@plusscommunities/pluss-maintenance-aws-forms 2.1.45 → 2.1.47

package/createJob.js

@@ -1,7 +1,7 @@
 const _ = require("lodash");
 const config = require("./config.json");
 const { init } = require("@plusscommunities/pluss-core-aws/config");
-const { getBody } = require("@plusscommunities/pluss-core-aws/helper");
+const { getBody, log } = require("@plusscommunities/pluss-core-aws/helper");
 const generateJsonResponse = require("@plusscommunities/pluss-core-aws/helper/generateJsonResponse");
 const addMaintenanceJob = require("./db/maintenance/addMaintenanceJob");
 const validateSiteAccess = require("@plusscommunities/pluss-core-aws/helper/auth/validateSiteAccess");
@@ -11,126 +11,219 @@ const getUserPreview = require("@plusscommunities/pluss-core-aws/helper/getUserP
 const publishActivity = require("@plusscommunities/pluss-core-aws/db/activity/publishActivity");
 const sendJobEmail = require("./sendJobEmail");
 const logAnalyticsActivity = require("@plusscommunities/pluss-core-aws/db/analytics/logAnalyticsActivity");
+const {
+	PropertyRepository,
+} = require("@plusscommunities/pluss-core-aws/db/property/PropertyRepository");
 const { values } = require("./values.config");
 
+const properties = new PropertyRepository();
+
+// Property linking also needs the Aurora wiring gs injects only in
+// environments with the database stack; without it, requests keep the
+// pre-property behaviour (free-text room required).
+const propertyLinkingEnabled =
+	values.linkToProperty === true && !!process.env.POSTGRES_SECRET_ARN;
+
 module.exports.createJob = (event, context, callback) => {
-  init(config);
-  const data = getBody(event);
+	// Avoids waiting on the pooled DB connection to close before returning.
+	context.callbackWaitsForEmptyEventLoop = false;
+	init(config);
+	const data = getBody(event);
+
+	validateSiteAccess(event, data.location)
+		.then(async (authorised) => {
+			if (!authorised) {
+				return callback(
+					null,
+					generateJsonResponse(403, { fail: true, error: "not authorised" }),
+				);
+			}
+			// With linking on, location is resolved later; without it, room is required now.
+			const hasLocation = propertyLinkingEnabled || !_.isUndefined(data.room);
+			if (
+				!data.userID ||
+				_.isUndefined(data.userName) ||
+				!hasLocation ||
+				_.isUndefined(data.title)
+			) {
+				log("createJob", "InsufficientInput", data.userID);
+				return callback(
+					null,
+					generateJsonResponse(422, { error: "Insufficient input" }),
+				);
+			}
+			let user = await getUserPreviewFromReq(event);
+			// Capture submitter before `user` is reassigned to the subject below.
+			const submittingUserId = user.id;
+			const isOnBehalf = data.userID !== "undefined" && user.id !== data.userID;
+			if (isOnBehalf) {
+				const canRequest = await validateMasterAuth(
+					event,
+					values.permissionMaintenanceTracking,
+					data.location,
+				);
+				if (!canRequest) {
+					return callback(
+						null,
+						generateJsonResponse(422, {
+							fail: true,
+							error: "cannot request on behalf",
+						}),
+					);
+				}
 
-  validateSiteAccess(event, data.location)
-    .then(async (authorised) => {
-      if (!authorised) {
-        return callback(
-          null,
-          generateJsonResponse(403, { fail: true, error: "not authorised" })
-        );
-      }
-      if (
-        !data.userID ||
-        _.isUndefined(data.userName) ||
-        _.isUndefined(data.room) ||
-        _.isUndefined(data.title)
-      ) {
-        console.error("insufficient input", data.userID);
-        return callback(
-          null,
-          generateJsonResponse(422, { error: "Insufficient input" })
-        );
-      }
-      let user = await getUserPreviewFromReq(event);
-      if (data.userID !== "undefined" && user.id !== data.userID) {
-        const canRequest = await validateMasterAuth(
-          event,
-          values.permissionMaintenanceTracking,
-          data.location
-        );
-        if (!canRequest) {
-          return callback(
-            null,
-            generateJsonResponse(422, {
-              fail: true,
-              error: "cannot request on behalf",
-            })
-          );
-        }
+				user = await getUserPreview(data.userID);
+			}
 
-        user = await getUserPreview(data.userID);
-      }
+			// Resolved server-side, never taken from the request, so a resident cannot spoof a property.
+			let resolvedProperty = null;
+			if (propertyLinkingEnabled) {
+				// An explicit propertyId is honoured for any actor holding the tracking
+				// permission (staff can also submit as themselves); it is client input,
+				// so resolution fails closed.
+				const picksProperty =
+					!!data.propertyId &&
+					(isOnBehalf ||
+						(await validateMasterAuth(
+							event,
+							values.permissionMaintenanceTracking,
+							data.location,
+						)));
+				if (picksProperty) {
+					try {
+						resolvedProperty = await properties.byId({
+							site: data.location,
+							propertyId: data.propertyId,
+						});
+					} catch (error) {
+						// A resolver outage is not invalid input.
+						log("createJob", "PropertyResolveError", error.message);
+						return callback(
+							null,
+							generateJsonResponse(500, { error: "Internal Error" }),
+						);
+					}
+					if (!resolvedProperty) {
+						return callback(
+							null,
+							generateJsonResponse(422, {
+								error: "Invalid property for this site",
+							}),
+						);
+					}
+				} else if (!isOnBehalf) {
+					// Self-submission: resolve the submitter's own link, failing open so a
+					// resolver outage cannot block residents from reporting.
+					try {
+						resolvedProperty = await properties.forUser({
+							site: data.location,
+							userId: submittingUserId,
+						});
+					} catch (error) {
+						log("createJob", "PropertyResolveError", error.message);
+						resolvedProperty = null;
+					}
+				}
+			}
 
-      addMaintenanceJob(
-        user.id,
-        user.displayName,
-        user,
-        data.phone,
-        data.room,
-        data.title,
-        data.description,
-        data.type,
-        data.isHome,
-        data.homeText,
-        data.images || data.image,
-        data.location,
-        data.audience,
-        data.customFields
-      ).then((id) => {
-        sendJobEmail({
-          userID: user.id,
-          userName: user.displayName,
-          phone: data.phone,
-          room: data.room,
-          title: data.title,
-          description: data.description,
-          type: data.type,
-          isHome: data.isHome,
-          homeText: data.homeText,
-          image: data.image,
-          images: data.images,
-          site: data.location,
-          audience: data.audience,
-          id,
-          customFields: data.customFields,
-        });
+			// Record and email use the same resolved name so they never disagree.
+			const propertyId = resolvedProperty ? resolvedProperty.id : undefined;
+			const propertyName = resolvedProperty ? resolvedProperty.name : undefined;
+			const room = propertyName || data.room;
 
-        publishActivity(
-          values.activityAddMaintenanceJob,
-          data.location,
-          id,
-          user,
-          {
-            title: data.title,
-            description: data.description,
-          }
-        );
+			// No property link and no room means no location.
+			if (propertyLinkingEnabled && !room) {
+				log("createJob", "InsufficientInput", data.userID);
+				return callback(
+					null,
+					generateJsonResponse(422, { error: "Insufficient input" }),
+				);
+			}
 
-        logAnalyticsActivity(
-          `Request`,
-          values.entityKey,
-          data.location,
-          user,
-          id
-        );
+			return addMaintenanceJob(
+				user.id,
+				user.displayName,
+				user,
+				data.phone,
+				room,
+				data.title,
+				data.description,
+				data.type,
+				data.isHome,
+				data.homeText,
+				data.images || data.image,
+				data.location,
+				data.audience,
+				data.customFields,
+				propertyId,
+				propertyName,
+			).then(async (id) => {
+				// Awaited (allSettled) — the frozen event loop would drop fire-and-forget
+				// work, one failure must not strand the others, and a failed side effect
+				// must not fail the create.
+				const settled = await Promise.allSettled([
+					sendJobEmail({
+						userID: user.id,
+						userName: user.displayName,
+						phone: data.phone,
+						room,
+						title: data.title,
+						description: data.description,
+						type: data.type,
+						isHome: data.isHome,
+						homeText: data.homeText,
+						image: data.image,
+						images: data.images,
+						site: data.location,
+						audience: data.audience,
+						id,
+						customFields: data.customFields,
+					}),
+					publishActivity(
+						values.activityAddMaintenanceJob,
+						data.location,
+						id,
+						user,
+						{
+							title: data.title,
+							description: data.description,
+						},
+					),
+					logAnalyticsActivity(
+						`Request`,
+						values.entityKey,
+						data.location,
+						user,
+						id,
+					),
+				]);
+				settled
+					.filter((result) => result.status === "rejected")
+					.forEach((result) => {
+						log("createJob", "SideEffectError", result.reason);
+					});
 
-        return callback(
-          null,
-          generateJsonResponse(200, {
-            success: true,
-            id,
-            searchResult: id,
-          })
-        );
-      });
-    })
-    .catch((error) => {
-      console.error(
-        "Failed to save maintenance node --> email successful",
-        data.userID
-      );
-      console.log(error);
-      return callback(
-        null,
-        generateJsonResponse(422, {
-          error,
-        })
-      );
-    });
+				return callback(
+					null,
+					generateJsonResponse(200, {
+						success: true,
+						id,
+						searchResult: id,
+					}),
+				);
+			});
+		})
+		.catch((error) => {
+			console.error(
+				"Failed to save maintenance node --> email successful",
+				data.userID,
+			);
+			console.log(error);
+			return callback(
+				null,
+				generateJsonResponse(422, {
+					error,
+				}),
+			);
+		});
 };

package/createJobType.js

@@ -8,57 +8,57 @@ const updateRef = require("@plusscommunities/pluss-core-aws/db/common/updateRef"
 const { values } = require("./values.config");
 
 module.exports.createJobType = (event, context, callback) => {
-  init(config);
-  const data = getBody(event);
+	init(config);
+	const data = getBody(event);
 
-  if (!data.site || !data.name || !data.email || !data.description) {
-    return callback(
-      null,
-      generateJsonResponse(422, { error: "No site, type or email attached" })
-    );
-  }
+	if (!data.site || !data.name || !data.email || !data.description) {
+		return callback(
+			null,
+			generateJsonResponse(422, { error: "No site, type or email attached" }),
+		);
+	}
 
-  validateMasterAuth(event, values.permissionMaintenanceTypes).then(
-    (authorised) => {
-      if (!authorised) {
-        console.error("Authorization not valid");
-        return callback(
-          null,
-          generateJsonResponse(422, {
-            error: { message: "Admin - Create User - not authorized." },
-          })
-        );
-      }
+	validateMasterAuth(event, values.permissionMaintenanceTypes).then(
+		(authorised) => {
+			if (!authorised) {
+				console.error("Authorization not valid");
+				return callback(
+					null,
+					generateJsonResponse(422, {
+						error: { message: "Admin - Create User - not authorized." },
+					}),
+				);
+			}
 
-      const jobType = {
-        id: createGuid().substring(0, 8),
-        email: data.email,
-        typeName: data.name,
-        description: data.description,
-        level: data.level,
-        site: data.site,
-        hasCustomFields: data.hasCustomFields ?? false,
-        customFields: data.customFields ?? [],
-      };
+			const jobType = {
+				id: createGuid().substring(0, 8),
+				email: data.email,
+				typeName: data.name,
+				description: data.description,
+				level: data.level,
+				site: data.site,
+				hasCustomFields: data.hasCustomFields ?? false,
+				customFields: data.customFields ?? [],
+			};
 
-      updateRef(values.tableNameJobTypes, jobType)
-        .then((result) => {
-          return callback(
-            null,
-            generateJsonResponse(200, {
-              success: true,
-              jobType: result,
-            })
-          );
-        })
-        .catch((error) => {
-          return callback(
-            null,
-            generateJsonResponse(422, {
-              error,
-            })
-          );
-        });
-    }
-  );
+			updateRef(values.tableNameJobTypes, jobType)
+				.then((result) => {
+					return callback(
+						null,
+						generateJsonResponse(200, {
+							success: true,
+							jobType: result,
+						}),
+					);
+				})
+				.catch((error) => {
+					return callback(
+						null,
+						generateJsonResponse(422, {
+							error,
+						}),
+					);
+				});
+		},
+	);
 };

package/db/maintenance/addMaintenanceJob.js

@@ -7,100 +7,110 @@ const { getConfig } = require("@plusscommunities/pluss-core-aws/config");
 const { values } = require("../../values.config");
 
 module.exports = async (
-  userID,
-  userName,
-  user,
-  phone,
-  room,
-  title,
-  description,
-  type,
-  isHome,
-  homeText,
-  images,
-  location,
-  audience,
-  customFields
+	userID,
+	userName,
+	user,
+	phone,
+	room,
+	title,
+	description,
+	type,
+	isHome,
+	homeText,
+	images,
+	location,
+	audience,
+	customFields,
+	propertyId,
+	propertyName,
 ) => {
-  const requestToSave = {
-    userID,
-    userName,
-    userProfilePic: user ? user.profilePic : null,
-    phone,
-    room,
-    title,
-    description,
-    type,
-    isHome,
-    homeText,
-    images,
-    site: location,
-    audience,
-    customFields,
-  };
+	// Property name overrides room so existing readers of room keep working.
+	const resolvedRoom = propertyName || room;
 
-  if (requestToSave.images) {
-    const thumbSource = Array.isArray(requestToSave.images)
-      ? requestToSave.images[0]
-      : requestToSave.images;
-    if (thumbSource) {
-      requestToSave.thumbnail = thumbSource
-        .replace("/general1400/", "/general300/")
-        .replace("/uploads1400/", "/uploads300/");
-    }
-  }
-  if (_.isEmpty(requestToSave.audience)) {
-    requestToSave.audience = [];
-  }
-  requestToSave.status = getConfig().maintenanceInstantComplete
-    ? "Completed"
-    : "Unassigned";
-  requestToSave.history = [
-    {
-      timestamp: moment.utc().valueOf(),
-      status: requestToSave.status,
-      user,
-    },
-  ];
+	const requestToSave = {
+		userID,
+		userName,
+		userProfilePic: user ? user.profilePic : null,
+		phone,
+		room: resolvedRoom,
+		title,
+		description,
+		type,
+		isHome,
+		homeText,
+		images,
+		site: location,
+		audience,
+		customFields,
+	};
 
-  requestToSave.id = uuid.v1();
-  requestToSave.createdTime = moment.utc().toISOString();
-  requestToSave.createdUnix = moment.utc().valueOf();
-  if (!requestToSave.jobId) {
-    const jobNoQ = {
-      IndexName: "MaintenanceSiteJobNoIndex",
-      KeyConditionExpression: "site = :site",
-      ExpressionAttributeValues: {
-        ":site": requestToSave.site,
-      },
-      Limit: 1,
-      ScanIndexForward: false,
-    };
+	// Omit propertyId when absent so the property index stays sparse (linked rows only).
+	if (propertyId) {
+		requestToSave.propertyId = propertyId;
+	}
 
-    const queryRes = await indexQuery(values.tableNameMaintenance, jobNoQ);
+	if (requestToSave.images) {
+		const thumbSource = Array.isArray(requestToSave.images)
+			? requestToSave.images[0]
+			: requestToSave.images;
+		if (thumbSource) {
+			requestToSave.thumbnail = thumbSource
+				.replace("/general1400/", "/general300/")
+				.replace("/uploads1400/", "/uploads300/");
+		}
+	}
+	if (_.isEmpty(requestToSave.audience)) {
+		requestToSave.audience = [];
+	}
+	requestToSave.status = getConfig().maintenanceInstantComplete
+		? "Completed"
+		: "Unassigned";
+	requestToSave.history = [
+		{
+			timestamp: moment.utc().valueOf(),
+			status: requestToSave.status,
+			user,
+		},
+	];
 
-    if (!_.isEmpty(queryRes.Items)) {
-      requestToSave.jobNo = queryRes.Items[0].jobNo + 1;
-    } else {
-      const query = {
-        IndexName: "MaintenanceSiteJobIdIndex",
-        KeyConditionExpression: "site = :site",
-        ExpressionAttributeValues: {
-          ":site": requestToSave.site,
-        },
-        Limit: 1,
-        ScanIndexForward: false,
-      };
-      const { Items } = await indexQuery(values.tableNameMaintenance, query);
-      requestToSave.jobNo =
-        !_.isEmpty(Items) && Items[0].jobId
-          ? Number.parseInt(Items[0].jobId) + 1
-          : 0;
-    }
-    requestToSave.jobId = (requestToSave.jobNo || 0) + "";
-  }
+	requestToSave.id = uuid.v1();
+	requestToSave.createdTime = moment.utc().toISOString();
+	requestToSave.createdUnix = moment.utc().valueOf();
+	if (!requestToSave.jobId) {
+		const jobNoQ = {
+			IndexName: "MaintenanceSiteJobNoIndex",
+			KeyConditionExpression: "site = :site",
+			ExpressionAttributeValues: {
+				":site": requestToSave.site,
+			},
+			Limit: 1,
+			ScanIndexForward: false,
+		};
 
-  requestToSave.priority = "Low";
-  await updateRef(values.tableNameMaintenance, requestToSave);
-  return requestToSave.id;
+		const queryRes = await indexQuery(values.tableNameMaintenance, jobNoQ);
+
+		if (!_.isEmpty(queryRes.Items)) {
+			requestToSave.jobNo = queryRes.Items[0].jobNo + 1;
+		} else {
+			const query = {
+				IndexName: "MaintenanceSiteJobIdIndex",
+				KeyConditionExpression: "site = :site",
+				ExpressionAttributeValues: {
+					":site": requestToSave.site,
+				},
+				Limit: 1,
+				ScanIndexForward: false,
+			};
+			const { Items } = await indexQuery(values.tableNameMaintenance, query);
+			requestToSave.jobNo =
+				!_.isEmpty(Items) && Items[0].jobId
+					? Number.parseInt(Items[0].jobId) + 1
+					: 0;
+		}
+		requestToSave.jobId = (requestToSave.jobNo || 0) + "";
+	}
+
+	requestToSave.priority = "Low";
+	await updateRef(values.tableNameMaintenance, requestToSave);
+	return requestToSave.id;
 };

package/db/maintenance/editMaintenanceJob.js

@@ -1,18 +1,28 @@
 const moment = require("moment");
+const _ = require("lodash");
 const editRef = require("@plusscommunities/pluss-core-aws/db/common/editRef");
+const getRef = require("@plusscommunities/pluss-core-aws/db/common/getRef");
+const updateRef = require("@plusscommunities/pluss-core-aws/db/common/updateRef");
 const { values } = require("../../values.config");
 
-module.exports = (job) => {
-  return new Promise((resolve, reject) => {
-    job.lastActivity = moment.utc().toISOString();
-    job.lastActivityUnix = moment.utc().valueOf();
+module.exports = async (job) => {
+	job.lastActivity = moment.utc().toISOString();
+	job.lastActivityUnix = moment.utc().valueOf();
 
-    editRef(values.tableNameMaintenance, "id", job.id, job)
-      .then((result) => {
-        resolve(result);
-      })
-      .catch((error) => {
-        reject(error);
-      });
-  });
+	const clearsProperty =
+		!_.isUndefined(job.propertyId) && job.propertyId == null;
+	if (!clearsProperty) {
+		return editRef(values.tableNameMaintenance, "id", job.id, job);
+	}
+
+	const item = await getRef(values.tableNameMaintenance, "id", job.id);
+	if (!item) {
+		throw new Error(`Maintenance job not found: ${job.id}`);
+	}
+	// GSI hash keys can't be null; drop propertyId/propertyName in the same
+	// single put as the edit so a partial failure can't leave the pair split.
+	const merged = { ...item, ...job, id: job.id };
+	delete merged.propertyId;
+	delete merged.propertyName;
+	return updateRef(values.tableNameMaintenance, merged);
 };