@openneuro/server 4.47.2 → 4.47.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openneuro/server",
-  "version": "4.47.2",
+  "version": "4.47.4",
   "description": "Core service for the OpenNeuro platform.",
   "license": "MIT",
   "main": "src/server.js",
@@ -21,7 +21,7 @@
     "@elastic/elasticsearch": "8.13.1",
     "@graphql-tools/schema": "^10.0.0",
     "@keyv/redis": "^4.5.0",
-    "@openneuro/search": "^4.47.2",
+    "@openneuro/search": "^4.47.4",
     "@sentry/node": "^10.37.0",
     "@sentry/profiling-node": "^10.37.0",
     "base64url": "^3.0.0",
@@ -89,5 +89,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "cd8302800fed945b6af809bcf172e5609efa84ae"
+  "gitHead": "fee430e60d713799a1c304676d0eaa758fa578ff"
 }

package/src/graphql/resolvers/user.ts

@@ -7,11 +7,53 @@ function isValidOrcid(orcid: string): boolean {
   return /^[0-9]{4}-[0-9]{4}-[0-9]{4}-[0-9]{3}[0-9X]$/.test(orcid || "")
 }
 
+// TODO - Use GraphQL codegen
+type GraphQLUserType = {
+  id: string
+  provider: "orcid" | "google"
+  avatar: string
+  orcid: string
+  created: Date
+  modified: Date
+  lastSeen: Date
+  email: string
+  name: string
+  admin: boolean
+  blocked: boolean
+  location: string
+  institution: string
+  github: string
+  githubSynced: Date
+  links: [string]
+  notifications: [Record<string, unknown>]
+  orcidConsent: boolean
+}
+
 export async function user(
   obj,
   { id },
   { userInfo }: { userInfo?: Record<string, unknown> } = {},
-) {
+): Promise<Partial<GraphQLUserType> | null> {
+  if (userInfo.reviewer) {
+    const oneWeekAgo = new Date()
+    oneWeekAgo.setDate(oneWeekAgo.getDate() - 7)
+    return {
+      id: "reviewer",
+      name: "Anonymous Reviewer",
+      email: "reviewer@openneuro.org",
+      provider: "orcid",
+      orcid: "0000-0000-0000-0000",
+      admin: false,
+      blocked: false,
+      location: "",
+      institution: "",
+      orcidConsent: true,
+      created: oneWeekAgo,
+      lastSeen: new Date(),
+      modified: oneWeekAgo,
+    }
+  }
+
   let user
   if (isValidOrcid(id)) {
     user = await User.findOne({
@@ -189,7 +231,12 @@ export const setBlocked = (obj, { id, blocked }, { userInfo }) => {
 export const updateUser = async (
   obj,
   { id, location, institution, links, orcidConsent },
+  { userInfo },
 ) => {
+  if (!userInfo) {
+    throw new Error("You must be logged in to update a user")
+  }
+
   try {
     let user
 
@@ -205,6 +252,11 @@ export const updateUser = async (
       throw new Error("User not found")
     }
 
+    // Only allow users to update their own profile, or admins to update any
+    if (user.id !== userInfo.id && !userInfo.admin) {
+      throw new Error("You are not authorized to update this user")
+    }
+
     // Update user fields (optional values based on provided inputs)
     if (location !== undefined) user.location = location
     if (institution !== undefined) user.institution = institution
@@ -226,6 +278,11 @@ export const updateUser = async (
 export async function notifications(obj, _, { userInfo }) {
   const userId = obj.id
 
+  // Reviewers never have notifications
+  if (userInfo.reviewer) {
+    return []
+  }
+
   // --- authorization ---
   if (!userInfo || (userInfo.id !== userId && !userInfo.admin)) {
     throw new Error("Not authorized to view these notifications.")

package/src/queues/producer-methods.ts

@@ -8,25 +8,33 @@ import * as Sentry from "@sentry/node"
  * @param datasetId Dataset to index
  */
 export function queueIndexDataset(datasetId: string) {
-  const msg = new ProducibleMessage()
-  msg.setQueue(OpenNeuroQueues.INDEXING).setBody({ datasetId })
-  producer.produce(msg, (err) => {
-    if (err) {
-      Sentry.captureException(err)
-    }
-  })
+  try {
+    const msg = new ProducibleMessage()
+    msg.setQueue(OpenNeuroQueues.INDEXING).setBody({ datasetId })
+    producer.produce(msg, (err) => {
+      if (err) {
+        Sentry.captureException(err)
+      }
+    })
+  } catch (err) {
+    Sentry.captureException(err)
+  }
 }
 
 /**
- * Queue search indexing for a dataset
- * @param datasetId Dataset to index
+ * Queue data retention check for a dataset
+ * @param datasetId Dataset to check
  */
 export function queueDataRetentionCheck(datasetId: string) {
-  const msg = new ProducibleMessage()
-  msg.setQueue(OpenNeuroQueues.DATARETENTION).setBody({ datasetId })
-  producer.produce(msg, (err) => {
-    if (err) {
-      Sentry.captureException(err)
-    }
-  })
+  try {
+    const msg = new ProducibleMessage()
+    msg.setQueue(OpenNeuroQueues.DATARETENTION).setBody({ datasetId })
+    producer.produce(msg, (err) => {
+      if (err) {
+        Sentry.captureException(err)
+      }
+    })
+  } catch (err) {
+    Sentry.captureException(err)
+  }
 }