feat: Begins views, login is currently not working.

Sources/App/Controllers/ApiController.swift

@@ -4,21 +4,20 @@ import Vapor
 struct ApiController: RouteCollection {
   func boot(routes: RoutesBuilder) throws {
     let api = routes.grouped("api", "v1")
-    let passwordProtected = api.grouped(User.authenticator(), User.guardMiddleware())
 
     // Allows basic or token authentication.
-    let tokenProtected = api.grouped(
+    let protected = api.grouped(
       User.authenticator(),
       UserToken.authenticator(),
       User.guardMiddleware()
     )
 
-    let employees = tokenProtected.grouped("employees")
-    let purchaseOrders = tokenProtected.grouped("purchase-orders")
+    let employees = protected.grouped("employees")
+    let purchaseOrders = protected.grouped("purchase-orders")
 
     // TODO: Need to handle the intial creation of users somehow.
-    let users = tokenProtected.grouped("users")
-    let vendors = tokenProtected.grouped("vendors")
+    let users = protected.grouped("users")
+    let vendors = protected.grouped("vendors")
     let vendorBranches = vendors.grouped(":vendorID", "branches")
 
     employees.get(use: employeesIndex(req:))
@@ -32,7 +31,7 @@ struct ApiController: RouteCollection {
     purchaseOrders.post(use: createPurchaseOrder(req:))
 
     users.post(use: createUser(req:))
-    passwordProtected.group("users", "login") {
+    users.group("login") {
       $0.get(use: self.login(req:))
     }
 
@@ -106,6 +105,7 @@ struct ApiController: RouteCollection {
       .with(\.$vendorBranch) {
         $0.with(\.$vendor)
       }
+      .sort(\.$id, .descending)
       .all()
       .map { $0.toDTO() }
   }
@@ -115,11 +115,20 @@ struct ApiController: RouteCollection {
     try PurchaseOrder.Create.validate(content: req)
     let createdById = try req.auth.require(User.self).requireID()
     let create = try req.content.decode(PurchaseOrder.Create.self)
+
+    guard let employee = try await Employee.find(create.createdForID, on: req.db) else {
+      throw Abort(.notFound, reason: "Employee not found.")
+    }
+
+    guard employee.active else {
+      throw Abort(.badRequest, reason: "Employee is not active, unable to generate a PO for in-active employees")
+    }
+
     let purchaseOrder = create.toModel(createdByID: createdById)
     try await purchaseOrder.save(on: req.db)
 
     guard let loaded = try await PurchaseOrder.query(on: req.db)
-      .filter(\.$id == purchaseOrder.id!)
+      .filter(\.$id == purchaseOrder.requireID())
       .with(\.$createdBy)
       .with(\.$createdFor)
       .with(\.$vendorBranch, { branch in
@@ -127,7 +136,8 @@ struct ApiController: RouteCollection {
       })
       .first()
     else {
-      throw Abort(.noContent)
+      // This should really never happen, since we just created the purchase order.
+      throw Abort(.noContent, reason: "Failed to load purchase order after creation")
     }
     return loaded.toDTO()
   }