initial commit
This commit is contained in:
Methapon2001
commit
c5e3107e03
26 changed files with 3828 additions and 0 deletions
7
.dockerignore
Normal file
7
.dockerignore
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
.DS_Store
|
||||
node_modules
|
||||
/dist
|
||||
|
||||
.env
|
||||
.env.*
|
||||
!.env.example
|
||||
10
.env.example
Normal file
10
.env.example
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
KC_URL=http://192.168.1.20:8080
|
||||
KC_REALM=dev
|
||||
|
||||
KC_SERVICE_ACCOUNT_CLIENT_ID=dev-service
|
||||
KC_SERVICE_ACCOUNT_SECRET=
|
||||
|
||||
APP_HOST=0.0.0.0
|
||||
APP_PORT=3000
|
||||
|
||||
DATABASE_URL=postgresql://postgres:1234@192.168.1.20:5432/dev_1?schema=public
|
||||
10
.gitignore
vendored
Normal file
10
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
.DS_S
|
||||
node_modules
|
||||
|
||||
.env
|
||||
.env.*
|
||||
!.env.example
|
||||
|
||||
/dist
|
||||
/src/routes.ts
|
||||
/src/swagger.json
|
||||
18
.prettierignore
Normal file
18
.prettierignore
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
.DS_Store
|
||||
node_modules
|
||||
.env
|
||||
.env.*
|
||||
!.env.example
|
||||
|
||||
/dist
|
||||
/static
|
||||
/src/routes.ts
|
||||
/src/swagger.json
|
||||
|
||||
# Any log
|
||||
*.log
|
||||
|
||||
# Ignore files for PNPM, NPM and YARN
|
||||
pnpm-lock.yaml
|
||||
package-lock.json
|
||||
yarn.lock
|
||||
5
.prettierrc
Normal file
5
.prettierrc
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"tabWidth": 2,
|
||||
"printWidth": 100,
|
||||
"trailingComma": "all"
|
||||
}
|
||||
26
Dockerfile
Normal file
26
Dockerfile
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
FROM node:20-slim AS base
|
||||
|
||||
ENV PNPM_HOME="/pnpm"
|
||||
ENV PATH="$PNPM_HOME:$PATH"
|
||||
|
||||
RUN corepack enable
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
COPY . .
|
||||
|
||||
FROM base AS deps
|
||||
RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --prod --frozen-lockfile
|
||||
|
||||
FROM base AS build
|
||||
RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile
|
||||
RUN pnpm prisma generate
|
||||
RUN pnpm run build
|
||||
|
||||
FROM base as prod
|
||||
ENV NODE_ENV="production"
|
||||
COPY --from=deps /app/node_modules /app/node_modules
|
||||
COPY --from=build /app/dist /app/dist
|
||||
COPY --from=base /app/static /app/static
|
||||
|
||||
CMD ["pnpm", "run", "start"]
|
||||
4
README.md
Normal file
4
README.md
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
# JWS Back-End
|
||||
|
||||
`npm run migrate:dev` - generate migration and push to database
|
||||
`npm run migrate:deploy` - push migrations to database
|
||||
89
cliff.toml
Normal file
89
cliff.toml
Normal file
|
|
@ -0,0 +1,89 @@
|
|||
# git-cliff ~ default configuration file
|
||||
# https://git-cliff.org/docs/configuration
|
||||
#
|
||||
# Lines starting with "#" are comments.
|
||||
# Configuration options are organized into tables and keys.
|
||||
# See documentation for more information on available options.
|
||||
|
||||
[changelog]
|
||||
# changelog header
|
||||
header = """
|
||||
# Changelog\n
|
||||
All notable changes to this project will be documented in this file.\n
|
||||
"""
|
||||
# template for the changelog body
|
||||
# https://keats.github.io/tera/docs/#introduction
|
||||
body = """
|
||||
{% if version %}\
|
||||
## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }}
|
||||
{% else %}\
|
||||
## [unreleased]
|
||||
{% endif %}\
|
||||
{% for group, commits in commits | group_by(attribute="group") %}
|
||||
### {{ group | striptags | trim | upper_first }}
|
||||
{% for commit in commits %}
|
||||
- {% if commit.scope %}*({{ commit.scope }})* {% endif %}\
|
||||
{% if commit.breaking %}[**breaking**] {% endif %}\
|
||||
{{ commit.message | upper_first }}\
|
||||
{% endfor %}
|
||||
{% endfor %}\n
|
||||
"""
|
||||
# template for the changelog footer
|
||||
footer = """
|
||||
<!-- generated by git-cliff -->
|
||||
"""
|
||||
# remove the leading and trailing s
|
||||
trim = true
|
||||
# postprocessors
|
||||
postprocessors = [
|
||||
# { pattern = '<REPO>', replace = "https://github.com/orhun/git-cliff" }, # replace repository URL
|
||||
]
|
||||
|
||||
[git]
|
||||
# parse the commits based on https://www.conventionalcommits.org
|
||||
conventional_commits = true
|
||||
# filter out the commits that are not conventional
|
||||
filter_unconventional = true
|
||||
# process each line of a commit as an individual commit
|
||||
split_commits = false
|
||||
# regex for preprocessing the commit messages
|
||||
commit_preprocessors = [
|
||||
# Replace issue numbers
|
||||
#{ pattern = '\((\w+\s)?#([0-9]+)\)', replace = "([#${2}](<REPO>/issues/${2}))"},
|
||||
# Check spelling of the commit with https://github.com/crate-ci/typos
|
||||
# If the spelling is incorrect, it will be automatically fixed.
|
||||
#{ pattern = '.*', replace_command = 'typos --write-changes -' },
|
||||
]
|
||||
# regex for parsing and grouping commits
|
||||
commit_parsers = [
|
||||
{ message = "^feat", group = "<!-- 0 -->🚀 Features" },
|
||||
{ message = "^fix", group = "<!-- 1 -->🐛 Bug Fixes" },
|
||||
{ message = "^doc", group = "<!-- 3 -->📚 Documentation" },
|
||||
{ message = "^perf", group = "<!-- 4 -->⚡ Performance" },
|
||||
{ message = "^refactor", group = "<!-- 2 -->🚜 Refactor" },
|
||||
{ message = "^style", group = "<!-- 5 -->🎨 Styling" },
|
||||
{ message = "^test", group = "<!-- 6 -->🧪 Testing" },
|
||||
{ message = "^chore\\(release\\): prepare for", skip = true },
|
||||
{ message = "^chore\\(deps.*\\)", skip = true },
|
||||
{ message = "^chore\\(pr\\)", skip = true },
|
||||
{ message = "^chore\\(pull\\)", skip = true },
|
||||
{ message = "^chore|^ci", group = "<!-- 7 -->⚙️ Miscellaneous Tasks" },
|
||||
{ body = ".*security", group = "<!-- 8 -->🛡️ Security" },
|
||||
{ message = "^revert", group = "<!-- 9 -->◀️ Revert" },
|
||||
]
|
||||
# protect breaking changes from being skipped due to matching a skipping commit_parser
|
||||
protect_breaking_commits = false
|
||||
# filter out the commits that are not matched by commit parsers
|
||||
filter_commits = false
|
||||
# regex for matching git tags
|
||||
# tag_pattern = "v[0-9].*"
|
||||
# regex for skipping tags
|
||||
# skip_tags = ""
|
||||
# regex for ignoring tags
|
||||
# ignore_tags = ""
|
||||
# sort the tags topologically
|
||||
topo_order = false
|
||||
# sort the commits inside sections by oldest/newest order
|
||||
sort_commits = "oldest"
|
||||
# limit the number of commits included in the changelog.
|
||||
# limit_commits = 42
|
||||
6
nodemon.json
Normal file
6
nodemon.json
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"exec": "tsoa spec-and-routes && ts-node src/app.ts",
|
||||
"ext": "ts",
|
||||
"watch": ["src"],
|
||||
"ignore": ["src/routes.ts"]
|
||||
}
|
||||
41
package.json
Normal file
41
package.json
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
{
|
||||
"name": "template",
|
||||
"version": "1.0.0",
|
||||
"description": "",
|
||||
"main": "./dist/app.js",
|
||||
"scripts": {
|
||||
"start": "node ./dist/app.js",
|
||||
"dev": "nodemon",
|
||||
"check": "tsc --noEmit",
|
||||
"format": "prettier --write .",
|
||||
"build": "tsoa spec-and-routes && tsc",
|
||||
"db:push": "prisma db push",
|
||||
"migrate:dev": "prisma migrate dev",
|
||||
"migrate:deploy": "prisma migrate deploy"
|
||||
},
|
||||
"keywords": [],
|
||||
"author": "Frappe'T",
|
||||
"license": "ISC",
|
||||
"devDependencies": {
|
||||
"@types/cors": "^2.8.17",
|
||||
"@types/express": "^4.17.21",
|
||||
"@types/node": "^20.12.2",
|
||||
"@types/swagger-ui-express": "^4.1.6",
|
||||
"nodemon": "^3.1.0",
|
||||
"prettier": "^3.2.5",
|
||||
"prisma": "^5.11.0",
|
||||
"ts-node": "^10.9.2",
|
||||
"typescript": "^5.4.3"
|
||||
},
|
||||
"dependencies": {
|
||||
"@prisma/client": "5.11.0",
|
||||
"@tsoa/runtime": "^6.2.0",
|
||||
"cors": "^2.8.5",
|
||||
"dotenv": "^16.4.5",
|
||||
"express": "^4.19.2",
|
||||
"fast-jwt": "^4.0.0",
|
||||
"promise.any": "^2.0.6",
|
||||
"swagger-ui-express": "^5.0.0",
|
||||
"tsoa": "^6.2.0"
|
||||
}
|
||||
}
|
||||
2320
pnpm-lock.yaml
generated
Normal file
2320
pnpm-lock.yaml
generated
Normal file
File diff suppressed because it is too large
Load diff
3
prisma/migrations/migration_lock.toml
Normal file
3
prisma/migrations/migration_lock.toml
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
# Please do not edit this file manually
|
||||
# It should be added in your version-control system (i.e. Git)
|
||||
provider = "postgresql"
|
||||
469
prisma/schema.prisma
Normal file
469
prisma/schema.prisma
Normal file
|
|
@ -0,0 +1,469 @@
|
|||
generator client {
|
||||
provider = "prisma-client-js"
|
||||
}
|
||||
|
||||
datasource db {
|
||||
provider = "postgresql"
|
||||
url = env("DATABASE_URL")
|
||||
}
|
||||
|
||||
model Province {
|
||||
id String @id @default(uuid())
|
||||
nameTH String
|
||||
nameEN String
|
||||
status String?
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
|
||||
district District[]
|
||||
branch Branch[]
|
||||
user User[]
|
||||
customerBranch CustomerBranch[]
|
||||
employee Employee[]
|
||||
employeeCheckup EmployeeCheckup[]
|
||||
}
|
||||
|
||||
model District {
|
||||
id String @id @default(uuid())
|
||||
nameTH String
|
||||
nameEN String
|
||||
status String?
|
||||
|
||||
provinceId String
|
||||
province Province @relation(fields: [provinceId], references: [id], onDelete: Cascade)
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
|
||||
subDistrict SubDistrict[]
|
||||
branch Branch[]
|
||||
user User[]
|
||||
customerBranch CustomerBranch[]
|
||||
employee Employee[]
|
||||
}
|
||||
|
||||
model SubDistrict {
|
||||
id String @id @default(uuid())
|
||||
nameTH String
|
||||
nameEN String
|
||||
zipCode String
|
||||
status String?
|
||||
|
||||
district District @relation(fields: [districtId], references: [id], onDelete: Cascade)
|
||||
districtId String
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
|
||||
branch Branch[]
|
||||
user User[]
|
||||
customerBranch CustomerBranch[]
|
||||
employee Employee[]
|
||||
}
|
||||
|
||||
model Branch {
|
||||
id String @id @default(uuid())
|
||||
code String
|
||||
taxNo String
|
||||
nameTH String
|
||||
nameEN String
|
||||
addressTH String
|
||||
addressEN String
|
||||
|
||||
province Province? @relation(fields: [provinceId], references: [id], onDelete: SetNull)
|
||||
provinceId String?
|
||||
|
||||
district District? @relation(fields: [districtId], references: [id], onDelete: SetNull)
|
||||
districtId String?
|
||||
|
||||
subDistrict SubDistrict? @relation(fields: [subDistrictId], references: [id], onDelete: SetNull)
|
||||
subDistrictId String?
|
||||
|
||||
zipCode String
|
||||
|
||||
email String
|
||||
telephoneNo String
|
||||
|
||||
latitude String
|
||||
longitude String
|
||||
|
||||
isHeadOffice Boolean @default(false)
|
||||
|
||||
headOffice Branch? @relation(name: "HeadOfficeRelation", fields: [headOfficeId], references: [id])
|
||||
headOfficeId String?
|
||||
|
||||
status String?
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
|
||||
branch Branch[] @relation(name: "HeadOfficeRelation")
|
||||
contact BranchContact[]
|
||||
user BranchUser[]
|
||||
}
|
||||
|
||||
model BranchContact {
|
||||
id String @id @default(uuid())
|
||||
telephoneNo String
|
||||
lineId String
|
||||
qrCodeImageUrl String?
|
||||
|
||||
branch Branch @relation(fields: [branchId], references: [id], onDelete: Cascade)
|
||||
branchId String
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
}
|
||||
|
||||
model BranchUser {
|
||||
id String @id @default(uuid())
|
||||
|
||||
branch Branch @relation(fields: [branchId], references: [id], onDelete: Cascade)
|
||||
branchId String
|
||||
|
||||
user User @relation(fields: [userId], references: [id], onDelete: Cascade)
|
||||
userId String
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
}
|
||||
|
||||
model User {
|
||||
id String @id @default(uuid())
|
||||
|
||||
code String
|
||||
fullNameTH String
|
||||
fullNameEN String
|
||||
|
||||
addressTH String
|
||||
addressEN String
|
||||
|
||||
province Province? @relation(fields: [provinceId], references: [id], onDelete: SetNull)
|
||||
provinceId String?
|
||||
|
||||
district District? @relation(fields: [districtId], references: [id], onDelete: SetNull)
|
||||
districtId String?
|
||||
|
||||
subDistrict SubDistrict? @relation(fields: [subDistrictId], references: [id], onDelete: SetNull)
|
||||
subDistrictId String?
|
||||
|
||||
zipCode String
|
||||
|
||||
email String
|
||||
telephoneNo String
|
||||
|
||||
registrationNo String
|
||||
|
||||
startDate DateTime
|
||||
retireDate DateTime
|
||||
|
||||
profileImageUrl String?
|
||||
|
||||
userType String
|
||||
userRole String
|
||||
|
||||
discountCondition String
|
||||
|
||||
licenseNo String
|
||||
licenseIssueDate DateTime
|
||||
licenseExpireDate DateTime
|
||||
|
||||
sourceNationality String
|
||||
importNationality String
|
||||
|
||||
trainingPlace String
|
||||
|
||||
status String?
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
|
||||
branch BranchUser[]
|
||||
}
|
||||
|
||||
model Customer {
|
||||
id String @id @default(uuid())
|
||||
code String
|
||||
customerType String
|
||||
customerNameTH String
|
||||
customerNameEN String
|
||||
imageUrl String
|
||||
|
||||
status String?
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
|
||||
branch CustomerBranch[]
|
||||
}
|
||||
|
||||
model CustomerBranch {
|
||||
id String @id @default(uuid())
|
||||
branchNo String
|
||||
legalPersonNo String
|
||||
|
||||
nameTH String
|
||||
nameEN String
|
||||
|
||||
customer Customer @relation(fields: [customerId], references: [id], onDelete: Cascade)
|
||||
customerId String
|
||||
|
||||
taxNo String
|
||||
registerName String
|
||||
registerDate DateTime
|
||||
authorizedCapital String
|
||||
|
||||
addressEN String
|
||||
|
||||
province Province? @relation(fields: [provinceId], references: [id], onDelete: SetNull)
|
||||
provinceId String?
|
||||
|
||||
district District? @relation(fields: [districtId], references: [id], onDelete: SetNull)
|
||||
districtId String?
|
||||
|
||||
subDistrict SubDistrict? @relation(fields: [subDistrictId], references: [id], onDelete: SetNull)
|
||||
subDistrictId String?
|
||||
|
||||
zipCode String
|
||||
|
||||
email String
|
||||
telephoneNo String
|
||||
|
||||
latitude String
|
||||
longitude String
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
|
||||
employee Employee[]
|
||||
}
|
||||
|
||||
model Employee {
|
||||
id String @id @default(uuid())
|
||||
|
||||
code String
|
||||
fullNameTH String
|
||||
fullNameEN String
|
||||
dateOfBirth DateTime
|
||||
gender String
|
||||
nationality String
|
||||
|
||||
addressTH String
|
||||
addressEN String
|
||||
|
||||
province Province? @relation(fields: [provinceId], references: [id], onDelete: SetNull)
|
||||
provinceId String?
|
||||
|
||||
district District? @relation(fields: [districtId], references: [id], onDelete: SetNull)
|
||||
districtId String?
|
||||
|
||||
subDistrict SubDistrict? @relation(fields: [subDistrictId], references: [id], onDelete: SetNull)
|
||||
subDistrictId String?
|
||||
|
||||
zipCode String
|
||||
|
||||
email String
|
||||
telephoneNo String
|
||||
|
||||
arrivalBarricade String
|
||||
arrivalCardNo String
|
||||
profileImageUrl String
|
||||
|
||||
customerBranch CustomerBranch? @relation(fields: [customerBranchId], references: [id], onDelete: SetNull)
|
||||
customerBranchId String?
|
||||
|
||||
status String?
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
|
||||
employeeCheckup EmployeeCheckup[]
|
||||
employeeWork EmployeeWork[]
|
||||
EmployeeOtherInfo EmployeeOtherInfo[]
|
||||
}
|
||||
|
||||
model EmployeeCheckup {
|
||||
id String @id @default(uuid())
|
||||
|
||||
employee Employee @relation(fields: [employeeId], references: [id], onDelete: Cascade)
|
||||
employeeId String
|
||||
|
||||
checkupResult String
|
||||
checkupType String
|
||||
|
||||
province Province? @relation(fields: [provinceId], references: [id], onDelete: SetNull)
|
||||
provinceId String?
|
||||
|
||||
hospitalName String
|
||||
remark String
|
||||
medicalBenefitScheme String
|
||||
insuranceCompany String
|
||||
coverageStartDate DateTime
|
||||
coverageExpireDate DateTime
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
}
|
||||
|
||||
model EmployeeWork {
|
||||
id String @id @default(uuid())
|
||||
|
||||
employee Employee @relation(fields: [employeeId], references: [id], onDelete: Cascade)
|
||||
employeeId String
|
||||
|
||||
ownerName String
|
||||
positionName String
|
||||
jobType String
|
||||
workplace String
|
||||
workPermitNo String
|
||||
workPermitIssuDate DateTime
|
||||
workPermitExpireDate DateTime
|
||||
workEndDate DateTime
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
}
|
||||
|
||||
model EmployeeOtherInfo {
|
||||
id String @id @default(uuid())
|
||||
|
||||
employee Employee @relation(fields: [employeeId], references: [id], onDelete: Cascade)
|
||||
employeeId String
|
||||
|
||||
citizenId String
|
||||
fatherFullName String
|
||||
motherFullName String
|
||||
birthPlace String
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
}
|
||||
|
||||
model Service {
|
||||
id String @id @default(uuid())
|
||||
|
||||
code String
|
||||
name String
|
||||
detail String
|
||||
imageUrl String
|
||||
status String?
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
work Work[]
|
||||
}
|
||||
|
||||
model Work {
|
||||
id String @id @default(uuid())
|
||||
|
||||
order String
|
||||
name String
|
||||
|
||||
service Service @relation(fields: [serviceId], references: [id], onDelete: Cascade)
|
||||
serviceId String
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
WorkProduct WorkProduct[]
|
||||
}
|
||||
|
||||
model WorkProduct {
|
||||
id String @id @default(uuid())
|
||||
|
||||
work Work @relation(fields: [workId], references: [id], onDelete: Cascade)
|
||||
workId String
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
}
|
||||
|
||||
model ProductGroup {
|
||||
id String @id @default(uuid())
|
||||
|
||||
code String
|
||||
name String
|
||||
detail String
|
||||
remark String
|
||||
status String?
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
Product Product[]
|
||||
}
|
||||
|
||||
model ProductType {
|
||||
id String @id @default(uuid())
|
||||
|
||||
code String
|
||||
name String
|
||||
detail String
|
||||
remark String
|
||||
status String?
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
|
||||
product Product[]
|
||||
}
|
||||
|
||||
model Product {
|
||||
id String @id @default(uuid())
|
||||
|
||||
code String
|
||||
name String
|
||||
detail String
|
||||
process String
|
||||
price Int
|
||||
agentPrice Int
|
||||
serviceCharge Int
|
||||
imageUrl String
|
||||
status String?
|
||||
|
||||
productType ProductType? @relation(fields: [productTypeId], references: [id], onDelete: SetNull)
|
||||
productTypeId String?
|
||||
|
||||
productGroup ProductGroup? @relation(fields: [productGroupId], references: [id], onDelete: SetNull)
|
||||
productGroupId String?
|
||||
|
||||
createdBy String?
|
||||
createdAt DateTime @default(now())
|
||||
updateBy String?
|
||||
updatedAt DateTime @updatedAt
|
||||
}
|
||||
26
src/app.ts
Normal file
26
src/app.ts
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
import "dotenv/config";
|
||||
import cors from "cors";
|
||||
import express, { json, urlencoded } from "express";
|
||||
import swaggerUi from "swagger-ui-express";
|
||||
import swaggerDocument from "./swagger.json";
|
||||
import error from "./middlewares/error";
|
||||
import { RegisterRoutes } from "./routes";
|
||||
|
||||
(async () => {
|
||||
const app = express();
|
||||
|
||||
app.use(cors());
|
||||
app.use(json());
|
||||
app.use(urlencoded({ extended: true }));
|
||||
app.use("/", express.static("static"));
|
||||
app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(swaggerDocument));
|
||||
|
||||
RegisterRoutes(app);
|
||||
|
||||
app.use(error);
|
||||
|
||||
const APP_HOST = process.env.APP_HOST || "0.0.0.0";
|
||||
const APP_PORT = +(process.env.APP_PORT || 3000);
|
||||
|
||||
app.listen(APP_PORT, APP_HOST, () => console.log(`Listening on: http://localhost:${APP_PORT}`));
|
||||
})();
|
||||
7
src/db.ts
Normal file
7
src/db.ts
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
import { PrismaClient } from "@prisma/client";
|
||||
|
||||
const prisma = new PrismaClient({
|
||||
errorFormat: process.env.NODE_ENV === "production" ? "minimal" : "pretty",
|
||||
});
|
||||
|
||||
export default prisma;
|
||||
19
src/interfaces/http-error.ts
Normal file
19
src/interfaces/http-error.ts
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
import HttpStatus from "./http-status";
|
||||
|
||||
class HttpError extends Error {
|
||||
/**
|
||||
* HTTP Status Code
|
||||
*/
|
||||
status: HttpStatus;
|
||||
message: string;
|
||||
|
||||
constructor(status: HttpStatus, message: string) {
|
||||
super(message);
|
||||
|
||||
this.name = "HttpError";
|
||||
this.status = status;
|
||||
this.message = message;
|
||||
}
|
||||
}
|
||||
|
||||
export default HttpError;
|
||||
380
src/interfaces/http-status.ts
Normal file
380
src/interfaces/http-status.ts
Normal file
|
|
@ -0,0 +1,380 @@
|
|||
/**
|
||||
* Hypertext Transfer Protocol (HTTP) response status codes.
|
||||
* @see {@link https://en.wikipedia.org/wiki/List_of_HTTP_status_codes}
|
||||
*/
|
||||
enum HttpStatus {
|
||||
/**
|
||||
* The server has received the request headers and the client should proceed to send the request body
|
||||
* (in the case of a request for which a body needs to be sent; for example, a POST request).
|
||||
* Sending a large request body to a server after a request has been rejected for inappropriate headers would be inefficient.
|
||||
* To have a server check the request's headers, a client must send Expect: 100-continue as a header in its initial request
|
||||
* and receive a 100 Continue status code in response before sending the body. The response 417 Expectation Failed indicates the request should not be continued.
|
||||
*/
|
||||
CONTINUE = 100,
|
||||
|
||||
/**
|
||||
* The requester has asked the server to switch protocols and the server has agreed to do so.
|
||||
*/
|
||||
SWITCHING_PROTOCOLS = 101,
|
||||
|
||||
/**
|
||||
* A WebDAV request may contain many sub-requests involving file operations, requiring a long time to complete the request.
|
||||
* This code indicates that the server has received and is processing the request, but no response is available yet.
|
||||
* This prevents the client from timing out and assuming the request was lost.
|
||||
*/
|
||||
PROCESSING = 102,
|
||||
|
||||
/**
|
||||
* Standard response for successful HTTP requests.
|
||||
* The actual response will depend on the request method used.
|
||||
* In a GET request, the response will contain an entity corresponding to the requested resource.
|
||||
* In a POST request, the response will contain an entity describing or containing the result of the action.
|
||||
*/
|
||||
OK = 200,
|
||||
|
||||
/**
|
||||
* The request has been fulfilled, resulting in the creation of a new resource.
|
||||
*/
|
||||
CREATED = 201,
|
||||
|
||||
/**
|
||||
* The request has been accepted for processing, but the processing has not been completed.
|
||||
* The request might or might not be eventually acted upon, and may be disallowed when processing occurs.
|
||||
*/
|
||||
ACCEPTED = 202,
|
||||
|
||||
/**
|
||||
* SINCE HTTP/1.1
|
||||
* The server is a transforming proxy that received a 200 OK from its origin,
|
||||
* but is returning a modified version of the origin's response.
|
||||
*/
|
||||
NON_AUTHORITATIVE_INFORMATION = 203,
|
||||
|
||||
/**
|
||||
* The server successfully processed the request and is not returning any content.
|
||||
*/
|
||||
NO_CONTENT = 204,
|
||||
|
||||
/**
|
||||
* The server successfully processed the request, but is not returning any content.
|
||||
* Unlike a 204 response, this response requires that the requester reset the document view.
|
||||
*/
|
||||
RESET_CONTENT = 205,
|
||||
|
||||
/**
|
||||
* The server is delivering only part of the resource (byte serving) due to a range header sent by the client.
|
||||
* The range header is used by HTTP clients to enable resuming of interrupted downloads,
|
||||
* or split a download into multiple simultaneous streams.
|
||||
*/
|
||||
PARTIAL_CONTENT = 206,
|
||||
|
||||
/**
|
||||
* The message body that follows is an XML message and can contain a number of separate response codes,
|
||||
* depending on how many sub-requests were made.
|
||||
*/
|
||||
MULTI_STATUS = 207,
|
||||
|
||||
/**
|
||||
* The members of a DAV binding have already been enumerated in a preceding part of the (multistatus) response,
|
||||
* and are not being included again.
|
||||
*/
|
||||
ALREADY_REPORTED = 208,
|
||||
|
||||
/**
|
||||
* The server has fulfilled a request for the resource,
|
||||
* and the response is a representation of the result of one or more instance-manipulations applied to the current instance.
|
||||
*/
|
||||
IM_USED = 226,
|
||||
|
||||
/**
|
||||
* Indicates multiple options for the resource from which the client may choose (via agent-driven content negotiation).
|
||||
* For example, this code could be used to present multiple video format options,
|
||||
* to list files with different filename extensions, or to suggest word-sense disambiguation.
|
||||
*/
|
||||
MULTIPLE_CHOICES = 300,
|
||||
|
||||
/**
|
||||
* This and all future requests should be directed to the given URI.
|
||||
*/
|
||||
MOVED_PERMANENTLY = 301,
|
||||
|
||||
/**
|
||||
* This is an example of industry practice contradicting the standard.
|
||||
* The HTTP/1.0 specification (RFC 1945) required the client to perform a temporary redirect
|
||||
* (the original describing phrase was "Moved Temporarily"), but popular browsers implemented 302
|
||||
* with the functionality of a 303 See Other. Therefore, HTTP/1.1 added status codes 303 and 307
|
||||
* to distinguish between the two behaviours. However, some Web applications and frameworks
|
||||
* use the 302 status code as if it were the 303.
|
||||
*/
|
||||
FOUND = 302,
|
||||
|
||||
/**
|
||||
* SINCE HTTP/1.1
|
||||
* The response to the request can be found under another URI using a GET method.
|
||||
* When received in response to a POST (or PUT/DELETE), the client should presume that
|
||||
* the server has received the data and should issue a redirect with a separate GET message.
|
||||
*/
|
||||
SEE_OTHER = 303,
|
||||
|
||||
/**
|
||||
* Indicates that the resource has not been modified since the version specified by the request headers If-Modified-Since or If-None-Match.
|
||||
* In such case, there is no need to retransmit the resource since the client still has a previously-downloaded copy.
|
||||
*/
|
||||
NOT_MODIFIED = 304,
|
||||
|
||||
/**
|
||||
* SINCE HTTP/1.1
|
||||
* The requested resource is available only through a proxy, the address for which is provided in the response.
|
||||
* Many HTTP clients (such as Mozilla and Internet Explorer) do not correctly handle responses with this status code, primarily for security reasons.
|
||||
*/
|
||||
USE_PROXY = 305,
|
||||
|
||||
/**
|
||||
* No longer used. Originally meant "Subsequent requests should use the specified proxy."
|
||||
*/
|
||||
SWITCH_PROXY = 306,
|
||||
|
||||
/**
|
||||
* SINCE HTTP/1.1
|
||||
* In this case, the request should be repeated with another URI; however, future requests should still use the original URI.
|
||||
* In contrast to how 302 was historically implemented, the request method is not allowed to be changed when reissuing the original request.
|
||||
* For example, a POST request should be repeated using another POST request.
|
||||
*/
|
||||
TEMPORARY_REDIRECT = 307,
|
||||
|
||||
/**
|
||||
* The request and all future requests should be repeated using another URI.
|
||||
* 307 and 308 parallel the behaviors of 302 and 301, but do not allow the HTTP method to change.
|
||||
* So, for example, submitting a form to a permanently redirected resource may continue smoothly.
|
||||
*/
|
||||
PERMANENT_REDIRECT = 308,
|
||||
|
||||
/**
|
||||
* The server cannot or will not process the request due to an apparent client error
|
||||
* (e.g., malformed request syntax, too large size, invalid request message framing, or deceptive request routing).
|
||||
*/
|
||||
BAD_REQUEST = 400,
|
||||
|
||||
/**
|
||||
* Similar to 403 Forbidden, but specifically for use when authentication is required and has failed or has not yet
|
||||
* been provided. The response must include a WWW-Authenticate header field containing a challenge applicable to the
|
||||
* requested resource. See Basic access authentication and Digest access authentication. 401 semantically means
|
||||
* "unauthenticated",i.e. the user does not have the necessary credentials.
|
||||
*/
|
||||
UNAUTHORIZED = 401,
|
||||
|
||||
/**
|
||||
* Reserved for future use. The original intention was that this code might be used as part of some form of digital
|
||||
* cash or micro payment scheme, but that has not happened, and this code is not usually used.
|
||||
* Google Developers API uses this status if a particular developer has exceeded the daily limit on requests.
|
||||
*/
|
||||
PAYMENT_REQUIRED = 402,
|
||||
|
||||
/**
|
||||
* The request was valid, but the server is refusing action.
|
||||
* The user might not have the necessary permissions for a resource.
|
||||
*/
|
||||
FORBIDDEN = 403,
|
||||
|
||||
/**
|
||||
* The requested resource could not be found but may be available in the future.
|
||||
* Subsequent requests by the client are permissible.
|
||||
*/
|
||||
NOT_FOUND = 404,
|
||||
|
||||
/**
|
||||
* A request method is not supported for the requested resource;
|
||||
* for example, a GET request on a form that requires data to be presented via POST, or a PUT request on a read-only resource.
|
||||
*/
|
||||
METHOD_NOT_ALLOWED = 405,
|
||||
|
||||
/**
|
||||
* The requested resource is capable of generating only content not acceptable according to the Accept headers sent in the request.
|
||||
*/
|
||||
NOT_ACCEPTABLE = 406,
|
||||
|
||||
/**
|
||||
* The client must first authenticate itself with the proxy.
|
||||
*/
|
||||
PROXY_AUTHENTICATION_REQUIRED = 407,
|
||||
|
||||
/**
|
||||
* The server timed out waiting for the request.
|
||||
* According to HTTP specifications:
|
||||
* "The client did not produce a request within the time that the server was prepared to wait. The client MAY repeat the request without modifications at any later time."
|
||||
*/
|
||||
REQUEST_TIMEOUT = 408,
|
||||
|
||||
/**
|
||||
* Indicates that the request could not be processed because of conflict in the request,
|
||||
* such as an edit conflict between multiple simultaneous updates.
|
||||
*/
|
||||
CONFLICT = 409,
|
||||
|
||||
/**
|
||||
* Indicates that the resource requested is no longer available and will not be available again.
|
||||
* This should be used when a resource has been intentionally removed and the resource should be purged.
|
||||
* Upon receiving a 410 status code, the client should not request the resource in the future.
|
||||
* Clients such as search engines should remove the resource from their indices.
|
||||
* Most use cases do not require clients and search engines to purge the resource, and a "404 Not Found" may be used instead.
|
||||
*/
|
||||
GONE = 410,
|
||||
|
||||
/**
|
||||
* The request did not specify the length of its content, which is required by the requested resource.
|
||||
*/
|
||||
LENGTH_REQUIRED = 411,
|
||||
|
||||
/**
|
||||
* The server does not meet one of the preconditions that the requester put on the request.
|
||||
*/
|
||||
PRECONDITION_FAILED = 412,
|
||||
|
||||
/**
|
||||
* The request is larger than the server is willing or able to process. Previously called "Request Entity Too Large".
|
||||
*/
|
||||
PAYLOAD_TOO_LARGE = 413,
|
||||
|
||||
/**
|
||||
* The URI provided was too long for the server to process. Often the result of too much data being encoded as a query-string of a GET request,
|
||||
* in which case it should be converted to a POST request.
|
||||
* Called "Request-URI Too Long" previously.
|
||||
*/
|
||||
URI_TOO_LONG = 414,
|
||||
|
||||
/**
|
||||
* The request entity has a media type which the server or resource does not support.
|
||||
* For example, the client uploads an image as image/svg+xml, but the server requires that images use a different format.
|
||||
*/
|
||||
UNSUPPORTED_MEDIA_TYPE = 415,
|
||||
|
||||
/**
|
||||
* The client has asked for a portion of the file (byte serving), but the server cannot supply that portion.
|
||||
* For example, if the client asked for a part of the file that lies beyond the end of the file.
|
||||
* Called "Requested Range Not Satisfiable" previously.
|
||||
*/
|
||||
RANGE_NOT_SATISFIABLE = 416,
|
||||
|
||||
/**
|
||||
* The server cannot meet the requirements of the Expect request-header field.
|
||||
*/
|
||||
EXPECTATION_FAILED = 417,
|
||||
|
||||
/**
|
||||
* This code was defined in 1998 as one of the traditional IETF April Fools' jokes, in RFC 2324, Hyper Text Coffee Pot Control Protocol,
|
||||
* and is not expected to be implemented by actual HTTP servers. The RFC specifies this code should be returned by
|
||||
* teapots requested to brew coffee. This HTTP status is used as an Easter egg in some websites, including Google.com.
|
||||
*/
|
||||
I_AM_A_TEAPOT = 418,
|
||||
|
||||
/**
|
||||
* The request was directed at a server that is not able to produce a response (for example because a connection reuse).
|
||||
*/
|
||||
MISDIRECTED_REQUEST = 421,
|
||||
|
||||
/**
|
||||
* The request was well-formed but was unable to be followed due to semantic errors.
|
||||
*/
|
||||
UNPROCESSABLE_ENTITY = 422,
|
||||
|
||||
/**
|
||||
* The resource that is being accessed is locked.
|
||||
*/
|
||||
LOCKED = 423,
|
||||
|
||||
/**
|
||||
* The request failed due to failure of a previous request (e.g., a PROPPATCH).
|
||||
*/
|
||||
FAILED_DEPENDENCY = 424,
|
||||
|
||||
/**
|
||||
* The client should switch to a different protocol such as TLS/1.0, given in the Upgrade header field.
|
||||
*/
|
||||
UPGRADE_REQUIRED = 426,
|
||||
|
||||
/**
|
||||
* The origin server requires the request to be conditional.
|
||||
* Intended to prevent "the 'lost update' problem, where a client
|
||||
* GETs a resource's state, modifies it, and PUTs it back to the server,
|
||||
* when meanwhile a third party has modified the state on the server, leading to a conflict."
|
||||
*/
|
||||
PRECONDITION_REQUIRED = 428,
|
||||
|
||||
/**
|
||||
* The user has sent too many requests in a given amount of time. Intended for use with rate-limiting schemes.
|
||||
*/
|
||||
TOO_MANY_REQUESTS = 429,
|
||||
|
||||
/**
|
||||
* The server is unwilling to process the request because either an individual header field,
|
||||
* or all the header fields collectively, are too large.
|
||||
*/
|
||||
REQUEST_HEADER_FIELDS_TOO_LARGE = 431,
|
||||
|
||||
/**
|
||||
* A server operator has received a legal demand to deny access to a resource or to a set of resources
|
||||
* that includes the requested resource. The code 451 was chosen as a reference to the novel Fahrenheit 451.
|
||||
*/
|
||||
UNAVAILABLE_FOR_LEGAL_REASONS = 451,
|
||||
|
||||
/**
|
||||
* A generic error message, given when an unexpected condition was encountered and no more specific message is suitable.
|
||||
*/
|
||||
INTERNAL_SERVER_ERROR = 500,
|
||||
|
||||
/**
|
||||
* The server either does not recognize the request method, or it lacks the ability to fulfill the request.
|
||||
* Usually this implies future availability (e.g., a new feature of a web-service API).
|
||||
*/
|
||||
NOT_IMPLEMENTED = 501,
|
||||
|
||||
/**
|
||||
* The server was acting as a gateway or proxy and received an invalid response from the upstream server.
|
||||
*/
|
||||
BAD_GATEWAY = 502,
|
||||
|
||||
/**
|
||||
* The server is currently unavailable (because it is overloaded or down for maintenance).
|
||||
* Generally, this is a temporary state.
|
||||
*/
|
||||
SERVICE_UNAVAILABLE = 503,
|
||||
|
||||
/**
|
||||
* The server was acting as a gateway or proxy and did not receive a timely response from the upstream server.
|
||||
*/
|
||||
GATEWAY_TIMEOUT = 504,
|
||||
|
||||
/**
|
||||
* The server does not support the HTTP protocol version used in the request
|
||||
*/
|
||||
HTTP_VERSION_NOT_SUPPORTED = 505,
|
||||
|
||||
/**
|
||||
* Transparent content negotiation for the request results in a circular reference.
|
||||
*/
|
||||
VARIANT_ALSO_NEGOTIATES = 506,
|
||||
|
||||
/**
|
||||
* The server is unable to store the representation needed to complete the request.
|
||||
*/
|
||||
INSUFFICIENT_STORAGE = 507,
|
||||
|
||||
/**
|
||||
* The server detected an infinite loop while processing the request.
|
||||
*/
|
||||
LOOP_DETECTED = 508,
|
||||
|
||||
/**
|
||||
* Further extensions to the request are required for the server to fulfill it.
|
||||
*/
|
||||
NOT_EXTENDED = 510,
|
||||
|
||||
/**
|
||||
* The client needs to authenticate to gain network access.
|
||||
* Intended for use by intercepting proxies used to control access to the network (e.g., "captive portals" used
|
||||
* to require agreement to Terms of Service before granting full Internet access via a Wi-Fi hotspot).
|
||||
*/
|
||||
NETWORK_AUTHENTICATION_REQUIRED = 511,
|
||||
}
|
||||
|
||||
export default HttpStatus;
|
||||
12
src/interfaces/user.ts
Normal file
12
src/interfaces/user.ts
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
import type { Request } from "express";
|
||||
|
||||
export type RequestWithUser = Request & {
|
||||
user: {
|
||||
name: string;
|
||||
given_name: string;
|
||||
familiy_name: string;
|
||||
preferred_username: string;
|
||||
email: string;
|
||||
role: string[];
|
||||
};
|
||||
};
|
||||
77
src/middlewares/auth-provider/keycloak.ts
Normal file
77
src/middlewares/auth-provider/keycloak.ts
Normal file
|
|
@ -0,0 +1,77 @@
|
|||
import Express from "express";
|
||||
import { createDecoder, createVerifier } from "fast-jwt";
|
||||
|
||||
import HttpError from "../../interfaces/http-error";
|
||||
import HttpStatus from "../../interfaces/http-status";
|
||||
|
||||
if (!process.env.KC_PUBLIC_KEY && !(process.env.KC_URL && process.env.KC_REALM)) {
|
||||
throw new Error("Require keycloak KC_PUBLIC_KEY or KC_URL with KC_REALM.");
|
||||
}
|
||||
|
||||
const jwtVerify = createVerifier({
|
||||
key: async () => {
|
||||
return `-----BEGIN PUBLIC KEY-----\n${process.env.KC_PUBLIC_KEY}\n-----END PUBLIC KEY-----`;
|
||||
},
|
||||
});
|
||||
|
||||
const jwtDecode = createDecoder();
|
||||
|
||||
export async function keycloakAuth(
|
||||
request: Express.Request,
|
||||
_securityName?: string,
|
||||
_scopes?: string[],
|
||||
) {
|
||||
const token = request.headers["authorization"]?.includes("Bearer ")
|
||||
? request.headers["authorization"].split(" ")[1]
|
||||
: request.headers["authorization"];
|
||||
|
||||
if (!token) {
|
||||
throw new HttpError(HttpStatus.UNAUTHORIZED, "ไม่พบข้อมูลสำหรับยืนยันตัวตน");
|
||||
}
|
||||
|
||||
let payload: Record<string, any> = {};
|
||||
|
||||
switch (process.env.KC_PREFERRED_MODE) {
|
||||
case "online":
|
||||
payload = await verifyOnline(token);
|
||||
break;
|
||||
case "offline":
|
||||
payload = await verifyOffline(token);
|
||||
break;
|
||||
default:
|
||||
if (process.env.KC_REALM_URL) {
|
||||
payload = await verifyOnline(token);
|
||||
break;
|
||||
}
|
||||
if (process.env.KC_PUBLIC_KEY) {
|
||||
payload = await verifyOffline(token);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
return payload;
|
||||
}
|
||||
|
||||
async function verifyOffline(token: string) {
|
||||
const payload = await jwtVerify(token).catch((_) => null);
|
||||
if (!payload) {
|
||||
throw new HttpError(HttpStatus.UNAUTHORIZED, "ไม่สามารถยืนยันตัวตนได้");
|
||||
}
|
||||
return payload;
|
||||
}
|
||||
|
||||
async function verifyOnline(token: string) {
|
||||
const res = await fetch(
|
||||
`${process.env.KC_URL}/realms/${process.env.KC_REALM}/protocol/openid-connect/userinfo`,
|
||||
{
|
||||
headers: { authorization: `Bearer ${token}` },
|
||||
},
|
||||
).catch((e) => console.error(e));
|
||||
|
||||
if (!res) throw new Error("ไม่สามารถเข้าถึงระบบยืนยันตัวตน");
|
||||
if (!res.ok) {
|
||||
throw new HttpError(HttpStatus.UNAUTHORIZED, "ไม่สามารถยืนยันตัวตนได้");
|
||||
}
|
||||
|
||||
return await jwtDecode(token);
|
||||
}
|
||||
17
src/middlewares/auth.ts
Normal file
17
src/middlewares/auth.ts
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
import Express from "express";
|
||||
import HttpError from "../interfaces/http-error";
|
||||
import HttpStatus from "../interfaces/http-status";
|
||||
import { keycloakAuth } from "./auth-provider/keycloak";
|
||||
|
||||
export async function expressAuthentication(
|
||||
request: Express.Request,
|
||||
securityName: string,
|
||||
_scopes?: string[],
|
||||
) {
|
||||
switch (securityName) {
|
||||
case "keycloak":
|
||||
return keycloakAuth(request);
|
||||
default:
|
||||
throw new HttpError(HttpStatus.NOT_IMPLEMENTED, "ไม่ทราบวิธียืนยันตัวตน");
|
||||
}
|
||||
}
|
||||
30
src/middlewares/error.ts
Normal file
30
src/middlewares/error.ts
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
import { NextFunction, Request, Response } from "express";
|
||||
import HttpError from "../interfaces/http-error";
|
||||
import HttpStatus from "../interfaces/http-status";
|
||||
import { ValidateError } from "tsoa";
|
||||
|
||||
function error(error: Error, _req: Request, res: Response, _next: NextFunction) {
|
||||
if (error instanceof HttpError) {
|
||||
return res.status(error.status).json({
|
||||
status: error.status,
|
||||
message: error.message,
|
||||
});
|
||||
}
|
||||
|
||||
if (error instanceof ValidateError) {
|
||||
return res.status(error.status).json({
|
||||
status: HttpStatus.UNPROCESSABLE_ENTITY,
|
||||
message: "Validation error(s).",
|
||||
detail: error.fields,
|
||||
});
|
||||
}
|
||||
|
||||
console.error("Exception Caught:" + error);
|
||||
|
||||
return res.status(HttpStatus.INTERNAL_SERVER_ERROR).json({
|
||||
status: HttpStatus.INTERNAL_SERVER_ERROR,
|
||||
message: error.message,
|
||||
});
|
||||
}
|
||||
|
||||
export default error;
|
||||
19
src/middlewares/role.ts
Normal file
19
src/middlewares/role.ts
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
import { Response, NextFunction } from "express";
|
||||
import { RequestWithUser } from "../interfaces/user";
|
||||
import HttpError from "../interfaces/http-error";
|
||||
import HttpStatus from "../interfaces/http-status";
|
||||
|
||||
export function role(
|
||||
role: string | string[],
|
||||
errorMessage: string = "คุณไม่มีสิทธิในการเข้าถึงทรัพยากรดังกล่าว",
|
||||
) {
|
||||
return (req: RequestWithUser, _res: Response, next: NextFunction) => {
|
||||
if (!Array.isArray(role) && !req.user.role.includes(role) && !req.user.role.includes("*")) {
|
||||
throw new HttpError(HttpStatus.FORBIDDEN, errorMessage);
|
||||
}
|
||||
if (role !== "*" && !req.user.role.some((v) => role.includes(v))) {
|
||||
throw new HttpError(HttpStatus.FORBIDDEN, errorMessage);
|
||||
}
|
||||
return next();
|
||||
};
|
||||
}
|
||||
193
src/services/keycloak.ts
Normal file
193
src/services/keycloak.ts
Normal file
|
|
@ -0,0 +1,193 @@
|
|||
import { DecodedJwt, createDecoder } from "fast-jwt";
|
||||
|
||||
const KC_URL = process.env.KC_URL;
|
||||
const KC_REALM = process.env.KC_REALM;
|
||||
const KC_CLIENT_ID = process.env.KC_SERVICE_ACCOUNT_CLIENT_ID;
|
||||
const KC_SECRET = process.env.KC_SERVICE_ACCOUNT_SECRET;
|
||||
|
||||
let token: string | null = null;
|
||||
let decoded: DecodedJwt | null = null;
|
||||
|
||||
const jwtDecode = createDecoder({ complete: true });
|
||||
|
||||
/**
|
||||
* Check if token is expired or will expire in 30 seconds
|
||||
* @returns true if expire or can't get exp, false otherwise
|
||||
*/
|
||||
export function isTokenExpired(token: string, beforeExpire: number = 30) {
|
||||
decoded = jwtDecode(token);
|
||||
|
||||
if (decoded && decoded.payload.exp) {
|
||||
return Date.now() / 1000 >= decoded.payload.exp - beforeExpire;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get token from keycloak if needed
|
||||
*/
|
||||
export async function getToken() {
|
||||
if (!KC_CLIENT_ID || !KC_SECRET) {
|
||||
throw new Error("KC_CLIENT_ID and KC_SECRET are required to used this feature.");
|
||||
}
|
||||
|
||||
if (token && !isTokenExpired(token)) return token;
|
||||
|
||||
const body = new URLSearchParams();
|
||||
|
||||
body.append("client_id", KC_CLIENT_ID);
|
||||
body.append("client_secret", KC_SECRET);
|
||||
body.append("grant_type", "client_credentials");
|
||||
|
||||
const res = await fetch(`${KC_URL}/realms/${KC_REALM}/protocol/openid-connect/token`, {
|
||||
method: "POST",
|
||||
body: body,
|
||||
}).catch((e) => console.error(e));
|
||||
|
||||
if (!res) {
|
||||
throw new Error("Cannot get token from keycloak.");
|
||||
}
|
||||
|
||||
const data = await res.json();
|
||||
|
||||
if (data && data.access_token) {
|
||||
token = data.access_token;
|
||||
}
|
||||
|
||||
return token;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create keycloak user by given username and password with roles
|
||||
*
|
||||
* Client must have permission to manage realm's user
|
||||
*
|
||||
* @returns user uuid or true if success, false otherwise.
|
||||
*/
|
||||
export async function createUser(username: string, password: string) {
|
||||
const res = await fetch(`${KC_URL}/admin/realms/${KC_REALM}/users`, {
|
||||
// prettier-ignore
|
||||
headers: {
|
||||
"authorization": `Bearer ${await getToken()}`,
|
||||
"content-type": `application/json`,
|
||||
},
|
||||
method: "POST",
|
||||
body: JSON.stringify({
|
||||
enabled: true,
|
||||
credentials: [{ type: "password", value: password }],
|
||||
username,
|
||||
}),
|
||||
}).catch((e) => console.log("Keycloak Error: ", e));
|
||||
|
||||
if (!res) return false;
|
||||
if (!res.ok) {
|
||||
return Boolean(console.error("Keycloak Error Response: ", await res.json()));
|
||||
}
|
||||
|
||||
const path = res.headers.get("Location");
|
||||
const id = path?.split("/").at(-1);
|
||||
return id || true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get roles list or specific role data
|
||||
*
|
||||
* Client must have permission to get realms roles
|
||||
*
|
||||
* @returns role's info (array if not specify name) if success, null if not found, false otherwise.
|
||||
*/
|
||||
export async function getRoles(name?: string) {
|
||||
const res = await fetch(
|
||||
`${KC_URL}/admin/realms/${KC_REALM}/roles`.concat((name && `/${name}`) || ""),
|
||||
{
|
||||
// prettier-ignore
|
||||
headers: {
|
||||
"authorization": `Bearer ${await getToken()}`,
|
||||
},
|
||||
},
|
||||
).catch((e) => console.log(e));
|
||||
|
||||
if (!res) return false;
|
||||
if (!res.ok && res.status !== 404) {
|
||||
return Boolean(console.error("Keycloak Error Response: ", await res.json()));
|
||||
}
|
||||
|
||||
if (res.status === 404) {
|
||||
return null;
|
||||
}
|
||||
|
||||
const data = await res.json();
|
||||
|
||||
if (Array.isArray(data)) {
|
||||
return data.map((v: Record<string, any>) => ({ id: v.id, name: v.name }));
|
||||
}
|
||||
|
||||
return {
|
||||
id: data.id,
|
||||
name: data.name,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Assign role to user
|
||||
*
|
||||
* Client must have permission to manage realm's user roles
|
||||
*
|
||||
* @returns true if success, false otherwise.
|
||||
*/
|
||||
export async function addUserRoles(userId: string, roleId: string[]) {
|
||||
const res = await fetch(
|
||||
`${KC_URL}/admin/realms/${KC_REALM}/users/${userId}/role-mappings/realm`,
|
||||
{
|
||||
// prettier-ignore
|
||||
headers: {
|
||||
"authorization": `Bearer ${await getToken()}`,
|
||||
"content-type": `application/json`,
|
||||
},
|
||||
method: "POST",
|
||||
body: JSON.stringify(roleId.map((v) => ({ id: v }))),
|
||||
},
|
||||
).catch((e) => console.log(e));
|
||||
|
||||
if (!res) return false;
|
||||
if (!res.ok) {
|
||||
return Boolean(console.error("Keycloak Error Response: ", await res.json()));
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Remove role from user
|
||||
*
|
||||
* Client must have permission to manage realm's user roles
|
||||
*
|
||||
* @returns true if success, false otherwise.
|
||||
*/
|
||||
export async function removeUserRoles(userId: string, roleId: string[]) {
|
||||
const res = await fetch(
|
||||
`${KC_URL}/admin/realms/${KC_REALM}/users/${userId}/role-mappings/realm`,
|
||||
{
|
||||
// prettier-ignore
|
||||
headers: {
|
||||
"authorization": `Bearer ${await getToken()}`,
|
||||
"content-type": `application/json`,
|
||||
},
|
||||
method: "DELETE",
|
||||
body: JSON.stringify(roleId.map((v) => ({ id: v }))),
|
||||
},
|
||||
).catch((e) => console.log(e));
|
||||
|
||||
if (!res) return false;
|
||||
if (!res.ok) {
|
||||
return Boolean(console.error("Keycloak Error Response: ", await res.json()));
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
export default {
|
||||
createUser,
|
||||
getRoles,
|
||||
addUserRoles,
|
||||
removeUserRoles,
|
||||
};
|
||||
0
static/.keep
Normal file
0
static/.keep
Normal file
19
tsconfig.json
Normal file
19
tsconfig.json
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"compilerOptions": {
|
||||
"incremental": true,
|
||||
"outDir": "dist",
|
||||
"lib": ["ESNext", "DOM", "DOM.Iterable"],
|
||||
"target": "ESNext",
|
||||
"module": "NodeNext",
|
||||
"moduleResolution": "NodeNext",
|
||||
"strictPropertyInitialization": false,
|
||||
"strict": true,
|
||||
"esModuleInterop": true,
|
||||
"forceConsistentCasingInFileNames": true,
|
||||
"experimentalDecorators": true,
|
||||
"emitDecoratorMetadata": true,
|
||||
"resolveJsonModule": true,
|
||||
"skipLibCheck": true
|
||||
},
|
||||
"include": ["src/**/*.ts"]
|
||||
}
|
||||
21
tsoa.json
Normal file
21
tsoa.json
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"entryFile": "src/app.ts",
|
||||
"noImplicitAdditionalProperties": "throw-on-extras",
|
||||
"controllerPathGlobs": ["src/controllers/**/*-controller.ts"],
|
||||
"spec": {
|
||||
"outputDirectory": "src/",
|
||||
"specVersion": 3,
|
||||
"securityDefinitions": {
|
||||
"keycloak": {
|
||||
"type": "apiKey",
|
||||
"name": "Authorization",
|
||||
"description": "Keycloak Bearer Token",
|
||||
"in": "header"
|
||||
}
|
||||
}
|
||||
},
|
||||
"routes": {
|
||||
"routesDir": "src/",
|
||||
"authenticationModule": "src/middlewares/auth.ts"
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue