Улучшение безопасности и обработки ошибок. Финал. #8

src/handlers/admin/admin_handler_banned_words.erl

@@ -24,6 +24,7 @@ handle_item(Word, Req) ->
     _            -> send_error(Req, 405, <<"Method not allowed">>)
   end.
 
+%% ================== GET /banned-words ==================
 list_banned_words(Req) ->
   case auth_admin(Req) of
     {ok, _AdminId, Req1} ->
@@ -33,22 +34,24 @@ list_banned_words(Req) ->
       send_error(Req1, Code, Message)
   end.
 
+%% ================== POST /banned-words ==================
 add_banned_word(Req) ->
   case auth_admin(Req) of
     {ok, AdminId, Req1} ->
       {ok, Body, Req2} = cowboy_req:read_body(Req1),
       try jsx:decode(Body, [return_maps]) of
-        #{<<"word">> := NewWord} ->
-          case core_banned_words:add_banned_word(NewWord, AdminId) of
-            {ok, WordRec} ->
-              send_json(Req2, 201, banned_word_to_json(WordRec));
+        #{<<"word">> := Word} when byte_size(Word) > 0 ->
+          case core_banned_words:add_banned_word(Word, AdminId) of
+            {ok, BW} ->
+              log_audit(AdminId, <<"add_banned_word">>, <<"banned_word">>, BW#banned_word.id, <<"">>),
+              send_json(Req2, 201, banned_word_to_json(BW));
             {error, already_exists} ->
               send_error(Req2, 409, <<"Word already exists">>);
             {error, _} ->
               send_error(Req2, 500, <<"Internal server error">>)
           end;
         _ ->
-          send_error(Req2, 400, <<"Missing 'word' field">>)
+          send_error(Req2, 400, <<"Missing or empty 'word'">>)
       catch
         _:_ -> send_error(Req2, 400, <<"Invalid JSON">>)
       end;
@@ -56,11 +59,13 @@ add_banned_word(Req) ->
       send_error(Req1, Code, Message)
   end.
 
+%% ================== DELETE /banned-words/:word ==================
 delete_banned_word(Word, Req) ->
   case auth_admin(Req) of
-    {ok, _AdminId, Req1} ->
+    {ok, AdminId, Req1} ->
       case core_banned_words:remove_banned_word(Word) of
         {ok, deleted} ->
+          log_audit(AdminId, <<"delete_banned_word">>, <<"banned_word">>, Word, <<"">>),
           send_json(Req1, 200, #{status => <<"deleted">>});
         {error, not_found} ->
           send_error(Req1, 404, <<"Word not found">>)
@@ -69,22 +74,24 @@ delete_banned_word(Word, Req) ->
       send_error(Req1, Code, Message)
   end.
 
-update_banned_word(Word, Req) ->
+%% ================== PUT /banned-words/:word ==================
+update_banned_word(OldWord, Req) ->
   case auth_admin(Req) of
-    {ok, _AdminId, Req1} ->
+    {ok, AdminId, Req1} ->
       {ok, Body, Req2} = cowboy_req:read_body(Req1),
       try jsx:decode(Body, [return_maps]) of
-        #{<<"word">> := NewWord} ->
-          case core_banned_words:update_banned_word(Word, NewWord) of
-            {ok, WordRec} ->
-              send_json(Req2, 200, banned_word_to_json(WordRec));
+        #{<<"word">> := NewWord} when byte_size(NewWord) > 0 ->
+          case core_banned_words:update_banned_word(OldWord, NewWord) of
+            {ok, BW} ->
+              log_audit(AdminId, <<"update_banned_word">>, <<"banned_word">>, BW#banned_word.id, <<"">>),
+              send_json(Req2, 200, banned_word_to_json(BW));
             {error, not_found} ->
               send_error(Req2, 404, <<"Word not found">>);
             {error, _} ->
               send_error(Req2, 500, <<"Internal server error">>)
           end;
         _ ->
-          send_error(Req2, 400, <<"Missing 'word' field">>)
+          send_error(Req2, 400, <<"Missing or empty 'word'">>)
       catch
         _:_ -> send_error(Req2, 400, <<"Invalid JSON">>)
       end;
@@ -92,6 +99,16 @@ update_banned_word(Word, Req) ->
       send_error(Req1, Code, Message)
   end.
 
+%% ── Аудит ──────────────────────────────────────────────
+log_audit(AdminId, Action, EntityType, EntityId, Reason) ->
+  case core_admin:get_by_id(AdminId) of
+    {ok, Admin} ->
+      core_admin_audit:log(AdminId, Admin#admin.email, Admin#admin.role,
+        Action, EntityType, EntityId, <<"127.0.0.1">>, Reason);
+    _ -> ok
+  end.
+
+%% ================== Аутентификация ==================
 auth_admin(Req) ->
   case handler_auth:authenticate(Req) of
     {ok, AdminId, Req1} ->
@@ -103,6 +120,7 @@ auth_admin(Req) ->
       {error, Code, Message, Req1}
   end.
 
+%% ================== Сериализация ==================
 banned_word_to_json(BW) ->
   #{
     id        => BW#banned_word.id,
@@ -116,6 +134,7 @@ datetime_to_iso8601({{Year, Month, Day}, {Hour, Minute, Second}}) ->
     [Year, Month, Day, Hour, Minute, Second]));
 datetime_to_iso8601(undefined) -> undefined.
 
+%% ================== HTTP-ответы ==================
 send_json(Req, Status, Data) ->
   Headers = #{
     <<"content-type">> => <<"application/json">>,
@@ -126,7 +145,12 @@ send_json(Req, Status, Data) ->
   cowboy_req:reply(Status, Headers, Body, Req),
   {ok, Body, []}.
 
-send_error(Req, Status, Message) ->
+send_error(Req, Code, Message) ->
+  Headers = #{
+    <<"content-type">> => <<"application/json">>,
+    <<"access-control-allow-origin">> => <<"*">>,
+    <<"access-control-expose-headers">> => <<"Content-Range">>
+  },
   Body = jsx:encode(#{error => Message}),
-  cowboy_req:reply(Status, #{<<"content-type">> => <<"application/json">>}, Body, Req),
+  cowboy_req:reply(Code, Headers, Body, Req),
   {ok, Body, []}.