v1.1: Add CIDR subnet filtering and Agent filter in Devices page

backend/routes/dashboard/deviceLabeling/updateLabel.js

@@ -0,0 +1,51 @@
+const { CustomDeviceLabel, DeviceStat } = require('../../../models/Schemas');
+
+async function updateLabelHandler(req, res) {
+  try {
+    // EXECUTIVE role is read-only — explicitly blocked from writing labels
+    if (req.user?.role === 'EXECUTIVE') {
+      return res.status(403).json({ ok: false, error: 'Executive role cannot modify device labels.' });
+    }
+
+    const isAuthorized = req.user?.role === 'SUPER_ADMIN' ||
+      req.user?.role === 'TENANT_ADMIN' ||
+      req.user?.role === 'COMPANY_ADMIN' ||
+      req.user?.role === 'COMPANY_OPERATOR' ||
+      req.user?._originalRole === 'SUPER_ADMIN' ||
+      req.user?._originalRole === 'TENANT_ADMIN';
+
+    if (!isAuthorized) {
+      return res.status(403).json({ ok: false, error: 'Only administrators can update device labels.' });
+    }
+
+    const { mac_address, device_label } = req.body;
+    if (!mac_address) return res.status(400).json({ ok: false, error: 'mac_address required' });
+    if (device_label === undefined) return res.status(400).json({ ok: false, error: 'device_label required' });
+
+    const isGlobalUser = req.user?.role === 'SUPER_ADMIN' ||
+      ((!req.user?.site_uuid || req.user?.site_uuid === 'default') && ['SOC_ANALYST', 'ENGINEER'].includes(req.user?.role)) ||
+      req.user?._originalRole === 'SUPER_ADMIN';
+
+    if (!isGlobalUser && req.user?.site_uuid) {
+      const deviceExists = await DeviceStat.findOne({
+        mac_address,
+        site_uuid: req.user.site_uuid
+      });
+      if (!deviceExists) {
+        return res.status(403).json({ ok: false, error: 'Unauthorized: This device does not belong to your tenant.' });
+      }
+    }
+
+    await CustomDeviceLabel.findOneAndUpdate(
+      { mac_address },
+      { device_label },
+      { upsert: true, new: true }
+    );
+
+    res.json({ ok: true, message: 'Device label updated successfully' });
+  } catch (err) {
+    res.status(500).json({ ok: false, error: err.message });
+  }
+}
+
+module.exports = updateLabelHandler;