Merge pull request #134 from RustyRory/feat/133-dashboard-admin

feat(backoffice): Fixes #133 - Dashboard Admin

Author: RustyRory

saintBarthVolleyApp/backend/package-lock.json

@@ -19,6 +19,7 @@
     "bcrypt": "^6.0.0",
     "chalk": "^5.6.2",
     "cheerio": "^1.2.0",
+    "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
     "dotenv": "^17.2.3",
     "express": "^5.2.1",

saintBarthVolleyApp/backend/package.json

@@ -2,11 +2,16 @@
 import express from 'express';
 import cors from 'cors';
 import dotenv from 'dotenv';
+import cookieParser from 'cookie-parser';
 dotenv.config();
 
 // Création de l'application Express
 const app = express();
 
+// Middlewares
+app.use(cookieParser());
+app.use(express.json());
+
 // Middlewares
 app.use(
   cors({

saintBarthVolleyApp/backend/src/app.js

@@ -1,66 +1,51 @@
 import User from '../models/User.js';
 
-// GET all users
+// GET /api/users
 export const getAllUsers = async (req, res) => {
   try {
-    const users = await User.find().select('-passwordHash'); // Ne jamais renvoyer les passwords
+    const users = await User.find().select('-passwordHash');
     res.json(users);
   } catch (err) {
-    res.status(500).json({ message: err.message });
+    console.error('GET ALL USERS ERROR:', err);
+    res.status(500).json({ message: 'Erreur serveur' });
   }
 };
 
-// GET single user
 export const getUserById = async (req, res) => {
   try {
     const user = await User.findById(req.params.id).select('-passwordHash');
-    if (!user) return res.status(404).json({ message: 'User not found' });
+    if (!user) return res.status(404).json({ message: 'Utilisateur introuvable' });
     res.json(user);
   } catch (err) {
-    res.status(500).json({ message: err.message });
+    console.error('GET USER ERROR:', err);
+    res.status(500).json({ message: 'Erreur serveur' });
   }
 };
 
-// POST create user
 export const createUser = async (req, res) => {
   try {
-    const { email, password, role, firstName, lastName } = req.body;
-    const user = new User({ email, role, firstName, lastName });
-    await user.setPassword(password);
+    const { email, firstName, lastName, role } = req.body;
+    const user = new User({ email, firstName, lastName, role });
     await user.save();
-    res.status(201).json({ message: 'User created', userId: user._id });
+    res.status(201).json(user);
   } catch (err) {
-    res.status(400).json({ message: err.message });
+    res.status(500).json({ message: err.message });
   }
 };
 
-// PUT update user
 export const updateUser = async (req, res) => {
   try {
-    const { email, role, firstName, lastName, isActive, password } = req.body;
-    const user = await User.findById(req.params.id);
-    if (!user) return res.status(404).json({ message: 'User not found' });
-
-    if (email) user.email = email;
-    if (role) user.role = role;
-    if (firstName) user.firstName = firstName;
-    if (lastName) user.lastName = lastName;
-    if (isActive !== undefined) user.isActive = isActive;
-    if (password) await user.setPassword(password);
-
-    await user.save();
-    res.json({ message: 'User updated' });
+    const user = await User.findByIdAndUpdate(req.params.id, req.body, { new: true }).select('-passwordHash');
+    res.json(user);
   } catch (err) {
-    res.status(400).json({ message: err.message });
+    res.status(500).json({ message: err.message });
   }
 };
 
-// DELETE user
 export const deleteUser = async (req, res) => {
   try {
-    const user = await User.findByIdAndDelete(req.params.id);
-    if (!user) return res.status(404).json({ message: 'User not found' });
-    res.json({ message: 'User deleted' });
+    await User.findByIdAndDelete(req.params.id);
+    res.json({ message: 'Utilisateur supprimé' });
   } catch (err) {
     res.status(500).json({ message: err.message });
   }

saintBarthVolleyApp/backend/src/controllers/usersController.js

@@ -7,31 +7,26 @@ import User from '../models/User.js';
  */
 export const authMiddleware = async (req, res, next) => {
   try {
-    const authHeader = req.headers.authorization;
+    let token;
 
-    // Vérification présence header
-    if (!authHeader || !authHeader.startsWith('Bearer ')) {
-      return res.status(401).json({ message: 'Token manquant ou invalide' });
+    // 1️⃣ Header Authorization
+    if (req.headers.authorization?.startsWith('Bearer ')) {
+      token = req.headers.authorization.split(' ')[1];
     }
 
-    const token = authHeader.split(' ')[1];
+    // 2️⃣ Cookie httpOnly
+    if (!token && req.cookies?.token) {
+      token = req.cookies.token;
+    }
 
-    // Vérification du token
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    if (!token) return res.status(401).json({ message: 'Token manquant' });
 
-    // Récupération utilisateur
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
     const user = await User.findById(decoded.id).select('-passwordHash');
 
-    if (!user) {
-      return res.status(401).json({ message: 'Utilisateur introuvable' });
-    }
-
-    // Compte désactivé
-    if (!user.isActive) {
-      return res.status(403).json({ message: 'Compte désactivé' });
-    }
+    if (!user) return res.status(401).json({ message: 'Utilisateur introuvable' });
+    if (!user.isActive) return res.status(403).json({ message: 'Compte désactivé' });
 
-    // Injection user dans la requête
     req.user = user;
     next();
   } catch (err) {

saintBarthVolleyApp/backend/src/middlewares/authMiddleware.js

@@ -49,55 +49,41 @@ router.post('/register', async (req, res) => {
  * POST /auth/login
  * Connexion utilisateur
  */
+
 router.post('/login', async (req, res) => {
   try {
     const { email, password } = req.body;
-
-    if (!email || !password) {
-      return res.status(400).json({ message: 'Email ou mot de passe manquant' });
-    }
+    if (!email || !password) return res.status(400).json({ message: 'Email ou mot de passe manquant' });
 
     const user = await User.findOne({ email });
-    if (!user) {
-      return res.status(401).json({ message: 'Identifiants invalides' });
-    }
-
-    // Compte non validé par l’admin
-    if (!user.isActive) {
-      return res.status(403).json({
-        message: 'Compte non activé. Contactez un administrateur.',
-      });
-    }
+    if (!user) return res.status(401).json({ message: 'Identifiants invalides' });
+    if (!user.isActive) return res.status(403).json({ message: 'Compte non activé' });
 
     const isPasswordValid = await user.comparePassword(password);
-    if (!isPasswordValid) {
-      return res.status(401).json({ message: 'Identifiants invalides' });
-    }
+    if (!isPasswordValid) return res.status(401).json({ message: 'Identifiants invalides' });
 
-    // Mise à jour last login
     user.lastLoginAt = new Date();
     await user.save();
 
-    // Génération JWT
-    const token = jwt.sign(
-      {
-        id: user._id,
-        role: user.role,
-      },
-      process.env.JWT_SECRET,
-      { expiresIn: '1d' },
-    );
-
-    res.json({
-      token,
-      user: {
-        id: user._id,
-        email: user.email,
-        role: user.role,
-        firstName: user.firstName,
-        lastName: user.lastName,
-      },
-    });
+    const token = jwt.sign({ id: user._id, role: user.role }, process.env.JWT_SECRET, { expiresIn: '1d' });
+
+    // 🔹 Stockage cookie httpOnly
+    res
+      .cookie('token', token, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax', // 'strict' bloque localhost
+        maxAge: 24 * 60 * 60 * 1000,
+      })
+      .json({
+        user: {
+          id: user._id,
+          email: user.email,
+          role: user.role,
+          firstName: user.firstName,
+          lastName: user.lastName,
+        },
+      });
   } catch (err) {
     console.error('LOGIN ERROR:', err);
     res.status(500).json({ message: 'Erreur serveur' });

saintBarthVolleyApp/backend/src/routes/auth.js

@@ -1,12 +1,25 @@
 import express from 'express';
 import * as usersController from '../controllers/usersController.js';
+import { authMiddleware, requireRole } from '../middlewares/authMiddleware.js';
+
 const router = express.Router();
 
-// Routes CRUD utilisateurs
-router.get('/', usersController.getAllUsers);
-router.get('/:id', usersController.getUserById);
-router.post('/', usersController.createUser);
-router.put('/:id', usersController.updateUser);
-router.delete('/:id', usersController.deleteUser);
+// 🔹 Toutes les routes sont protégées
+router.use(authMiddleware);
+
+// GET /api/users => liste tous les utilisateurs (admin uniquement)
+router.get('/', requireRole('admin'), usersController.getAllUsers);
+
+// GET /api/users/:id => voir un utilisateur (admin/éditeur)
+router.get('/:id', requireRole('admin', 'editor'), usersController.getUserById);
+
+// POST /api/users => créer un utilisateur (admin uniquement)
+router.post('/', requireRole('admin'), usersController.createUser);
+
+// PUT /api/users/:id => modifier un utilisateur (admin uniquement)
+router.put('/:id', requireRole('admin'), usersController.updateUser);
+
+// DELETE /api/users/:id => supprimer un utilisateur (admin uniquement)
+router.delete('/:id', requireRole('admin'), usersController.deleteUser);
 
 export default router;

saintBarthVolleyApp/backend/src/routes/users.js

@@ -1,6 +1,31 @@
 {
   "pages": {
-    "/_app": []
+    "/_app": [
+      "static/chunks/node_modules_next_dist_compiled_8ca6b690._.js",
+      "static/chunks/node_modules_next_dist_shared_lib_8bac8163._.js",
+      "static/chunks/node_modules_next_dist_client_5a8a528e._.js",
+      "static/chunks/node_modules_next_dist_b3fb3b5f._.js",
+      "static/chunks/node_modules_next_app_72f3d36f.js",
+      "static/chunks/[next]_entry_page-loader_ts_742e4b53._.js",
+      "static/chunks/node_modules_react-dom_4411d9bd._.js",
+      "static/chunks/node_modules_7f09fef0._.js",
+      "static/chunks/[root-of-the-server]__45f039c3._.js",
+      "static/chunks/pages__app_2da965e7._.js",
+      "static/chunks/turbopack-pages__app_0fce199e._.js"
+    ],
+    "/_error": [
+      "static/chunks/node_modules_next_dist_compiled_8ca6b690._.js",
+      "static/chunks/node_modules_next_dist_shared_lib_9a2a7093._.js",
+      "static/chunks/node_modules_next_dist_client_5a8a528e._.js",
+      "static/chunks/node_modules_next_dist_a183fb77._.js",
+      "static/chunks/node_modules_next_error_1cfbb379.js",
+      "static/chunks/[next]_entry_page-loader_ts_43b523b5._.js",
+      "static/chunks/node_modules_react-dom_4411d9bd._.js",
+      "static/chunks/node_modules_7f09fef0._.js",
+      "static/chunks/[root-of-the-server]__092393de._.js",
+      "static/chunks/pages__error_2da965e7._.js",
+      "static/chunks/turbopack-pages__error_af01c4e3._.js"
+    ]
   },
   "devFiles": [],
   "polyfillFiles": [