474 lines
21 KiB
JavaScript
474 lines
21 KiB
JavaScript
require('dotenv').config();
|
|
const express = require('express');
|
|
const sqlite3 = require('sqlite3');
|
|
const { open } = require('sqlite');
|
|
const bcrypt = require('bcryptjs');
|
|
const jwt = require('jsonwebtoken');
|
|
const cors = require('cors');
|
|
const path = require('path');
|
|
|
|
const PORT = process.env.PORT || 3000;
|
|
const JWT_SECRET = process.env.JWT_SECRET || 'default_secret_key';
|
|
const ADMIN_USERNAME = process.env.ADMIN_USERNAME || 'admin';
|
|
const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || 'adminpassword';
|
|
|
|
const app = express();
|
|
app.use(cors());
|
|
app.use(express.json());
|
|
app.use(express.static(path.join(__dirname, 'public')));
|
|
|
|
let db;
|
|
|
|
async function startServer() {
|
|
try {
|
|
const dbPath = path.resolve(__dirname, 'data', 'timetracker.db');
|
|
db = await open({ filename: dbPath, driver: sqlite3.Database });
|
|
console.log("Connected to the SQLite database.");
|
|
await initializeDatabase();
|
|
setupRoutes();
|
|
app.listen(PORT, () => console.log(`Server running on http://localhost:${PORT}`));
|
|
} catch (err) {
|
|
console.error("FATAL: Could not start server.", err);
|
|
process.exit(1);
|
|
}
|
|
}
|
|
|
|
async function initializeDatabase() {
|
|
console.log("Initializing database schema...");
|
|
await db.exec(`CREATE TABLE IF NOT EXISTS users (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
username TEXT UNIQUE NOT NULL,
|
|
password TEXT NOT NULL,
|
|
role TEXT NOT NULL DEFAULT 'employee'
|
|
)`);
|
|
await db.exec(`CREATE TABLE IF NOT EXISTS time_entries (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
user_id INTEGER NOT NULL,
|
|
username TEXT,
|
|
punch_in_time DATETIME NOT NULL,
|
|
punch_out_time DATETIME,
|
|
status TEXT NOT NULL,
|
|
FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
|
|
)`);
|
|
await db.exec(`CREATE TABLE IF NOT EXISTS archived_time_entries (
|
|
id INTEGER PRIMARY KEY,
|
|
user_id INTEGER NOT NULL,
|
|
username TEXT,
|
|
punch_in_time DATETIME NOT NULL,
|
|
punch_out_time DATETIME,
|
|
status TEXT NOT NULL,
|
|
archived_at DATETIME NOT NULL
|
|
)`);
|
|
await db.exec(`CREATE TABLE IF NOT EXISTS time_off_requests (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
user_id INTEGER NOT NULL,
|
|
username TEXT,
|
|
start_date TEXT NOT NULL,
|
|
end_date TEXT NOT NULL,
|
|
reason TEXT,
|
|
status TEXT NOT NULL DEFAULT 'pending',
|
|
FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
|
|
)`);
|
|
await db.exec(`CREATE TABLE IF NOT EXISTS notes (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
admin_username TEXT NOT NULL,
|
|
employee_user_id INTEGER NOT NULL,
|
|
note_text TEXT NOT NULL,
|
|
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
FOREIGN KEY (employee_user_id) REFERENCES users (id) ON DELETE CASCADE
|
|
)`);
|
|
const adminUser = await db.get('SELECT * FROM users WHERE username = ?', [ADMIN_USERNAME]);
|
|
if (!adminUser) {
|
|
const hashedPassword = await bcrypt.hash(ADMIN_PASSWORD, 10);
|
|
await db.run('INSERT INTO users (username, password, role) VALUES (?, ?, ?)', [ADMIN_USERNAME, hashedPassword, 'admin']);
|
|
console.log("Primary admin user created.");
|
|
}
|
|
console.log("Database initialization complete.");
|
|
}
|
|
|
|
function setupRoutes() {
|
|
const authenticateToken = (req, res, next) => {
|
|
const token = req.headers['authorization']?.split(' ')[1];
|
|
if (!token) return res.status(401).json({ message: "Authentication required. No token provided." });
|
|
jwt.verify(token, JWT_SECRET, (err, user) => {
|
|
if (err) return res.status(403).json({ message: "Access denied. Invalid or expired token." });
|
|
req.user = user;
|
|
next();
|
|
});
|
|
};
|
|
|
|
const requireRole = (role) => (req, res, next) => {
|
|
if (req.user && req.user.role === role) next();
|
|
else res.status(403).json({ message: "Access denied." });
|
|
};
|
|
|
|
// --- Auth Routes ---
|
|
app.post('/api/login', async (req, res) => {
|
|
try {
|
|
const { username, password } = req.body;
|
|
const user = await db.get('SELECT * FROM users WHERE username = ?', [username]);
|
|
if (!user) return res.status(404).json({ message: "User not found." });
|
|
const isMatch = await bcrypt.compare(password, user.password);
|
|
if (!isMatch) return res.status(401).json({ message: "Invalid credentials." });
|
|
const tokenPayload = { id: user.id, username: user.username, role: user.role };
|
|
const token = jwt.sign(tokenPayload, JWT_SECRET, { expiresIn: '30d' });
|
|
res.json({ token, user: tokenPayload });
|
|
} catch (err) {
|
|
res.status(500).json({ message: "Server error during login." });
|
|
}
|
|
});
|
|
|
|
// --- Employee-Facing Routes ---
|
|
app.post('/api/punch', authenticateToken, async (req, res) => {
|
|
try {
|
|
const { id, username } = req.user;
|
|
const openPunch = await db.get(`SELECT * FROM time_entries WHERE user_id = ? AND status = 'in' ORDER BY punch_in_time DESC LIMIT 1`, [id]);
|
|
const now = new Date().toISOString();
|
|
if (openPunch) {
|
|
await db.run(`UPDATE time_entries SET punch_out_time = ?, status = 'out' WHERE id = ?`, [now, openPunch.id]);
|
|
res.json({ message: "Punched out." });
|
|
} else {
|
|
await db.run(`INSERT INTO time_entries (user_id, username, punch_in_time, status) VALUES (?, ?, ?, 'in')`, [id, username, now]);
|
|
res.json({ message: "Punched in." });
|
|
}
|
|
} catch (err) {
|
|
res.status(500).json({ message: "Server error during punch." });
|
|
}
|
|
});
|
|
|
|
app.get('/api/status', authenticateToken, async (req, res) => {
|
|
try {
|
|
const rows = await db.all(`SELECT * FROM time_entries WHERE user_id = ? ORDER BY punch_in_time DESC`, [req.user.id]);
|
|
res.json(rows);
|
|
} catch (err) {
|
|
res.status(500).json({ message: "Server error fetching status." });
|
|
}
|
|
});
|
|
|
|
app.post('/api/user/change-password', authenticateToken, async (req, res) => {
|
|
try {
|
|
const { currentPassword, newPassword } = req.body;
|
|
const user = await db.get('SELECT * FROM users WHERE id = ?', [req.user.id]);
|
|
if (!user) return res.status(404).json({ message: "User not found." });
|
|
const isMatch = await bcrypt.compare(currentPassword, user.password);
|
|
if (!isMatch) return res.status(401).json({ message: "Incorrect current password." });
|
|
const hashed = await bcrypt.hash(newPassword, 10);
|
|
await db.run('UPDATE users SET password = ? WHERE id = ?', [hashed, req.user.id]);
|
|
res.json({ message: "Password updated successfully." });
|
|
} catch (err) {
|
|
res.status(500).json({ message: "Error changing password." });
|
|
}
|
|
});
|
|
|
|
app.post('/api/user/request-time-off', authenticateToken, async (req, res) => {
|
|
try {
|
|
const { startDate, endDate, reason } = req.body;
|
|
const { id, username } = req.user;
|
|
await db.run(`INSERT INTO time_off_requests (user_id, username, start_date, end_date, reason) VALUES (?, ?, ?, ?, ?)`, [id, username, startDate, endDate, reason]);
|
|
res.status(201).json({ message: "Time off request submitted." });
|
|
} catch (err) {
|
|
res.status(500).json({ message: "Failed to submit request." });
|
|
}
|
|
});
|
|
|
|
app.get('/api/user/time-off-requests', authenticateToken, async (req, res) => {
|
|
try {
|
|
const rows = await db.all(`SELECT * FROM time_off_requests WHERE user_id = ? AND (status = 'pending' OR end_date >= date('now')) ORDER BY start_date ASC`, [req.user.id]);
|
|
res.json(rows);
|
|
} catch (err) {
|
|
res.status(500).json({ message: "Failed to fetch requests." });
|
|
}
|
|
});
|
|
|
|
app.get('/api/user/time-off-requests/history', authenticateToken, async (req, res) => {
|
|
try {
|
|
const rows = await db.all("SELECT * FROM time_off_requests WHERE user_id = ? ORDER BY start_date DESC", [req.user.id]);
|
|
res.json(rows);
|
|
} catch (err) {
|
|
res.status(500).json({ message: "Failed to fetch request history." });
|
|
}
|
|
});
|
|
|
|
app.get('/api/user/notes', authenticateToken, async (req, res) => {
|
|
try {
|
|
const notes = await db.all("SELECT admin_username, note_text, created_at FROM notes WHERE employee_user_id = ? ORDER BY created_at DESC", [req.user.id]);
|
|
res.json(notes);
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Failed to fetch notes.' });
|
|
}
|
|
});
|
|
|
|
// --- Admin User Management ---
|
|
app.get('/api/admin/users', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const users = await db.all("SELECT id, username, role FROM users");
|
|
const usersWithPrimaryFlag = users.map(u => ({...u, isPrimary: u.username === ADMIN_USERNAME}));
|
|
res.json(usersWithPrimaryFlag);
|
|
} catch (err) {
|
|
res.status(500).json({ message: "Failed to fetch users." });
|
|
}
|
|
});
|
|
|
|
app.post('/api/admin/create-user', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const { username, password, role } = req.body;
|
|
if (!username || !password || !role) return res.status(400).json({ message: "Username, password, and role are required." });
|
|
|
|
const existingUser = await db.get("SELECT id FROM users WHERE username = ?", [username]);
|
|
if (existingUser) return res.status(409).json({ message: "Username already exists." });
|
|
|
|
const hashedPassword = await bcrypt.hash(password, 10);
|
|
await db.run('INSERT INTO users (username, password, role) VALUES (?, ?, ?)', [username, hashedPassword, role]);
|
|
res.status(201).json({ message: 'User created successfully.' });
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Failed to create user.' });
|
|
}
|
|
});
|
|
|
|
app.post('/api/admin/update-role', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const { username, newRole } = req.body;
|
|
if (username === ADMIN_USERNAME) return res.status(403).json({ message: "Cannot change the role of the primary admin." });
|
|
await db.run('UPDATE users SET role = ? WHERE username = ?', [newRole, username]);
|
|
res.json({ message: 'User role updated.' });
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Failed to update role.' });
|
|
}
|
|
});
|
|
|
|
app.post('/api/admin/reset-password', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const { username, newPassword } = req.body;
|
|
if (!username || !newPassword) return res.status(400).json({ message: "Username and new password are required." });
|
|
const hashedPassword = await bcrypt.hash(newPassword, 10);
|
|
const result = await db.run('UPDATE users SET password = ? WHERE username = ?', [hashedPassword, username]);
|
|
if (result.changes === 0) return res.status(404).json({ message: "User not found." });
|
|
res.json({ message: `Password for ${username} has been reset.` });
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Failed to reset password.' });
|
|
}
|
|
});
|
|
|
|
app.delete('/api/admin/delete-user/:username', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const { username } = req.params;
|
|
if (username === req.user.username) return res.status(403).json({ message: "Cannot delete yourself." });
|
|
if (username === ADMIN_USERNAME) return res.status(403).json({ message: "Cannot delete the primary admin." });
|
|
|
|
const result = await db.run('DELETE FROM users WHERE username = ?', [username]);
|
|
if (result.changes === 0) return res.status(404).json({ message: "User not found." });
|
|
res.json({ message: 'User and all associated data deleted.' });
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Failed to delete user.' });
|
|
}
|
|
});
|
|
|
|
// --- Admin Time & Log Management ---
|
|
app.get('/api/admin/logs', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const rows = await db.all("SELECT * FROM time_entries ORDER BY punch_in_time DESC");
|
|
res.json(rows);
|
|
} catch (err) {
|
|
res.status(500).json({ message: "Server error fetching logs." });
|
|
}
|
|
});
|
|
|
|
app.put('/api/admin/logs/:id', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const { id } = req.params;
|
|
const { punch_in_time, punch_out_time } = req.body;
|
|
const status = punch_out_time ? 'out' : 'in';
|
|
await db.run(`UPDATE time_entries SET punch_in_time = ?, punch_out_time = ?, status = ? WHERE id = ?`, [punch_in_time, punch_out_time, status, id]);
|
|
res.json({ message: 'Entry updated successfully.' });
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Failed to update entry.' });
|
|
}
|
|
});
|
|
|
|
app.delete('/api/admin/logs/:id', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const { id } = req.params;
|
|
const result = await db.run('DELETE FROM time_entries WHERE id = ?', [id]);
|
|
if (result.changes === 0) return res.status(404).json({ message: "Entry not found." });
|
|
res.json({ message: 'Time entry deleted successfully.' });
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Failed to delete time entry.' });
|
|
}
|
|
});
|
|
|
|
app.post('/api/admin/force-clock-out', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const { userId } = req.body;
|
|
const punch = await db.get(`SELECT * FROM time_entries WHERE user_id = ? AND status = 'in' ORDER BY punch_in_time DESC LIMIT 1`, [userId]);
|
|
if (!punch) return res.status(404).json({ message: "No active punch-in found." });
|
|
await db.run(`UPDATE time_entries SET punch_out_time = ?, status = 'out' WHERE id = ?`, [new Date().toISOString(), punch.id]);
|
|
res.json({ message: "User has been clocked out." });
|
|
} catch (err) {
|
|
res.status(500).json({ message: "Server error forcing clock out." });
|
|
}
|
|
});
|
|
|
|
app.post('/api/admin/add-punch', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const { userId, username, punchInTime, punchOutTime } = req.body;
|
|
if (!userId || !punchInTime) return res.status(400).json({ message: "User and Punch In time are required." });
|
|
if (!punchOutTime) {
|
|
const existingPunch = await db.get("SELECT id FROM time_entries WHERE user_id = ? AND status = 'in'", [userId]);
|
|
if (existingPunch) return res.status(409).json({ message: `${username} is already punched in.` });
|
|
await db.run('INSERT INTO time_entries (user_id, username, punch_in_time, status) VALUES (?, ?, ?, ?)', [userId, username, punchInTime, 'in']);
|
|
return res.status(201).json({ message: `Active punch started for ${username}.` });
|
|
}
|
|
if (new Date(punchOutTime) < new Date(punchInTime)) return res.status(400).json({ message: "Punch out time cannot be before punch in time." });
|
|
await db.run('INSERT INTO time_entries (user_id, username, punch_in_time, punch_out_time, status) VALUES (?, ?, ?, ?, ?)', [userId, username, punchInTime, punchOutTime, 'out']);
|
|
res.status(201).json({ message: `Completed entry added for ${username}.` });
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Failed to add manual punch.' });
|
|
}
|
|
});
|
|
|
|
app.get('/api/admin/archives', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const rows = await db.all("SELECT * FROM archived_time_entries ORDER BY archived_at DESC");
|
|
res.json(rows);
|
|
} catch (err) {
|
|
res.status(500).json({ message: "Failed to fetch archives." });
|
|
}
|
|
});
|
|
|
|
app.post('/api/admin/archive', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const entriesToArchive = await db.all("SELECT * FROM time_entries WHERE status = 'out'");
|
|
if (entriesToArchive.length === 0) return res.json({ message: "No completed entries to archive." });
|
|
|
|
const archivedAt = new Date().toISOString();
|
|
await db.exec('BEGIN TRANSACTION');
|
|
for (const entry of entriesToArchive) {
|
|
await db.run('INSERT INTO archived_time_entries VALUES (?, ?, ?, ?, ?, ?, ?)',
|
|
[entry.id, entry.user_id, entry.username, entry.punch_in_time, entry.punch_out_time, entry.status, archivedAt]
|
|
);
|
|
await db.run('DELETE FROM time_entries WHERE id = ?', [entry.id]);
|
|
}
|
|
await db.exec('COMMIT');
|
|
res.json({ message: `${entriesToArchive.length} entries archived successfully.` });
|
|
} catch (err) {
|
|
await db.exec('ROLLBACK');
|
|
res.status(500).json({ message: 'Failed to archive entries.' });
|
|
}
|
|
});
|
|
|
|
// --- Admin Time Off & Note Management ---
|
|
app.get('/api/admin/time-off-requests/pending', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const rows = await db.all("SELECT * FROM time_off_requests WHERE status = 'pending' ORDER BY start_date ASC");
|
|
res.json(rows);
|
|
} catch (err) {
|
|
res.status(500).json({ message: "Failed to fetch pending requests." });
|
|
}
|
|
});
|
|
|
|
app.get('/api/admin/time-off-requests/history', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const rows = await db.all("SELECT * FROM time_off_requests WHERE status != 'pending' ORDER BY start_date DESC");
|
|
res.json(rows);
|
|
} catch (err) {
|
|
res.status(500).json({ message: "Failed to fetch request history." });
|
|
}
|
|
});
|
|
|
|
app.post('/api/admin/update-time-off-status', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const { requestId, status } = req.body;
|
|
await db.run('UPDATE time_off_requests SET status = ? WHERE id = ?', [status, requestId]);
|
|
res.json({ message: `Request status updated to ${status}.` });
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Failed to update request status.' });
|
|
}
|
|
});
|
|
|
|
app.delete('/api/admin/time-off-requests/:id', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const { id } = req.params;
|
|
const result = await db.run('DELETE FROM time_off_requests WHERE id = ?', [id]);
|
|
if (result.changes === 0) {
|
|
return res.status(404).json({ message: "Request not found." });
|
|
}
|
|
res.json({ message: 'Time off request permanently deleted.' });
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Error deleting time off request.' });
|
|
}
|
|
});
|
|
|
|
app.post('/api/admin/notes', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const { userId, noteText } = req.body;
|
|
const adminUsername = req.user.username;
|
|
if (!userId || !noteText) return res.status(400).json({ message: "Employee and note text are required." });
|
|
await db.run('INSERT INTO notes (admin_username, employee_user_id, note_text) VALUES (?, ?, ?)', [adminUsername, userId, noteText]);
|
|
res.status(201).json({ message: "Note successfully posted." });
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Failed to post note.' });
|
|
}
|
|
});
|
|
|
|
// NEW: Endpoint to UPDATE a specific time-off request
|
|
app.put('/api/user/time-off-requests/:id', authenticateToken, async (req, res) => {
|
|
try {
|
|
const { id } = req.params;
|
|
const { startDate, endDate, reason } = req.body;
|
|
// Ensure users can only edit their own pending requests
|
|
const result = await db.run(
|
|
`UPDATE time_off_requests
|
|
SET start_date = ?, end_date = ?, reason = ?
|
|
WHERE id = ? AND user_id = ? AND status = 'pending'`,
|
|
[startDate, endDate, reason, id, req.user.id]
|
|
);
|
|
if (result.changes === 0) {
|
|
return res.status(404).json({ message: "Pending request not found or you don't have permission to edit it." });
|
|
}
|
|
res.json({ message: 'Time off request updated successfully.' });
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Error updating time off request.' });
|
|
}
|
|
});
|
|
|
|
// NEW: Endpoint to DELETE a specific time-off request
|
|
app.delete('/api/user/time-off-requests/:id', authenticateToken, async (req, res) => {
|
|
try {
|
|
const { id } = req.params;
|
|
// Ensure users can only delete their own pending requests
|
|
const result = await db.run(
|
|
`DELETE FROM time_off_requests
|
|
WHERE id = ? AND user_id = ? AND status = 'pending'`,
|
|
[id, req.user.id]
|
|
);
|
|
if (result.changes === 0) {
|
|
return res.status(404).json({ message: "Pending request not found or you don't have permission to delete it." });
|
|
}
|
|
res.json({ message: 'Time off request deleted successfully.' });
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Error deleting time off request.' });
|
|
}
|
|
});
|
|
app.get('/api/admin/notes/:userId', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const { userId } = req.params;
|
|
const notes = await db.all("SELECT id, admin_username, note_text, created_at FROM notes WHERE employee_user_id = ? ORDER BY created_at DESC", [userId]);
|
|
res.json(notes);
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Failed to fetch notes.' });
|
|
}
|
|
});
|
|
|
|
app.delete('/api/admin/notes/:noteId', authenticateToken, requireRole('admin'), async (req, res) => {
|
|
try {
|
|
const { noteId } = req.params;
|
|
const result = await db.run('DELETE FROM notes WHERE id = ?', [noteId]);
|
|
if (result.changes === 0) return res.status(404).json({ message: "Note not found." });
|
|
res.json({ message: 'Note deleted successfully.' });
|
|
} catch (err) {
|
|
res.status(500).json({ message: 'Failed to delete note.' });
|
|
}
|
|
});
|
|
}
|
|
|
|
startServer(); |