first commit

app/routes/activity.routes.js

@@ -0,0 +1,40 @@
+/**
+ * Copyright (c) 2026 Niolla
+ * All rights reserved.
+ *
+ * This source code is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use
+ * of this file, via any medium, is strictly prohibited.
+ */
+
+// app/routes/activity.routes.js
+
+const express = require("express");
+const router = express.Router();
+const activityController = require("../controllers/activity.controller");
+const {
+  authenticate,
+} = require("../middleware/auth.middleware");
+
+const { authorizedAccountType, checkPermission } = require("../middleware/permission.middleware");
+const PERMISSIONS = require("../constants/permissions");
+
+
+// Get all user activities
+router.get(
+  "/",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  activityController.getUserActivities,
+);
+
+// Get activity by User ID
+router.get(
+  "/user/:userId",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  activityController.getActivitiesByUserId,
+);
+
+
+module.exports = router;

app/routes/auth.routes.js

@@ -0,0 +1,29 @@
+/**
+ * Copyright (c) 2026 Niolla
+ * All rights reserved.
+ *
+ * This source code is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use
+ * of this file, via any medium, is strictly prohibited.
+ */
+
+// app/routes/auth.routes.js
+
+const express = require('express');
+const router = express.Router();
+const authController = require('../controllers/auth.controller');
+const {authenticate} = require('../middleware/auth.middleware');
+
+// GET /api/auth/me
+router.get("/me", authenticate, (req, res) => {
+  res.json({
+    authenticated: true,
+    user: req.user
+  });
+});
+
+router.post('/req-otp', authController.loginReq);   
+router.post('/login', authController.login);    
+router.post('/logout', authController.logout);    
+
+module.exports = router;

app/routes/docs.routes.js

@@ -0,0 +1,77 @@
+/**
+ * Markdown Docs Route
+ */
+
+const express = require("express");
+const fs = require("fs");
+const path = require("path");
+const docsSession = require("../middleware/docsSession.middleware");
+
+const router = express.Router();
+
+
+const DOCS_DIR = path.join(__dirname, "../../Documentation");
+
+router.get("/markdown-files", docsSession, (req, res) => {
+  fs.readdir(DOCS_DIR, (err, files) => {
+    if (err) {
+      return res.status(500).json({
+        success: false,
+        message: "Failed to read documentation folder",
+        error: err.message,
+      });
+    }
+
+    const mdFiles = files.filter((file) => file.endsWith(".md"));
+
+    res.json({
+      success: true,
+      data: mdFiles,
+    });
+  });
+});
+
+router.get("/view/:file", docsSession, (req, res) => {
+  const filePath = path.join(DOCS_DIR, req.params.file);
+
+  if (!req.params.file.endsWith(".md")) {
+    return res.status(400).send("Only markdown files allowed");
+  }
+
+  // basic protection against path traversal
+  if (!filePath.startsWith(DOCS_DIR)) {
+    return res.status(400).send("Invalid path");
+  }
+
+  res.sendFile(filePath);
+});
+
+// Docs login (simple)
+router.post("/login", (req, res) => {
+  const { username, password } = req.body;
+
+  if (
+    username === process.env.DOCS_USER &&
+    password === process.env.DOCS_PASS
+  ) {
+    res.cookie("docsAuth", "true", {
+      httpOnly: true,
+      sameSite: "lax",
+      secure: process.env.NODE_ENV === "production",
+    });
+
+    return res.json({ success: true });
+  }
+
+  return res.status(401).json({
+    success: false,
+    message: "Invalid credentials",
+  });
+});
+
+router.post("/logout", (req, res) => {
+  res.clearCookie("docsAuth");
+  res.json({ success: true });
+});
+
+module.exports = router;

app/routes/document.routes.js

@@ -0,0 +1,94 @@
+/**
+ * Copyright (c) 2026 Niolla
+ * All rights reserved.
+ *
+ * This source code is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use
+ * of this file, via any medium, is strictly prohibited.
+ */
+
+// app/routes/document.routes.js
+
+const express = require("express");
+const router = express.Router();
+const generateDocumentController = require("../controllers/generateDocument.controller");
+const {
+  authenticate,
+} = require("../middleware/auth.middleware");
+
+const { authorizedAccountType, checkPermission } = require("../middleware/permission.middleware");
+const PERMISSIONS = require("../constants/permissions");
+
+
+// Get available document types
+router.get(
+  "/types",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  generateDocumentController.getAvailableDocumentTypes
+);
+
+// Get saved documents
+router.post(
+  "/saved",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  generateDocumentController.getSavedDocuments
+);
+
+// Generate Document (async - returns jobId immediately)
+router.post(
+  "/generate",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  generateDocumentController.generateDocument
+);
+
+router.post(
+  "/draft",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  generateDocumentController.generateDraftDocument
+);
+
+// Generate Reference Number
+router.get(
+  "/reference-number/:documentType",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  generateDocumentController.generateReferenceNo
+);
+
+// Get Job Status
+router.get(
+  "/job/:jobId/status",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  generateDocumentController.getJobStatus
+);
+
+// Download Document
+router.get(
+  "/download/:uuid",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  generateDocumentController.downloadDocument
+);
+
+// Cancel Job
+router.delete(
+  "/job/:jobId",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  generateDocumentController.cancelJob
+);
+
+// Get document details
+router.get(
+  "/:docId",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  generateDocumentController.getDocumentData
+);
+
+module.exports = router;

app/routes/index.js

@@ -0,0 +1,35 @@
+/**
+ * Copyright (c) 2026 Niolla
+ * All rights reserved.
+ *
+ * This source code is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use
+ * of this file, via any medium, is strictly prohibited.
+ */
+
+// app/routes/index.js
+
+const express = require("express");
+
+const authRoutes = require("./auth.routes");
+const userRoutes = require("./user.routes");
+const activityRoutes = require("./activity.routes");
+const uploadRoutes = require("./upload.routes");
+const documentRoutes = require("./document.routes");
+const docsRoutes = require("./docs.routes");
+const permissionRoutes = require("./permission.routes");
+const profileRoutes = require("./profile.routes");
+const notificationRoutes = require("./notification.routes");
+
+const router = express.Router();
+
+router.use("/auth", authRoutes);
+router.use("/user", userRoutes);
+router.use("/activity", activityRoutes);
+router.use("/upload", uploadRoutes);
+router.use("/document", documentRoutes);
+router.use("/docs", docsRoutes);
+router.use("/profile", profileRoutes);
+router.use("/notification", notificationRoutes);
+
+module.exports = router;

app/routes/notification.routes.js

@@ -0,0 +1,69 @@
+/**
+ * Copyright (c) 2026 Niolla
+ * All rights reserved.
+ *
+ * This source code is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use
+ * of this file, via any medium, is strictly prohibited.
+ */
+
+// app/routes/notification.routes.js
+
+const express = require("express");
+const router = express.Router();
+
+const notificationController = require("../controllers/notification.controller");
+
+const {
+  authenticate,
+} = require("../middleware/auth.middleware");
+
+const {
+  authorizedAccountType,
+  checkPermission,
+} = require("../middleware/permission.middleware");
+
+const PERMISSIONS = require("../constants/permissions");
+
+
+// Create notification
+router.post(
+  "/",
+  authenticate,
+  authorizedAccountType(["admin", "management"]),
+  // checkPermission(PERMISSIONS.NOTIFICATION_CREATE),
+  notificationController.createNotification,
+);
+
+
+// Get all announcements
+router.get(
+  "/announcements",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  // checkPermission(PERMISSIONS.NOTIFICATION_VIEW),
+  notificationController.getAnnouncements,
+);
+
+
+// Get notifications for a user
+router.get(
+  "/user/:userId",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  // checkPermission(PERMISSIONS.NOTIFICATION_VIEW),
+  notificationController.getUserNotifications,
+);
+
+
+// Mark notification as read
+router.patch(
+  "/user/:userId/notification/:notificationId/read",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  // checkPermission(PERMISSIONS.NOTIFICATION_READ),
+  notificationController.markAsRead,
+);
+
+
+module.exports = router;

app/routes/permission.routes.js

@@ -0,0 +1,145 @@
+/**
+ * Copyright (c) 2026 Niolla
+ * All rights reserved.
+ *
+ * This source code is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use
+ * of this file, via any medium, is strictly prohibited.
+ */
+
+// app/routes/permission.routes.js
+
+const express = require("express");
+const router = express.Router();
+const permissionController = require("../controllers/permission.controller");
+const { authenticate } = require("../middleware/auth.middleware");
+const { authorizedAccountType } = require("../middleware/permission.middleware");
+
+// Permission routes
+router.post(
+  "/",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  permissionController.createPermission
+);
+
+router.post(
+  "/bulk",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  permissionController.bulkCreatePermissions
+);
+
+router.get(
+  "/",
+  authenticate,
+  permissionController.getAllPermissions
+);
+
+router.get(
+  "/:permissionId",
+  authenticate,
+  permissionController.getPermissionById
+);
+
+router.put(
+  "/:permissionId",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  permissionController.updatePermission
+);
+
+router.delete(
+  "/:permissionId",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  permissionController.deletePermission
+);
+
+// Role routes
+router.post(
+  "/roles",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  permissionController.createRole
+);
+
+router.get(
+  "/roles",
+  authenticate,
+  permissionController.getAllRoles
+);
+
+router.get(
+  "/roles/:roleId",
+  authenticate,
+  permissionController.getRoleById
+);
+
+router.put(
+  "/roles/:roleId",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  permissionController.updateRole
+);
+
+router.delete(
+  "/roles/:roleId",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  permissionController.deleteRole
+);
+
+// Role-Permission assignment route
+router.post(
+  "/roles/:roleId/permissions",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  permissionController.createRolePermission
+);
+
+// Bulk Role-Permission assignment
+router.post(
+  "/roles/permissions/bulk",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  permissionController.bulkCreateRolePermissions
+);
+
+// User permissions route
+router.get(
+  "/users/:userId/permissions",
+  authenticate,
+  permissionController.getUserPermissions
+);
+
+router.post(
+  "/users/permissions",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  permissionController.createUserPermission
+);
+
+// Bulk User Permissions
+router.post(
+  "/users/permissions/bulk",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  permissionController.bulkCreateUserPermissions
+);
+
+router.put(
+  "/users/permissions/:upId",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  permissionController.updateUserPermission
+);
+
+router.delete(
+  "/users/permissions/:upId",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  permissionController.deleteUserPermission
+);
+
+module.exports = router;

app/routes/profile.routes.js

@@ -0,0 +1,48 @@
+/**
+ * Copyright (c) 2026 Niolla
+ * All rights reserved.
+ *
+ * This source code is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use
+ * of this file, via any medium, is strictly prohibited.
+ */
+
+// app/routes/profile.routes.js
+
+const express = require("express");
+const router = express.Router();
+const profileController = require("../controllers/profile.controller.js");
+const { authenticate } = require("../middleware/auth.middleware");
+
+const {
+  authorizedAccountType,
+  checkPermission,
+} = require("../middleware/permission.middleware");
+const PERMISSIONS = require("../constants/permissions");
+
+router.post("/req-reset-password", profileController.requestPasswordReset);
+
+router.post("/reset-password", profileController.resetPassword);
+
+router.post(
+  "/change-password",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  profileController.changePassword,
+);
+
+router.get(
+  "/avatar/:userId",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  profileController.getProfileAvatar,
+);
+
+router.get(
+  "/background/:userId",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  profileController.getProfileBackgroundImage,
+);
+
+module.exports = router;

app/routes/upload.routes.js

@@ -0,0 +1,40 @@
+/**
+ * Copyright (c) 2026 Niolla
+ * All rights reserved.
+ *
+ * This source code is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use
+ * of this file, via any medium, is strictly prohibited.
+ */
+
+// app/routes/upload.routes.js
+
+const express = require("express");
+const router = express.Router();
+const uploadController = require("../controllers/upload.controller");
+const { uploadSingle } = require("../middleware/upload.middleware");
+const {
+  authenticate,
+} = require("../middleware/auth.middleware");
+
+const { authorizedAccountType, checkPermission } = require("../middleware/permission.middleware");
+const PERMISSIONS = require("../constants/permissions");
+
+// Upload file
+router.post(
+  "/",
+  authenticate,
+  authorizedAccountType(["admin", "staff"]),
+  uploadSingle("file"),
+  uploadController.uploadFile,
+);
+
+// Get signed URL for a file
+router.get(
+  "/signed-url/:id",
+  authenticate,
+  authorizedAccountType(["admin", "staff"]),
+  uploadController.getFileUrl,
+);
+
+module.exports = router;

app/routes/user.routes.js

@@ -0,0 +1,58 @@
+/**
+ * Copyright (c) 2026 Niolla
+ * All rights reserved.
+ *
+ * This source code is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use
+ * of this file, via any medium, is strictly prohibited.
+ */
+
+// app/routes/user.routes.js
+
+const express = require("express");
+const router = express.Router();
+const userController = require("../controllers/user.controller");
+const {
+  authenticate,
+} = require("../middleware/auth.middleware");
+
+const { authorizedAccountType, checkPermission } = require("../middleware/permission.middleware");
+const PERMISSIONS = require("../constants/permissions");
+
+
+router.post(
+  "/",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  userController.createNewUser
+);
+
+router.get(
+  "/",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  userController.getAllUsers
+);
+
+router.get(
+  "/:id",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  userController.getUserById
+);
+
+router.patch(
+  "/:id",
+  authenticate,
+  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  userController.updateUser
+); 
+
+router.delete(
+  "/:id",
+  authenticate,
+  authorizedAccountType(["admin"]),
+  userController.deleteUser
+);
+
+module.exports = router;