Adjust user creation more, allow route

backend/src/index.ts

@@ -33,7 +33,7 @@ app.use(cors())
 app.use(compression())
 app.use(responseLogger)
 
-if (!ENABLE_WRITE && RUNNING_ENV !== 'dev') {
+if (!ENABLE_WRITE || RUNNING_ENV === 'dev') {
   app.use(blockWriteRequests)
 }
 

backend/src/middlewares/misc.ts

@@ -2,8 +2,9 @@ import { Middleware } from '../types'
 
 /* Disables all write routes except the ones excluded by "allowedRoutes" */
 export const blockWriteRequests: Middleware = (req, res, next) => {
-  const allowedRoutes = ['/user/login', '/locality-species', '/refreshToken', '/user/password']
+  const allowedRoutes = ['/user/login', '/locality-species', '/refreshToken', '/user/password', '/user/create']
   const writeMethods = ['POST', 'PUT', 'PATCH', 'DELETE']
+
   if (writeMethods.includes(req.method) && !allowedRoutes.includes(req.path)) {
     return res.status(403).send()
   }

backend/src/routes/user.ts

@@ -68,16 +68,24 @@ const createPasswordHash = async (password: string) => {
 }
 
 router.post('/create', async (req, res) => {
-  const { username, password, secret } = req.body
+  const { username, password, initials, role, secret } = req.body
 
   if ((!req.user || req.user?.role !== Role.Admin) && secret !== SECRET) throw new AccessError()
 
   const passwordHash = await createPasswordHash(password as string)
 
-  await nowDb.com_users.create({
+  const createdUser = await nowDb.com_users.create({
     data: {
       user_name: username as string,
       newpassword: passwordHash,
+      now_user_group: role,
+    },
+  })
+
+  await nowDb.com_people.create({
+    data: {
+      initials,
+      user_id: createdUser.user_id,
     },
   })