@stamhoofd/backend 2.103.0 → 2.104.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.103.0",
+    "version": "2.104.0",
     "main": "./dist/index.js",
     "exports": {
         ".": {
@@ -45,14 +45,14 @@
         "@simonbackx/simple-encoding": "2.22.0",
         "@simonbackx/simple-endpoints": "1.20.1",
         "@simonbackx/simple-logging": "^1.0.1",
-        "@stamhoofd/backend-i18n": "2.103.0",
-        "@stamhoofd/backend-middleware": "2.103.0",
-        "@stamhoofd/email": "2.103.0",
-        "@stamhoofd/models": "2.103.0",
-        "@stamhoofd/queues": "2.103.0",
-        "@stamhoofd/sql": "2.103.0",
-        "@stamhoofd/structures": "2.103.0",
-        "@stamhoofd/utility": "2.103.0",
+        "@stamhoofd/backend-i18n": "2.104.0",
+        "@stamhoofd/backend-middleware": "2.104.0",
+        "@stamhoofd/email": "2.104.0",
+        "@stamhoofd/models": "2.104.0",
+        "@stamhoofd/queues": "2.104.0",
+        "@stamhoofd/sql": "2.104.0",
+        "@stamhoofd/structures": "2.104.0",
+        "@stamhoofd/utility": "2.104.0",
         "archiver": "^7.0.1",
         "axios": "^1.8.2",
         "cookie": "^0.7.0",
@@ -70,5 +70,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "81c0e08f64f5c9a32a513cf6cfd2d48e3601f1a8"
+    "gitHead": "b0ab736ce6f13f9f663503ff0967caa8bb660723"
 }

package/src/endpoints/global/events/PatchEventsEndpoint.test.ts

@@ -1,7 +1,7 @@
 import { PatchableArray } from '@simonbackx/simple-encoding';
 import { Endpoint, Request } from '@simonbackx/simple-endpoints';
-import { EventFactory, Organization, OrganizationFactory, PlatformEventTypeFactory, RegistrationPeriodFactory, Token, User, UserFactory } from '@stamhoofd/models';
-import { AccessRight, Event, Permissions, PermissionsResourceType, ResourcePermissions } from '@stamhoofd/structures';
+import { EventFactory, Organization, OrganizationFactory, OrganizationRegistrationPeriodFactory, PlatformEventTypeFactory, RegistrationPeriodFactory, Token, User, UserFactory } from '@stamhoofd/models';
+import { AccessRight, Event, Group, GroupSettings, GroupType, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions, TranslatedString } from '@stamhoofd/structures';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer';
 import { PatchEventsEndpoint } from './PatchEventsEndpoint';
@@ -57,6 +57,10 @@ describe('Endpoint.PatchEventsEndpoint', () => {
         }).create();
     });
 
+    beforeEach(async () => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
     test('A normal user with write access can create an event', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({
@@ -168,6 +172,264 @@ describe('Endpoint.PatchEventsEndpoint', () => {
             TestUtils.setEnvironment('userMode', 'organization');
         });
 
+        test('Cannot create group for event in non-default period as non-full admin', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({
+                organization,
+                permissions: minimumUserPermissions,
+            }).create();
+
+            const period1 = await new RegistrationPeriodFactory({
+                startDate: new Date('2000-01-01'),
+                endDate: new Date('2001-01-01'),
+                organization,
+            }).create();
+
+            await new OrganizationRegistrationPeriodFactory({
+                period: period1,
+                organization,
+            }).create();
+
+            const period2 = await new RegistrationPeriodFactory({
+                startDate: new Date('2001-01-01'),
+                endDate: new Date('2002-01-01'),
+                organization,
+            }).create();
+
+            await new OrganizationRegistrationPeriodFactory({
+                period: period2,
+                organization,
+            }).create();
+
+            organization.periodId = period2.id;
+            await organization.save();
+
+            const event = await new EventFactory({
+                organization,
+                name: 'test event',
+                startDate: new Date('2000-02-10'),
+                endDate: new Date('2000-02-12'),
+            }).create();
+
+            const body: Body = new PatchableArray();
+            const newEvent = Event.patch({
+                id: event.id,
+                group: Group.create({
+                    settings: GroupSettings.create({
+                        description: TranslatedString.create('Inschrijvingsgroep'),
+                    }),
+                }),
+            });
+            body.addPatch(newEvent);
+
+            await expect(TestRequest.patch({ body, user, organization })).rejects.toThrow(STExpect.simpleError({
+                code: 'permission_denied',
+            }));
+        });
+
+        test('Can create group for event in non-default period as full admin', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const period1 = await new RegistrationPeriodFactory({
+                startDate: new Date('2000-01-01'),
+                endDate: new Date('2001-01-01'),
+                organization,
+            }).create();
+
+            await new OrganizationRegistrationPeriodFactory({
+                period: period1,
+                organization,
+            }).create();
+
+            const period2 = await new RegistrationPeriodFactory({
+                startDate: new Date('2001-01-01'),
+                endDate: new Date('2002-01-01'),
+                organization,
+            }).create();
+
+            await new OrganizationRegistrationPeriodFactory({
+                period: period2,
+                organization,
+            }).create();
+
+            organization.periodId = period2.id;
+            await organization.save();
+
+            const event = await new EventFactory({
+                organization,
+                name: 'test event',
+                startDate: new Date('2000-02-10'),
+                endDate: new Date('2000-02-12'),
+            }).create();
+
+            const body: Body = new PatchableArray();
+            const newEvent = Event.patch({
+                id: event.id,
+                group: Group.create({
+                    settings: GroupSettings.create({
+                        description: TranslatedString.create('Inschrijvingsgroep'),
+                    }),
+                }),
+            });
+            body.addPatch(newEvent);
+
+            const result = await TestRequest.patch({ body, user, organization });
+            expect(result.status).toBe(200);
+            expect(result.body).toHaveLength(1);
+            expect(result.body[0].group).toBeDefined();
+            expect(result.body[0].group!.settings.name).toEqual(TranslatedString.create('test event'));
+            expect(result.body[0].group!.settings.description).toEqual(TranslatedString.create('Inschrijvingsgroep'));
+            expect(result.body[0].group!.periodId).toEqual(period1.id);
+            expect(result.body[0].group!.organizationId).toEqual(organization.id);
+            expect(result.body[0].group!.type).toEqual(GroupType.EventRegistration);
+        });
+
+        test('Can create group for event in default period as non-full admin', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({
+                organization,
+                permissions: minimumUserPermissions,
+            }).create();
+
+            const period1 = await new RegistrationPeriodFactory({
+                startDate: new Date('2000-01-01'),
+                endDate: new Date('2001-01-01'),
+                organization,
+            }).create();
+
+            await new OrganizationRegistrationPeriodFactory({
+                period: period1,
+                organization,
+            }).create();
+
+            const period2 = await new RegistrationPeriodFactory({
+                startDate: new Date('2001-01-01'),
+                endDate: new Date('2002-01-01'),
+                organization,
+            }).create();
+
+            await new OrganizationRegistrationPeriodFactory({
+                period: period2,
+                organization,
+            }).create();
+
+            organization.periodId = period2.id;
+            await organization.save();
+
+            const event = await new EventFactory({
+                organization,
+                name: 'test event',
+                startDate: new Date('2001-02-10'),
+                endDate: new Date('2001-02-12'),
+            }).create();
+
+            const body: Body = new PatchableArray();
+            const newEvent = Event.patch({
+                id: event.id,
+                group: Group.create({
+                    settings: GroupSettings.create({
+                        description: TranslatedString.create('Inschrijvingsgroep'),
+                    }),
+                }),
+            });
+            body.addPatch(newEvent);
+
+            const result = await TestRequest.patch({ body, user, organization });
+            expect(result.status).toBe(200);
+            expect(result.body).toHaveLength(1);
+            expect(result.body[0].group).toBeDefined();
+            expect(result.body[0].group!.settings.name).toEqual(TranslatedString.create('test event'));
+            expect(result.body[0].group!.settings.description).toEqual(TranslatedString.create('Inschrijvingsgroep'));
+            expect(result.body[0].group!.periodId).toEqual(period2.id);
+            expect(result.body[0].group!.organizationId).toEqual(organization.id);
+            expect(result.body[0].group!.type).toEqual(GroupType.EventRegistration);
+        });
+
+        test('Changing an event startDate will move the registration period of the corresponding group', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }), // full permissions are required, otherwise you'll get a permission error
+            }).create();
+
+            const period1 = await new RegistrationPeriodFactory({
+                startDate: new Date('2000-01-01'),
+                endDate: new Date('2001-01-01'),
+                organization,
+            }).create();
+
+            await new OrganizationRegistrationPeriodFactory({
+                period: period1,
+                organization,
+            }).create();
+
+            const period2 = await new RegistrationPeriodFactory({
+                startDate: new Date('2001-01-01'),
+                endDate: new Date('2002-01-01'),
+                organization,
+            }).create();
+
+            await new OrganizationRegistrationPeriodFactory({
+                period: period2,
+                organization,
+            }).create();
+
+            const event = await new EventFactory({
+                organization,
+                name: 'test event',
+                startDate: new Date('2000-02-10'),
+                endDate: new Date('2000-02-12'),
+            }).create();
+
+            async function part1() {
+                const body: Body = new PatchableArray();
+                const newEvent = Event.patch({
+                    id: event.id,
+                    group: Group.create({
+                        settings: GroupSettings.create({
+                            description: TranslatedString.create('Inschrijvingsgroep'),
+                        }),
+                    }),
+                });
+                body.addPatch(newEvent);
+
+                const result = await TestRequest.patch({ body, user, organization });
+                expect(result.status).toBe(200);
+                expect(result.body).toHaveLength(1);
+                expect(result.body[0].group).toBeDefined();
+                expect(result.body[0].group!.settings.name).toEqual(TranslatedString.create('test event'));
+                expect(result.body[0].group!.settings.description).toEqual(TranslatedString.create('Inschrijvingsgroep'));
+                expect(result.body[0].group!.periodId).toEqual(period1.id);
+                expect(result.body[0].group!.organizationId).toEqual(organization.id);
+                expect(result.body[0].group!.type).toEqual(GroupType.EventRegistration);
+            }
+            await part1();
+
+            // Now alter start date
+            async function part2() {
+                const body: Body = new PatchableArray();
+                const newEvent = Event.patch({
+                    id: event.id,
+                    startDate: new Date('2001-02-10'),
+                    endDate: new Date('2001-02-12'),
+                });
+                body.addPatch(newEvent);
+
+                const result = await TestRequest.patch({ body, user, organization });
+                expect(result.status).toBe(200);
+                expect(result.body).toHaveLength(1);
+                expect(result.body[0].group).toBeDefined();
+                expect(result.body[0].group!.periodId).toEqual(period2.id);
+            }
+            await part2();
+        });
+
         test('A normal user with write access can create an event where the type has a maximum', async () => {
             const organization = await new OrganizationFactory({}).create();
 

package/src/endpoints/global/events/PatchEventsEndpoint.ts

@@ -38,7 +38,7 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
         if (!period) {
             throw new SimpleError({
                 code: 'invalid_period',
-                message: 'No period found for this start date',
+                message: 'No period found for this start date: ' + Formatter.dateIso(event.startDate),
                 human: Context.i18n.$t('5959a6a9-064a-413c-871f-c74a145ed569'),
                 field: 'startDate',
             });
@@ -52,6 +52,10 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
             putGroup.organizationId = event.organizationId;
         }
 
+        if (!await Context.auth.canAccessGroupsInPeriod(period.id, putGroup.organizationId)) {
+            throw Context.auth.error($t(`0d47541d-abf2-45b5-a06c-3a85b7fa3994`));
+        }
+
         if (!group) {
             putGroup.type = GroupType.EventRegistration;
 
@@ -254,7 +258,7 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     patch.group.type = GroupType.EventRegistration;
 
                     const period = await RegistrationPeriod.getByDate(event.startDate, event.organizationId);
-                    group = await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(patch.group, period);
+                    group = await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(patch.group, period, { isPatchingEvent: true });
                 }
                 else {
                     if (event.groupId === patch.group.id) {
@@ -276,10 +280,17 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
                 if (patch.startDate || patch.endDate) {
                     // Correct period id if needed
                     const period = await RegistrationPeriod.getByDate(event.startDate, event.organizationId);
-                    if (event.groupId) {
+                    if (event.groupId && period) {
                         await AuditLogService.setContext({ source: AuditLogSource.System }, async () => {
                             if (event.groupId) {
-                                group = await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(GroupStruct.patch({ id: event.groupId }), period);
+                                group = await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(
+                                    GroupStruct.patch({
+                                        id: event.groupId,
+                                        periodId: period.id,
+                                    }),
+                                    period,
+                                    { isPatchingEvent: true },
+                                );
                             }
                         });
                     }

package/src/endpoints/global/files/ExportToExcelEndpoint.ts

@@ -154,7 +154,7 @@ export class ExportToExcelEndpoint extends Endpoint<Params, Query, Body, Respons
                 await exportToExcel({
                     definitions: loader.sheets,
                     writer,
-                    dataGenerator: fetchToAsyncIterator(request.filter, loader),
+                    dataGenerator: fetchToAsyncIterator(request.filter, loader, { signFiles: true }),
                     filter: request.workbookFilter,
                 });
 

package/src/endpoints/global/registration/RegisterMembersEndpoint.test.ts

@@ -1,7 +1,7 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { EmailMocker } from '@stamhoofd/email';
 import { BalanceItemFactory, Group, GroupFactory, MemberFactory, MemberWithRegistrations, Organization, OrganizationFactory, OrganizationRegistrationPeriodFactory, Registration, RegistrationFactory, RegistrationPeriod, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
-import { BalanceItemCartItem, BalanceItemStatus, BalanceItemType, BooleanStatus, Company, GroupOption, GroupOptionMenu, IDRegisterCart, IDRegisterCheckout, IDRegisterItem, OrganizationPackages, PaymentCustomer, PaymentMethod, PermissionLevel, Permissions, PermissionsResourceType, ReduceablePrice, RegisterItemOption, ResourcePermissions, STPackageStatus, STPackageType, UserPermissions, Version } from '@stamhoofd/structures';
+import { AccessRight, BalanceItemCartItem, BalanceItemStatus, BalanceItemType, BooleanStatus, Company, GroupOption, GroupOptionMenu, IDRegisterCart, IDRegisterCheckout, IDRegisterItem, OrganizationPackages, PaymentCustomer, PaymentMethod, PermissionLevel, Permissions, PermissionsResourceType, ReduceablePrice, RegisterItemOption, ResourcePermissions, STPackageStatus, STPackageType, UserPermissions, Version } from '@stamhoofd/structures';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { v4 as uuidv4 } from 'uuid';
 import { testServer } from '../../../../tests/helpers/TestServer';
@@ -10,6 +10,8 @@ import { RegisterMembersEndpoint } from './RegisterMembersEndpoint';
 import { assertBalances } from '../../../../tests/assertions/assertBalances';
 import PersistentFile from 'formidable/PersistentFile';
 import { PatchMap } from '@simonbackx/simple-encoding';
+import { initAdmin, initPermissionRole } from '../../../../tests/init';
+import { BalanceItemService } from '../../../services/BalanceItemService';
 
 const baseUrl = `/v${Version}/members/register`;
 
@@ -1219,6 +1221,132 @@ describe('Endpoint.RegisterMembers', () => {
             defaultLinkMembersToUser = false;
         });
 
+        test('[Regression] Pay balance between organizations requires only finance access rights', async () => {
+            const { member, organization, token, user } = await initData();
+            const role = await initPermissionRole({
+                organization,
+                accessRights: [AccessRight.OrganizationFinanceDirector],
+            });
+            const { admin, adminToken } = await initAdmin({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.None,
+                    roles: [role],
+                }),
+            });
+
+            const company = Company.create({});
+            organization.meta.companies.push(company);
+            await organization.save();
+
+            const otherOrganization = await new OrganizationFactory({ }).create();
+
+            const balanceItem1 = await new BalanceItemFactory({
+                organizationId: otherOrganization.id,
+                memberId: null,
+                userId: null,
+                payingOrganizationId: organization.id,
+                type: BalanceItemType.PlatformMembership,
+                amount: 10,
+                unitPrice: 2,
+            }).create();
+
+            const cartItem = BalanceItemCartItem.create({
+                item: balanceItem1.getStructure(),
+                price: 20,
+            });
+
+            const body = IDRegisterCheckout.create({
+                cart: IDRegisterCart.create({
+                    items: [],
+                    balanceItems: [
+                        cartItem,
+                    ],
+                    deleteRegistrationIds: [],
+                }),
+                administrationFee: 0,
+                freeContribution: 0,
+                paymentMethod: PaymentMethod.PointOfSale,
+                totalPrice: 20,
+                asOrganizationId: organization.id,
+                customer: PaymentCustomer.create({
+                    firstName: user.firstName,
+                    lastName: user.lastName,
+                    email: user.email,
+                    company,
+                }),
+            });
+
+            const response = await post(body, otherOrganization, adminToken);
+            expect(response.body.registrations.length).toBe(0);
+
+            await BalanceItemService.flushAll();
+            await balanceItem1.refresh();
+
+            expect(balanceItem1).toMatchObject({
+                amount: 10,
+                unitPrice: 2,
+                priceOpen: 0,
+                pricePending: 20,
+                pricePaid: 0,
+            });
+        });
+
+        test('Pay balance between organizations not possible without finance access rights', async () => {
+            const { member, user, organization, token } = await initData({
+                permissionLevel: PermissionLevel.Write,
+            });
+
+            const otherOrganization = await new OrganizationFactory({ }).create();
+
+            const company = Company.create({});
+            organization.meta.companies.push(company);
+            await organization.save();
+
+            const balanceItem1 = await new BalanceItemFactory({
+                organizationId: otherOrganization.id,
+                memberId: null,
+                userId: null,
+                payingOrganizationId: organization.id,
+                type: BalanceItemType.PlatformMembership,
+                amount: 10,
+                unitPrice: 2,
+            }).create();
+
+            const cartItem = BalanceItemCartItem.create({
+                item: balanceItem1.getStructure(),
+                price: 20,
+            });
+
+            const body = IDRegisterCheckout.create({
+                cart: IDRegisterCart.create({
+                    items: [],
+                    balanceItems: [
+                        cartItem,
+                    ],
+                    deleteRegistrationIds: [],
+                }),
+                administrationFee: 0,
+                freeContribution: 0,
+                paymentMethod: PaymentMethod.PointOfSale,
+                totalPrice: 20,
+                asOrganizationId: organization.id,
+                customer: PaymentCustomer.create({
+                    firstName: user.firstName,
+                    lastName: user.lastName,
+                    email: user.email,
+                    company,
+                }),
+            });
+
+            await expect(post(body, otherOrganization, token))
+                .rejects
+                .toThrow(STExpect.simpleError({
+                    code: 'forbidden',
+                    message: 'No permission to checkout as this organization for a different organization',
+                }));
+        });
+
         test('Should reuse recently deactivated registration', async () => {
             const { organization, group, groupPrice, token, member } = await initData();
             group.settings.allowRegistrationsByOrganization = true;
@@ -1262,7 +1390,7 @@ describe('Endpoint.RegisterMembers', () => {
             expect(response.body.registrations[0].id).toEqual(firstRegistration.id);
         });
 
-        test('Cannot pay balances as organization', async () => {
+        test('Cannot pay member balances as organization', async () => {
             const { member, user, organization, token } = await initData();
 
             const balanceItem1 = await new BalanceItemFactory({

package/src/endpoints/global/registration/RegisterMembersEndpoint.ts

@@ -85,11 +85,13 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             whoWillPayNow = 'nobody';
         }
         else if (request.body.asOrganizationId && request.body.asOrganizationId !== organization.id) {
-            if (!await Context.auth.hasFullAccess(request.body.asOrganizationId)) {
+            // Paying balance to a different organization requires finance permissions
+            // we'll check later if you are also registering members, which requires full permissions
+            if (!await Context.auth.canManageFinances(request.body.asOrganizationId)) {
                 throw new SimpleError({
                     code: 'forbidden',
-                    message: 'No permission to register as this organization for a different organization',
-                    human: $t(`62fe6e39-f6b0-4836-b0f7-dc84d22a81e3`),
+                    message: 'No permission to checkout as this organization for a different organization',
+                    human: $t(`eff21f4c-2d50-4553-9eb9-8a9e399f4124`),
                     statusCode: 403,
                 });
             }
@@ -207,6 +209,18 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
                 }
                 platformMembers.push(platformMember);
             }
+
+            if (memberIds.length > 0 && request.body.asOrganizationId && request.body.asOrganizationId !== organization.id) {
+                // For registering members at a different organization, you need full permissions
+                if (!await Context.auth.hasFullAccess(request.body.asOrganizationId)) {
+                    throw new SimpleError({
+                        code: 'forbidden',
+                        message: 'No permission to register as this organization for a different organization',
+                        human: $t(`62fe6e39-f6b0-4836-b0f7-dc84d22a81e3`),
+                        statusCode: 403,
+                    });
+                }
+            }
         }
         else {
             const blob = await AuthenticatedStructures.membersBlob(members, true);