admin/3dtours
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sử dụng antigravity cli để sửa lỗi người dùng public không nhìn thấy tour chia sẻ

Browse Source
This commit is contained in:
Lộc Phạm
2026-06-10 22:32:26 +07:00
parent 358a98b21b
commit edd91d4d64
7 changed files with 74 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/routes/sceneRoutes.js
+13 -5
View File
@@ -111,10 +111,14 @@ router.get('/', optionalAuth, async (req, res) => {
try {
const { token } = req.query;
// [FIX] Lấy danh sách ID của các Tour đang ở chế độ công khai
const publicTours = await Tour.find({ privacy: 'public' }).select('_id');
const publicTourIds = publicTours.map(t => t._id);
// Quyền cơ bản: Công khai hoặc là chủ sở hữu/thành viên được chia sẻ
let baseQuery = req.user && req.user.role !== 'guest'
? { $or: [{ privacy: 'public' }, { createdBy: req.user._id }, { sharedWith: req.user._id }, { sharedEmails: req.user.email }] }
: { privacy: 'public' };
? { $or: [{ privacy: 'public' }, { tourId: { $in: publicTourIds } }, { createdBy: req.user._id }, { sharedWith: req.user._id }, { sharedEmails: req.user.email }] }
: { $or: [{ privacy: 'public' }, { tourId: { $in: publicTourIds } }] };
let finalQuery = baseQuery;
@@ -130,7 +134,11 @@ router.get('/', optionalAuth, async (req, res) => {
};
}
const scenes = await Scene.find(finalQuery).populate('createdBy', 'username').lean();
console.log(`[SceneRoutes] GET /api/scenes - Final Query for user ${req.user?._id || 'Guest'}:`, JSON.stringify(finalQuery));
const scenes = await Scene.find(finalQuery)
.populate('createdBy', 'username')
.populate('tourId') // Nạp thông tin Tour để Frontend nhận diện
.lean();
res.json(scenes);
} catch (error) {
res.status(500).json({ message: error.message });
@@ -150,7 +158,7 @@ router.get('/:id', optionalAuth, async (req, res) => {
const tour = scene.tourId; // tourId is populated
if (!tour) return res.status(404).json({ message: 'Tour liên kết không tồn tại.' });
const isOwner = req.user && tour.createdBy?.toString() === req.user._id.toString();
const isOwner = req.user && req.user._id && tour.createdBy?.toString() === req.user._id.toString();
const isAdmin = req.user && req.user.role === 'admin';
const isSceneTokenValid = scene.shareToken && (!scene.shareTokenExpires || new Date() < scene.shareTokenExpires);
@@ -160,7 +168,7 @@ router.get('/:id', optionalAuth, async (req, res) => {
let hasAccess = tour.privacy === 'public' || isOwner || isAdmin ||
(scene.privacy === 'shared' && req.query.token === scene.shareToken && isSceneTokenValid) || // Access via scene's token
(tour.privacy === 'shared' && req.query.token === tour.shareToken && isTourTokenValid) || // Access via tour's token
(tour.privacy === 'member' && req.user && ( // Access for members
(tour.privacy === 'member' && req.user && req.user._id && ( // Access for members
tour.sharedWith.some(u => u.toString() === req.user._id.toString()) ||
(userEmail && tour.sharedEmails.includes(userEmail))
));