+
+
${title}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+ No category? Create one for:
+
+
+
+
+
+
+
+
+
+
+ Add subcategory to:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Public Photo
+
+
+
+
+
+
+
+
+
+
+
+
+ Hidden Content (shown after purchase)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- No category? Create one for:
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Public Photo
-
-
-
-
-
-
-
-
-
-
-
-
- Hidden Content (shown after purchase)
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
`;
+`;
}
-router.get('/', async (req, res) => {
+router.get('/', asyncHandler(async (req, res) => {
const { loc, cat, sub, msg, msg_type } = req.query;
const [locations, categories, subcategories] = await Promise.all([
db.allAsync('SELECT * FROM locations ORDER BY country, city, district'),
@@ -279,9 +309,10 @@ router.get('/', async (req, res) => {
}
const catOptions = categories.map(c => `
`).join('');
- const treeHtml = buildTreeHtml(tree);
- const addFormHtml = buildProductFormHtml('/catalog/products', catOptions, locations);
- const editFormHtml = buildProductFormHtml('/catalog/products/__ID__/edit', catOptions, locations);
+ const csrf = res.locals.csrfToken || '';
+ const treeHtml = buildTreeHtml(tree, csrf);
+ const addFormHtml = buildProductFormHtml('/catalog/products', catOptions, locations).replace('__CSRF__', esc(csrf));
+ const editFormHtml = buildProductFormHtml('/catalog/products/__ID__/edit', catOptions, locations).replace('__CSRF__', esc(csrf));
res.render('catalog', {
title: 'Catalog',
@@ -295,74 +326,89 @@ router.get('/', async (req, res) => {
msg: msg || '',
msgType: msg_type || 'info',
});
-});
+}));
-router.post('/locations', async (req, res) => {
+router.post('/locations', asyncHandler(async (req, res) => {
const { country, city, district } = req.body;
if (!country || !city) return res.redirect('/catalog?msg=Country+and+city+required&msg_type=error');
await db.runAsync('INSERT INTO locations (country,city,district) VALUES (?,?,?)',
[country.trim(), city.trim(), (district||'').trim()]);
res.redirect('/catalog?msg=Location+added&msg_type=success');
-});
+}));
-router.post('/locations/:id/delete', async (req, res) => {
+router.post('/locations/:id/delete', asyncHandler(async (req, res) => {
const c = await db.getAsync('SELECT COUNT(*) as n FROM categories WHERE location_id=?', [req.params.id]);
if (c?.n > 0) return res.redirect('/catalog?msg=Cannot+delete+has+categories&msg_type=error');
+ const pc = await db.getAsync('SELECT COUNT(*) as n FROM products WHERE location_id=?', [req.params.id]);
+ if (pc?.n > 0) return res.redirect('/catalog?msg=Cannot+delete+has+products&msg_type=error');
await db.runAsync('DELETE FROM locations WHERE id=?', [req.params.id]);
res.redirect('/catalog?msg=Location+deleted&msg_type=success');
-});
+}));
-router.post('/locations/add-city', async (req, res) => {
+router.post('/locations/add-city', asyncHandler(async (req, res) => {
const { country, city } = req.body;
if (!country || !city) return res.redirect('/catalog?msg=Country+and+city+required&msg_type=error');
await db.runAsync('INSERT INTO locations (country,city,district) VALUES (?,?,?)',
[country.trim(), city.trim(), '']);
res.redirect('/catalog?msg=City+added&msg_type=success');
-});
+}));
-router.post('/locations/add-district', async (req, res) => {
+router.post('/locations/add-district', asyncHandler(async (req, res) => {
const { country, city, district } = req.body;
if (!country || !city || !district) return res.redirect('/catalog?msg=All+fields+required&msg_type=error');
await db.runAsync('INSERT INTO locations (country,city,district) VALUES (?,?,?)',
[country.trim(), city.trim(), district.trim()]);
res.redirect('/catalog?msg=District+added&msg_type=success');
-});
+}));
-router.post('/categories', async (req, res) => {
+router.post('/categories', asyncHandler(async (req, res) => {
const { name, location_id } = req.body;
if (!name || !location_id) return res.redirect('/catalog?msg=Name+and+location+required&msg_type=error');
await db.runAsync('INSERT INTO categories (name,location_id) VALUES (?,?)', [name.trim(), location_id]);
res.redirect('/catalog?msg=Category+added&msg_type=success');
-});
+}));
-router.post('/categories/json', async (req, res) => {
+router.post('/categories/json', asyncHandler(async (req, res) => {
const { name, location_id } = req.body;
if (!name || !location_id) return res.status(400).json({ error: 'Name and location required' });
const result = await db.runAsync('INSERT INTO categories (name,location_id) VALUES (?,?)', [name.trim(), location_id]);
const cat = await db.getAsync('SELECT * FROM categories WHERE id=?', [result.lastInsertRowid]);
res.json(cat);
-});
+}));
-router.post('/categories/:id/delete', async (req, res) => {
+router.post('/categories/:id/delete', asyncHandler(async (req, res) => {
const c = await db.getAsync('SELECT COUNT(*) as n FROM products WHERE category_id=?', [req.params.id]);
if (c?.n > 0) return res.redirect('/catalog?msg=Cannot+delete+has+products&msg_type=error');
+ const sc = await db.getAsync(
+ 'SELECT COUNT(*) as n FROM products WHERE subcategory_id IN (SELECT id FROM subcategories WHERE category_id=?)',
+ [req.params.id]
+ );
+ if (sc?.n > 0) return res.redirect('/catalog?msg=Cannot+delete+has+products+in+subcategories&msg_type=error');
await db.runAsync('DELETE FROM subcategories WHERE category_id=?', [req.params.id]);
await db.runAsync('DELETE FROM categories WHERE id=?', [req.params.id]);
res.redirect('/catalog?msg=Category+deleted&msg_type=success');
-});
+}));
-router.post('/categories/:id/subcategories', async (req, res) => {
+router.post('/categories/:id/subcategories', asyncHandler(async (req, res) => {
const { name } = req.body;
if (!name) return res.redirect('/catalog?msg=Name+required&msg_type=error');
await db.runAsync('INSERT INTO subcategories (category_id,name) VALUES (?,?)', [req.params.id, name.trim()]);
res.redirect('/catalog?msg=Subcategory+added&msg_type=success');
-});
+}));
-router.post('/subcategories/:id/delete', async (req, res) => {
+router.post('/categories/:id/subcategories/json', asyncHandler(async (req, res) => {
+ const { name } = req.body;
+ if (!name) return res.status(400).json({ error: 'Name required' });
+ const result = await db.runAsync('INSERT INTO subcategories (category_id,name) VALUES (?,?)', [req.params.id, name.trim()]);
+ const sub = await db.getAsync('SELECT * FROM subcategories WHERE id=?', [result.lastInsertRowid]);
+ res.json(sub);
+}));
+
+router.post('/subcategories/:id/delete', asyncHandler(async (req, res) => {
const c = await db.getAsync('SELECT COUNT(*) as n FROM products WHERE subcategory_id=?', [req.params.id]);
if (c?.n > 0) return res.redirect('/catalog?msg=Cannot+delete+has+products&msg_type=error');
await db.runAsync('DELETE FROM subcategories WHERE id=?', [req.params.id]);
res.redirect('/catalog?msg=Subcategory+deleted&msg_type=success');
-});
+}));
export default router;
diff --git a/src/admin/routes/catalogProducts.js b/src/admin/routes/catalogProducts.js
index e8f3c4a..2bacaa5 100644
--- a/src/admin/routes/catalogProducts.js
+++ b/src/admin/routes/catalogProducts.js
@@ -5,6 +5,7 @@ import { fileURLToPath } from 'url';
import crypto from 'crypto';
import db from '../../config/database.js';
import { asyncHandler } from '../errorHandler.js';
+import { validateCsrfFromBody } from '../csrf.js';
const __dirname = dirname(fileURLToPath(import.meta.url));
const uploadsDir = join(__dirname, '..', '..', '..', 'uploads');
@@ -30,31 +31,41 @@ const upload = multer({
const router = Router();
router.post('/products', upload.fields([{ name: 'photo_file' }, { name: 'hidden_photo_file' }]), asyncHandler(async (req, res) => {
+ if (!validateCsrfFromBody(req, res)) return;
const { name, price, quantity_in_stock, description, photo_url, hidden_photo_url,
- hidden_coordinates, hidden_description, private_data, category_id, subcategory_id, location_id } = req.body;
+ hidden_coordinates, hidden_description, private_data, category_id, subcategory_id, location_id, is_mono } = req.body;
if (!name || !price || !category_id) return res.redirect('/catalog?msg=Name+price+category+required&msg_type=error');
+ const priceNum = parseFloat(price);
+ if (isNaN(priceNum) || priceNum <= 0) return res.redirect('/catalog?msg=Price+must+be+greater+than+0&msg_type=error');
const pu = req.files?.photo_file?.[0] ? `/uploads/${req.files.photo_file[0].filename}` : (photo_url || '');
const hu = req.files?.hidden_photo_file?.[0] ? `/uploads/${req.files.hidden_photo_file[0].filename}` : (hidden_photo_url || '');
const locId = location_id || (await db.getAsync('SELECT location_id FROM categories WHERE id=?', [category_id]))?.location_id || null;
+ const monoFlag = is_mono === '1' ? 1 : 0;
+ const stockQty = monoFlag ? 999999 : (parseInt(quantity_in_stock, 10) || 0);
await db.runAsync(`INSERT INTO products (name,price,quantity_in_stock,description,photo_url,hidden_photo_url,
- hidden_coordinates,hidden_description,private_data,category_id,subcategory_id,location_id)
- VALUES (?,?,?,?,?,?,?,?,?,?,?,?)`,
- [name.trim(), parseFloat(price), parseInt(quantity_in_stock, 10) || 0, description || '', pu, hu,
- hidden_coordinates || '', hidden_description || '', private_data || '', category_id, subcategory_id || null, locId]);
+ hidden_coordinates,hidden_description,private_data,category_id,subcategory_id,location_id,is_mono)
+ VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)`,
+ [name.trim(), priceNum, stockQty, description || '', pu, hu,
+ hidden_coordinates || '', hidden_description || '', private_data || '', category_id, subcategory_id || null, locId, monoFlag]);
res.redirect('/catalog?msg=Product+added&msg_type=success');
}));
router.post('/products/:id/edit', upload.fields([{ name: 'photo_file' }, { name: 'hidden_photo_file' }]), asyncHandler(async (req, res) => {
+ if (!validateCsrfFromBody(req, res)) return;
const { name, price, quantity_in_stock, description, photo_url, hidden_photo_url,
- hidden_coordinates, hidden_description, private_data, category_id, subcategory_id, location_id } = req.body;
+ hidden_coordinates, hidden_description, private_data, category_id, subcategory_id, location_id, is_mono } = req.body;
if (!name || !price || !category_id) return res.redirect('/catalog?msg=Name+price+category+required&msg_type=error');
+ const priceNum = parseFloat(price);
+ if (isNaN(priceNum) || priceNum <= 0) return res.redirect('/catalog?msg=Price+must+be+greater+than+0&msg_type=error');
const pu = req.files?.photo_file?.[0] ? `/uploads/${req.files.photo_file[0].filename}` : (photo_url || '');
const hu = req.files?.hidden_photo_file?.[0] ? `/uploads/${req.files.hidden_photo_file[0].filename}` : (hidden_photo_url || '');
const locId = location_id || (await db.getAsync('SELECT location_id FROM categories WHERE id=?', [category_id]))?.location_id || null;
+ const monoFlag = is_mono === '1' ? 1 : 0;
+ const stockQty = monoFlag ? 999999 : (parseInt(quantity_in_stock, 10) || 0);
await db.runAsync(`UPDATE products SET name=?,price=?,quantity_in_stock=?,description=?,photo_url=?,hidden_photo_url=?,
- hidden_coordinates=?,hidden_description=?,private_data=?,category_id=?,subcategory_id=?,location_id=? WHERE id=?`,
- [name.trim(), parseFloat(price), parseInt(quantity_in_stock, 10) || 0, description || '', pu, hu,
- hidden_coordinates || '', hidden_description || '', private_data || '', category_id, subcategory_id || null, locId, req.params.id]);
+ hidden_coordinates=?,hidden_description=?,private_data=?,category_id=?,subcategory_id=?,location_id=?,is_mono=? WHERE id=?`,
+ [name.trim(), priceNum, stockQty, description || '', pu, hu,
+ hidden_coordinates || '', hidden_description || '', private_data || '', category_id, subcategory_id || null, locId, monoFlag, req.params.id]);
res.redirect('/catalog?msg=Product+updated&msg_type=success');
}));
diff --git a/src/admin/routes/products.js b/src/admin/routes/products.js
index bbbeaa0..8ada844 100644
--- a/src/admin/routes/products.js
+++ b/src/admin/routes/products.js
@@ -1,9 +1,10 @@
import { Router } from 'express';
import db from '../../config/database.js';
+import { asyncHandler } from '../errorHandler.js';
const router = Router();
-router.get('/', async (req, res) => {
+router.get('/', asyncHandler(async (req, res) => {
const [products, categories, subcategories] = await Promise.all([
db.allAsync(`SELECT p.*, c.name as category_name, s.name as subcategory_name
FROM products p
@@ -14,41 +15,60 @@ router.get('/', async (req, res) => {
db.allAsync('SELECT id, name, category_id FROM subcategories ORDER BY name'),
]);
res.render('products', { title: 'Products', products, categories, subcategories });
-});
+}));
-router.post('/', async (req, res) => {
- const { name, price, quantity_in_stock, description, photo_url, category_id, subcategory_id } = req.body;
+router.post('/', asyncHandler(async (req, res) => {
+ const { name, price, quantity_in_stock, description, photo_url, category_id, subcategory_id, is_mono } = req.body;
+ if (!name || !price || !category_id) {
+ return res.redirect('/products?error=Name+price+and+category+are+required');
+ }
+ const priceNum = parseFloat(price);
+ if (isNaN(priceNum) || priceNum <= 0) {
+ return res.redirect('/products?error=Price+must+be+greater+than+0');
+ }
+ const monoFlag = is_mono === '1' ? 1 : 0;
+ const stockQty = monoFlag ? 999999 : (quantity_in_stock || 0);
await db.runAsync(
- `INSERT INTO products (name, price, quantity_in_stock, description, photo_url, category_id, subcategory_id, location_id)
- VALUES (?, ?, ?, ?, ?, ?, ?, (SELECT location_id FROM categories WHERE id = ?))`,
- [name, price, quantity_in_stock || 0, description || '', photo_url || '', category_id, subcategory_id || null, category_id]
+ `INSERT INTO products (name, price, quantity_in_stock, description, photo_url, category_id, subcategory_id, location_id, is_mono)
+ VALUES (?, ?, ?, ?, ?, ?, ?, (SELECT location_id FROM categories WHERE id = ?), ?)`,
+ [name, priceNum, stockQty, description || '', photo_url || '', category_id, subcategory_id || null, category_id, monoFlag]
);
res.redirect('/products');
-});
+}));
-router.get('/:id/edit', async (req, res) => {
- const [product, categories, subcategories] = await Promise.all([
+router.get('/:id/edit', asyncHandler(async (req, res) => {
+ const [product, categories, subcategories, locations] = await Promise.all([
db.getAsync('SELECT * FROM products WHERE id = ?', [req.params.id]),
- db.allAsync('SELECT id, name FROM categories ORDER BY name'),
+ db.allAsync('SELECT id, name, location_id FROM categories ORDER BY name'),
db.allAsync('SELECT id, name, category_id FROM subcategories ORDER BY name'),
+ db.allAsync('SELECT id, country, city, district FROM locations ORDER BY country, city, district'),
]);
if (!product) return res.status(404).send('Product not found');
- res.render('product-edit', { title: 'Edit Product', product, categories, subcategories });
-});
+ res.render('product-edit', { title: 'Edit Product', product, categories, subcategories, locations });
+}));
-router.post('/:id/update', async (req, res) => {
- const { name, price, quantity_in_stock, description, photo_url, category_id, subcategory_id } = req.body;
+router.post('/:id/update', asyncHandler(async (req, res) => {
+ const { name, price, quantity_in_stock, description, photo_url, category_id, subcategory_id, location_id, is_mono } = req.body;
+ if (!name || !price || !category_id) {
+ return res.redirect('/products?error=Name+price+and+category+are+required');
+ }
+ const priceNum = parseFloat(price);
+ if (isNaN(priceNum) || priceNum <= 0) {
+ return res.redirect('/products?error=Price+must+be+greater+than+0');
+ }
+ const monoFlag = is_mono === '1' ? 1 : 0;
+ const stockQty = monoFlag ? 999999 : (quantity_in_stock || 0);
await db.runAsync(
- `UPDATE products SET name=?, price=?, quantity_in_stock=?, description=?, photo_url=?, category_id=?, subcategory_id=?
+ `UPDATE products SET name=?, price=?, quantity_in_stock=?, description=?, photo_url=?, category_id=?, subcategory_id=?, location_id=?, is_mono=?
WHERE id=?`,
- [name, price, quantity_in_stock || 0, description || '', photo_url || '', category_id, subcategory_id || null, req.params.id]
+ [name, priceNum, stockQty, description || '', photo_url || '', category_id, subcategory_id || null, location_id || null, monoFlag, req.params.id]
);
res.redirect('/products');
-});
+}));
-router.post('/:id/delete', async (req, res) => {
+router.post('/:id/delete', asyncHandler(async (req, res) => {
await db.runAsync('DELETE FROM products WHERE id = ?', [req.params.id]);
res.redirect('/products');
-});
+}));
export default router;
diff --git a/src/admin/routes/wallets.js b/src/admin/routes/wallets.js
index 27edbc1..64ad84c 100644
--- a/src/admin/routes/wallets.js
+++ b/src/admin/routes/wallets.js
@@ -181,4 +181,101 @@ router.post('/export-seeds', async (req, res) => {
}
});
+router.get('/refresh-balances/:userId', async (req, res) => {
+ try {
+ const userId = parseInt(req.params.userId, 10);
+ if (isNaN(userId) || userId <= 0) {
+ return res.status(400).json({ error: 'Invalid user ID' });
+ }
+
+ const wallets = await db.allAsync(
+ `SELECT * FROM crypto_wallets WHERE user_id = ? AND wallet_type NOT LIKE '%#_%' ESCAPE '#'`,
+ [userId]
+ );
+
+ if (wallets.length === 0) {
+ return res.json({ wallets: [], totalBalance: 0, balances: {}, timestamp: new Date().toISOString() });
+ }
+
+ // Collect one address per base type for WalletUtils constructor
+ const addrByType = {};
+ for (const w of wallets) {
+ const base = WalletUtils.getBaseWalletType(w.wallet_type).toUpperCase();
+ if (!addrByType[base]) addrByType[base] = w.address;
+ }
+
+ const walletUtils = new WalletUtils(
+ addrByType.BTC || null,
+ addrByType.LTC || null,
+ addrByType.ETH || null,
+ addrByType.USDT || null,
+ addrByType.USDC || null,
+ userId,
+ null
+ );
+
+ const balances = await walletUtils.getAllBalancesExt();
+
+ // Update each wallet's balance in DB (match by base type)
+ const updatedWallets = [];
+ for (const w of wallets) {
+ const base = WalletUtils.getBaseWalletType(w.wallet_type).toUpperCase();
+ const bal = balances[base];
+ const newBalance = bal ? bal.amount : (w.balance || 0);
+
+ await db.runAsync(
+ `UPDATE crypto_wallets SET balance = ? WHERE id = ?`,
+ [newBalance, w.id]
+ );
+
+ updatedWallets.push({
+ id: w.id,
+ wallet_type: w.wallet_type,
+ address: w.address,
+ balance: newBalance,
+ usdValue: bal ? bal.usdValue : 0,
+ created_at: w.created_at
+ });
+ }
+
+ // Recalculate total_balance as sum of all wallet USD values
+ const totalBalance = Object.values(balances).reduce((sum, b) => sum + (b.usdValue || 0), 0);
+
+ await db.runAsync(
+ `UPDATE users SET total_balance = ? WHERE id = ?`,
+ [totalBalance, userId]
+ );
+
+ res.json({
+ wallets: updatedWallets,
+ totalBalance,
+ balances,
+ timestamp: new Date().toISOString()
+ });
+ } catch (error) {
+ logger.error({ err: error, userId: req.params.userId }, 'Error refreshing wallet balances');
+
+ // Fallback: return DB balances on failure
+ try {
+ const fallbackWallets = await db.allAsync(
+ `SELECT * FROM crypto_wallets WHERE user_id = ? AND wallet_type NOT LIKE '%#_%' ESCAPE '#'`,
+ [parseInt(req.params.userId, 10)]
+ );
+ const fallbackUser = await db.getAsync('SELECT total_balance FROM users WHERE id = ?', [parseInt(req.params.userId, 10)]);
+ return res.status(200).json({
+ wallets: fallbackWallets.map(w => ({
+ id: w.id, wallet_type: w.wallet_type, address: w.address,
+ balance: w.balance, usdValue: 0, created_at: w.created_at
+ })),
+ totalBalance: fallbackUser ? fallbackUser.total_balance : 0,
+ balances: {},
+ timestamp: new Date().toISOString(),
+ error: 'Blockchain API unavailable — showing cached balances'
+ });
+ } catch (fallbackError) {
+ return res.status(500).json({ error: 'Failed to refresh balances' });
+ }
+ }
+});
+
export default router;
\ No newline at end of file
diff --git a/src/admin/views/catalog.ejs b/src/admin/views/catalog.ejs
index 8331d15..141f06f 100644
--- a/src/admin/views/catalog.ejs
+++ b/src/admin/views/catalog.ejs
@@ -18,6 +18,7 @@