From dc3a1d824d6a078cf4c69a7c3ce0e45460299c69 Mon Sep 17 00:00:00 2001
From: Gowtham M <gowtham.m@venbainfotech.com>
Date: Thu, 4 Dec 2025 13:25:54 +0530
Subject: [PATCH] GWM : cors changes

---
 .../establishment_products.controller.js      | 30 +++++++++++++++----
 app/middleware/auth.middleware.js             | 16 +++++-----
 app/routes/routes.js                          | 18 +++++++----
 server.js                                     | 17 ++++++++++-
 4 files changed, 61 insertions(+), 20 deletions(-)

diff --git a/app/controllers/establishment_products.controller.js b/app/controllers/establishment_products.controller.js
index 65695d5..4375ba1 100644
--- a/app/controllers/establishment_products.controller.js
+++ b/app/controllers/establishment_products.controller.js
@@ -3,10 +3,20 @@ const db = require("../models");
 const EstablishmentProduct = db.EstablishmentProduct;
 const Product = db.Product;
 const UnitMaster = db.UnitMaster;
+
+
 exports.createEstablishmentProduct = async (req, res) => {
   try {
-    req.body.created_by = req.body.created_by || req.user.id;
-    const data = await EstablishmentProduct.create(req.body);
+
+    const { establishment_id , product_id, action_done_by , created_by } = req.body;
+
+    const data = await EstablishmentProduct.create({
+      establishment_id,
+      product_id,
+      action_done_by,
+      created_by: created_by || req.user?.id || null,
+    });
+
     res.status(201).send({'status':"success",'message':"Creation successful",'data': data }); 
 
   } catch (err) {
@@ -64,10 +74,18 @@ exports.getEstablishmentProductById = async (req, res) => {
 
 exports.updateEstablishmentProduct = async (req, res) => {
   try {
-    
-    req.body.updated_by = req.body.updated_by || req.user.id;    
-    req.body.updated_at = req.body.updated_at || new Date();
-    const [updated] = await EstablishmentProduct.update(req.body, { where: { id: req.params.id } });
+
+    const id = req.params.id;
+    // whitelist fields
+    const updateData = {};
+    if (req.body.establishment_id) updateData.establishment_id = req.body.establishment_id;
+    if (req.body.product_id) updateData.product_id = req.body.product_id;
+    if (req.body.action_done_by) updateData.action_done_by = req.body.action_done_by;
+
+    updateData.updated_by = req.body.updated_by || req.user?.id || null;
+    updateData.updated_at = new Date();
+
+    const [updated] = await EstablishmentProduct.update(updateData, { where: { id } });
 
     if (!updated) res.status(404).send({'status':"failed",'message':"Record not found",'data': "" }); 
 
diff --git a/app/middleware/auth.middleware.js b/app/middleware/auth.middleware.js
index 1e76944..335051f 100644
--- a/app/middleware/auth.middleware.js
+++ b/app/middleware/auth.middleware.js
@@ -23,20 +23,22 @@ const authJWT = (req, res, next) => {
 
     if (!token) {
       return res
-        .status(401)
-        .json({ status: "failed", message: "Unauthorized: No token provided" });
+        .status(403)
+        .json({ status: "failed", message: "Access denied, token missing" });
     }
 
     console.log('token ='+token)
 
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    jwt.verify(token, process.env.JWT_SECRET, (err, decoded) => {
+      if (err) return res.status(401).json({ message: "Invalid or expired token" });
+      req.user = decoded;
+      next();
+    });
+
 
-    // Attach user info to req for downstream handlers
-    req.user = decoded;
-    next();
   } catch (err) {
     return res
-      .status(401)
+      .status(403)
       .json({ status: "failed", message: "Unauthorized: Invalid token" });
   }
 };
diff --git a/app/routes/routes.js b/app/routes/routes.js
index 8f7a501..a9f254e 100644
--- a/app/routes/routes.js
+++ b/app/routes/routes.js
@@ -1245,9 +1245,12 @@ router.get("/download-sample-product-upload-file",[verifySignature, verifyToken]
  *               product_id:
  *                 type: integer
  *                 example: 10
- *               is_active:
- *                 type: boolean
- *                 example: true
+ *               action_done_by:
+ *                 type: string
+ *                 example: admin_users
+ *               created_by:
+ *                 type: integer
+ *                 example: 1
  *     responses:
  *       201:
  *         description: EstablishmentProduct created successfully
@@ -1339,9 +1342,12 @@ router.get("/establishment-products/:id",[verifySignature, verifyToken], establi
  *               product_id:
  *                 type: integer
  *                 example: 10
- *               is_active:
- *                 type: boolean
- *                 example: false
+ *               action_done_by:
+ *                 type: string
+ *                 example: admin_users
+ *               updated_by:
+ *                 type: integer
+ *                 example: 1
  *     responses:
  *       200:
  *         description: Record updated successfully
diff --git a/server.js b/server.js
index 4936e76..3acad06 100644
--- a/server.js
+++ b/server.js
@@ -14,10 +14,25 @@ const app = express();
 
 
 app.use(express.json());
-app.use(cors());
 app.use(helmet());
 app.use(morgan("dev"));
 app.use(cookieParser());
+// app.use(cors());
+const allowedOrigins = [
+  "http://localhost:5173/",     //local
+  "http://13.201.47.205:5173/", //dev
+  "http://13.201.47.205:5175/"  //uat
+];
+app.use(cors({
+  origin: allowedOrigins,
+  credentials: true
+}));
+app.use((req, res, next) => {
+  res.header("Access-Control-Allow-Credentials", "true");
+  next();
+});
+
+
 
 // // Swagger setup
 // const swaggerOptions = {