98 lines
6.2 KiB
JavaScript
98 lines
6.2 KiB
JavaScript
// backend/server.js
|
|
const path = require('path');
|
|
require('dotenv').config({ path: path.join(__dirname, '..', '.env.local') });
|
|
const express = require('express');
|
|
const cors = require('cors');
|
|
const cookieParser = require('cookie-parser');
|
|
const jwt = require('jsonwebtoken');
|
|
const connectDB = require('./db/mongoose');
|
|
|
|
// Connect to MongoDB
|
|
connectDB();
|
|
|
|
// Start Data Ingestion Scheduler
|
|
const { startScheduler } = require('./services/ingestionService');
|
|
startScheduler();
|
|
|
|
const app = express();
|
|
const PORT = process.env.BACKEND_PORT || 3001;
|
|
|
|
// ── Middleware ────────────────────────────────────────────────────────────────
|
|
const ALLOWED_ORIGINS = process.env.ALLOWED_ORIGINS
|
|
? process.env.ALLOWED_ORIGINS.split(',')
|
|
: ['http://localhost:3000', 'http://127.0.0.1:3000'];
|
|
|
|
app.use(cors({
|
|
origin: (origin, callback) => {
|
|
if (!origin) return callback(null, true);
|
|
if (ALLOWED_ORIGINS.includes(origin)) {
|
|
callback(null, true);
|
|
} else {
|
|
callback(new Error('Blocked by CORS policy (Unauthorized Origin)'));
|
|
}
|
|
},
|
|
credentials: true
|
|
}));
|
|
app.use(express.json());
|
|
app.use(cookieParser());
|
|
|
|
// ── API Routes ────────────────────────────────────────────────────────────────
|
|
const authRoutes = require('./routes/auth');
|
|
app.use('/api/auth', authRoutes);
|
|
app.use('/api/uploads', express.static(path.join(__dirname, 'uploads')));
|
|
|
|
// Auth Middleware for Dashboard
|
|
const JWT_SECRET = process.env.JWT_SECRET || 'super-secret-backone-key';
|
|
function requireAuth(req, res, next) {
|
|
const token = req.cookies?.token;
|
|
if (!token) return res.status(401).json({ error: 'Unauthorized' });
|
|
try {
|
|
req.user = jwt.verify(token, JWT_SECRET);
|
|
|
|
// ── VIEW-AS MODE ──────────────────────────────────────────────────────────
|
|
// Jika admin sedang dalam mode "View As Agent", frontend mengirim header
|
|
// X-View-As-Agent berisi JWT token yang berisi agent_uuid yang dipilih.
|
|
// Pendekatan header lebih reliable dari cookie karena melewati Next.js proxy.
|
|
const viewAsHeader = req.headers['x-view-as-agent'];
|
|
if (viewAsHeader && req.user.role === 'SUPER_ADMIN') {
|
|
try {
|
|
const viewDecoded = jwt.verify(viewAsHeader, JWT_SECRET);
|
|
if (viewDecoded.type === 'view-as' && viewDecoded.adminId === req.user.id && viewDecoded.viewAs) {
|
|
// Override: set role ke AGENT_VIEWER dan agent_uuid ke agent yang dipilih
|
|
req.user = {
|
|
...req.user,
|
|
role: 'AGENT_VIEWER',
|
|
agent_uuid: viewDecoded.viewAs,
|
|
_viewAsMode: true,
|
|
_originalRole: 'SUPER_ADMIN',
|
|
};
|
|
}
|
|
} catch (viewErr) {
|
|
// Token view-as invalid/expired — abaikan, lanjut sebagai admin normal
|
|
console.warn('[ViewAs] Invalid view-as token, ignoring:', viewErr.message);
|
|
}
|
|
}
|
|
// ─────────────────────────────────────────────────────────────────────────
|
|
|
|
next();
|
|
} catch (err) {
|
|
res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
}
|
|
|
|
const dashboardRoutes = require('./routes/dashboard');
|
|
app.use('/api/dashboard', requireAuth, dashboardRoutes);
|
|
|
|
// ── Health Check ──────────────────────────────────────────────────────────────
|
|
app.get('/api/health', (req, res) => {
|
|
res.json({ ok: true, message: 'BackOne Dashboard Backend berjalan!', time: new Date().toISOString() });
|
|
});
|
|
|
|
|
|
// ── Start Server ──────────────────────────────────────────────────────────────
|
|
app.listen(PORT, () => {
|
|
console.log(`\n🚀 API Server berjalan di http://localhost:${PORT}`);
|
|
console.log(`🔌 API Health : http://localhost:${PORT}/api/health\n`);
|
|
|
|
});
|