@stamhoofd/backend 2.103.1 → 2.104.0

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -3,7 +3,8 @@ import { GroupPrivateSettings, Group as GroupStruct, GroupType, OrganizationRegi
 
 import { AutoEncoderPatchType, Decoder, PatchableArrayAutoEncoder, PatchableArrayDecoder, StringDecoder } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { Event, Group, Organization, OrganizationRegistrationPeriod, Platform, RegistrationPeriod } from '@stamhoofd/models';
+import { Event, Group, Organization, OrganizationRegistrationPeriod, Platform, Registration, RegistrationPeriod } from '@stamhoofd/models';
+import { SQL } from '@stamhoofd/sql';
 import { AuthenticatedStructures } from '../../../../helpers/AuthenticatedStructures';
 import { Context } from '../../../../helpers/Context';
 import { SetupStepUpdater } from '../../../../helpers/SetupStepUpdater';
@@ -75,7 +76,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                 });
             }
 
-            if (period.locked) {
+            if ((!period.organizationId && period.locked) || (period.locked && period.organizationId && !await Context.auth.hasFullAccess(period.organizationId))) {
                 throw new SimpleError({
                     code: 'locked_period',
                     message: 'This period is locked',
@@ -375,7 +376,9 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
         }
     }
 
-    static async patchGroup(struct: AutoEncoderPatchType<GroupStruct>, period?: RegistrationPeriod | null) {
+    static async patchGroup(struct: AutoEncoderPatchType<GroupStruct>, period?: RegistrationPeriod | null, options: { allowPatchWaitingListPeriod?: boolean; isPatchingEvent?: boolean } = {}) {
+        const { allowPatchWaitingListPeriod = false, isPatchingEvent = false } = options;
+
         const model = await Group.getByID(struct.id);
 
         if (!model || !await Context.auth.canAccessGroup(model, PermissionLevel.Full)) {
@@ -417,16 +420,87 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
 
         if (!period && !model.settings.period) {
             period = await RegistrationPeriod.getByID(model.periodId);
-        }
 
-        if (period) {
-            if (STAMHOOFD.userMode === 'organization' && period.organizationId !== model.organizationId) {
+            if (!period) {
                 throw new SimpleError({
-                    code: 'invalid_period',
-                    message: 'Period has different organization id',
-                    statusCode: 400,
+                    code: 'missing_required_relation',
+                    message: 'Relation periodId is missing on group ' + model.id,
+                    statusCode: 500,
                 });
             }
+        }
+
+        let shouldUpdatePeriodIds = false;
+
+        if (period) {
+            shouldUpdatePeriodIds = period.id !== model.periodId;
+
+            if (shouldUpdatePeriodIds && period.locked) {
+                if (period.organizationId === null || !await Context.auth.hasFullAccess(period.organizationId)) {
+                    throw new SimpleError({
+                        code: 'locked_period',
+                        message: 'This period is locked',
+                        human: Context.i18n.$t('f544b972-416c-471d-8836-d7f3b16f947d'),
+                    });
+                }
+            }
+
+            if (shouldUpdatePeriodIds) {
+                if (!isPatchingEvent && struct.periodId === undefined) {
+                    throw new SimpleError({
+                        code: 'invalid_field',
+                        field: 'periodId',
+                        message: 'Setting periodId is required when moving a group to a new period',
+                    });
+                }
+
+                if (STAMHOOFD.userMode === 'organization' && period.organizationId !== model.organizationId) {
+                    throw new SimpleError({
+                        code: 'invalid_period',
+                        message: 'Period has different organization id',
+                        statusCode: 400,
+                    });
+                }
+
+                // Check current period is locked
+                const currentPeriod = await RegistrationPeriod.getByID(model.periodId);
+
+                if (!currentPeriod) {
+                    throw new SimpleError({
+                        code: 'missing_required_relation',
+                        message: 'Relation periodId is missing on group ' + model.id,
+                        statusCode: 500,
+                    });
+                }
+
+                if (currentPeriod.locked) {
+                    if (currentPeriod.organizationId === null || !await Context.auth.hasFullAccess(currentPeriod.organizationId)) {
+                        throw new SimpleError({
+                            code: 'locked_period',
+                            message: 'This period is locked',
+                            human: $t('e115a9d1-11a6-42b9-a781-c6ab9d8a4b9c'),
+                        });
+                    }
+                }
+
+                if ((!isPatchingEvent && model.type === GroupType.EventRegistration) || (model.type === GroupType.WaitingList && !allowPatchWaitingListPeriod)) {
+                    throw new SimpleError({
+                        code: 'not_supported',
+                        message: `Moving group with type ${model.type} to a different period is not supported`,
+                        statusCode: 400,
+                    });
+                }
+            }
+
+            if (!isPatchingEvent) {
+                if (struct.periodId !== undefined && struct.periodId !== period.id) {
+                    throw new SimpleError({
+                        code: 'invalid_field',
+                        field: 'periodId',
+                        message: 'Cannot patch periodId to a different period then the one being patched',
+                    });
+                }
+            }
 
             model.periodId = period.id;
             model.settings.period = period.getBaseStructure();
@@ -447,6 +521,27 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             }
         }
 
+        /**
+         * A group should only be able to be moved to another period if the waiting list is not shared with other groups in the current period.
+         */
+        const throwIfUpdateWaitingListPeriodWithMultipleGroups = async (waitingListId: string) => {
+            if (shouldUpdatePeriodIds) {
+                const groupCount = await Group.select()
+                    .where('waitingListId', waitingListId)
+                    .whereNot('id', model.id)
+                    .whereNot('periodId', model.periodId).limit(1).count();
+
+                if (groupCount > 0) {
+                    throw new SimpleError({
+                        code: 'invalid_field',
+                        field: 'periodId',
+                        message: 'Group has waiting list with other groups in the current period',
+                        human: $t('753684e1-94aa-4663-a81c-9656a51283ae'),
+                    });
+                }
+            }
+        };
+
         const patch = struct;
         if (patch.waitingList !== undefined) {
             if (patch.waitingList === null) {
@@ -467,7 +562,11 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                 }
                 patch.waitingList.id = model.waitingListId;
                 patch.waitingList.type = GroupType.WaitingList;
-                await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(patch.waitingList, period);
+                await throwIfUpdateWaitingListPeriodWithMultipleGroups(patch.waitingList.id);
+                await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(patch.waitingList, period, {
+                    allowPatchWaitingListPeriod: shouldUpdatePeriodIds,
+                    isPatchingEvent,
+                });
             }
             else {
                 if (model.waitingListId) {
@@ -525,6 +624,27 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                 }
             }
         }
+        else if (shouldUpdatePeriodIds && model.waitingListId && period) {
+            // update waiting list period
+            await throwIfUpdateWaitingListPeriodWithMultipleGroups(model.waitingListId);
+            await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(
+                GroupStruct.patch({
+                    id: model.waitingListId,
+                    periodId: period.id,
+                }),
+                period,
+                {
+                    allowPatchWaitingListPeriod: shouldUpdatePeriodIds,
+                    isPatchingEvent,
+                },
+            );
+        }
+
+        if (shouldUpdatePeriodIds) {
+            // change the period ids of the registrations in the group
+            const { changedRows } = await SQL.update(Registration.table).set('periodId', model.periodId).where('groupId', model.id).update();
+            console.log(`Moved ${changedRows} registrations to period ${model.periodId}`);
+        }
 
         model.settings.throwIfInvalidPrices();
         await model.updateOccupancy();

package/src/helpers/AdminPermissionChecker.ts

@@ -216,20 +216,28 @@ export class AdminPermissionChecker {
         return true;
     }
 
+    async canAccessGroupsInPeriod(periodId: string, organizationId: string) {
+        const organization = await this.getOrganization(organizationId);
+        if (periodId !== organization.periodId) {
+            if (STAMHOOFD.userMode === 'organization' || periodId !== this.platform.period.id) {
+                if (!await this.hasFullAccess(organization.id)) {
+                    return false;
+                }
+            }
+        }
+        return true;
+    }
+
     async canAccessGroup(group: Group, permissionLevel: PermissionLevel = PermissionLevel.Read): Promise<boolean> {
         // Check permissions aren't scoped to a specific organization, and they mismatch
         if (!this.checkScope(group.organizationId)) {
             // return false;
         }
-        const organization = await this.getOrganization(group.organizationId);
 
-        if (group.periodId !== organization.periodId) {
-            if (STAMHOOFD.userMode === 'organization' || group.periodId !== this.platform.period.id) {
-                if (!await this.hasFullAccess(group.organizationId)) {
-                    return false;
-                }
-            }
+        if (!await this.canAccessGroupsInPeriod(group.periodId, group.organizationId)) {
+            return false;
         }
+        const organization = await this.getOrganization(group.organizationId);
 
         if (group.deletedAt || group.status === GroupStatus.Archived) {
             return await this.canAccessArchivedGroups(group.organizationId);

package/src/helpers/PeriodHelper.ts

@@ -155,7 +155,7 @@ export class PeriodHelper {
         await QueueHandler.schedule(tag, async () => {
             await AuditLogService.setContext({ source: AuditLogSource.System }, async () => {
                 for await (const group of Group.select().where('periodId', period.id).all()) {
-                    await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(GroupStruct.patch({ id: group.id }), period);
+                    await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(GroupStruct.patch({ id: group.id, periodId: period.id }), period);
                 }
             });
         });

package/src/helpers/fetchToAsyncIterator.ts

@@ -1,10 +1,14 @@
 import { IPaginatedResponse, LimitedFilteredRequest } from '@stamhoofd/structures';
+import { FileSignService } from '../services/FileSignService';
 
 export function fetchToAsyncIterator<T>(
     initialFilter: LimitedFilteredRequest,
     loader: {
         fetch(request: LimitedFilteredRequest): Promise<IPaginatedResponse<T, LimitedFilteredRequest>>;
     },
+    options?: {
+        signFiles?: boolean;
+    },
 ): AsyncIterable<T> {
     return {
         [Symbol.asyncIterator]: function () {
@@ -20,6 +24,9 @@ export function fetchToAsyncIterator<T>(
                     }
 
                     const response = await loader.fetch(request);
+                    if (options?.signFiles) {
+                        await FileSignService.fillSignedUrlsForStruct(response.results);
+                    }
                     request = response.next ?? null;
 
                     return {

package/tests/assertions/assertBalances.ts

@@ -1,7 +1,13 @@
 import { BalanceItem } from '@stamhoofd/models';
 import { BalanceItemService } from '../../src/services/BalanceItemService';
 
-export async function assertBalances(selector: { user: { id: string | null } } | { member: { id: string | null } }, balances: Partial<BalanceItem>[]) {
+export async function assertBalances(
+    selector:
+        { user: { id: string | null } }
+        | { member: { id: string | null } }
+        | { organization: { id: string | null } }
+        | { payingOrganization: { id: string | null } },
+    balances: Partial<BalanceItem>[]) {
     await BalanceItemService.flushAll();
 
     // Fetch all user balances
@@ -12,6 +18,12 @@ export async function assertBalances(selector: { user: { id: string | null } } |
     else if ('member' in selector && selector.member.id) {
         q.where('memberId', selector.member.id);
     }
+    else if ('organization' in selector && selector.organization.id) {
+        q.where('organizationId', selector.organization.id);
+    }
+    else if ('payingOrganization' in selector && selector.payingOrganization.id) {
+        q.where('payingOrganizationId', selector.payingOrganization.id);
+    }
     else {
         throw new Error('Selector must contain either user or member with an id');
     }

package/tests/jest.setup.ts

@@ -51,7 +51,6 @@ beforeAll(async () => {
     await Database.delete('DELETE FROM `webshops`');
     await Database.delete('DELETE FROM `groups`');
     await Database.delete('DELETE FROM `email_addresses`');
-
     await Database.update('UPDATE registration_periods set organizationId = null, customName = ? where organizationId is not null', ['delete']);
     await Database.delete('DELETE FROM `organizations`');
     await Database.delete('DELETE FROM `registration_periods` where customName = ?', ['delete']);