@plusscommunities/pluss-newsletter-aws-projects 2.0.9 → 2.0.10

package/addNewsletterEntry.js

@@ -15,170 +15,182 @@ const publishActivity = require("./common/db/activity/publishActivity");
 const { values } = require("./values.config");
 
 const sendNewsSubmissionEmail = (update) => {
-  getRef(
-    "strings",
-    "RowId",
-    `${update.Site}_${values.stringPostfixSubmissionEmail}`
-  )
-    .then((ev) => {
-      sendEmail(
-        ev.Value,
-        newsletterSubmissionEmail.subject.replace("___TITLE___", update.Title),
-        newsletterSubmissionEmail.content
-          .replace("___TITLE___", update.Title)
-          .replace("___TEXT___", update.Text)
-          .replace("___NAME___", update.SubmittedBy.displayName)
-          .replace(/\n/g, " <br /> "),
-        true
-      );
-    })
-    .catch((err) => {
-      console.log("No email to send to");
-    });
+	getRef(
+		"strings",
+		"RowId",
+		`${update.Site}_${values.stringPostfixSubmissionEmail}`,
+	)
+		.then((ev) => {
+			sendEmail(
+				ev.Value,
+				newsletterSubmissionEmail.subject.replace("___TITLE___", update.Title),
+				newsletterSubmissionEmail.content
+					.replace("___TITLE___", update.Title)
+					.replace("___TEXT___", update.Text)
+					.replace("___NAME___", update.SubmittedBy.displayName)
+					.replace(/\n/g, " <br /> "),
+				true,
+			);
+		})
+		.catch((err) => {
+			console.log("No email to send to");
+		});
 };
 
 module.exports.addNewsletterEntry = (event, context, callback) => {
-  initConfig();
-  const data = JSON.parse(event.body);
+	initConfig();
+	const data = JSON.parse(event.body);
 
-  data.update.Id = uuid.v1();
+	// PC-1444 §AC-B.7: strip caller-supplied HqSourceId. Only the stream
+	// handler (newsletterChanged.js) writes HqSourceId on community-copy rows
+	// (via fanOutHqSource). Allowing callers to set it would let them forge
+	// "ghost-locked" rows that bypass Story A's Boolean(HqSourceId) lock guard
+	// — defense-in-depth pairing with the lock guard.
+	if (data.update && data.update.HqSourceId !== undefined) {
+		console.warn(
+			"addNewsletterEntry: stripped caller-supplied HqSourceId",
+		);
+		delete data.update.HqSourceId;
+	}
 
-  if (!data.update.Timestamp && !data.update.UnixTimestamp) {
-    data.update.Timestamp = moment.utc().toISOString();
-    data.update.UnixTimestamp = moment.utc().valueOf();
-  }
-  data.update.UnixTimestampReverse =
-    Number.MAX_SAFE_INTEGER - data.update.UnixTimestamp;
-  data.update.RowId = getRowId(data.update.Site, data.update.Id);
-  if (data.update.IsFeatured && !data.update.IsFeaturedDate) {
-    data.update.IsFeaturedDate = moment.utc().unix();
-  } else if (!data.update.IsFeatured) {
-    data.update.IsFeaturedDate = null;
-  }
+	data.update.Id = uuid.v1();
 
-  if (data.update.Video) {
-    if (!isValidVideo(data.update.Video)) {
-      return callback(
-        null,
-        generateJsonResponse(400, {
-          message:
-            "The video URL is from a domain that is not recognized and therefore blocked for security reasons.",
-        })
-      );
-    }
-  }
+	if (!data.update.Timestamp && !data.update.UnixTimestamp) {
+		data.update.Timestamp = moment.utc().toISOString();
+		data.update.UnixTimestamp = moment.utc().valueOf();
+	}
+	data.update.UnixTimestampReverse =
+		Number.MAX_SAFE_INTEGER - data.update.UnixTimestamp;
+	data.update.RowId = getRowId(data.update.Site, data.update.Id);
+	if (data.update.IsFeatured && !data.update.IsFeaturedDate) {
+		data.update.IsFeaturedDate = moment.utc().unix();
+	} else if (!data.update.IsFeatured) {
+		data.update.IsFeaturedDate = null;
+	}
 
-  if (data.update.Notification) data.update.UnsentNotification = "X";
+	if (data.update.Video) {
+		if (!isValidVideo(data.update.Video)) {
+			return callback(
+				null,
+				generateJsonResponse(400, {
+					message:
+						"The video URL is from a domain that is not recognized and therefore blocked for security reasons.",
+				}),
+			);
+		}
+	}
 
-  getSessionUserFromReqAuthKey(event).then((uid) => {
-    getUserPreview(uid).then((user) => {
-      data.update.SubmittedBy = user;
-      if (data.update.AuthorDisplay === "name") {
-        data.update.Author = user;
-      }
+	if (data.update.Notification) data.update.UnsentNotification = "X";
 
-      validateMasterAuth(event, values.permissionNewsletter).then(
-        (authorised) => {
-          if (!authorised) {
-            validateMasterAuth(event, values.permissionNewsletterSubmit).then(
-              (authorised) => {
-                if (!authorised) {
-                  console.error("Authorization not valid");
-                  callback(
-                    null,
-                    generateJsonResponse(403, {
-                      message: "Authorization not valid.",
-                    })
-                  );
-                  return;
-                }
+	getSessionUserFromReqAuthKey(event).then((uid) => {
+		getUserPreview(uid).then((user) => {
+			data.update.SubmittedBy = user;
+			if (data.update.AuthorDisplay === "name") {
+				data.update.Author = user;
+			}
 
-                if (data.update.Private) {
-                  updateRef(values.tableNameNewsletterEntries, data.update)
-                    .then((result) => {
-                      callback(
-                        null,
-                        generateJsonResponse(200, {
-                          success: true,
-                          update: result,
-                          reviewRequired: false,
-                        })
-                      );
-                    })
-                    .catch((error) => {
-                      console.log("error", error);
-                      callback(
-                        null,
-                        generateJsonResponse(500, {
-                          message: "Something went wrong.",
-                        })
-                      );
-                    });
-                } else {
-                  updateRef(values.tableNameNewsletterSubmissions, data.update)
-                    .then((result) => {
-                      publishActivity(
-                        values.activityAddNewsSubmission,
-                        data.update.Site,
-                        data.update.RowId,
-                        user,
-                        { title: data.update.Title }
-                      );
-                      sendNewsSubmissionEmail(data.update);
-                      callback(
-                        null,
-                        generateJsonResponse(200, {
-                          success: true,
-                          update: result,
-                          reviewRequired: true,
-                        })
-                      );
-                    })
-                    .catch((error) => {
-                      console.log("error", error);
-                      callback(
-                        null,
-                        generateJsonResponse(500, {
-                          message: "Something went wrong.",
-                        })
-                      );
-                    });
-                }
-              }
-            );
-          } else {
-            updateRef(values.tableNameNewsletterEntries, data.update)
-              .then((result) => {
-                if (!data.update.Private) {
-                  publishActivity(
-                    values.activityAddNews,
-                    data.update.Site,
-                    data.update.RowId,
-                    user,
-                    { title: data.update.Title }
-                  );
-                }
-                callback(
-                  null,
-                  generateJsonResponse(200, {
-                    success: true,
-                    update: result,
-                    reviewRequired: false,
-                  })
-                );
-              })
-              .catch((error) => {
-                console.log("error", error);
-                callback(
-                  null,
-                  generateJsonResponse(500, {
-                    message: "Something went wrong.",
-                  })
-                );
-              });
-          }
-        }
-      );
-    });
-  });
+			validateMasterAuth(event, values.permissionNewsletter).then(
+				(authorised) => {
+					if (!authorised) {
+						validateMasterAuth(event, values.permissionNewsletterSubmit).then(
+							(authorised) => {
+								if (!authorised) {
+									console.error("Authorization not valid");
+									callback(
+										null,
+										generateJsonResponse(403, {
+											message: "Authorization not valid.",
+										}),
+									);
+									return;
+								}
+
+								if (data.update.Private) {
+									updateRef(values.tableNameNewsletterEntries, data.update)
+										.then((result) => {
+											callback(
+												null,
+												generateJsonResponse(200, {
+													success: true,
+													update: result,
+													reviewRequired: false,
+												}),
+											);
+										})
+										.catch((error) => {
+											console.log("error", error);
+											callback(
+												null,
+												generateJsonResponse(500, {
+													message: "Something went wrong.",
+												}),
+											);
+										});
+								} else {
+									updateRef(values.tableNameNewsletterSubmissions, data.update)
+										.then((result) => {
+											publishActivity(
+												values.activityAddNewsSubmission,
+												data.update.Site,
+												data.update.RowId,
+												user,
+												{ title: data.update.Title },
+											);
+											sendNewsSubmissionEmail(data.update);
+											callback(
+												null,
+												generateJsonResponse(200, {
+													success: true,
+													update: result,
+													reviewRequired: true,
+												}),
+											);
+										})
+										.catch((error) => {
+											console.log("error", error);
+											callback(
+												null,
+												generateJsonResponse(500, {
+													message: "Something went wrong.",
+												}),
+											);
+										});
+								}
+							},
+						);
+					} else {
+						updateRef(values.tableNameNewsletterEntries, data.update)
+							.then((result) => {
+								if (!data.update.Private) {
+									publishActivity(
+										values.activityAddNews,
+										data.update.Site,
+										data.update.RowId,
+										user,
+										{ title: data.update.Title },
+									);
+								}
+								callback(
+									null,
+									generateJsonResponse(200, {
+										success: true,
+										update: result,
+										reviewRequired: false,
+									}),
+								);
+							})
+							.catch((error) => {
+								console.log("error", error);
+								callback(
+									null,
+									generateJsonResponse(500, {
+										message: "Something went wrong.",
+									}),
+								);
+							});
+					}
+				},
+			);
+		});
+	});
 };

package/common/helper/index.js

@@ -1,7 +1,7 @@
 const {
-  getRowId,
-  thisOrDefault,
-  log,
+	getRowId,
+	thisOrDefault,
+	log,
 } = require("@plusscommunities/pluss-core-aws/helper");
 
 module.exports.getRowId = getRowId;

package/common/templates/newsletterSubmissionEmail.js

@@ -1,8 +1,8 @@
 const { values } = require("../../values.config");
 
 module.exports = {
-  subject: `${values.textNewNewsletterSubmission}: ___TITLE___`,
-  content: `<div style='margin-bottom: 40px; font-size: 14px; line-height: 23px; color: #3e4245;'>
+	subject: `${values.textNewNewsletterSubmission}: ___TITLE___`,
+	content: `<div style='margin-bottom: 40px; font-size: 14px; line-height: 23px; color: #3e4245;'>
                 ___NAME___ ${values.textHasSubmittedANewNewsletterPost}
             </div>
             <div style='margin-bottom: 16px; font-size: 22px; line-height: 30px; color: #0a2246; font-weight: bold;'>

package/config/validVideoURLs.js

@@ -3,10 +3,10 @@ const { log } = require("@plusscommunities/pluss-core-aws/helper");
 const { getConfig } = require("@plusscommunities/pluss-core-aws/config");
 
 const validVideoURLs = [
-  "youtube.com",
-  "youtu.be",
-  "vimeo.com",
-  `${process.env.tablePrefix}uploads.s3.ap-southeast-2.amazonaws.com`,
+	"youtube.com",
+	"youtu.be",
+	"vimeo.com",
+	`${process.env.tablePrefix}uploads.s3.ap-southeast-2.amazonaws.com`,
 ];
 
 /**
@@ -15,32 +15,32 @@ const validVideoURLs = [
  * @returns {Boolean} true if the URL is valid. false if it should be blocked.
  */
 exports.isValidVideo = (videoUrl) => {
-  const logId = log("isValidVideo", "Start", videoUrl);
-  if (_.isEmpty(videoUrl)) {
-    log("isValidVideo", "Empty", videoUrl, logId);
-    return true;
-  }
+	const logId = log("isValidVideo", "Start", videoUrl);
+	if (_.isEmpty(videoUrl)) {
+		log("isValidVideo", "Empty", videoUrl, logId);
+		return true;
+	}
 
-  const { featureConfig } = getConfig();
-  if (!featureConfig.limitVideoURLs) {
-    return true;
-  }
-  try {
-    const host = new URL(videoUrl.toLowerCase()).host;
-    log("isValidVideo", "host", host, logId);
+	const { featureConfig } = getConfig();
+	if (!featureConfig.limitVideoURLs) {
+		return true;
+	}
+	try {
+		const host = new URL(videoUrl.toLowerCase()).host;
+		log("isValidVideo", "host", host, logId);
 
-    return _.some(validVideoURLs, (validUrl) => {
-      log("isValidVideo", "validUrl", validUrl, logId);
-      log(
-        "isValidVideo",
-        "isValid",
-        host === validUrl || host === `www.${validUrl}`,
-        logId
-      );
-      return host === validUrl || host === `www.${validUrl}`;
-    });
-  } catch (e) {
-    log("isValidVideo", "Error", e, logId);
-  }
-  return false;
+		return _.some(validVideoURLs, (validUrl) => {
+			log("isValidVideo", "validUrl", validUrl, logId);
+			log(
+				"isValidVideo",
+				"isValid",
+				host === validUrl || host === `www.${validUrl}`,
+				logId,
+			);
+			return host === validUrl || host === `www.${validUrl}`;
+		});
+	} catch (e) {
+		log("isValidVideo", "Error", e, logId);
+	}
+	return false;
 };

package/deleteNewsletterEntry.js

@@ -6,70 +6,91 @@ const getRef = require("./common/db/common/getRef");
 const validateMasterAuth = require("./common/helper/auth/validateMasterAuth");
 const publishActivity = require("./common/db/activity/publishActivity");
 const getUserPreviewFromHeader = require("./common/helper/getUserPreviewFromHeader");
+const {
+	isHqLocked,
+} = require("@plusscommunities/pluss-core-aws/helper/hqPublishing");
 const { values } = require("./values.config");
 
 module.exports.deleteNewsletterEntry = (event, context, callback) => {
-  initConfig();
-  const data = JSON.parse(event.body);
+	initConfig();
+	const data = JSON.parse(event.body);
 
-  if (!data.site || !data.id) {
-    callback(
-      null,
-      generateJsonResponse(422, { error: "No site or id attached" })
-    );
-    return;
-  }
+	if (!data.site || !data.id) {
+		callback(
+			null,
+			generateJsonResponse(422, { error: "No site or id attached" }),
+		);
+		return;
+	}
 
-  validateMasterAuth(event, values.permissionNewsletter).then((authorised) => {
-    if (!authorised) {
-      console.error("Authorization not valid");
-      callback(
-        null,
-        generateJsonResponse(422, {
-          error: {
-            message: "Authorization not valid.",
-          },
-        })
-      );
-      return;
-    }
+	validateMasterAuth(event, values.permissionNewsletter).then((authorised) => {
+		if (!authorised) {
+			console.error("Authorization not valid");
+			callback(
+				null,
+				generateJsonResponse(422, {
+					error: {
+						message: "Authorization not valid.",
+					},
+				}),
+			);
+			return;
+		}
 
-    getRef(values.tableNameNewsletterEntries, "RowId", data.id).then(
-      (result) => {
-        if (result.Site !== data.site) {
-          return callback(
-            null,
-            generateJsonResponse(422, {
-              error: {
-                message: "Incorrect site.",
-              },
-            })
-          );
-        }
-        editRef(values.tableNameNewsletterEntries, "RowId", data.id, {
-          Deleted: true,
-          Changed: moment.utc().unix(),
-        })
-          .then(() => {
-            getUserPreviewFromHeader(event.headers.authkey).then((user) => {
-              publishActivity(
-                values.activityDeleteNews,
-                result.Site,
-                result.RowId,
-                user,
-                {
-                  title: result.Title,
-                }
-              );
-            });
-            callback(null, generateJsonResponse(200, { success: true }));
-            return;
-          })
-          .catch((error) => {
-            callback(null, generateJsonResponse(422, { error }));
-            return;
-          });
-      }
-    );
-  });
+		getRef(values.tableNameNewsletterEntries, "RowId", data.id).then(
+			(result) => {
+				if (result.Site !== data.site) {
+					return callback(
+						null,
+						generateJsonResponse(422, {
+							error: {
+								message: "Incorrect site.",
+							},
+						}),
+					);
+				}
+				// PC-1441 §3.2 AC2.3: community copies of HQ-published posts are
+				// universally locked (Boolean(HqSourceId) falsy test — no role
+				// exception, including masters). Retract happens on the HQ-source
+				// row (where !HqSourceId) and the stream cascades Deleted: true.
+				if (isHqLocked(result)) {
+					console.error(
+						"deleteNewsletterEntry: blocked — row is HQ-managed",
+					);
+					return callback(
+						null,
+						generateJsonResponse(403, {
+							error: {
+								message:
+									"This post is managed by Enterprise HQ and cannot be deleted locally.",
+							},
+						}),
+					);
+				}
+				editRef(values.tableNameNewsletterEntries, "RowId", data.id, {
+					Deleted: true,
+					Changed: moment.utc().unix(),
+				})
+					.then(() => {
+						getUserPreviewFromHeader(event.headers.authkey).then((user) => {
+							publishActivity(
+								values.activityDeleteNews,
+								result.Site,
+								result.RowId,
+								user,
+								{
+									title: result.Title,
+								},
+							);
+						});
+						callback(null, generateJsonResponse(200, { success: true }));
+						return;
+					})
+					.catch((error) => {
+						callback(null, generateJsonResponse(422, { error }));
+						return;
+					});
+			},
+		);
+	});
 };