fcsc_ipi_backend/app/controllers/notificationTemplate.controller.js

const db = require("../models");
const NotificationTemplate = db.NotificationTemplate;
const { sanitizeHtml } = require("../utils/sanitize");
const logger = require("../services/logger");

// Create template
exports.createTemplate = async (req, res) => {

   try {
    const { title , template_code, subject, body_html , created_by } = req.body;

    if (!title || !template_code || !subject || !body_html ) {
      return res.status(400).json({
        status: "failed",
        message: "Missing required fields",
      });
    }

    // sanitize input
    const cleanHtml = sanitizeHtml(body_html);

    const template = await NotificationTemplate.create({
      title,
      template_code,
      subject,
      body_html: cleanHtml,
      created_by: created_by || req.user?.id || null,
    });

    return res.status(201).json({
      status: "success",
      message: "Template created successfully",
      data: {
        id: template.id,
        template_code: template.template_code,
        subject: template.subject
        // DO NOT return HTML to avoid XSS
      },
    });

  } catch (err) {
    logger.error(err.message);
    logger.error(`Stack trace: ${err.stack}`);
    res.status(500).json({ status: "failed", message: "Internal server error" });
  }
};

// Update template
exports.updateTemplate = async (req, res) => {
  try {
    const id = req.params.id;

    // whitelist fields
    const updateData = {};
    if (req.body.title) updateData.title = req.body.title;
    if (req.body.subject) updateData.subject = req.body.subject;

    // sanitize HTML if provided
    if (req.body.body_html) {
      updateData.body_html = sanitizeHtml(req.body.body_html);
    }

    updateData.updated_by = req.body.updated_by || req.user?.id || null;
    updateData.updated_at = new Date();

    // run update
    const [updated] = await NotificationTemplate.update(updateData, {
      where: { id }
    });

    if (!updated) {
      return res.status(404).json({
        status: "failed",
        message: "Template not found"
      });
    }

    return res.status(200).json({
      status: "success",
      message: "Template updated successfully"
    });

  } catch (err) {
    logger.error(err.message);
    logger.error(`Stack trace: ${err.stack}`);
    return res.status(500).json({
      status: "failed",
      message: "Internal server error"
    });
  }
};

// Get all templates
exports.getAllTemplates = async (req, res) => {
  try {
    const templates = await NotificationTemplate.findAll();
    res.status(200).send({
      status: "success",
      message: "Fetched successfully",
      data: templates,
    });
  } catch (err) {
    logger.error(err.message);
    logger.error(`Stack trace: ${err.stack}`);
    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
};

// Get single template
exports.getTemplateById = async (req, res) => {
  try {
    const template = await NotificationTemplate.findByPk(req.params.id);
    if (!template)
      return res
        .status(404)
        .send({ status: "failed", message: "Template not found" });

    res.status(200).send({
      status: "success",
      message: "Fetched successfully",
      data: template,
    });
  } catch (err) {
    logger.error(err.message);
    logger.error(`Stack trace: ${err.stack}`);
    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
};

// Delete template
exports.deleteTemplate = async (req, res) => {
  try {
    const deleted = await NotificationTemplate.destroy({
      where: { id: req.params.id },
    });

    if (!deleted)
      return res
        .status(404)
        .send({ status: "failed", message: "Template not found" });

    res
      .status(200)
      .send({ status: "success", message: "Deleted successfully" });
  } catch (err) {
    logger.error(err.message);
    logger.error(`Stack trace: ${err.stack}`);
    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
};