@@ -485,7 +485,7 @@ router.post('/:projectId/removeCustomRoles', auth0Middleware(), async (req, res)
485485 }
486486} )
487487
488- // Add a New Layer
488+ // Route to add a new layer to a project
489489router . route ( "/:projectId/layer" ) . post ( auth0Middleware ( ) , async ( req , res ) => {
490490 const { projectId } = req . params
491491 const labelAndCanvases = req . body
@@ -502,21 +502,21 @@ router.route("/:projectId/layer").post(auth0Middleware(), async (req, res) => {
502502 return respondWithError ( res , 400 , "Invalid project ID provided." )
503503 }
504504
505- if ( ! labelAndCanvases || ! labelAndCanvases . canvases ) {
506- return respondWithError ( res , 400 , "Invalid layer provided. Expected a layer object ." )
505+ if ( ! labelAndCanvases || ! labelAndCanvases . canvases || ! Array . isArray ( labelAndCanvases . canvases ) || labelAndCanvases . canvases . some ( canvas => typeof canvas !== "string" ) ) {
506+ return respondWithError ( res , 400 , "Invalid layer provided. Expected an array of canvas IDs ." )
507507 }
508508
509509 try {
510510 const project = new Project ( projectId )
511511
512- if ( ! project || await project . loadProject ( ) === null ) {
513- return respondWithError ( res , 404 , "Project does not exist ." )
512+ if ( ! ( await project . checkUserAccess ( user . _id , ACTIONS . CREATE , SCOPES . ALL , ENTITIES . LAYER ) ) ) {
513+ return respondWithError ( res , 403 , "You do not have permission to add layers to this project ." )
514514 }
515515
516- const layers = ( await project . loadProject ( ) )
516+ const layers = await project . loadProject ( )
517517
518- if ( ! ( await project . checkUserAccess ( user . _id , ACTIONS . CREATE , SCOPES . ALL , ENTITIES . LAYER ) ) ) {
519- return respondWithError ( res , 403 , "You do not have permission to add layers to this project ." )
518+ if ( ! project || layers === null ) {
519+ return respondWithError ( res , 404 , "Project does not exist ." )
520520 }
521521
522522 const layer = new Layer ( layers )
@@ -527,7 +527,7 @@ router.route("/:projectId/layer").post(auth0Middleware(), async (req, res) => {
527527 }
528528} )
529529
530- // Delete a Layer
530+ // Route to delete a specific layer within a project
531531router . route ( "/:projectId/layer/:layerId" ) . delete ( auth0Middleware ( ) , async ( req , res ) => {
532532 const { projectId, layerId } = req . params
533533 const user = req . user
@@ -550,28 +550,110 @@ router.route("/:projectId/layer/:layerId").delete(auth0Middleware(), async (req,
550550 try {
551551 const project = new Project ( projectId )
552552
553- if ( ! project || await project . loadProject ( ) === null ) {
554- return respondWithError ( res , 404 , "Project does not exist ." )
553+ if ( ! ( await project . checkUserAccess ( user . _id , ACTIONS . DELETE , SCOPES . ALL , ENTITIES . LAYER ) ) ) {
554+ return respondWithError ( res , 403 , "You do not have permission to delete layers from this project ." )
555555 }
556556
557- const layers = ( await project . loadProject ( ) )
557+ const layers = await project . loadProject ( )
558558
559- if ( ! ( await project . checkUserAccess ( user . _id , ACTIONS . DELETE , SCOPES . ALL , ENTITIES . LAYER ) ) ) {
560- return respondWithError ( res , 403 , "You do not have permission to delete layers from this project ." )
559+ if ( ! project || layers === null ) {
560+ return respondWithError ( res , 404 , "Project does not exist ." )
561561 }
562562
563563 const layer = new Layer ( layers )
564564 if ( layer . data . layers . find ( layer => String ( layer . id ) . split ( "/" ) . pop ( ) === `${ layerId } ` ) === undefined ) {
565565 return respondWithError ( res , 400 , "Layer not found in project." )
566566 }
567567
568- const response = await layer . deleteLayer ( projectId , layerId )
568+ await layer . deleteLayer ( projectId , layerId )
569569 res . status ( 204 ) . send ( )
570570 } catch ( error ) {
571571 return respondWithError ( res , error . status ?? 500 , error . message ?? "Error deleting layer from project." )
572572 }
573573} )
574574
575+ // Route to update the ordering of pages/deleting of pages of a specific layer within a project
576+ router . route ( "/:projectId/layer/:layerId/pages" ) . put ( auth0Middleware ( ) , async ( req , res ) => {
577+ const { projectId, layerId } = req . params
578+ const pages = req . body . pages
579+ const user = req . user
580+ if ( ! user ) {
581+ return respondWithError ( res , 401 , "Unauthenticated request" )
582+ }
583+
584+ if ( ! pages || ! Array . isArray ( pages ) || pages . some ( page => typeof page !== "string" ) ) {
585+ return respondWithError ( res , 400 , "Invalid pages provided. Expected an array of page IDs." )
586+ }
587+
588+ try {
589+ const project = new Project ( projectId )
590+
591+ if ( ! ( await project . checkUserAccess ( user . _id , ACTIONS . UPDATE , SCOPES . ALL , ENTITIES . LAYER ) ) ) {
592+ return respondWithError ( res , 403 , "You do not have permission to update pages in this layer." )
593+ }
594+
595+ const layers = await project . loadProject ( )
596+
597+ if ( ! project || layers === null ) {
598+ return respondWithError ( res , 404 , "Project does not exist." )
599+ }
600+
601+ const layer = new Layer ( layers )
602+ if ( layer . data . layers . find ( layer => String ( layer . id ) . split ( "/" ) . pop ( ) === `${ layerId } ` ) === undefined ) {
603+ return respondWithError ( res , 400 , "Layer not found in project." )
604+ }
605+
606+ const existingPages = layer . data . layers . find ( layer => String ( layer . id ) . split ( "/" ) . pop ( ) === `${ layerId } ` ) . pages . map ( page => page . id )
607+
608+ if ( ! existingPages . some ( page => pages . includes ( page ) ) ) {
609+ return respondWithError ( res , 400 , "Page not found in layer." )
610+ }
611+
612+ const response = await layer . updatePages ( layerId , pages )
613+ res . status ( 200 ) . json ( response )
614+ } catch ( error ) {
615+ return respondWithError ( res , error . status ?? 500 , error . message ?? "Error updating layer pages." )
616+ }
617+ } )
618+
619+ // Route to update the label only of a specific layer within a project
620+ router . route ( "/:projectId/layer/:layerId" ) . put ( auth0Middleware ( ) , async ( req , res ) => {
621+ const { projectId, layerId } = req . params
622+ const label = req . body
623+ const user = req . user
624+ if ( ! user ) {
625+ return respondWithError ( res , 401 , "Unauthenticated request" )
626+ }
627+
628+ if ( ! label || ! Object ( label ) ) {
629+ return respondWithError ( res , 400 , "Invalid metadata provided. Expected an array of objects with 'label' and 'value'." )
630+ }
631+
632+ try {
633+ const project = new Project ( projectId )
634+
635+ if ( ! ( await project . checkUserAccess ( user . _id , ACTIONS . UPDATE , SCOPES . METADATA , ENTITIES . LAYER ) ) ) {
636+ return respondWithError ( res , 403 , "You do not have permission to update metadata for this layer." )
637+ }
638+
639+ const layers = await project . loadProject ( )
640+
641+ if ( ! project || layers === null ) {
642+ return respondWithError ( res , 404 , "Project does not exist." )
643+ }
644+
645+ const layer = new Layer ( layers )
646+ if ( layer . data . layers . find ( layer => String ( layer . id ) . split ( "/" ) . pop ( ) === `${ layerId } ` ) === undefined ) {
647+ return respondWithError ( res , 400 , "Layer not found in project." )
648+ }
649+
650+ const response = await layer . updateLayerMetadata ( layerId , label )
651+ res . status ( 200 ) . json ( response )
652+ } catch ( error ) {
653+ return respondWithError ( res , error . status ?? 500 , error . message ?? "Error updating layer metadata." )
654+ }
655+ } )
656+
575657// Update Project Metadata
576658router . route ( "/:projectId/metadata" ) . put ( auth0Middleware ( ) , async ( req , res ) => {
577659 const { projectId } = req . params
0 commit comments