scene_data = ? WHERE id = ?', [name, JSON.stringify(scene_data), projectId]);
|
|
} else {
|
|
await run('INSERT INTO projects (id, user_id, name, scene_data) VALUES (?, ?, ?, ?)', [projectId, req.user.id, name, JSON.stringify(scene_data)]);
|
|
}
|
|
res.json({ success: true, id: projectId });
|
|
} catch (err) {
|
|
res.status(500).json({ error: err.message });
|
|
}
|
|
});
|
|
|
|
// 7. Get users (Admin only)
|
|
app.get('/api/users', authenticate, async (req, res) => {
|
|
if (req.user.role !== 'admin') return res.status(403).json({ error: 'Forbidden' });
|
|
try {
|
|
const users = await all('SELECT id, email, role, api_credits, storage_limit_mb, is_active FROM profiles');
|
|
res.json({ users });
|
|
} catch (err) {
|
|
res.status(500).json({ error: err.message });
|
|
}
|
|
});
|
|
|
|
// 8. Update user (Admin only)
|
|
app.put('/api/users/:id', authenticate, async (req, res) => {
|
|
if (req.user.role !== 'admin') return res.status(403).json({ error: 'Forbidden' });
|
|
const { role, api_credits, storage_limit_mb, is_active } = req.body;
|
|
try {
|
|
await run('UPDATE profiles SET role = ?, api_credits = ?, storage_limit_mb = ?, is_active = ? WHERE id = ?', [role, api_credits, storage_limit_mb, is_active !== undefined ? is_active : 1, req.params.id]);
|
|
res.json({ success: true });
|
|
} catch (err) {
|
|
res.status(500).json({ error: err.message });
|
|
}
|
|
});
|
|
|
|
// 9. Deduct API credit
|
|
app.post('/api/users/deduct-credit', authenticate, async (req, res) => {
|
|
try {
|
|
const user = await get('SELECT api_credits FROM profiles WHERE id = ?', [req.user.id]);
|
|
if (user.api_credits <= 0) return res.status(400).json({ error: 'Not enough credits' });
|
|
await run('UPDATE profiles SET api_credits = api_credits - 1 WHERE id = ?', [req.user.id]);
|
|
const updated = await get('SELECT api_credits FROM profiles WHERE id = ?', [req.user.id]);
|
|
res.json({ api_credits: updated.api_credits });
|
|
} catch (err) {
|
|
res.status(500).json({ error: err.message });
|
|
}
|
|
});
|
|
|
|
// 10. Upload file
|
|
app.post('/api/upload', authenticate, upload.single('file'), (req, res) => {
|
|
if (!req.file) return res.status(400).json({ error: 'No file uploaded' });
|
|
const url = `${req.protocol}://${req.get('host')}/uploads/${req.file.filename}`;
|
|
res.json({ url });
|
|
});
|
|
|
|
const PORT = process.env.PORT || 3005;
|
|
app.listen(PORT, () => {
|
|
console.log(`Backend server running on port ${PORT}`);
|
|
});
|