apps: add route to list sites for operators

the main backup listing route is only available for admins

src/routes/apps.js

@@ -17,6 +17,7 @@ exports = module.exports = {
     getLogStream,
     listEventlog,
     listBackups,
+    listBackupSites,
     repair,
 
     setAccessRestriction,
@@ -75,6 +76,7 @@ const apps = require('../apps.js'),
     appstore = require('../appstore.js'),
     assert = require('node:assert'),
     AuditSource = require('../auditsource.js'),
+    backupSites = require('../backupsites.js'),
     BoxError = require('../boxerror.js'),
     constants = require('../constants.js'),
     debug = require('debug')('box:routes/apps'),
@@ -918,6 +920,15 @@ async function listBackups(req, res, next) {
     next(new HttpSuccess(200, { backups: result }));
 }
 
+async function listBackupSites(req, res, next) {
+    assert.strictEqual(typeof req.resources.app, 'object');
+
+    const [error, result] = await safe(backupSites.list());
+    if (error) return next(BoxError.toHttpError(error));
+
+    next(new HttpSuccess(200, { backupSites: result.map(backupSites.removePrivateFields) }));
+}
+
 async function updateBackup(req, res, next) {
     assert.strictEqual(typeof req.resources.app, 'object');
     assert.strictEqual(typeof req.params.backupId, 'string');