@stamhoofd/backend 2.105.0 → 2.106.1

package/src/helpers/AdminPermissionChecker.ts

@@ -434,8 +434,16 @@ export class AdminPermissionChecker {
      */
     async canAccessRegistration(registration: Registration, permissionLevel: PermissionLevel = PermissionLevel.Read, checkMember: boolean | MemberWithRegistrations = true) {
         if (registration.deactivatedAt || !registration.registeredAt) {
+            if (!checkMember) {
+                // We can't grant access to a member because of a deactivated registration
+                return false;
+            }
+
             // No full access: cannot access deactivated registrations
-            return false;
+            if (permissionLevel !== PermissionLevel.Read) {
+                // Not allowed to edit registrations that are deleted
+                return false;
+            }
         }
 
         const organizationPermissions = await this.getOrganizationPermissions(registration.organizationId);
@@ -1293,6 +1301,14 @@ export class AdminPermissionChecker {
             };
         }
 
+        // All member access, means also having access to record categories of non-registered members
+        if (this.canAccessAllPlatformMembers(PermissionLevel.Read)) {
+            return {
+                canAccess: true,
+                record: record.record,
+            };
+        }
+
         return {
             canAccess: false,
             record: record.record,
@@ -1362,6 +1378,14 @@ export class AdminPermissionChecker {
             };
         }
 
+        // All member access, means also having access to record categories of non-registered members
+        if (this.canAccessAllPlatformMembers(level)) { // needs to be full to also inherit record category access
+            return {
+                canAccess: true,
+                record: record.record,
+            };
+        }
+
         if (hasTemporaryMemberAccess(this.user.id, member.id, PermissionLevel.Full)) {
             // You created this member, so temporary can read all records in order to set the member up correctly
             return {
@@ -1371,13 +1395,13 @@ export class AdminPermissionChecker {
         }
 
         // It is possible that this is a platform admin (or an admin that has access to multiple organizations), and inherits automatic permissions for tags. So'll need to loop all the organizations where this member has an active registration for
-        if (!record.organizationId && !this.organization && this.hasSomePlatformAccess()) {
+        if (!record.organizationId && !this.organization) {
             const checkedOrganizations = new Map<string, boolean>();
             for (const registration of member.registrations) {
                 const permissions = checkedOrganizations.get(registration.organizationId);
 
                 // Checking the organization permissions is faster (and less data lookups required), so we do that first before doing the more expensive registration access check
-                if (permissions !== null) {
+                if (permissions !== undefined) {
                     if (permissions === true && await this.canAccessRegistration(registration, level)) {
                         return {
                             canAccess: true,
@@ -1648,8 +1672,8 @@ export class AdminPermissionChecker {
         return data;
     }
 
-    canAccessAllPlatformMembers(): boolean {
-        return !!this.platformPermissions && !!this.platformPermissions.hasAccessRight(AccessRight.PlatformLoginAs);
+    canAccessAllPlatformMembers(level: PermissionLevel): boolean {
+        return this.getPlatformAccessibleOrganizationTags(level) === 'all';
     }
 
     canAccess(accessRight: AccessRight): boolean {
@@ -1682,7 +1706,7 @@ export class AdminPermissionChecker {
             }
         }
 
-        if (tags.length === allTags.length) {
+        if (tags.length > 0 && tags.length === allTags.length) {
             return 'all';
         }
 

package/src/helpers/AuthenticatedStructures.ts

@@ -937,7 +937,7 @@ export class AuthenticatedStructures {
                                     ]
                                 : []),
 
-                            ...((member.details.defaultAge <= 18 || member.details.getMemberEmails().length === 0)
+                            ...((member.details.calculatedParentsHaveAccess || member.details.getMemberEmails().length === 0)
                                 ? member.details.parents.filter(p => p.getEmails().length > 0).map(p => ReceivableBalanceObjectContact.create({
                                         firstName: p.firstName ?? '',
                                         lastName: p.lastName ?? '',
@@ -980,7 +980,7 @@ export class AuthenticatedStructures {
                                     ]
                                 : []),
 
-                            ...((member.details.defaultAge <= 18 || member.details.getMemberEmails().length === 0)
+                            ...((member.details.calculatedParentsHaveAccess || member.details.getMemberEmails().length === 0)
                                 ? member.details.parents.filter(p => p.getEmails().length > 0).map(p => ReceivableBalanceObjectContact.create({
                                         firstName: p.firstName ?? '',
                                         lastName: p.lastName ?? '',

package/src/helpers/MemberUserSyncer.test.ts

@@ -1,6 +1,6 @@
 import { Database } from '@simonbackx/simple-database';
 import { Member, MemberFactory, MemberResponsibilityRecordFactory, User, UserFactory } from '@stamhoofd/models';
-import { MemberDetails, Parent, UserPermissions } from '@stamhoofd/structures';
+import { BooleanStatus, MemberDetails, Parent, UserPermissions } from '@stamhoofd/structures';
 import { TestUtils } from '@stamhoofd/test-utils';
 import { MemberUserSyncer } from './MemberUserSyncer';
 
@@ -19,6 +19,143 @@ describe('Helpers.MemberUserSyncer', () => {
             details: MemberDetails.create({
                 firstName: 'John',
                 lastName: 'Doe',
+                birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
+                parents: [
+                    Parent.create({
+                        firstName: 'Linda',
+                        lastName: 'Potter',
+                        email: 'linda@example.com',
+                    }),
+                    Parent.create({
+                        firstName: 'Peter',
+                        lastName: 'Doe',
+                        email: 'peter@example.com',
+                        alternativeEmails: [
+                            'peter@work.com',
+                        ],
+                    }),
+                ],
+                email: 'john@example.com',
+                alternativeEmails: ['john@work.com'],
+                unverifiedEmails: ['untitled@example.com', 'peter@example.com'], // Last one should be ignored
+            }),
+        }).create();
+
+        await MemberUserSyncer.onChangeMember(member);
+
+        const users = await Member.users.load(member);
+        expect(users).toIncludeSameMembers([
+            // Member
+            expect.objectContaining({
+                firstName: 'John',
+                lastName: 'Doe',
+                email: 'john@example.com',
+                memberId: member.id,
+            }),
+            expect.objectContaining({
+                firstName: 'John',
+                lastName: 'Doe',
+                email: 'john@work.com',
+                memberId: member.id,
+            }),
+
+            // Parents
+            expect.objectContaining({
+                firstName: 'Linda',
+                lastName: 'Potter',
+                email: 'linda@example.com',
+                memberId: null,
+                permissions: null,
+            }),
+            expect.objectContaining({
+                firstName: 'Peter',
+                lastName: 'Doe',
+                email: 'peter@example.com',
+                memberId: null,
+                permissions: null,
+            }),
+            expect.objectContaining({
+                firstName: 'Peter',
+                lastName: 'Doe',
+                email: 'peter@work.com',
+                memberId: null,
+                permissions: null,
+            }),
+
+            // Unverified
+            expect.objectContaining({
+                firstName: null,
+                lastName: null,
+                email: 'untitled@example.com',
+                memberId: null,
+                permissions: null,
+            }),
+        ]);
+    });
+
+    test('Parents do not get access by default for adult members', async () => {
+        const member = await new MemberFactory({
+            details: MemberDetails.create({
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 366 * 18), // 18 years old + compensation for leap years
+                parents: [
+                    Parent.create({
+                        firstName: 'Linda',
+                        lastName: 'Potter',
+                        email: 'linda@example.com',
+                    }),
+                    Parent.create({
+                        firstName: 'Peter',
+                        lastName: 'Doe',
+                        email: 'peter@example.com',
+                        alternativeEmails: [
+                            'peter@work.com',
+                        ],
+                    }),
+                ],
+                email: 'john@example.com',
+                alternativeEmails: ['john@work.com'],
+                unverifiedEmails: ['untitled@example.com', 'peter@example.com'], // Last one should be ignored
+            }),
+        }).create();
+
+        await MemberUserSyncer.onChangeMember(member);
+
+        const users = await Member.users.load(member);
+        expect(users).toIncludeSameMembers([
+            // Member
+            expect.objectContaining({
+                firstName: 'John',
+                lastName: 'Doe',
+                email: 'john@example.com',
+                memberId: member.id,
+            }),
+            expect.objectContaining({
+                firstName: 'John',
+                lastName: 'Doe',
+                email: 'john@work.com',
+                memberId: member.id,
+            }),
+
+            // Unverified
+            expect.objectContaining({
+                firstName: null,
+                lastName: null,
+                email: 'untitled@example.com',
+                memberId: null,
+                permissions: null,
+            }),
+        ]);
+    });
+
+    test('Parents can get access for adult members if explicitly set', async () => {
+        const member = await new MemberFactory({
+            details: MemberDetails.create({
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 366 * 18), // 18 years old + compensation for leap years
+                parentsHaveAccess: BooleanStatus.create({ value: true }),
                 parents: [
                     Parent.create({
                         firstName: 'Linda',
@@ -104,6 +241,7 @@ describe('Helpers.MemberUserSyncer', () => {
             details: MemberDetails.create({
                 firstName: 'John',
                 lastName: 'Doe',
+                birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                 parents: [
                     Parent.create({
                         firstName: 'Linda',
@@ -192,6 +330,7 @@ describe('Helpers.MemberUserSyncer', () => {
             details: MemberDetails.create({
                 firstName: 'John',
                 lastName: 'Doe',
+                birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                 parents: [
                     Parent.create({
                         firstName: 'Linda',
@@ -225,6 +364,7 @@ describe('Helpers.MemberUserSyncer', () => {
             details: MemberDetails.create({
                 firstName: 'John',
                 lastName: 'Doe',
+                birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                 parents: [
                     Parent.create({
                         firstName: 'Linda',
@@ -258,6 +398,7 @@ describe('Helpers.MemberUserSyncer', () => {
             details: MemberDetails.create({
                 firstName: 'John',
                 lastName: 'Doe',
+                birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                 parents: [
                     Parent.create({
                         firstName: 'Linda',
@@ -291,6 +432,7 @@ describe('Helpers.MemberUserSyncer', () => {
             details: MemberDetails.create({
                 firstName: 'John',
                 lastName: 'Doe',
+                birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                 parents: [
                     Parent.create({
                         firstName: 'John',
@@ -322,6 +464,7 @@ describe('Helpers.MemberUserSyncer', () => {
             details: MemberDetails.create({
                 firstName: 'John',
                 lastName: 'Doe',
+                birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                 parents: [
                     Parent.create({
                         firstName: 'John',
@@ -353,6 +496,7 @@ describe('Helpers.MemberUserSyncer', () => {
                 details: MemberDetails.create({
                     firstName: 'John',
                     lastName: 'Doe',
+                    birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                     parents: [
                         Parent.create({
                             firstName: 'Linda',
@@ -466,6 +610,170 @@ describe('Helpers.MemberUserSyncer', () => {
             });
         });
 
+        test('Parents are removed if access is revoked', async () => {
+            const member = await new MemberFactory({
+                details: MemberDetails.create({
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
+                    parents: [
+                        Parent.create({
+                            firstName: 'Linda',
+                            lastName: 'Potter',
+                            email: 'linda@example.com',
+                        }),
+                        Parent.create({
+                            firstName: 'Peter',
+                            lastName: 'Doe',
+                            email: 'peter@example.com',
+                            alternativeEmails: [
+                                'peter@work.com',
+                            ],
+                        }),
+                    ],
+                    email: 'john@example.com',
+                }),
+            }).create();
+            await new MemberResponsibilityRecordFactory({
+                member,
+            }).create();
+
+            await MemberUserSyncer.onChangeMember(member);
+
+            let users = await Member.users.load(member);
+            expect(users).toIncludeSameMembers([
+                // Member
+                expect.objectContaining({
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    email: 'john@example.com',
+                    memberId: member.id,
+                    permissions: expect.any(UserPermissions),
+                }),
+
+                // Parents
+                expect.objectContaining({
+                    firstName: 'Linda',
+                    lastName: 'Potter',
+                    email: 'linda@example.com',
+                    memberId: null,
+                    permissions: null,
+                }),
+                expect.objectContaining({
+                    firstName: 'Peter',
+                    lastName: 'Doe',
+                    email: 'peter@example.com',
+                    memberId: null,
+                    permissions: null,
+                }),
+                expect.objectContaining({
+                    firstName: 'Peter',
+                    lastName: 'Doe',
+                    email: 'peter@work.com',
+                    memberId: null,
+                    permissions: null,
+                }),
+            ]);
+
+            // Revoke parents access
+            member.details.parentsHaveAccess = BooleanStatus.create({ value: false });
+            await MemberUserSyncer.onChangeMember(member);
+
+            users = await Member.users.load(member);
+            expect(users).toIncludeSameMembers([
+                // Member
+                expect.objectContaining({
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    email: 'john@example.com',
+                    memberId: member.id,
+                    permissions: expect.any(UserPermissions),
+                }),
+            ]);
+        });
+
+        test('Parents are removed if member turns 18', async () => {
+            const member = await new MemberFactory({
+                details: MemberDetails.create({
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
+                    parents: [
+                        Parent.create({
+                            firstName: 'Linda',
+                            lastName: 'Potter',
+                            email: 'linda@example.com',
+                        }),
+                        Parent.create({
+                            firstName: 'Peter',
+                            lastName: 'Doe',
+                            email: 'peter@example.com',
+                            alternativeEmails: [
+                                'peter@work.com',
+                            ],
+                        }),
+                    ],
+                    email: 'john@example.com',
+                }),
+            }).create();
+            await new MemberResponsibilityRecordFactory({
+                member,
+            }).create();
+
+            await MemberUserSyncer.onChangeMember(member);
+
+            let users = await Member.users.load(member);
+            expect(users).toIncludeSameMembers([
+                // Member
+                expect.objectContaining({
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    email: 'john@example.com',
+                    memberId: member.id,
+                    permissions: expect.any(UserPermissions),
+                }),
+
+                // Parents
+                expect.objectContaining({
+                    firstName: 'Linda',
+                    lastName: 'Potter',
+                    email: 'linda@example.com',
+                    memberId: null,
+                    permissions: null,
+                }),
+                expect.objectContaining({
+                    firstName: 'Peter',
+                    lastName: 'Doe',
+                    email: 'peter@example.com',
+                    memberId: null,
+                    permissions: null,
+                }),
+                expect.objectContaining({
+                    firstName: 'Peter',
+                    lastName: 'Doe',
+                    email: 'peter@work.com',
+                    memberId: null,
+                    permissions: null,
+                }),
+            ]);
+
+            // Revoke parents access
+            member.details.birthDay = new Date(Date.now() - 1000 * 60 * 60 * 24 * 366 * 18); // 18 years old + compensation for leap years
+            await MemberUserSyncer.onChangeMember(member);
+
+            users = await Member.users.load(member);
+            expect(users).toIncludeSameMembers([
+                // Member
+                expect.objectContaining({
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    email: 'john@example.com',
+                    memberId: member.id,
+                    permissions: expect.any(UserPermissions),
+                }),
+            ]);
+        });
+
         test('Old emails with account are not removed', async () => {
             const user_m1 = await new UserFactory({ email: 'john@example.com' }).create();
             const user_m2 = await new UserFactory({ email: 'john@work.com' }).create();
@@ -478,6 +786,7 @@ describe('Helpers.MemberUserSyncer', () => {
                 details: MemberDetails.create({
                     firstName: 'John',
                     lastName: 'Doe',
+                    birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                     parents: [
                         Parent.create({
                             firstName: 'Linda',
@@ -634,12 +943,97 @@ describe('Helpers.MemberUserSyncer', () => {
         });
     });
 
+    describe('Linking', () => {
+        test('Parents are added if access is added', async () => {
+            const member = await new MemberFactory({
+                details: MemberDetails.create({
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 366 * 18), // 18 years old + leap year margin
+                    parents: [
+                        Parent.create({
+                            firstName: 'Linda',
+                            lastName: 'Potter',
+                            email: 'linda@example.com',
+                        }),
+                        Parent.create({
+                            firstName: 'Peter',
+                            lastName: 'Doe',
+                            email: 'peter@example.com',
+                            alternativeEmails: [
+                                'peter@work.com',
+                            ],
+                        }),
+                    ],
+                    email: 'john@example.com',
+                }),
+            }).create();
+            await new MemberResponsibilityRecordFactory({
+                member,
+            }).create();
+
+            await MemberUserSyncer.onChangeMember(member);
+
+            let users = await Member.users.load(member);
+            expect(users).toIncludeSameMembers([
+                // Member
+                expect.objectContaining({
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    email: 'john@example.com',
+                    memberId: member.id,
+                    permissions: expect.any(UserPermissions),
+                }),
+            ]);
+
+            // Revoke parents access
+            member.details.parentsHaveAccess = BooleanStatus.create({ value: true });
+            await MemberUserSyncer.onChangeMember(member);
+
+            users = await Member.users.load(member);
+            expect(users).toIncludeSameMembers([
+                // Member
+                expect.objectContaining({
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    email: 'john@example.com',
+                    memberId: member.id,
+                    permissions: expect.any(UserPermissions),
+                }),
+
+                // Parents
+                expect.objectContaining({
+                    firstName: 'Linda',
+                    lastName: 'Potter',
+                    email: 'linda@example.com',
+                    memberId: null,
+                    permissions: null,
+                }),
+                expect.objectContaining({
+                    firstName: 'Peter',
+                    lastName: 'Doe',
+                    email: 'peter@example.com',
+                    memberId: null,
+                    permissions: null,
+                }),
+                expect.objectContaining({
+                    firstName: 'Peter',
+                    lastName: 'Doe',
+                    email: 'peter@work.com',
+                    memberId: null,
+                    permissions: null,
+                }),
+            ]);
+        });
+    });
+
     describe('Members with the same email addresses', () => {
         test('The most recent member is linked to a user if both do not have responsibilities', async () => {
             const member1 = await new MemberFactory({
                 details: MemberDetails.create({
                     firstName: 'John',
                     lastName: 'Doe',
+                    birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                     email: 'john@example.com',
                 }),
             }).create();
@@ -663,6 +1057,7 @@ describe('Helpers.MemberUserSyncer', () => {
                 details: MemberDetails.create({
                     firstName: 'Other',
                     lastName: 'Doe',
+                    birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                     email: 'john@example.com',
                 }),
             }).create();
@@ -698,6 +1093,7 @@ describe('Helpers.MemberUserSyncer', () => {
                 details: MemberDetails.create({
                     firstName: 'John',
                     lastName: 'Doe',
+                    birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                     email: 'john@example.com',
                 }),
             }).create();
@@ -724,6 +1120,7 @@ describe('Helpers.MemberUserSyncer', () => {
                 details: MemberDetails.create({
                     firstName: 'Other',
                     lastName: 'Doe',
+                    birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                     email: 'john@example.com',
                 }),
             }).create();
@@ -764,6 +1161,7 @@ describe('Helpers.MemberUserSyncer', () => {
                 details: MemberDetails.create({
                     firstName: 'John',
                     lastName: 'Doe',
+                    birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                     email: 'john@example.com',
                 }),
             }).create();
@@ -784,6 +1182,7 @@ describe('Helpers.MemberUserSyncer', () => {
                 details: MemberDetails.create({
                     firstName: 'Other',
                     lastName: 'Doe',
+                    birthDay: new Date(Date.now() - 1000 * 60 * 60 * 24 * 365 * 8), // 8 years old
                     email: 'john@example.com',
                 }),
             }).create();

package/src/helpers/MemberUserSyncer.ts

@@ -49,17 +49,19 @@ export class MemberUserSyncerStatic {
                     });
                 }
 
-                for (const parent of member.details.parents) {
-                    for (const email of parent.getEmails()) {
-                        if (userEmails.includes(email.toLocaleLowerCase())) {
-                            continue;
+                if (member.details.calculatedParentsHaveAccess) {
+                    for (const parent of member.details.parents) {
+                        for (const email of parent.getEmails()) {
+                            if (userEmails.includes(email.toLocaleLowerCase())) {
+                                continue;
+                            }
+
+                            // Link parents and unverified emails
+                            await this.linkUser(email, member, true, {
+                                firstName: parent.firstName,
+                                lastName: parent.lastName,
+                            });
                         }
-
-                        // Link parents and unverified emails
-                        await this.linkUser(email, member, true, {
-                            firstName: parent.firstName,
-                            lastName: parent.lastName,
-                        });
                     }
                 }
 
@@ -89,6 +91,9 @@ export class MemberUserSyncerStatic {
                             await this.linkUser(user.email, member, true);
                         }
                     }
+                    else if (!member.details.calculatedParentsHaveAccess && parentEmails.includes(user.email.toLocaleLowerCase()) && !userEmails.includes(user.email.toLocaleLowerCase())) {
+                        await this.unlinkUser(user, member);
+                    }
                 }
 
                 if (member.details.securityCode === null) {