v_1.5_patch_0.2

routes/legislation.js

@@ -0,0 +1,81 @@
+'use strict';
+const express = require('express');
+const { db } = require('../db');
+const { log } = require('../lib/audit');
+const { requireAuth, requireAdmin } = require('../middleware/auth');
+const { parseInputDate } = require('../lib/dates');
+
+const router = express.Router();
+const PAGE = 'Legislation';
+
+// ---- Read: available to every signed-in user --------------------------
+router.get('/', requireAuth, (req, res) => {
+  const entries = db.prepare(
+    `SELECT id, reference, title, effective_date, summary, link_url, sort_order, created_at, updated_at
+       FROM legislation_entries
+      ORDER BY sort_order DESC, COALESCE(effective_date, '') DESC, id DESC`
+  ).all();
+  res.json({ entries });
+});
+
+// ---- Write: administrators only ---------------------------------------
+function clean(body) {
+  return {
+    reference: String((body && body.reference) || '').trim(),
+    title: String((body && body.title) || '').trim(),
+    effective_date: parseInputDate((body && body.effective_date) || ''),
+    effective_date_raw: String((body && body.effective_date) || '').trim(),
+    summary: String((body && body.summary) || '').trim(),
+    link_url: String((body && body.link_url) || '').trim(),
+    sort_order: Number.isFinite(Number(body && body.sort_order)) ? Number(body.sort_order) : 0,
+  };
+}
+
+router.post('/', requireAuth, requireAdmin, (req, res) => {
+  const v = clean(req.body);
+  if (!v.title) return res.status(400).json({ error: 'A title is required.' });
+  if (v.effective_date_raw && !v.effective_date) {
+    return res.status(400).json({ error: 'Effective date must be a valid date in DD-MM-YYYY format.' });
+  }
+  const info = db.prepare(
+    `INSERT INTO legislation_entries (reference, title, effective_date, summary, link_url, sort_order, created_by)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`
+  ).run(v.reference || null, v.title, v.effective_date || null, v.summary || null,
+        v.link_url || null, v.sort_order, req.session.user.id);
+
+  log(req, 'LEGISLATION_ENTRY_CREATED', 'Data Management', `Added legislation entry "${v.title}"`);
+  res.json({ ok: true, entry: db.prepare('SELECT * FROM legislation_entries WHERE id = ?').get(info.lastInsertRowid) });
+});
+
+router.patch('/:id', requireAuth, requireAdmin, (req, res) => {
+  const id = Number(req.params.id);
+  const existing = db.prepare('SELECT * FROM legislation_entries WHERE id = ?').get(id);
+  if (!existing) return res.status(404).json({ error: 'Entry not found.' });
+
+  const v = clean(req.body);
+  if (!v.title) return res.status(400).json({ error: 'A title is required.' });
+  if (v.effective_date_raw && !v.effective_date) {
+    return res.status(400).json({ error: 'Effective date must be a valid date in DD-MM-YYYY format.' });
+  }
+  db.prepare(
+    `UPDATE legislation_entries
+        SET reference = ?, title = ?, effective_date = ?, summary = ?, link_url = ?,
+            sort_order = ?, updated_at = CURRENT_TIMESTAMP
+      WHERE id = ?`
+  ).run(v.reference || null, v.title, v.effective_date || null, v.summary || null,
+        v.link_url || null, v.sort_order, id);
+
+  log(req, 'LEGISLATION_ENTRY_UPDATED', 'Data Management', `Updated legislation entry "${v.title}"`);
+  res.json({ ok: true, entry: db.prepare('SELECT * FROM legislation_entries WHERE id = ?').get(id) });
+});
+
+router.delete('/:id', requireAuth, requireAdmin, (req, res) => {
+  const id = Number(req.params.id);
+  const existing = db.prepare('SELECT * FROM legislation_entries WHERE id = ?').get(id);
+  if (!existing) return res.status(404).json({ error: 'Entry not found.' });
+  db.prepare('DELETE FROM legislation_entries WHERE id = ?').run(id);
+  log(req, 'LEGISLATION_ENTRY_DELETED', 'Data Management', `Deleted legislation entry "${existing.title}"`);
+  res.json({ ok: true });
+});
+
+module.exports = router;