tmaker.sori.studio/backend/src/routes/admin.js

const path = require('path')
const express = require('express')
const multer = require('multer')
const bcrypt = require('bcryptjs')
const { z } = require('zod')
const { nanoid } = require('nanoid')
const {
  findUserById,
  findGameById,
  createGame,
  updateGameThumbnail,
  createGameItem,
  deleteGameItem,
  deleteGame,
  listCustomItems,
  listUsers,
  adminUpdateUser,
  adminUpdateUserPassword,
  adminDeleteUser,
} = require('../db')
const { requireAdmin } = require('../middleware/auth')

const router = express.Router()

function buildUploadFilename(file) {
  const ext = path.extname(file.originalname || '').toLowerCase()
  const safeExt = ext && /^[.a-z0-9]+$/.test(ext) ? ext : ''
  return `${Date.now()}-${nanoid()}${safeExt}`
}

const upload = multer({
  storage: multer.diskStorage({
    destination: (req, file, cb) => cb(null, path.join(__dirname, '..', '..', 'uploads', 'games')),
    filename: (req, file, cb) => cb(null, buildUploadFilename(file)),
  }),
  limits: { fileSize: 6 * 1024 * 1024 },
})

router.post('/games', requireAdmin, async (req, res) => {
  const schema = z.object({ id: z.string().min(1), name: z.string().min(1).max(60) })
  const parsed = schema.safeParse(req.body)
  if (!parsed.success) return res.status(400).json({ error: 'bad_request' })
  const exists = await findGameById(parsed.data.id)
  if (exists) return res.status(409).json({ error: 'game_id_taken' })
  const game = await createGame({ id: parsed.data.id, name: parsed.data.name })
  res.json({ game })
})

router.post('/games/:gameId/thumbnail', requireAdmin, upload.single('thumbnail'), async (req, res) => {
  if (!req.file) return res.status(400).json({ error: 'file_required' })
  const game = await findGameById(req.params.gameId)
  if (!game) return res.status(404).json({ error: 'not_found' })
  const updated = await updateGameThumbnail(req.params.gameId, `/uploads/games/${req.file.filename}`)
  res.json({ game: updated })
})

router.post('/games/:gameId/images', requireAdmin, upload.single('image'), async (req, res) => {
  if (!req.file) return res.status(400).json({ error: 'file_required' })
  const schema = z.object({ label: z.string().min(1).max(60) })
  const parsed = schema.safeParse(req.body)
  if (!parsed.success) return res.status(400).json({ error: 'bad_request' })
  const game = await findGameById(req.params.gameId)
  if (!game) return res.status(404).json({ error: 'not_found' })
  const item = await createGameItem({
    id: nanoid(),
    gameId: game.id,
    src: `/uploads/games/${req.file.filename}`,
    label: parsed.data.label,
  })
  res.json({ item })
})

router.delete('/games/:gameId/items/:itemId', requireAdmin, async (req, res) => {
  const game = await findGameById(req.params.gameId)
  if (!game) return res.status(404).json({ error: 'not_found' })
  await deleteGameItem(req.params.itemId)
  res.json({ ok: true })
})

router.delete('/games/:gameId', requireAdmin, async (req, res) => {
  const game = await findGameById(req.params.gameId)
  if (!game) return res.status(404).json({ error: 'not_found' })
  await deleteGame(req.params.gameId)
  res.json({ ok: true })
})

router.get('/custom-items', requireAdmin, async (req, res) => {
  const schema = z.object({
    q: z.string().trim().max(120).optional().default(''),
    page: z.coerce.number().int().min(1).optional().default(1),
    limit: z.coerce.number().int().min(1).max(200).optional().default(50),
  })
  const parsed = schema.safeParse(req.query)
  if (!parsed.success) return res.status(400).json({ error: 'bad_request' })

  const result = await listCustomItems({
    queryText: parsed.data.q,
    page: parsed.data.page,
    limit: parsed.data.limit,
  })
  res.json(result)
})

router.get('/users', requireAdmin, async (req, res) => {
  const users = await listUsers()
  res.json({ users })
})

router.patch('/users/:userId', requireAdmin, async (req, res) => {
  const schema = z.object({
    email: z.string().email(),
    nickname: z.string().trim().max(40).default(''),
    isAdmin: z.boolean(),
  })
  const parsed = schema.safeParse(req.body)
  if (!parsed.success) return res.status(400).json({ error: 'bad_request' })

  if (req.params.userId === req.session.userId && !parsed.data.isAdmin) {
    return res.status(400).json({ error: 'self_admin_required' })
  }

  const user = await findUserById(req.params.userId)
  if (!user) return res.status(404).json({ error: 'not_found' })

  try {
    const updated = await adminUpdateUser({
      id: user.id,
      email: parsed.data.email,
      nickname: parsed.data.nickname,
      isAdmin: parsed.data.isAdmin,
    })
    res.json({ user: updated })
  } catch (e) {
    if (e && e.code === 'ER_DUP_ENTRY') {
      return res.status(409).json({ error: 'email_taken' })
    }
    throw e
  }
})

router.delete('/users/:userId', requireAdmin, async (req, res) => {
  if (req.params.userId === req.session.userId) {
    return res.status(400).json({ error: 'cannot_delete_self' })
  }

  const user = await findUserById(req.params.userId)
  if (!user) return res.status(404).json({ error: 'not_found' })

  await adminDeleteUser(user.id)
  res.json({ ok: true })
})

router.patch('/users/:userId/password', requireAdmin, async (req, res) => {
  const schema = z.object({
    password: z.string().min(6).max(120),
  })
  const parsed = schema.safeParse(req.body)
  if (!parsed.success) return res.status(400).json({ error: 'bad_request' })

  const user = await findUserById(req.params.userId)
  if (!user) return res.status(404).json({ error: 'not_found' })

  const passwordHash = await bcrypt.hash(parsed.data.password, 10)
  await adminUpdateUserPassword({ id: user.id, passwordHash })
  res.json({ ok: true })
})

module.exports = router