feat(source2): lock dark mode, sans-serif typography, and all recent updates

backend/routes/auth/viewAs.js

@@ -6,7 +6,7 @@ const { requireAdmin, requireAuth, JWT_SECRET } = require('./helpers');
 
 const router = express.Router();
 
-// Helper to block SOC_ANALYST from starting view-as sessions
+// Block SOC_ANALYST from starting view-as sessions; EXECUTIVE is allowed (read-only viewer)
 function blockAnalyst(req, res, next) {
   if (req.adminUser.role === 'SOC_ANALYST') {
     return res.status(403).json({ ok: false, error: 'Aksi ini tidak diizinkan untuk peran SOC Analyst' });
@@ -14,40 +14,56 @@ function blockAnalyst(req, res, next) {
   next();
 }
 
-// POST /api/auth/admin/view-as — admin masuk mode "lihat sebagai agent"
+// POST /api/auth/admin/view-as — admin masuk mode "lihat sebagai user/agent"
 router.post('/admin/view-as', requireAdmin, blockAnalyst, async (req, res) => {
-  const { agent_uuid, agent_label } = req.body;
+  const { agent_uuid, agent_label, target_user_id, target_username, target_role } = req.body;
   if (!agent_uuid) return res.status(400).json({ ok: false, error: 'agent_uuid wajib diisi' });
 
   try {
-    const viewToken = jwt.sign(
-      {
-        adminId: req.adminUser.id,
-        adminUsername: req.adminUser.username,
-        viewAs: agent_uuid,
-        viewAsLabel: agent_label || agent_uuid,
-        type: 'view-as'
-      },
-      JWT_SECRET,
-      { expiresIn: '8h' }
-    );
-
-    // Simpan log audit ke MongoDB
     const ViewAsLog = mongoose.model('ViewAsLog');
+    const User = mongoose.model('User');
+
+    let targetUserDoc = null;
+    if (target_user_id) {
+      targetUserDoc = await User.findById(target_user_id).lean();
+    } else if (target_username) {
+      targetUserDoc = await User.findOne({ username: target_username }).lean();
+    }
+
+    const payload = {
+      adminId: req.adminUser.id,
+      adminUsername: req.adminUser.username,
+      viewAs: agent_uuid,
+      viewAsLabel: agent_label || agent_uuid,
+      target_user_id: targetUserDoc ? (targetUserDoc.id || targetUserDoc._id) : (target_user_id || null),
+      target_username: targetUserDoc ? targetUserDoc.username : (target_username || null),
+      target_role: targetUserDoc ? targetUserDoc.role : (target_role || null),
+      type: 'view-as'
+    };
+
+    const viewToken = jwt.sign(payload, JWT_SECRET, { expiresIn: '8h' });
+
+    // Simpan log audit lengkap ke MongoDB
     await new ViewAsLog({
       admin_id: req.adminUser.id,
       admin_username: req.adminUser.username,
-      admin_role: req.adminUser.role, // Save role!
+      admin_role: req.adminUser.role,
+      target_user_id: payload.target_user_id,
+      target_username: payload.target_username,
+      target_role: payload.target_role,
       agent_uuid,
       agent_label: agent_label || agent_uuid
     }).save();
 
     res.json({
       ok: true,
-      message: `Sekarang melihat sebagai ${agent_label || agent_uuid}`,
+      message: `Sekarang melihat sebagai ${payload.target_username || agent_label || agent_uuid}`,
       view_token: viewToken,
       agent_uuid,
-      agent_label: agent_label || agent_uuid
+      agent_label: agent_label || agent_uuid,
+      target_user_id: payload.target_user_id,
+      target_username: payload.target_username,
+      target_role: payload.target_role
     });
   } catch (err) {
     res.status(500).json({ ok: false, error: err.message });
@@ -60,11 +76,19 @@ router.get('/admin/view-as/logs', requireAdmin, async (req, res) => {
     const ViewAsLog = mongoose.model('ViewAsLog');
     
     // Role-based visibility logic:
-    // If the requesting user is a SOC_ANALYST, filter out logs performed by a SUPER_ADMIN.
     const query = {};
     if (req.adminUser.role === 'SOC_ANALYST') {
       query.admin_role = { $ne: 'SUPER_ADMIN' };
       query.admin_username = { $ne: 'admin' };
+    } else if (req.adminUser.role === 'TENANT_ADMIN') {
+      const Summary = mongoose.model('Summary');
+      const siteAgents = await Summary.distinct('agent_uuid', { site_uuid: req.adminUser.site_uuid });
+      query.agent_uuid = { $in: siteAgents };
+      query.admin_role = { $ne: 'SUPER_ADMIN' };
+      query.admin_username = { $ne: 'admin' };
+    } else if (req.adminUser.role === 'COMPANY_ADMIN' || req.adminUser.role === 'COMPANY_OPERATOR') {
+      // COMPANY_ADMIN/OPERATOR hanya lihat log mereka sendiri
+      query.admin_id = req.adminUser.id;
     }
 
     const logs = await ViewAsLog.find(query).sort({ timestamp: -1 }).lean();