1094 lines
67 KiB
JavaScript
1094 lines
67 KiB
JavaScript
const fs = require("fs");
|
|
const path = require("path");
|
|
const crypto = require("crypto");
|
|
const express = require("express");
|
|
const session = require("express-session");
|
|
const bcrypt = require("bcryptjs");
|
|
const multer = require("multer");
|
|
const sharp = require("sharp");
|
|
const nodemailer = require("nodemailer");
|
|
const archiver = require("archiver");
|
|
const config = require("./config");
|
|
const {
|
|
db,
|
|
setSetting,
|
|
getSetting,
|
|
allSettings,
|
|
ensureCategory,
|
|
saveRevision,
|
|
audit
|
|
} = require("./database");
|
|
const {
|
|
escapeHtml,
|
|
cleanRichText,
|
|
makeSlug,
|
|
token,
|
|
now,
|
|
bytes,
|
|
checkbox,
|
|
listFromText,
|
|
safeJson
|
|
} = require("./utils");
|
|
const {
|
|
publicLayout,
|
|
adminLayout,
|
|
authLayout,
|
|
setting,
|
|
button,
|
|
itemCard,
|
|
serviceCard,
|
|
contactForm,
|
|
sectionHtml,
|
|
mediaOption,
|
|
mediaGrid
|
|
} = require("./render");
|
|
|
|
const app = express();
|
|
app.set("trust proxy", 1);
|
|
|
|
class SQLiteSessionStore extends session.Store {
|
|
get(sid, cb) {
|
|
try {
|
|
const row = db.prepare("SELECT sess FROM sessions WHERE sid = ? AND expired_at > ?").get(sid, Date.now());
|
|
cb(null, row ? JSON.parse(row.sess) : null);
|
|
} catch (error) {
|
|
cb(error);
|
|
}
|
|
}
|
|
set(sid, sess, cb) {
|
|
try {
|
|
const maxAge = sess.cookie?.maxAge || 1000 * 60 * 60 * 8;
|
|
db.prepare(`
|
|
INSERT INTO sessions (sid, sess, expired_at)
|
|
VALUES (?, ?, ?)
|
|
ON CONFLICT(sid) DO UPDATE SET sess = excluded.sess, expired_at = excluded.expired_at
|
|
`).run(sid, JSON.stringify(sess), Date.now() + maxAge);
|
|
cb(null);
|
|
} catch (error) {
|
|
cb(error);
|
|
}
|
|
}
|
|
destroy(sid, cb) {
|
|
try {
|
|
db.prepare("DELETE FROM sessions WHERE sid = ?").run(sid);
|
|
cb(null);
|
|
} catch (error) {
|
|
cb(error);
|
|
}
|
|
}
|
|
}
|
|
|
|
app.use(express.urlencoded({ extended: true, limit: "1mb" }));
|
|
app.use(express.json({ limit: "1mb" }));
|
|
app.use(session({
|
|
store: new SQLiteSessionStore(),
|
|
name: "dws.sid",
|
|
secret: config.sessionSecret,
|
|
resave: false,
|
|
saveUninitialized: false,
|
|
rolling: true,
|
|
cookie: {
|
|
httpOnly: true,
|
|
sameSite: "lax",
|
|
secure: config.production,
|
|
maxAge: 1000 * 60 * 60 * 8
|
|
}
|
|
}));
|
|
app.use((req, res, next) => {
|
|
if (!req.session.csrfToken) req.session.csrfToken = token(16);
|
|
res.locals.csrfToken = req.session.csrfToken;
|
|
next();
|
|
});
|
|
app.use((req, res, next) => {
|
|
if (["POST", "PUT", "PATCH", "DELETE"].includes(req.method)) {
|
|
const submitted = req.body?._csrf || req.headers["x-csrf-token"];
|
|
if (!submitted || submitted !== req.session.csrfToken) return res.status(403).send("Security check failed. Please go back and try again.");
|
|
}
|
|
next();
|
|
});
|
|
app.use("/css", express.static(path.join(config.root, "public/css"), { maxAge: "7d" }));
|
|
app.use("/js", express.static(path.join(config.root, "public/js"), { maxAge: "7d" }));
|
|
app.use("/uploads", express.static(config.uploadDir, { maxAge: "30d", fallthrough: true }));
|
|
|
|
const upload = multer({
|
|
storage: multer.memoryStorage(),
|
|
limits: { fileSize: 8 * 1024 * 1024, files: 10 },
|
|
fileFilter(req, file, cb) {
|
|
const ok = ["image/jpeg", "image/png", "image/webp"].includes(file.mimetype);
|
|
cb(ok ? null : new Error("Only JPG, PNG, and WebP images are allowed."), ok);
|
|
}
|
|
});
|
|
|
|
function adminCount() {
|
|
return db.prepare("SELECT COUNT(*) AS count FROM administrators").get().count;
|
|
}
|
|
|
|
function currentAdmin(req) {
|
|
if (!req.session.adminId) return null;
|
|
return db.prepare("SELECT id, name, email, role FROM administrators WHERE id = ?").get(req.session.adminId);
|
|
}
|
|
|
|
function requireAdmin(req, res, next) {
|
|
const admin = currentAdmin(req);
|
|
if (!admin) return res.redirect("/admin/login");
|
|
req.admin = admin;
|
|
next();
|
|
}
|
|
|
|
function navLinks() {
|
|
return db.prepare("SELECT * FROM navigation WHERE is_published = 1 ORDER BY display_order, id").all();
|
|
}
|
|
|
|
function mediaRows() {
|
|
return db.prepare("SELECT * FROM media ORDER BY created_at DESC").all();
|
|
}
|
|
|
|
function pageBySlug(slug) {
|
|
return db.prepare("SELECT * FROM pages WHERE slug = ?").get(slug);
|
|
}
|
|
|
|
function pageSections(pageId, includeHidden = false) {
|
|
return db.prepare(`
|
|
SELECT ps.*, m.url image_url, m.alt_text image_alt, bm.url background_url
|
|
FROM page_sections ps
|
|
LEFT JOIN media m ON m.id = ps.image_id
|
|
LEFT JOIN media bm ON bm.id = ps.background_image_id
|
|
WHERE ps.page_id = ? ${includeHidden ? "" : "AND ps.is_published = 1"}
|
|
ORDER BY ps.display_order, ps.id
|
|
`).all(pageId);
|
|
}
|
|
|
|
function publicItems(where = "", params = []) {
|
|
return db.prepare(`
|
|
SELECT i.*, c.name category_name, m.url image_url, m.alt_text image_alt
|
|
FROM items i
|
|
LEFT JOIN categories c ON c.id = i.category_id
|
|
LEFT JOIN media m ON m.id = i.main_image_id
|
|
WHERE i.is_published = 1 AND i.is_archived = 0 ${where}
|
|
ORDER BY i.name COLLATE NOCASE
|
|
`).all(...params);
|
|
}
|
|
|
|
function publicServices() {
|
|
return db.prepare(`
|
|
SELECT s.*, m.url image_url, m.alt_text image_alt
|
|
FROM services s
|
|
LEFT JOIN media m ON m.id = s.image_id
|
|
WHERE s.is_published = 1
|
|
ORDER BY s.display_order, s.name
|
|
`).all();
|
|
}
|
|
|
|
function renderPublic(req, res, opts) {
|
|
const settings = allSettings();
|
|
if (maintenanceActive(req, settings)) {
|
|
return res.status(503).send(publicLayout({
|
|
title: "Website Maintenance",
|
|
description: "The website is temporarily in maintenance mode.",
|
|
settings,
|
|
nav: navLinks(),
|
|
csrfToken: res.locals.csrfToken,
|
|
currentPath: req.path,
|
|
body: maintenancePage(settings)
|
|
}));
|
|
}
|
|
res.send(publicLayout({
|
|
...opts,
|
|
settings,
|
|
nav: navLinks(),
|
|
csrfToken: res.locals.csrfToken,
|
|
currentPath: req.path
|
|
}));
|
|
}
|
|
|
|
function renderAdmin(req, res, title, active, body) {
|
|
res.send(adminLayout({ title, active, body, admin: req.admin, csrfToken: res.locals.csrfToken }));
|
|
}
|
|
|
|
function maintenanceActive(req, settings) {
|
|
return setting(settings, "maintenance.enabled", "false") === "true" && !req.session.adminId && !req.path.startsWith("/admin") && req.path !== "/healthz";
|
|
}
|
|
|
|
function maintenancePage(settings) {
|
|
const artwork = setting(settings, "maintenance.artwork", "");
|
|
return `<section class="maintenance">
|
|
${artwork ? `<img src="${escapeHtml(artwork)}" alt="">` : ""}
|
|
<p class="eyebrow">Website maintenance</p>
|
|
<h1>${escapeHtml(setting(settings, "business.name", "Debbie Windler Seamstress"))}</h1>
|
|
<p>${escapeHtml(setting(settings, "maintenance.message", "The website is getting a careful refresh. Please check back soon."))}</p>
|
|
${setting(settings, "maintenance.return_note", "") ? `<p>${escapeHtml(setting(settings, "maintenance.return_note"))}</p>` : ""}
|
|
</section>`;
|
|
}
|
|
|
|
function ipHash(req) {
|
|
return crypto.createHash("sha256").update(`${req.ip}|${config.sessionSecret}`).digest("hex");
|
|
}
|
|
|
|
function rateLimit(key, limit, windowMs) {
|
|
const resetAt = Date.now() + windowMs;
|
|
const row = db.prepare("SELECT * FROM rate_limits WHERE key = ?").get(key);
|
|
if (!row || row.reset_at < Date.now()) {
|
|
db.prepare("INSERT INTO rate_limits (key, count, reset_at) VALUES (?, 1, ?) ON CONFLICT(key) DO UPDATE SET count = 1, reset_at = excluded.reset_at").run(key, resetAt);
|
|
return true;
|
|
}
|
|
if (row.count >= limit) return false;
|
|
db.prepare("UPDATE rate_limits SET count = count + 1 WHERE key = ?").run(key);
|
|
return true;
|
|
}
|
|
|
|
async function storeImage(file, { title = "", alt = "", category = "" } = {}) {
|
|
if (!file) return null;
|
|
const metadata = await sharp(file.buffer, { failOn: "error" }).metadata();
|
|
if (!["jpeg", "png", "webp"].includes(metadata.format)) throw new Error("That image format is not allowed.");
|
|
const base = `${Date.now()}-${token(4)}`;
|
|
const webName = `${base}.webp`;
|
|
const thumbName = `${base}-thumb.webp`;
|
|
const webPath = path.join(config.uploadDir, webName);
|
|
const thumbPath = path.join(config.uploadDir, thumbName);
|
|
await sharp(file.buffer).rotate().resize({ width: 1800, withoutEnlargement: true }).webp({ quality: 82 }).toFile(webPath);
|
|
await sharp(file.buffer).rotate().resize(420, 300, { fit: "cover" }).webp({ quality: 78 }).toFile(thumbPath);
|
|
const finalMeta = await sharp(webPath).metadata();
|
|
const created = now();
|
|
const result = db.prepare(`
|
|
INSERT INTO media (file_name, original_name, title, alt_text, category, mime_type, size_bytes, width, height, url, thumb_url, created_at, updated_at)
|
|
VALUES (?, ?, ?, ?, ?, 'image/webp', ?, ?, ?, ?, ?, ?, ?)
|
|
`).run(webName, file.originalname, title || file.originalname, alt, category, fs.statSync(webPath).size, finalMeta.width, finalMeta.height, `/uploads/${webName}`, `/uploads/${thumbName}`, created, created);
|
|
return db.prepare("SELECT * FROM media WHERE id = ?").get(result.lastInsertRowid);
|
|
}
|
|
|
|
async function notifyOwner(message) {
|
|
const ownerEmail = config.smtp.ownerEmail || getSetting("business.email", "");
|
|
if (!config.smtp.host || !ownerEmail) return { status: "not_configured", error: "" };
|
|
try {
|
|
const transporter = nodemailer.createTransport({
|
|
host: config.smtp.host,
|
|
port: config.smtp.port,
|
|
secure: config.smtp.secure,
|
|
auth: config.smtp.user ? { user: config.smtp.user, pass: config.smtp.pass } : undefined
|
|
});
|
|
await transporter.sendMail({
|
|
from: config.smtp.from,
|
|
to: ownerEmail,
|
|
replyTo: message.email,
|
|
subject: `Website inquiry: ${message.subject}`,
|
|
text: [
|
|
`Name: ${message.name}`,
|
|
`Email: ${message.email}`,
|
|
`Phone: ${message.phone || ""}`,
|
|
`Preferred contact: ${message.preferred_contact || ""}`,
|
|
`Related: ${message.related || ""}`,
|
|
`Source: ${message.source_page || ""}`,
|
|
"",
|
|
message.message
|
|
].join("\n")
|
|
});
|
|
return { status: "sent", error: "" };
|
|
} catch (error) {
|
|
return { status: "failed", error: error.message.slice(0, 500) };
|
|
}
|
|
}
|
|
|
|
app.get("/healthz", (req, res) => res.json({ ok: true, time: now() }));
|
|
|
|
app.get("/", (req, res) => {
|
|
const settings = allSettings();
|
|
const featured = publicItems("AND (i.featured = 1 OR i.newly_added = 1 OR i.on_sale = 1)").slice(0, 6);
|
|
const home = pageBySlug("home");
|
|
const sections = pageSections(home.id);
|
|
const overlay = setting(settings, "home.hero.overlay", "light");
|
|
const body = `
|
|
<section class="hero ${overlay}" style="background-image:url('${escapeHtml(setting(settings, "home.hero.image", ""))}');background-position:${escapeHtml(setting(settings, "home.hero.position", "center"))};background-size:${escapeHtml(setting(settings, "home.hero.size", "cover"))};--overlay-opacity:${escapeHtml(setting(settings, "home.hero.overlay_opacity", "0.28"))};color:${escapeHtml(setting(settings, "home.hero.text_color", "#2d2522"))}">
|
|
<div class="hero-inner">
|
|
<p class="eyebrow">${escapeHtml(setting(settings, "business.tagline", ""))}</p>
|
|
<h1>${escapeHtml(setting(settings, "home.hero.title", "Debbie Windler Seamstress"))}</h1>
|
|
<p>${escapeHtml(setting(settings, "home.hero.subtitle", ""))}</p>
|
|
<p class="hero-contact">${escapeHtml(setting(settings, "home.hero.contact", ""))}</p>
|
|
<div class="button-row">
|
|
${button(setting(settings, "home.hero.button1_label"), setting(settings, "home.hero.button1_url"))}
|
|
${button(setting(settings, "home.hero.button2_label"), setting(settings, "home.hero.button2_url"), "button secondary")}
|
|
</div>
|
|
</div>
|
|
</section>
|
|
<section class="showcase" style="background:${escapeHtml(setting(settings, "home.highlight.background_color", "#f4e8df"))}">
|
|
<div class="section-heading">
|
|
<p class="eyebrow">Showcase</p>
|
|
<h2>${escapeHtml(setting(settings, "home.highlight.title", "Featured and Newly Added"))}</h2>
|
|
<p>${escapeHtml(setting(settings, "home.highlight.intro", ""))}</p>
|
|
</div>
|
|
<div class="cards-grid">${featured.map(itemCard).join("")}</div>
|
|
</section>
|
|
${sections.map(sectionHtml).join("")}
|
|
`;
|
|
res.send(publicLayout({
|
|
title: setting(settings, "site.title", "Debbie Windler Seamstress"),
|
|
description: setting(settings, "site.description", ""),
|
|
settings,
|
|
nav: navLinks(),
|
|
csrfToken: res.locals.csrfToken,
|
|
currentPath: req.path,
|
|
body
|
|
}));
|
|
});
|
|
|
|
app.get("/items", (req, res) => {
|
|
const settings = allSettings();
|
|
const q = String(req.query.q || "").trim();
|
|
const category = String(req.query.category || "").trim();
|
|
const availability = String(req.query.availability || "").trim();
|
|
const where = [];
|
|
const params = [];
|
|
if (q) {
|
|
where.push("AND (i.name LIKE ? OR i.short_description LIKE ? OR i.full_description LIKE ?)");
|
|
params.push(`%${q}%`, `%${q}%`, `%${q}%`);
|
|
}
|
|
if (category) {
|
|
where.push("AND c.slug = ?");
|
|
params.push(category);
|
|
}
|
|
if (availability) {
|
|
where.push("AND i.availability_status = ?");
|
|
params.push(availability);
|
|
}
|
|
const items = publicItems(where.join(" "), params);
|
|
const categories = db.prepare("SELECT * FROM categories ORDER BY name").all();
|
|
const statuses = db.prepare("SELECT DISTINCT availability_status FROM items WHERE is_published = 1 ORDER BY availability_status").all();
|
|
const alphabet = [...new Set(items.map((item) => item.name[0]?.toUpperCase()).filter(Boolean))];
|
|
const body = `
|
|
<section class="page-hero compact"><h1>Items Available and Custom Orders</h1><p>Browse sample listings alphabetically. Every item can be edited, hidden, marked new, put on sale, or offered as a custom order.</p></section>
|
|
<section class="filters">
|
|
<form method="get">
|
|
<label>Search <input name="q" value="${escapeHtml(q)}" placeholder="Name or description"></label>
|
|
<label>Category <select name="category"><option value="">All categories</option>${categories.map((c) => `<option value="${escapeHtml(c.slug)}" ${category === c.slug ? "selected" : ""}>${escapeHtml(c.name)}</option>`).join("")}</select></label>
|
|
<label>Availability <select name="availability"><option value="">All statuses</option>${statuses.map((s) => `<option ${availability === s.availability_status ? "selected" : ""}>${escapeHtml(s.availability_status)}</option>`).join("")}</select></label>
|
|
<button type="submit">Filter</button>
|
|
</form>
|
|
${alphabet.length > 6 ? `<div class="alphabet">${alphabet.map((letter) => `<a href="#letter-${letter}">${letter}</a>`).join("")}</div>` : ""}
|
|
</section>
|
|
<section class="cards-grid">${items.map(itemCard).join("") || "<p>No items match that search yet.</p>"}</section>
|
|
`;
|
|
renderPublic(req, res, { title: "Items Available and Custom Orders", description: "Items, custom orders, and sewing examples.", body });
|
|
});
|
|
|
|
app.get("/items/:slug", (req, res) => {
|
|
const item = db.prepare(`
|
|
SELECT i.*, c.name category_name, m.url image_url, m.alt_text image_alt
|
|
FROM items i
|
|
LEFT JOIN categories c ON c.id = i.category_id
|
|
LEFT JOIN media m ON m.id = i.main_image_id
|
|
WHERE i.slug = ? AND i.is_published = 1 AND i.is_archived = 0
|
|
`).get(req.params.slug);
|
|
if (!item) return res.status(404).send("Item not found");
|
|
const gallery = db.prepare(`
|
|
SELECT m.* FROM item_images ii JOIN media m ON m.id = ii.media_id
|
|
WHERE ii.item_id = ? ORDER BY ii.display_order, ii.id
|
|
`).all(item.id);
|
|
const body = `<section class="detail-layout">
|
|
<div>${item.image_url ? `<img class="detail-image" src="${escapeHtml(item.image_url)}" alt="${escapeHtml(item.image_alt || item.name)}">` : `<div class="image-placeholder large"></div>`}</div>
|
|
<div>
|
|
<p class="eyebrow">${escapeHtml(item.category_name || "Item")}</p>
|
|
<h1>${escapeHtml(item.name)}</h1>
|
|
<p class="status">${escapeHtml(item.availability_status)}</p>
|
|
<p class="price">${item.contact_for_pricing ? "Contact for pricing" : escapeHtml(item.price || item.starting_price || item.price_range || "")}</p>
|
|
${cleanRichText(item.full_description || item.short_description || "")}
|
|
${item.material_notes ? `<h2>Materials</h2><p>${escapeHtml(item.material_notes)}</p>` : ""}
|
|
${item.color_size_notes ? `<h2>Color or Size Notes</h2><p>${escapeHtml(item.color_size_notes)}</p>` : ""}
|
|
${item.care_instructions ? `<h2>Care Instructions</h2><p>${escapeHtml(item.care_instructions)}</p>` : ""}
|
|
${button("Ask About This Item", `/about-contact?item=${encodeURIComponent(item.name)}#contact-form`)}
|
|
</div>
|
|
</section>
|
|
${gallery.length ? `<section class="gallery">${gallery.map((m) => `<img src="${escapeHtml(m.url)}" alt="${escapeHtml(m.alt_text || m.title || "")}" loading="lazy">`).join("")}</section>` : ""}`;
|
|
renderPublic(req, res, { title: item.name, description: item.short_description, body });
|
|
});
|
|
|
|
app.get("/services", (req, res) => {
|
|
const page = pageBySlug("services");
|
|
const services = publicServices();
|
|
const sections = pageSections(page.id);
|
|
const body = `<section class="page-hero compact"><h1>${escapeHtml(page.title)}</h1><p>${escapeHtml(page.intro || "")}</p></section>
|
|
<section class="cards-grid">${services.map(serviceCard).join("")}</section>
|
|
${sections.map(sectionHtml).join("")}`;
|
|
renderPublic(req, res, { title: page.title, description: page.meta_description, body });
|
|
});
|
|
|
|
app.get("/about-contact", (req, res) => {
|
|
const settings = allSettings();
|
|
const page = pageBySlug("about-contact");
|
|
const sections = pageSections(page.id);
|
|
const equipment = db.prepare(`
|
|
SELECT e.*, m.url image_url, m.alt_text image_alt
|
|
FROM equipment e LEFT JOIN media m ON m.id = e.image_id
|
|
WHERE e.is_published = 1 ORDER BY e.display_order, e.name
|
|
`).all();
|
|
const body = `<section class="page-hero compact"><h1>${escapeHtml(page.title)}</h1><p>${escapeHtml(page.intro || "")}</p></section>
|
|
${sections.map(sectionHtml).join("")}
|
|
<section class="equipment">
|
|
<div class="section-heading"><p class="eyebrow">Equipment</p><h2>Sewing Room and Equipment</h2></div>
|
|
<div class="cards-grid">${equipment.map((e) => `<article class="service-card">${e.image_url ? `<img src="${escapeHtml(e.image_url)}" alt="${escapeHtml(e.image_alt || e.name)}" loading="lazy">` : `<div class="image-placeholder thread"></div>`}<div class="card-body"><h3>${escapeHtml(e.name)}</h3><p>${escapeHtml([e.brand, e.model].filter(Boolean).join(" "))}</p><p>${escapeHtml(e.description || "")}</p></div></article>`).join("")}</div>
|
|
</section>
|
|
<section class="contact-details">
|
|
<h2>Contact Information</h2>
|
|
<dl>
|
|
<div><dt>Email</dt><dd>${escapeHtml(setting(settings, "business.email", "To be supplied"))}</dd></div>
|
|
<div><dt>Phone</dt><dd>${escapeHtml(setting(settings, "business.phone", "To be supplied"))}</dd></div>
|
|
<div><dt>Service area</dt><dd>${escapeHtml(setting(settings, "business.service_area", "To be supplied"))}</dd></div>
|
|
<div><dt>Hours</dt><dd>${escapeHtml(setting(settings, "business.hours", "By appointment"))}</dd></div>
|
|
</dl>
|
|
</section>
|
|
${contactForm({ csrfToken: res.locals.csrfToken, item: req.query.item, service: req.query.service, success: req.query.sent === "1", settings })}`;
|
|
renderPublic(req, res, { title: page.title, description: page.meta_description, body });
|
|
});
|
|
|
|
app.post("/contact", async (req, res) => {
|
|
if (!rateLimit(`contact:${ipHash(req)}`, 5, 60 * 60 * 1000)) return res.status(429).send("Too many messages were sent recently. Please try again later.");
|
|
if (req.body.website) return res.redirect("/about-contact?sent=1#contact-form");
|
|
const fields = {
|
|
name: String(req.body.name || "").trim().slice(0, 120),
|
|
email: String(req.body.email || "").trim().slice(0, 180),
|
|
phone: String(req.body.phone || "").trim().slice(0, 80),
|
|
preferred_contact: String(req.body.preferred_contact || "").trim().slice(0, 80),
|
|
subject: String(req.body.subject || "").trim().slice(0, 160),
|
|
message: String(req.body.message || "").trim().slice(0, 3000),
|
|
related: String(req.body.related || "").trim().slice(0, 160),
|
|
source_page: String(req.body.source_page || req.get("referer") || "").slice(0, 300)
|
|
};
|
|
if (!fields.name || !fields.email || !fields.subject || !fields.message || !req.body.consent || !fields.email.includes("@")) {
|
|
return res.status(400).send("Please complete the required contact form fields and try again.");
|
|
}
|
|
const emailResult = await notifyOwner(fields);
|
|
const created = now();
|
|
db.prepare(`
|
|
INSERT INTO messages
|
|
(name, email, phone, preferred_contact, subject, message, related_item, consent, source_page, ip_hash, user_agent, email_notification_status, email_error, created_at, updated_at)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?)
|
|
`).run(fields.name, fields.email, fields.phone, fields.preferred_contact, fields.subject, fields.message, fields.related, fields.source_page, ipHash(req), String(req.get("user-agent") || "").slice(0, 300), emailResult.status, emailResult.error, created, created);
|
|
res.redirect("/about-contact?sent=1#contact-form");
|
|
});
|
|
|
|
app.get("/robots.txt", (req, res) => {
|
|
const settings = allSettings();
|
|
const visible = setting(settings, "seo.visible", "true") !== "false";
|
|
res.type("text/plain").send(`${visible ? "User-agent: *\nAllow: /" : "User-agent: *\nDisallow: /"}\nSitemap: ${config.baseUrl}/sitemap.xml\n`);
|
|
});
|
|
|
|
app.get("/sitemap.xml", (req, res) => {
|
|
const items = publicItems();
|
|
const urls = ["/", "/items", "/services", "/about-contact", ...items.map((item) => `/items/${item.slug}`)];
|
|
res.type("application/xml").send(`<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">${urls.map((url) => `<url><loc>${escapeHtml(config.baseUrl + url)}</loc></url>`).join("")}</urlset>`);
|
|
});
|
|
|
|
app.get("/admin", (req, res) => {
|
|
if (!adminCount()) return res.redirect("/admin/setup");
|
|
if (!currentAdmin(req)) return res.redirect("/admin/login");
|
|
res.redirect("/admin/dashboard");
|
|
});
|
|
|
|
app.get("/admin/setup", (req, res) => {
|
|
if (adminCount()) return res.redirect("/admin/login");
|
|
res.send(authLayout("Create Owner Account", `<p>Create the first owner login. No password is stored as plain text.</p>
|
|
<form method="post">
|
|
<input type="hidden" name="_csrf" value="${escapeHtml(res.locals.csrfToken)}">
|
|
<label>Name <input required name="name" maxlength="120"></label>
|
|
<label>Email <input required type="email" name="email" maxlength="180"></label>
|
|
<label>Password <input required type="password" name="password" minlength="10"></label>
|
|
<button type="submit">Create Owner Account</button>
|
|
</form>`));
|
|
});
|
|
|
|
app.post("/admin/setup", async (req, res) => {
|
|
if (adminCount()) return res.redirect("/admin/login");
|
|
const password = String(req.body.password || "");
|
|
if (password.length < 10) return res.status(400).send("Please use a password with at least 10 characters.");
|
|
const hash = await bcrypt.hash(password, 12);
|
|
const ts = now();
|
|
const result = db.prepare("INSERT INTO administrators (name, email, password_hash, created_at, updated_at) VALUES (?, ?, ?, ?, ?)").run(String(req.body.name || "Owner").trim(), String(req.body.email || "").trim().toLowerCase(), hash, ts, ts);
|
|
req.session.adminId = result.lastInsertRowid;
|
|
audit(result.lastInsertRowid, "Created owner account", "", req.ip);
|
|
res.redirect("/admin/dashboard");
|
|
});
|
|
|
|
app.get("/admin/login", (req, res) => {
|
|
if (!adminCount()) return res.redirect("/admin/setup");
|
|
res.send(authLayout("Owner Login", `<form method="post">
|
|
<input type="hidden" name="_csrf" value="${escapeHtml(res.locals.csrfToken)}">
|
|
<label>Email <input required type="email" name="email" autocomplete="username"></label>
|
|
<label>Password <input required type="password" name="password" autocomplete="current-password"></label>
|
|
<button type="submit">Log In</button>
|
|
</form>`));
|
|
});
|
|
|
|
app.post("/admin/login", async (req, res) => {
|
|
if (!rateLimit(`login:${ipHash(req)}`, 8, 15 * 60 * 1000)) return res.status(429).send("Too many login tries. Please wait and try again.");
|
|
const admin = db.prepare("SELECT * FROM administrators WHERE email = ?").get(String(req.body.email || "").trim().toLowerCase());
|
|
if (!admin || !(await bcrypt.compare(String(req.body.password || ""), admin.password_hash))) return res.status(401).send("Login failed. Check the email and password.");
|
|
req.session.regenerate((error) => {
|
|
if (error) return res.status(500).send("Login could not be completed.");
|
|
req.session.adminId = admin.id;
|
|
req.session.csrfToken = token(16);
|
|
db.prepare("UPDATE administrators SET last_login_at = ? WHERE id = ?").run(now(), admin.id);
|
|
audit(admin.id, "Logged in", "", req.ip);
|
|
res.redirect("/admin/dashboard");
|
|
});
|
|
});
|
|
|
|
app.post("/admin/logout", requireAdmin, (req, res) => {
|
|
req.session.destroy(() => res.redirect("/admin/login"));
|
|
});
|
|
|
|
app.get("/admin/dashboard", requireAdmin, (req, res) => {
|
|
const stats = {
|
|
unread: db.prepare("SELECT COUNT(*) count FROM messages WHERE status = 'unread'").get().count,
|
|
publishedItems: db.prepare("SELECT COUNT(*) count FROM items WHERE is_published = 1 AND is_archived = 0").get().count,
|
|
hiddenItems: db.prepare("SELECT COUNT(*) count FROM items WHERE is_published = 0 OR is_archived = 1").get().count,
|
|
newItems: db.prepare("SELECT COUNT(*) count FROM items WHERE newly_added = 1").get().count,
|
|
featuredItems: db.prepare("SELECT COUNT(*) count FROM items WHERE featured = 1").get().count,
|
|
services: db.prepare("SELECT COUNT(*) count FROM services WHERE is_published = 1").get().count,
|
|
media: db.prepare("SELECT COALESCE(SUM(size_bytes),0) bytes FROM media").get().bytes,
|
|
backups: db.prepare("SELECT * FROM backups ORDER BY created_at DESC LIMIT 1").get()
|
|
};
|
|
const messages = db.prepare("SELECT * FROM messages ORDER BY created_at DESC LIMIT 5").all();
|
|
const changes = db.prepare("SELECT * FROM audit_logs ORDER BY created_at DESC LIMIT 8").all();
|
|
const body = `<section class="stats-grid">
|
|
${Object.entries({
|
|
"Unread messages": stats.unread,
|
|
"Published items": stats.publishedItems,
|
|
"Hidden or draft items": stats.hiddenItems,
|
|
"New items": stats.newItems,
|
|
"Featured items": stats.featuredItems,
|
|
"Published services": stats.services,
|
|
"Storage used": bytes(stats.media),
|
|
"Last backup": stats.backups ? stats.backups.created_at.slice(0, 10) : "No backup yet"
|
|
}).map(([label, value]) => `<article><strong>${escapeHtml(value)}</strong><span>${label}</span></article>`).join("")}
|
|
</section>
|
|
<section class="quick-actions">
|
|
${button("Add Item", "/admin/items/new")}
|
|
${button("Add Service", "/admin/services/new")}
|
|
${button("Upload Image", "/admin/media")}
|
|
${button("Edit Home Page", "/admin/home")}
|
|
${button("Read Messages", "/admin/messages")}
|
|
${button("Edit Contact Information", "/admin/business")}
|
|
</section>
|
|
<section class="two-column">
|
|
<div class="panel"><h2>Recent Messages</h2>${messages.map((m) => `<p><a href="/admin/messages/${m.id}">${escapeHtml(m.subject)}</a><br><small>${escapeHtml(m.name)} · ${escapeHtml(m.created_at)}</small></p>`).join("") || "<p>No messages yet.</p>"}</div>
|
|
<div class="panel"><h2>Recent Website Changes</h2>${changes.map((c) => `<p>${escapeHtml(c.action)}<br><small>${escapeHtml(c.created_at)}</small></p>`).join("") || "<p>No changes yet.</p>"}</div>
|
|
</section>`;
|
|
renderAdmin(req, res, "Dashboard", "dashboard", body);
|
|
});
|
|
|
|
app.get("/admin/home", requireAdmin, (req, res) => {
|
|
const s = allSettings();
|
|
const body = `<form method="post" class="editor-form">
|
|
${csrf(res)}
|
|
<section class="panel"><h2>Hero Area</h2>
|
|
${input("Business name in hero", "home.hero.title", setting(s, "home.hero.title"))}
|
|
${textarea("Subtitle", "home.hero.subtitle", setting(s, "home.hero.subtitle"))}
|
|
${input("Contact line", "home.hero.contact", setting(s, "home.hero.contact"))}
|
|
${input("Hero background URL", "home.hero.image", setting(s, "home.hero.image"))}
|
|
${select("Image position", "home.hero.position", ["center", "top", "bottom", "left", "right"], setting(s, "home.hero.position"))}
|
|
${select("Image sizing", "home.hero.size", ["cover", "contain", "auto"], setting(s, "home.hero.size"))}
|
|
${select("Overlay style", "home.hero.overlay", ["light", "dark", "none"], setting(s, "home.hero.overlay"))}
|
|
${input("Overlay opacity", "home.hero.overlay_opacity", setting(s, "home.hero.overlay_opacity"), "number", "0", "1", "0.05")}
|
|
${input("Hero text color", "home.hero.text_color", setting(s, "home.hero.text_color"), "color")}
|
|
${input("First button label", "home.hero.button1_label", setting(s, "home.hero.button1_label"))}
|
|
${input("First button link", "home.hero.button1_url", setting(s, "home.hero.button1_url"))}
|
|
${input("Second button label", "home.hero.button2_label", setting(s, "home.hero.button2_label"))}
|
|
${input("Second button link", "home.hero.button2_url", setting(s, "home.hero.button2_url"))}
|
|
</section>
|
|
<section class="panel"><h2>Featured and Newly Added Area</h2>
|
|
${input("Section title", "home.highlight.title", setting(s, "home.highlight.title"))}
|
|
${textarea("Intro text", "home.highlight.intro", setting(s, "home.highlight.intro"))}
|
|
${input("Background color", "home.highlight.background_color", setting(s, "home.highlight.background_color"), "color")}
|
|
</section>
|
|
<button type="submit">Save Home Page Settings</button>
|
|
<a class="button secondary" href="/" target="_blank" rel="noopener noreferrer">Preview Home Page</a>
|
|
</form>`;
|
|
renderAdmin(req, res, "Home Page Editor", "home", body);
|
|
});
|
|
|
|
app.post("/admin/home", requireAdmin, (req, res) => {
|
|
Object.keys(req.body).filter((key) => key.startsWith("home.")).forEach((key) => setSetting(key, req.body[key]));
|
|
audit(req.admin.id, "Updated home page settings", "", req.ip);
|
|
res.redirect("/admin/home?saved=1");
|
|
});
|
|
|
|
app.get("/admin/pages", requireAdmin, (req, res) => {
|
|
const pages = db.prepare("SELECT * FROM pages ORDER BY id").all();
|
|
renderAdmin(req, res, "Page Editor", "pages", `<div class="table-list">${pages.map((p) => `<article><h2>${escapeHtml(p.title)}</h2><p>${escapeHtml(p.intro || "")}</p><a class="button" href="/admin/pages/${p.slug}">Edit Page</a><a class="button secondary" href="${p.slug === "home" ? "/" : "/" + p.slug}" target="_blank">Preview</a></article>`).join("")}</div>`);
|
|
});
|
|
|
|
app.get("/admin/pages/:slug", requireAdmin, (req, res) => {
|
|
const page = pageBySlug(req.params.slug);
|
|
if (!page) return res.status(404).send("Page not found");
|
|
const sections = pageSections(page.id, true);
|
|
const media = mediaRows();
|
|
const body = `<form method="post" class="editor-form">
|
|
${csrf(res)}
|
|
<section class="panel">
|
|
${input("Page title", "title", page.title)}
|
|
${input("Page subtitle", "subtitle", page.subtitle || "")}
|
|
${textarea("Introduction", "intro", page.intro || "")}
|
|
${input("Search title", "meta_title", page.meta_title || "")}
|
|
${textarea("Search description", "meta_description", page.meta_description || "")}
|
|
${select("Search visibility", "search_visible", [["1","Visible to search engines"], ["0","Hidden from search engines"]], String(page.search_visible))}
|
|
${select("Status", "status", ["published", "draft"], page.status)}
|
|
</section>
|
|
<button type="submit">Save Page</button>
|
|
<a class="button secondary" href="${page.slug === "home" ? "/" : "/" + page.slug}" target="_blank">Preview Page</a>
|
|
</form>
|
|
<section class="panel"><h2>Content Sections</h2>
|
|
${sections.map((section) => sectionForm(section, media, res.locals.csrfToken, `/admin/pages/${page.slug}/sections/${section.id}`)).join("")}
|
|
<form method="post" action="/admin/pages/${page.slug}/sections/new" class="inline-form">
|
|
${csrf(res)}<button type="submit">Add Section</button>
|
|
</form>
|
|
</section>`;
|
|
renderAdmin(req, res, `Edit ${page.title}`, "pages", body);
|
|
});
|
|
|
|
app.post("/admin/pages/:slug", requireAdmin, (req, res) => {
|
|
const page = pageBySlug(req.params.slug);
|
|
saveRevision("page", page.id, page.title, page, req.admin.id);
|
|
db.prepare("UPDATE pages SET title=?, subtitle=?, intro=?, meta_title=?, meta_description=?, search_visible=?, status=?, updated_at=? WHERE id=?")
|
|
.run(req.body.title, req.body.subtitle, req.body.intro, req.body.meta_title, req.body.meta_description, checkbox(req.body.search_visible === "1"), req.body.status, now(), page.id);
|
|
audit(req.admin.id, `Updated page ${page.title}`, "", req.ip);
|
|
res.redirect(`/admin/pages/${page.slug}`);
|
|
});
|
|
|
|
app.post("/admin/pages/:slug/sections/new", requireAdmin, (req, res) => {
|
|
const page = pageBySlug(req.params.slug);
|
|
db.prepare("INSERT INTO page_sections (page_id, title, body, layout, display_order, is_published, updated_at) VALUES (?, 'New Section', '<p>Edit this section.</p>', 'text', (SELECT COALESCE(MAX(display_order),0)+10 FROM page_sections WHERE page_id=?), 0, ?)")
|
|
.run(page.id, page.id, now());
|
|
res.redirect(`/admin/pages/${page.slug}`);
|
|
});
|
|
|
|
app.post("/admin/pages/:slug/sections/:id", requireAdmin, (req, res) => {
|
|
const page = pageBySlug(req.params.slug);
|
|
const section = db.prepare("SELECT * FROM page_sections WHERE id = ?").get(req.params.id);
|
|
saveRevision("section", section.id, section.title, section, req.admin.id);
|
|
db.prepare("UPDATE page_sections SET title=?, body=?, layout=?, image_id=?, background_image_id=?, background_color=?, button_label=?, button_url=?, display_order=?, is_published=?, updated_at=? WHERE id=?")
|
|
.run(req.body.title, cleanRichText(req.body.body), req.body.layout, req.body.image_id || null, req.body.background_image_id || null, req.body.background_color, req.body.button_label, req.body.button_url, Number(req.body.display_order || 0), checkbox(req.body.is_published), now(), section.id);
|
|
audit(req.admin.id, `Updated section on ${page.title}`, "", req.ip);
|
|
res.redirect(`/admin/pages/${page.slug}`);
|
|
});
|
|
|
|
function csrf(res) {
|
|
return `<input type="hidden" name="_csrf" value="${escapeHtml(res.locals.csrfToken)}">`;
|
|
}
|
|
|
|
function input(label, name, value = "", type = "text", min = "", max = "", step = "") {
|
|
return `<label>${escapeHtml(label)} <input type="${type}" name="${escapeHtml(name)}" value="${escapeHtml(value)}" ${min !== "" ? `min="${min}"` : ""} ${max !== "" ? `max="${max}"` : ""} ${step !== "" ? `step="${step}"` : ""}></label>`;
|
|
}
|
|
|
|
function textarea(label, name, value = "") {
|
|
return `<label>${escapeHtml(label)} <textarea name="${escapeHtml(name)}" rows="5">${escapeHtml(value)}</textarea></label>`;
|
|
}
|
|
|
|
function select(label, name, options, selected = "") {
|
|
const html = options.map((option) => {
|
|
const value = Array.isArray(option) ? option[0] : option;
|
|
const text = Array.isArray(option) ? option[1] : option;
|
|
return `<option value="${escapeHtml(value)}" ${String(selected) === String(value) ? "selected" : ""}>${escapeHtml(text)}</option>`;
|
|
}).join("");
|
|
return `<label>${escapeHtml(label)} <select name="${escapeHtml(name)}">${html}</select></label>`;
|
|
}
|
|
|
|
function checkboxInput(label, name, checked) {
|
|
return `<label class="checkbox"><input type="checkbox" name="${escapeHtml(name)}" value="1" ${checked ? "checked" : ""}> ${escapeHtml(label)}</label>`;
|
|
}
|
|
|
|
function sectionForm(section, media, csrfToken, action) {
|
|
return `<details class="section-editor"><summary>${escapeHtml(section.title || "Untitled section")} ${section.is_published ? "" : "(hidden)"}</summary>
|
|
<form method="post" action="${escapeHtml(action)}" class="editor-form nested">
|
|
<input type="hidden" name="_csrf" value="${escapeHtml(csrfToken)}">
|
|
${input("Heading", "title", section.title || "")}
|
|
${textarea("Text", "body", section.body || "")}
|
|
${select("Layout", "layout", [["text", "Text only"], ["image-left", "Image left, text right"], ["image-right", "Text left, image right"], ["full-image", "Full-width image"], ["contact-callout", "Contact callout"]], section.layout)}
|
|
<label>Image <select name="image_id"><option value="">No image</option>${media.map((m) => mediaOption(m, section.image_id)).join("")}</select></label>
|
|
<label>Background image <select name="background_image_id"><option value="">No background image</option>${media.map((m) => mediaOption(m, section.background_image_id)).join("")}</select></label>
|
|
${input("Background color", "background_color", section.background_color || "", "color")}
|
|
${input("Button label", "button_label", section.button_label || "")}
|
|
${input("Button link", "button_url", section.button_url || "")}
|
|
${input("Display order", "display_order", section.display_order || 0, "number")}
|
|
${checkboxInput("Show this section on the public page", "is_published", section.is_published)}
|
|
<button type="submit">Save Section</button>
|
|
</form>
|
|
</details>`;
|
|
}
|
|
|
|
app.get("/admin/items", requireAdmin, (req, res) => {
|
|
const q = String(req.query.q || "");
|
|
const items = db.prepare(`
|
|
SELECT i.*, c.name category_name FROM items i LEFT JOIN categories c ON c.id = i.category_id
|
|
WHERE i.name LIKE ? OR i.short_description LIKE ?
|
|
ORDER BY i.name
|
|
`).all(`%${q}%`, `%${q}%`);
|
|
const body = `<form method="get" class="toolbar"><input name="q" placeholder="Search items" value="${escapeHtml(q)}"><button>Search</button><a class="button" href="/admin/items/new">Add Item</a></form>
|
|
<div class="table-list">${items.map((i) => `<article><h2>${escapeHtml(i.name)}</h2><p>${escapeHtml(i.category_name || "")} · ${escapeHtml(i.availability_status)} ${i.is_published ? "" : "· Hidden"}</p><a class="button" href="/admin/items/${i.id}/edit">Edit</a><a class="button secondary" href="/items/${i.slug}" target="_blank">Preview</a></article>`).join("")}</div>`;
|
|
renderAdmin(req, res, "Items Manager", "items", body);
|
|
});
|
|
|
|
app.get("/admin/items/new", requireAdmin, (req, res) => renderAdmin(req, res, "Add Item", "items", itemEditor(null, res.locals.csrfToken)));
|
|
app.get("/admin/items/:id/edit", requireAdmin, (req, res) => {
|
|
const item = db.prepare("SELECT i.*, c.name category_name FROM items i LEFT JOIN categories c ON c.id = i.category_id WHERE i.id = ?").get(req.params.id);
|
|
if (!item) return res.status(404).send("Item not found");
|
|
renderAdmin(req, res, `Edit ${item.name}`, "items", itemEditor(item, res.locals.csrfToken));
|
|
});
|
|
|
|
app.post("/admin/items/new", requireAdmin, upload.array("images", 8), async (req, res, next) => {
|
|
try {
|
|
const id = await saveItem(req, null);
|
|
res.redirect(`/admin/items/${id}/edit`);
|
|
} catch (error) { next(error); }
|
|
});
|
|
app.post("/admin/items/:id/edit", requireAdmin, upload.array("images", 8), async (req, res, next) => {
|
|
try {
|
|
await saveItem(req, req.params.id);
|
|
res.redirect(`/admin/items/${req.params.id}/edit`);
|
|
} catch (error) { next(error); }
|
|
});
|
|
app.post("/admin/items/:id/duplicate", requireAdmin, (req, res) => {
|
|
const item = db.prepare("SELECT * FROM items WHERE id=?").get(req.params.id);
|
|
if (!item) return res.status(404).send("Item not found");
|
|
const copyName = `${item.name} Copy`;
|
|
const copySlug = `${item.slug}-copy-${token(3)}`;
|
|
const ts = now();
|
|
const result = db.prepare(`INSERT INTO items (name, slug, short_description, full_description, category_id, main_image_id, price, starting_price, price_range, contact_for_pricing, quantity, availability_status, custom_order_available, color_size_notes, material_notes, care_instructions, featured, newly_added, on_sale, sale_text, display_order, is_published, is_archived, date_added, published_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, 0, 0, ?, ?, 0, 0, ?, NULL, ?)`)
|
|
.run(copyName, copySlug, item.short_description, item.full_description, item.category_id, item.main_image_id, item.price, item.starting_price, item.price_range, item.contact_for_pricing, item.quantity, item.availability_status, item.custom_order_available, item.color_size_notes, item.material_notes, item.care_instructions, item.sale_text, item.display_order + 1, ts, ts);
|
|
audit(req.admin.id, "Duplicated item", item.name, req.ip);
|
|
res.redirect(`/admin/items/${result.lastInsertRowid}/edit`);
|
|
});
|
|
app.post("/admin/items/:id/archive", requireAdmin, (req, res) => {
|
|
db.prepare("UPDATE items SET is_archived=1, is_published=0, updated_at=? WHERE id=?").run(now(), req.params.id);
|
|
audit(req.admin.id, "Archived item", String(req.params.id), req.ip);
|
|
res.redirect("/admin/items");
|
|
});
|
|
app.post("/admin/items/:id/delete", requireAdmin, (req, res) => {
|
|
db.prepare("DELETE FROM items WHERE id=?").run(req.params.id);
|
|
audit(req.admin.id, "Deleted item", String(req.params.id), req.ip);
|
|
res.redirect("/admin/items");
|
|
});
|
|
|
|
async function saveItem(req, id) {
|
|
const categoryId = req.body.category ? ensureCategory(req.body.category.trim()) : null;
|
|
const ts = now();
|
|
const slug = makeSlug(req.body.slug || req.body.name, "item");
|
|
if (id) {
|
|
const old = db.prepare("SELECT * FROM items WHERE id=?").get(id);
|
|
saveRevision("item", id, old.name, old, req.admin.id);
|
|
db.prepare(`UPDATE items SET name=?, slug=?, short_description=?, full_description=?, category_id=?, price=?, starting_price=?, price_range=?, contact_for_pricing=?, quantity=?, availability_status=?, custom_order_available=?, color_size_notes=?, material_notes=?, care_instructions=?, featured=?, newly_added=?, on_sale=?, sale_text=?, display_order=?, is_published=?, updated_at=? WHERE id=?`)
|
|
.run(req.body.name, slug, req.body.short_description, cleanRichText(req.body.full_description), categoryId, req.body.price, req.body.starting_price, req.body.price_range, checkbox(req.body.contact_for_pricing), req.body.quantity, req.body.availability_status, checkbox(req.body.custom_order_available), req.body.color_size_notes, req.body.material_notes, req.body.care_instructions, checkbox(req.body.featured), checkbox(req.body.newly_added), checkbox(req.body.on_sale), req.body.sale_text, Number(req.body.display_order || 0), checkbox(req.body.is_published), ts, id);
|
|
} else {
|
|
const result = db.prepare(`INSERT INTO items (name, slug, short_description, full_description, category_id, price, starting_price, price_range, contact_for_pricing, quantity, availability_status, custom_order_available, color_size_notes, material_notes, care_instructions, featured, newly_added, on_sale, sale_text, display_order, is_published, date_added, published_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
|
|
.run(req.body.name, slug, req.body.short_description, cleanRichText(req.body.full_description), categoryId, req.body.price, req.body.starting_price, req.body.price_range, checkbox(req.body.contact_for_pricing), req.body.quantity, req.body.availability_status, checkbox(req.body.custom_order_available), req.body.color_size_notes, req.body.material_notes, req.body.care_instructions, checkbox(req.body.featured), checkbox(req.body.newly_added), checkbox(req.body.on_sale), req.body.sale_text, Number(req.body.display_order || 0), checkbox(req.body.is_published), ts, ts, ts);
|
|
id = result.lastInsertRowid;
|
|
}
|
|
for (const file of req.files || []) {
|
|
const media = await storeImage(file, { title: req.body.name, alt: req.body.name, category: "Items" });
|
|
db.prepare("INSERT INTO item_images (item_id, media_id, display_order, is_main) VALUES (?, ?, (SELECT COALESCE(MAX(display_order),0)+10 FROM item_images WHERE item_id=?), 0)").run(id, media.id, id);
|
|
const item = db.prepare("SELECT main_image_id FROM items WHERE id=?").get(id);
|
|
if (!item.main_image_id) db.prepare("UPDATE items SET main_image_id=? WHERE id=?").run(media.id, id);
|
|
}
|
|
audit(req.admin.id, id ? "Saved item" : "Added item", req.body.name, req.ip);
|
|
return id;
|
|
}
|
|
|
|
function itemEditor(item, csrfToken) {
|
|
const values = item || { availability_status: "Available", is_published: 1 };
|
|
return `<form method="post" enctype="multipart/form-data" class="editor-form">
|
|
<input type="hidden" name="_csrf" value="${escapeHtml(csrfToken)}">
|
|
${input("Item name", "name", values.name || "")}
|
|
${input("Clean page address", "slug", values.slug || "")}
|
|
${textarea("Short description", "short_description", values.short_description || "")}
|
|
${textarea("Full description", "full_description", values.full_description || "")}
|
|
${input("Category", "category", values.category_name || "")}
|
|
${input("Price", "price", values.price || "")}
|
|
${input("Starting price", "starting_price", values.starting_price || "")}
|
|
${input("Price range", "price_range", values.price_range || "")}
|
|
${checkboxInput("Contact for pricing", "contact_for_pricing", values.contact_for_pricing)}
|
|
${input("Available quantity", "quantity", values.quantity || "")}
|
|
${select("Availability", "availability_status", ["Available", "Made to Order", "Custom Order", "Sold", "Seasonal", "On Sale", "Hidden"], values.availability_status)}
|
|
${checkboxInput("Custom order available", "custom_order_available", values.custom_order_available)}
|
|
${textarea("Color or size notes", "color_size_notes", values.color_size_notes || "")}
|
|
${textarea("Material notes", "material_notes", values.material_notes || "")}
|
|
${textarea("Care instructions", "care_instructions", values.care_instructions || "")}
|
|
${checkboxInput("Feature this item", "featured", values.featured)}
|
|
${checkboxInput("Mark as newly added", "newly_added", values.newly_added)}
|
|
${checkboxInput("Mark as on sale", "on_sale", values.on_sale)}
|
|
${input("Sale text", "sale_text", values.sale_text || "")}
|
|
${input("Display order", "display_order", values.display_order || 0, "number")}
|
|
${checkboxInput("Publish this item", "is_published", values.is_published)}
|
|
<label>Upload item images <input type="file" name="images" multiple accept="image/png,image/jpeg,image/webp"></label>
|
|
<button type="submit">Save Item</button>
|
|
</form>
|
|
${values.id ? `<section class="panel quick-actions">
|
|
<form method="post" action="/admin/items/${values.id}/duplicate"><input type="hidden" name="_csrf" value="${escapeHtml(csrfToken)}"><button>Duplicate Item</button></form>
|
|
<form method="post" action="/admin/items/${values.id}/archive"><input type="hidden" name="_csrf" value="${escapeHtml(csrfToken)}"><button>Archive Item</button></form>
|
|
<form method="post" action="/admin/items/${values.id}/delete"><input type="hidden" name="_csrf" value="${escapeHtml(csrfToken)}"><button class="danger">Delete Item</button></form>
|
|
</section>` : ""}`;
|
|
}
|
|
|
|
app.get("/admin/services", requireAdmin, (req, res) => {
|
|
const services = db.prepare("SELECT * FROM services ORDER BY display_order, name").all();
|
|
renderAdmin(req, res, "Services Manager", "services", `<p><a class="button" href="/admin/services/new">Add Service</a></p><div class="table-list">${services.map((s) => `<article><h2>${escapeHtml(s.name)}</h2><p>${s.is_published ? "Published" : "Hidden"} · Order ${s.display_order}</p><a class="button" href="/admin/services/${s.id}/edit">Edit</a></article>`).join("")}</div>`);
|
|
});
|
|
|
|
app.get("/admin/services/new", requireAdmin, (req, res) => renderAdmin(req, res, "Add Service", "services", serviceEditor(null, res.locals.csrfToken)));
|
|
app.get("/admin/services/:id/edit", requireAdmin, (req, res) => {
|
|
const service = db.prepare("SELECT * FROM services WHERE id=?").get(req.params.id);
|
|
renderAdmin(req, res, `Edit ${service.name}`, "services", serviceEditor(service, res.locals.csrfToken));
|
|
});
|
|
app.post("/admin/services/new", requireAdmin, upload.single("image"), async (req, res, next) => {
|
|
try { const id = await saveService(req, null); res.redirect(`/admin/services/${id}/edit`); } catch (e) { next(e); }
|
|
});
|
|
app.post("/admin/services/:id/edit", requireAdmin, upload.single("image"), async (req, res, next) => {
|
|
try { await saveService(req, req.params.id); res.redirect(`/admin/services/${req.params.id}/edit`); } catch (e) { next(e); }
|
|
});
|
|
app.post("/admin/services/:id/duplicate", requireAdmin, (req, res) => {
|
|
const s = db.prepare("SELECT * FROM services WHERE id=?").get(req.params.id);
|
|
if (!s) return res.status(404).send("Service not found");
|
|
const result = db.prepare("INSERT INTO services (name, slug, image_id, short_description, full_description, pricing_note, display_order, featured, is_published, published_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, 0, 0, NULL, ?)")
|
|
.run(`${s.name} Copy`, `${s.slug}-copy-${token(3)}`, s.image_id, s.short_description, s.full_description, s.pricing_note, s.display_order + 1, now());
|
|
audit(req.admin.id, "Duplicated service", s.name, req.ip);
|
|
res.redirect(`/admin/services/${result.lastInsertRowid}/edit`);
|
|
});
|
|
app.post("/admin/services/:id/delete", requireAdmin, (req, res) => {
|
|
db.prepare("DELETE FROM services WHERE id=?").run(req.params.id);
|
|
audit(req.admin.id, "Deleted service", String(req.params.id), req.ip);
|
|
res.redirect("/admin/services");
|
|
});
|
|
|
|
async function saveService(req, id) {
|
|
const media = req.file ? await storeImage(req.file, { title: req.body.name, alt: req.body.name, category: "Services" }) : null;
|
|
const ts = now();
|
|
const slug = makeSlug(req.body.slug || req.body.name, "service");
|
|
if (id) {
|
|
const old = db.prepare("SELECT * FROM services WHERE id=?").get(id);
|
|
saveRevision("service", id, old.name, old, req.admin.id);
|
|
db.prepare("UPDATE services SET name=?, slug=?, image_id=COALESCE(?, image_id), short_description=?, full_description=?, pricing_note=?, display_order=?, featured=?, is_published=?, updated_at=? WHERE id=?")
|
|
.run(req.body.name, slug, media?.id || null, req.body.short_description, cleanRichText(req.body.full_description), req.body.pricing_note, Number(req.body.display_order || 0), checkbox(req.body.featured), checkbox(req.body.is_published), ts, id);
|
|
} else {
|
|
const result = db.prepare("INSERT INTO services (name, slug, image_id, short_description, full_description, pricing_note, display_order, featured, is_published, published_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")
|
|
.run(req.body.name, slug, media?.id || null, req.body.short_description, cleanRichText(req.body.full_description), req.body.pricing_note, Number(req.body.display_order || 0), checkbox(req.body.featured), checkbox(req.body.is_published), ts, ts);
|
|
id = result.lastInsertRowid;
|
|
}
|
|
audit(req.admin.id, "Saved service", req.body.name, req.ip);
|
|
return id;
|
|
}
|
|
|
|
function serviceEditor(service, csrfToken) {
|
|
const s = service || { is_published: 1, display_order: 0 };
|
|
return `<form method="post" enctype="multipart/form-data" class="editor-form">
|
|
<input type="hidden" name="_csrf" value="${escapeHtml(csrfToken)}">
|
|
${input("Service name", "name", s.name || "")}
|
|
${input("Clean page address", "slug", s.slug || "")}
|
|
${textarea("Short description", "short_description", s.short_description || "")}
|
|
${textarea("Full description", "full_description", s.full_description || "")}
|
|
${input("Pricing note", "pricing_note", s.pricing_note || "")}
|
|
${input("Display order", "display_order", s.display_order || 0, "number")}
|
|
${checkboxInput("Feature this service", "featured", s.featured)}
|
|
${checkboxInput("Publish this service", "is_published", s.is_published)}
|
|
<label>Service image <input type="file" name="image" accept="image/png,image/jpeg,image/webp"></label>
|
|
<button type="submit">Save Service</button>
|
|
</form>
|
|
${s.id ? `<section class="panel quick-actions">
|
|
<form method="post" action="/admin/services/${s.id}/duplicate"><input type="hidden" name="_csrf" value="${escapeHtml(csrfToken)}"><button>Duplicate Service</button></form>
|
|
<form method="post" action="/admin/services/${s.id}/delete"><input type="hidden" name="_csrf" value="${escapeHtml(csrfToken)}"><button class="danger">Delete Service</button></form>
|
|
</section>` : ""}`;
|
|
}
|
|
|
|
app.get("/admin/about-equipment", requireAdmin, (req, res) => {
|
|
const equipment = db.prepare("SELECT * FROM equipment ORDER BY display_order, name").all();
|
|
const body = `<p><a class="button" href="/admin/pages/about-contact">Edit About Page Text</a></p>
|
|
<section class="panel"><h2>Equipment</h2>${equipment.map((e) => equipmentForm(e, res.locals.csrfToken)).join("")}
|
|
<form method="post" action="/admin/about-equipment/new">${csrf(res)}<button>Add Equipment</button></form></section>`;
|
|
renderAdmin(req, res, "About and Equipment Manager", "about", body);
|
|
});
|
|
|
|
app.post("/admin/about-equipment/new", requireAdmin, (req, res) => {
|
|
db.prepare("INSERT INTO equipment (name, type, description, display_order, is_published, updated_at) VALUES ('New Equipment', '', '', 100, 0, ?)").run(now());
|
|
res.redirect("/admin/about-equipment");
|
|
});
|
|
app.post("/admin/about-equipment/:id", requireAdmin, (req, res) => {
|
|
db.prepare("UPDATE equipment SET name=?, type=?, brand=?, model=?, description=?, display_order=?, is_published=?, updated_at=? WHERE id=?")
|
|
.run(req.body.name, req.body.type, req.body.brand, req.body.model, req.body.description, Number(req.body.display_order || 0), checkbox(req.body.is_published), now(), req.params.id);
|
|
audit(req.admin.id, "Saved equipment", req.body.name, req.ip);
|
|
res.redirect("/admin/about-equipment");
|
|
});
|
|
function equipmentForm(e, csrfToken) {
|
|
return `<details class="section-editor"><summary>${escapeHtml(e.name)} ${e.is_published ? "" : "(hidden)"}</summary><form method="post" action="/admin/about-equipment/${e.id}" class="editor-form nested">
|
|
<input type="hidden" name="_csrf" value="${escapeHtml(csrfToken)}">${input("Equipment name", "name", e.name)}${input("Type", "type", e.type || "")}${input("Brand", "brand", e.brand || "")}${input("Model", "model", e.model || "")}${textarea("Description", "description", e.description || "")}${input("Display order", "display_order", e.display_order, "number")}${checkboxInput("Publish this equipment", "is_published", e.is_published)}<button>Save Equipment</button></form></details>`;
|
|
}
|
|
|
|
app.get("/admin/messages", requireAdmin, (req, res) => {
|
|
const status = req.query.status || "";
|
|
const rows = db.prepare(`SELECT * FROM messages ${status ? "WHERE status=?" : ""} ORDER BY created_at DESC`).all(...(status ? [status] : []));
|
|
const body = `<div class="toolbar"><a class="button secondary" href="/admin/messages/export">Export CSV</a><a href="/admin/messages">All</a><a href="/admin/messages?status=unread">Unread</a><a href="/admin/messages?status=archived">Archived</a></div>
|
|
<div class="table-list">${rows.map((m) => `<article><h2><a href="/admin/messages/${m.id}">${escapeHtml(m.subject)}</a></h2><p>${escapeHtml(m.name)} · ${escapeHtml(m.email)} · ${escapeHtml(m.created_at)} · ${escapeHtml(m.status)}</p></article>`).join("") || "<p>No messages here.</p>"}</div>`;
|
|
renderAdmin(req, res, "Messages Inbox", "messages", body);
|
|
});
|
|
app.get("/admin/messages/export", requireAdmin, (req, res) => {
|
|
const rows = db.prepare("SELECT created_at,name,email,phone,preferred_contact,subject,message,related_item,source_page,status,email_notification_status FROM messages ORDER BY created_at DESC").all();
|
|
const csv = ["created_at,name,email,phone,preferred_contact,subject,message,related_item,source_page,status,email_notification_status", ...rows.map((r) => Object.values(r).map((v) => `"${String(v ?? "").replaceAll('"', '""')}"`).join(","))].join("\n");
|
|
res.type("text/csv").attachment("debbie-windler-messages.csv").send(csv);
|
|
});
|
|
app.get("/admin/messages/:id", requireAdmin, (req, res) => {
|
|
const m = db.prepare("SELECT * FROM messages WHERE id=?").get(req.params.id);
|
|
if (!m) return res.status(404).send("Message not found");
|
|
db.prepare("UPDATE messages SET status='read', updated_at=? WHERE id=? AND status='unread'").run(now(), m.id);
|
|
const mailto = `mailto:${encodeURIComponent(m.email)}?subject=${encodeURIComponent(`Re: ${m.subject}`)}`;
|
|
renderAdmin(req, res, m.subject, "messages", `<section class="panel message-detail"><p><strong>From:</strong> ${escapeHtml(m.name)} · ${escapeHtml(m.email)} · ${escapeHtml(m.phone || "")}</p><p><strong>Preferred:</strong> ${escapeHtml(m.preferred_contact || "")}</p><p><strong>Related:</strong> ${escapeHtml(m.related_item || "")}</p><p><strong>Source:</strong> ${escapeHtml(m.source_page || "")}</p><p><strong>Email notice:</strong> ${escapeHtml(m.email_notification_status)} ${m.email_error ? `- ${escapeHtml(m.email_error)}` : ""}</p><pre>${escapeHtml(m.message)}</pre><form method="post" action="/admin/messages/${m.id}/status">${csrf(res)}<button name="status" value="unread">Mark Unread</button><button name="status" value="archived">Archive</button><button name="status" value="deleted" class="danger">Delete</button><a class="button secondary" href="${mailto}">Reply by Email</a></form></section>`);
|
|
});
|
|
app.post("/admin/messages/:id/status", requireAdmin, (req, res) => {
|
|
db.prepare("UPDATE messages SET status=?, updated_at=? WHERE id=?").run(req.body.status, now(), req.params.id);
|
|
res.redirect("/admin/messages");
|
|
});
|
|
|
|
app.get("/admin/media", requireAdmin, (req, res) => {
|
|
const media = mediaRows();
|
|
const body = `<form method="post" enctype="multipart/form-data" class="panel editor-form">
|
|
${csrf(res)}${input("Image title", "title", "")}${input("Alt text", "alt", "")}${input("Folder or category", "category", "")}
|
|
<label>Images <input type="file" name="images" multiple accept="image/png,image/jpeg,image/webp"></label><button>Upload Images</button>
|
|
</form>${mediaGrid(media)}
|
|
<div class="table-list">${media.map((m) => `<article><h2>${escapeHtml(m.title || m.original_name)}</h2><p>${escapeHtml(m.url)} · ${bytes(m.size_bytes)}</p><form method="post" action="/admin/media/${m.id}">${csrf(res)}${input("Title", "title", m.title || "")}${input("Alt text", "alt_text", m.alt_text || "")}${input("Folder", "category", m.category || "")}<button>Save Image Details</button></form><form method="post" action="/admin/media/${m.id}/delete">${csrf(res)}<button class="danger">Delete Unused Image</button></form></article>`).join("")}</div>`;
|
|
renderAdmin(req, res, "Media Library", "media", body);
|
|
});
|
|
app.post("/admin/media", requireAdmin, upload.array("images", 10), async (req, res, next) => {
|
|
try {
|
|
for (const file of req.files || []) await storeImage(file, req.body);
|
|
audit(req.admin.id, "Uploaded images", `${req.files?.length || 0} files`, req.ip);
|
|
res.redirect("/admin/media");
|
|
} catch (e) { next(e); }
|
|
});
|
|
app.post("/admin/media/:id", requireAdmin, (req, res) => {
|
|
db.prepare("UPDATE media SET title=?, alt_text=?, category=?, updated_at=? WHERE id=?").run(req.body.title, req.body.alt_text, req.body.category, now(), req.params.id);
|
|
res.redirect("/admin/media");
|
|
});
|
|
app.post("/admin/media/:id/delete", requireAdmin, (req, res) => {
|
|
const id = Number(req.params.id);
|
|
const used = [
|
|
db.prepare("SELECT COUNT(*) count FROM items WHERE main_image_id=?").get(id).count,
|
|
db.prepare("SELECT COUNT(*) count FROM services WHERE image_id=?").get(id).count,
|
|
db.prepare("SELECT COUNT(*) count FROM equipment WHERE image_id=?").get(id).count,
|
|
db.prepare("SELECT COUNT(*) count FROM page_sections WHERE image_id=? OR background_image_id=?").get(id, id).count
|
|
].reduce((sum, count) => sum + count, 0);
|
|
if (used) return res.status(400).send("This image is currently used on the website. Remove it from those pages or items before deleting it.");
|
|
const media = db.prepare("SELECT * FROM media WHERE id=?").get(id);
|
|
if (media) {
|
|
for (const url of [media.url, media.thumb_url]) {
|
|
if (!url) continue;
|
|
const filePath = path.join(config.root, "public", url.replace(/^\//, ""));
|
|
if (filePath.startsWith(config.uploadDir) && fs.existsSync(filePath)) fs.unlinkSync(filePath);
|
|
}
|
|
db.prepare("DELETE FROM media WHERE id=?").run(id);
|
|
audit(req.admin.id, "Deleted unused image", media.file_name, req.ip);
|
|
}
|
|
res.redirect("/admin/media");
|
|
});
|
|
|
|
app.get("/admin/appearance", requireAdmin, (req, res) => settingsForm(req, res, "Appearance and Theme Settings", "appearance", [
|
|
["Main background color", "theme.bg", "color"], ["Secondary background color", "theme.bg_alt", "color"], ["Text color", "theme.text", "color"], ["Heading color", "theme.heading", "color"], ["Link color", "theme.link", "color"], ["Button color", "theme.button", "color"], ["Button text color", "theme.button_text", "color"], ["Accent color", "theme.accent", "color"], ["Border radius", "theme.radius", "number"], ["Site width", "theme.width", "number"], ["Heading font", "theme.heading_font"], ["Body font", "theme.body_font"], ["Footer style", "theme.footer_style"]
|
|
]));
|
|
app.post("/admin/appearance", requireAdmin, (req, res) => saveSettings(req, res, "appearance", "Updated appearance settings"));
|
|
|
|
app.get("/admin/business", requireAdmin, (req, res) => settingsForm(req, res, "Business Settings", "business", [
|
|
["Business name", "business.name"], ["Tagline", "business.tagline"], ["Email", "business.email"], ["Phone", "business.phone"], ["Facebook link", "business.facebook"], ["Service area", "business.service_area"], ["Business hours", "business.hours"], ["Preferred contact method", "business.preferred_contact"], ["Footer text", "business.footer_text"], ["Copyright text", "business.copyright"], ["Website title", "site.title"], ["Website description", "site.description"]
|
|
]));
|
|
app.post("/admin/business", requireAdmin, (req, res) => saveSettings(req, res, "business", "Updated business settings"));
|
|
|
|
app.get("/admin/seo", requireAdmin, (req, res) => settingsForm(req, res, "Search Engine and Sharing Settings", "seo", [
|
|
["Website title", "site.title"], ["Website description", "site.description"], ["Canonical URL", "seo.canonical"], ["Search-engine visibility", "seo.visible"]
|
|
]));
|
|
app.post("/admin/seo", requireAdmin, (req, res) => saveSettings(req, res, "seo", "Updated SEO settings"));
|
|
|
|
app.get("/admin/maintenance", requireAdmin, (req, res) => settingsForm(req, res, "Maintenance Mode", "maintenance", [
|
|
["Maintenance enabled (true or false)", "maintenance.enabled"], ["Maintenance message", "maintenance.message"], ["Expected return message", "maintenance.return_note"], ["Artwork URL", "maintenance.artwork"]
|
|
]));
|
|
app.post("/admin/maintenance", requireAdmin, (req, res) => saveSettings(req, res, "maintenance", "Updated maintenance mode"));
|
|
|
|
function settingsForm(req, res, title, active, fields) {
|
|
const s = allSettings();
|
|
const body = `<form method="post" class="editor-form panel">${csrf(res)}${fields.map(([label, key, type]) => type === "textarea" ? textarea(label, key, setting(s, key)) : input(label, key, setting(s, key), type || "text")).join("")}<button>Save Settings</button></form>`;
|
|
renderAdmin(req, res, title, active, body);
|
|
}
|
|
function saveSettings(req, res, redirect, action) {
|
|
Object.entries(req.body).filter(([k]) => k !== "_csrf").forEach(([key, value]) => setSetting(key, value));
|
|
audit(req.admin.id, action, "", req.ip);
|
|
res.redirect(`/admin/${redirect}`);
|
|
}
|
|
|
|
app.get("/admin/navigation", requireAdmin, (req, res) => {
|
|
const rows = db.prepare("SELECT * FROM navigation ORDER BY display_order, id").all();
|
|
const body = `<section class="panel">${rows.map((n) => `<form method="post" action="/admin/navigation/${n.id}" class="inline-grid">${csrf(res)}${input("Label", "label", n.label)}${input("Link", "url", n.url)}${select("Kind", "kind", ["internal", "external"], n.kind)}${input("Order", "display_order", n.display_order, "number")}${checkboxInput("Show", "is_published", n.is_published)}${checkboxInput("Open in new tab", "opens_new_tab", n.opens_new_tab)}<button>Save Link</button></form>`).join("")}<form method="post" action="/admin/navigation/new">${csrf(res)}<button>Add Navigation Link</button></form></section>`;
|
|
renderAdmin(req, res, "Navigation Manager", "navigation", body);
|
|
});
|
|
app.post("/admin/navigation/new", requireAdmin, (req, res) => {
|
|
db.prepare("INSERT INTO navigation (label,url,kind,display_order,is_published) VALUES ('New Link','/','internal',100,0)").run();
|
|
res.redirect("/admin/navigation");
|
|
});
|
|
app.post("/admin/navigation/:id", requireAdmin, (req, res) => {
|
|
const url = String(req.body.url || "/");
|
|
if (url.startsWith("/admin")) return res.status(400).send("Administration links cannot be added to the public menu.");
|
|
db.prepare("UPDATE navigation SET label=?, url=?, kind=?, display_order=?, is_published=?, opens_new_tab=? WHERE id=?").run(req.body.label, url, req.body.kind, Number(req.body.display_order || 0), checkbox(req.body.is_published), checkbox(req.body.opens_new_tab), req.params.id);
|
|
res.redirect("/admin/navigation");
|
|
});
|
|
|
|
app.get("/admin/security", requireAdmin, (req, res) => {
|
|
renderAdmin(req, res, "User and Security Settings", "security", `<section class="panel"><h2>Change Password</h2><form method="post" class="editor-form">${csrf(res)}<label>Current password <input type="password" name="current_password" required></label><label>New password <input type="password" name="new_password" minlength="10" required></label><button>Change Password</button></form></section><section class="panel"><h2>Security Included</h2><ul><li>Secure password hashing</li><li>Session expiration</li><li>Login rate limiting</li><li>CSRF protection</li><li>Upload validation</li><li>Audit log for important changes</li></ul></section>`);
|
|
});
|
|
app.post("/admin/security", requireAdmin, async (req, res) => {
|
|
const row = db.prepare("SELECT * FROM administrators WHERE id=?").get(req.admin.id);
|
|
if (!(await bcrypt.compare(req.body.current_password || "", row.password_hash))) return res.status(400).send("Current password was not correct.");
|
|
if (String(req.body.new_password || "").length < 10) return res.status(400).send("Use at least 10 characters.");
|
|
db.prepare("UPDATE administrators SET password_hash=?, updated_at=? WHERE id=?").run(await bcrypt.hash(req.body.new_password, 12), now(), req.admin.id);
|
|
audit(req.admin.id, "Changed password", "", req.ip);
|
|
res.redirect("/admin/security");
|
|
});
|
|
|
|
app.get("/admin/backups", requireAdmin, (req, res) => {
|
|
const rows = db.prepare("SELECT * FROM backups ORDER BY created_at DESC").all();
|
|
renderAdmin(req, res, "Backup and Restore", "backups", `<section class="panel"><form method="post" action="/admin/backups/create">${csrf(res)}<button>Create Manual Backup</button></form><p>Backups include the SQLite database and uploaded images. Secret environment files are not included.</p></section><div class="table-list">${rows.map((b) => `<article><h2>${escapeHtml(b.file_name)}</h2><p>${bytes(b.size_bytes)} · ${escapeHtml(b.created_at)}</p><a class="button" href="/admin/backups/${b.id}/download">Download Backup</a></article>`).join("") || "<p>No backups yet.</p>"}</div>`);
|
|
});
|
|
app.post("/admin/backups/create", requireAdmin, async (req, res, next) => {
|
|
try {
|
|
const backup = await createBackup();
|
|
audit(req.admin.id, "Created backup", backup.file_name, req.ip);
|
|
res.redirect("/admin/backups");
|
|
} catch (e) { next(e); }
|
|
});
|
|
app.get("/admin/backups/:id/download", requireAdmin, (req, res) => {
|
|
const backup = db.prepare("SELECT * FROM backups WHERE id=?").get(req.params.id);
|
|
if (!backup || !fs.existsSync(backup.file_path)) return res.status(404).send("Backup not found");
|
|
res.download(backup.file_path, backup.file_name);
|
|
});
|
|
|
|
async function createBackup() {
|
|
fs.mkdirSync(config.backupDir, { recursive: true });
|
|
const fileName = `debbie-windler-backup-${new Date().toISOString().replace(/[:.]/g, "-")}.zip`;
|
|
const filePath = path.join(config.backupDir, fileName);
|
|
await new Promise((resolve, reject) => {
|
|
const output = fs.createWriteStream(filePath);
|
|
const archive = archiver("zip", { zlib: { level: 9 } });
|
|
output.on("close", resolve);
|
|
archive.on("error", reject);
|
|
archive.pipe(output);
|
|
archive.file(config.databasePath, { name: "site.sqlite" });
|
|
if (fs.existsSync(config.uploadDir)) archive.directory(config.uploadDir, "uploads");
|
|
archive.finalize();
|
|
});
|
|
const stat = fs.statSync(filePath);
|
|
const result = db.prepare("INSERT INTO backups (file_name, file_path, size_bytes, created_at) VALUES (?, ?, ?, ?)").run(fileName, filePath, stat.size, now());
|
|
return db.prepare("SELECT * FROM backups WHERE id=?").get(result.lastInsertRowid);
|
|
}
|
|
|
|
app.use((err, req, res, next) => {
|
|
console.error(err);
|
|
const message = config.production ? "Something went wrong. Please try again." : err.message;
|
|
res.status(500).send(`<h1>Something went wrong</h1><p>${escapeHtml(message)}</p>`);
|
|
});
|
|
|
|
if (require.main === module) {
|
|
app.listen(config.port, () => {
|
|
console.log(`Debbie Windler Seamstress running at http://localhost:${config.port}`);
|
|
});
|
|
}
|
|
|
|
module.exports = { app, createBackup };
|