fix(security): enforce admin auth guards across sensitive backend routes and eliminate BOM data leak

2026-10-19 06:44:26 +07:00
2 changed files with 0 additions and 120 deletions
@@ -155,10 +155,6 @@ export const productAttributesRoute = new Elysia()
      if (!definition) return status(404, { message: "Attribute definition not found" });
      return localizeAttributeDefinition(definition, lang);
    } catch (err: any) {
      return status(400, { message: err.message });
    }
  })
  .get("/products/:id/attributes", async ({ params, query, status }) => {
    try {
      const productId = parseId(params.id, "product ID");
@@ -1,116 +0,0 @@
 let prisma: any;
 try {
  const mod = await import("../apps/backend/src/lib/prisma");
  prisma = mod.default;
 } catch {
  const mod = await import("./src/lib/prisma");
  prisma = mod.default;
 }
 interface RunOptions {
  deleteOldBrands?: boolean;
 }
 export async function reassignProductsToHomAroma(options: RunOptions = {}) {
  console.log("=== Reassign Products to 'Hom Aroma' Brand ===");
  // 1. Find or create 'Hom Aroma' brand
  let homAroma = await prisma.productBrand.findFirst({
    where: { name: { equals: "Hom Aroma", mode: "insensitive" } },
  });
  if (!homAroma) {
    homAroma = await prisma.productBrand.create({
      data: { name: "Hom Aroma" },
    });
    console.log(`✓ Created 'Hom Aroma' brand with ID: ${homAroma.id}`);
  } else {
    console.log(`✓ Found existing 'Hom Aroma' brand with ID: ${homAroma.id}`);
  }
  // 2. Ensure translations for Hom Aroma
  const translations = [
    { langCode: "th", name: "Hom Aroma" },
    { langCode: "en", name: "Hom Aroma" },
  ];
  for (const tr of translations) {
    await prisma.productBrandTranslation.upsert({
      where: {
        brandId_langCode: {
          brandId: homAroma.id,
          langCode: tr.langCode,
        },
      },
      create: {
        brandId: homAroma.id,
        langCode: tr.langCode,
        name: tr.name,
      },
      update: {
        name: tr.name,
      },
    });
  }
  console.log("✓ Brand translations ensured for 'th' and 'en'.");
  // 3. Reassign all products to Hom Aroma
  const totalProducts = await prisma.product.count();
  const updateResult = await prisma.product.updateMany({
    data: {
      brandId: homAroma.id,
    },
  });
  console.log(`✓ Reassigned ${updateResult.count} of ${totalProducts} products to Brand '${homAroma.name}' (ID: ${homAroma.id}).`);
  // 4. Handle old brands
  const otherBrands = await prisma.productBrand.findMany({
    where: { id: { not: homAroma.id } },
    include: { _count: { select: { products: true } } },
  });
  console.log(`Found ${otherBrands.length} other brands in database.`);
  if (options.deleteOldBrands && otherBrands.length > 0) {
    console.log(`Deleting ${otherBrands.length} old scent brand records...`);
    const delResult = await prisma.productBrand.deleteMany({
      where: { id: { not: homAroma.id } },
    });
    console.log(`✓ Deleted ${delResult.count} old scent brands successfully.`);
  } else if (!options.deleteOldBrands) {
    console.log("Old brands preserved (deleteOldBrands is false).");
  }
  // 5. Final summary verification
  const finalHomAromaProducts = await prisma.product.count({
    where: { brandId: homAroma.id },
  });
  const remainingBrands = await prisma.productBrand.count();
  console.log("\n=== Final Summary ===");
  console.log(`Total Products linked to 'Hom Aroma': ${finalHomAromaProducts} / ${totalProducts}`);
  console.log(`Total Brands remaining in database: ${remainingBrands}`);
  return {
    homAromaId: homAroma.id,
    totalProducts,
    reassignedCount: updateResult.count,
    otherBrandsCount: otherBrands.length,
    remainingBrandsCount: remainingBrands,
  };
 }
 // Auto-run if executed directly
 if (import.meta.main) {
  const shouldDelete = process.argv.includes("--delete-old");
  reassignProductsToHomAroma({ deleteOldBrands: shouldDelete })
    .then((res) => {
      console.log("\nExecution completed:", res);
      process.exit(0);
    })
    .catch((err) => {
      console.error("\nExecution failed:", err);
      process.exit(1);
    })
    .finally(() => prisma.$disconnect());
 }