@stamhoofd/backend 2.120.6 → 2.122.0

package/src/endpoints/global/registration-invitations/GetRegistrationInvitationsEndpoint.ts

@@ -0,0 +1,213 @@
+import type { Decoder } from '@simonbackx/simple-encoding';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { Group, Platform, RegistrationInvitation } from '@stamhoofd/models';
+import type { SQLFilterDefinitions, SQLSortDefinitions } from '@stamhoofd/sql';
+import { applySQLSorter, compileToSQLFilter } from '@stamhoofd/sql';
+import type { CountFilteredRequest, RegistrationInvitation as RegistrationInvitationStruct, StamhoofdFilter } from '@stamhoofd/structures';
+import { GroupType, LimitedFilteredRequest, PaginatedResponse, PermissionLevel, assertSort } from '@stamhoofd/structures';
+
+import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures.js';
+import { Context } from '../../../helpers/Context.js';
+import { LimitedFilteredRequestHelper } from '../../../helpers/LimitedFilteredRequestHelper.js';
+import { registrationInvitationFilterCompilers } from '../../../sql-filters/registration-invitations.js';
+import { registrationInvitationSorters } from '../../../sql-sorters/registration-invitations.js';
+import { GetMembersEndpoint } from '../members/GetMembersEndpoint.js';
+import { validateGroupFilter } from '../members/helpers/validateGroupFilter.js';
+
+type Params = Record<string, never>;
+type Query = LimitedFilteredRequest;
+type Body = undefined;
+type ResponseBody = PaginatedResponse<RegistrationInvitationStruct[], LimitedFilteredRequest>;
+
+const sorters: SQLSortDefinitions<RegistrationInvitation> = registrationInvitationSorters;
+const filterCompilers: SQLFilterDefinitions = registrationInvitationFilterCompilers;
+
+export class GetRegistrationInvitationsEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    queryDecoder = LimitedFilteredRequest as Decoder<LimitedFilteredRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'GET') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/registration-invitations', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    static async buildQuery(q: CountFilteredRequest | LimitedFilteredRequest, permissionLevel: PermissionLevel = PermissionLevel.Read) {
+        const organization = Context.organization;
+        let scopeFilter: StamhoofdFilter | undefined = undefined;
+
+        // First do a quick validation of the groups, so that prevents the backend from having to add a scope filter
+        if (!Context.auth.canAccessAllPlatformMembers(permissionLevel) && !await validateGroupFilter({ filter: q.filter, permissionLevel, key: null })) {
+            if (!organization) {
+                const tags = Context.auth.getPlatformAccessibleOrganizationTags(permissionLevel);
+                if (tags !== 'all' && tags.length === 0) {
+                    throw Context.auth.error();
+                }
+
+                if (tags !== 'all') {
+                    const platform = await Platform.getShared();
+
+                    // Add organization scope filter
+                    scopeFilter = {
+                        group: {
+                            $elemMatch: {
+                                periodId: platform.periodIdIfPlatform,
+                            },
+                        },
+                        organization: {
+                            $elemMatch: {
+                                tags: {
+                                    $in: tags,
+                                },
+                            },
+
+                        },
+                    };
+                }
+            }
+
+            if (organization) {
+                // Add organization scope filter
+                if (await Context.auth.canAccessAllMembers(organization.id, permissionLevel)) {
+                    if (await Context.auth.hasFullAccess(organization.id, permissionLevel)) {
+                        // Can access full history for now
+                        scopeFilter = {
+                            organizationId: organization.id,
+                        };
+                    } else {
+                        // Can only access current period
+                        scopeFilter = {
+                            organizationId: organization.id,
+                            group: {
+                                $elemMatch: {
+                                    periodId: organization.periodId,
+                                },
+                            },
+                        };
+                    }
+                } else {
+                    const groups = await Group.getAll(organization.id, organization.periodId, true, [GroupType.Membership, GroupType.EventRegistration]);
+                    Context.auth.cacheGroups(groups);
+                    const groupIds: string[] = [];
+
+                    for (const group of groups) {
+                        if (await Context.auth.canAccessGroup(group, permissionLevel)) {
+                            groupIds.push(group.id);
+                        }
+                    }
+
+                    if (groupIds.length === 0) {
+                        throw Context.auth.error({
+                            message: 'You must filter on a group of the organization you are trying to access',
+                            human: $t(`%15g`),
+                        });
+                    }
+
+                    scopeFilter = {
+                        groupId: {
+                            $in: groupIds,
+                        },
+                    };
+                }
+            }
+        }
+
+        const query = RegistrationInvitation.select().setMaxExecutionTime(15 * 1000);
+
+        if (scopeFilter) {
+            query.where(await compileToSQLFilter(scopeFilter, filterCompilers));
+        }
+
+        if (q.filter) {
+            query.where(await compileToSQLFilter(q.filter, filterCompilers));
+        }
+
+        const memberSearchFilter = GetMembersEndpoint.buildSearchFilter(q.search);
+
+        if (memberSearchFilter) {
+            const searchFilter: StamhoofdFilter = {
+                member: {
+                    $elemMatch: memberSearchFilter,
+                },
+            };
+
+            query.where(await compileToSQLFilter(searchFilter, filterCompilers));
+        }
+
+        if (q instanceof LimitedFilteredRequest) {
+            if (q.pageFilter) {
+                query.where(await compileToSQLFilter(q.pageFilter, filterCompilers));
+            }
+
+            q.sort = assertSort(q.sort, [{ key: 'id' }]);
+            applySQLSorter(query, q.sort, sorters);
+            query.limit(q.limit);
+        }
+
+        return query;
+    }
+
+    static async buildData(requestQuery: LimitedFilteredRequest, permissionLevel = PermissionLevel.Read) {
+        const query = await GetRegistrationInvitationsEndpoint.buildQuery(requestQuery, permissionLevel);
+        let data: RegistrationInvitation[];
+
+        try {
+            data = await query.fetch();
+        } catch (error) {
+            if (error.message.includes('ER_QUERY_TIMEOUT')) {
+                throw new SimpleError({
+                    code: 'timeout',
+                    message: 'Query took too long',
+                    human: $t(`%Cv`),
+                });
+            }
+            throw error;
+        }
+
+        const next = LimitedFilteredRequestHelper.fixInfiniteLoadingLoop({
+            request: requestQuery,
+            results: data,
+            sorters,
+        });
+
+        return new PaginatedResponse<RegistrationInvitationStruct[], LimitedFilteredRequest>({
+            results: await AuthenticatedStructures.registrationInvitations(data),
+            next,
+        });
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope();
+        await Context.authenticate();
+
+        const maxLimit = Context.auth.hasSomePlatformAccess() ? 1000 : 100;
+
+        if (request.query.limit > maxLimit) {
+            throw new SimpleError({
+                code: 'invalid_field',
+                field: 'limit',
+                message: 'Limit can not be more than ' + maxLimit,
+            });
+        }
+
+        if (request.query.limit < 1) {
+            throw new SimpleError({
+                code: 'invalid_field',
+                field: 'limit',
+                message: 'Limit can not be less than 1',
+            });
+        }
+
+        return new Response(
+            await GetRegistrationInvitationsEndpoint.buildData(request.query),
+        );
+    }
+}

package/src/endpoints/global/registration-invitations/PatchRegistrationInvitationsEndpoint.test.ts

@@ -0,0 +1,404 @@
+import type { PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
+import { PatchableArray } from '@simonbackx/simple-encoding';
+import { Request } from '@simonbackx/simple-endpoints';
+import type { Organization, User } from '@stamhoofd/models';
+import { GroupFactory, MemberFactory, OrganizationFactory, RegistrationFactory, RegistrationInvitationFactory, Token, UserFactory } from '@stamhoofd/models';
+import type { RegistrationInvitation as RegistrationInvitationStruct } from '@stamhoofd/structures';
+import { PermissionLevel, Permissions, PermissionsResourceType, RegistrationInvitationRequest, ResourcePermissions, TranslatedString } from '@stamhoofd/structures';
+import { testServer } from '../../../../tests/helpers/TestServer.js';
+import { PatchRegistrationInvitationsEndpoint } from './PatchRegistrationInvitationsEndpoint.js';
+
+describe('Endpoint.PatchRegistrationInvitationsEndpoint', () => {
+    const endpoint = new PatchRegistrationInvitationsEndpoint();
+
+    const patchInvitations = async ({ patch, organization, user }: { patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest>; organization: Organization; user: User | null }) => {
+        const request = Request.buildJson('PATCH', '/registration-invitations', organization.getApiHost(), patch);
+        if (user) {
+            const token = await Token.createToken(user);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+        }
+        return await testServer.test<RegistrationInvitationStruct[]>(endpoint, request);
+    };
+
+    describe('Put invitation', () => {
+        test('Happy path', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const groupName = 'test groep';
+            const group = await new GroupFactory({ organization, name: new TranslatedString(groupName) }).create();
+            const resources = new Map();
+
+            resources.set(
+                PermissionsResourceType.Groups, new Map([[
+                    group.id,
+                    ResourcePermissions.create({
+                        level: PermissionLevel.Write,
+                    }),
+                ]]),
+            );
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.None,
+                    resources,
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization, user,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addPut(RegistrationInvitationRequest.create({
+                groupId: group.id,
+                memberId: member.id,
+            }));
+
+            const response = await patchInvitations({
+                patch,
+                organization,
+                user,
+            });
+
+            // assert
+            expect(response.body).toBeDefined();
+            expect(response.body).toHaveLength(1);
+            expect(response.body[0].group.id).toBe(group.id);
+            expect(response.body[0].group.name.toString()).toBe(groupName);
+            expect(response.body[0].member.id).toBe(member.id);
+            expect(response.body[0].member.firstName).toBe(member.firstName);
+            expect(response.body[0].member.lastName).toBe(member.lastName);
+        });
+
+        test('Should fail if no write access to group', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const groupName = 'test groep';
+            const group = await new GroupFactory({ organization, name: new TranslatedString(groupName) }).create();
+            const resources = new Map();
+
+            resources.set(
+                PermissionsResourceType.Groups, new Map([[
+                    group.id,
+                    ResourcePermissions.create({
+                        // read access!
+                        level: PermissionLevel.Read,
+                    }),
+                ]]),
+            );
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.None,
+                    resources,
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization, user,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addPut(RegistrationInvitationRequest.create({
+                groupId: group.id,
+                memberId: member.id,
+            }));
+
+            // assert
+            await expect(patchInvitations({
+                patch,
+                organization,
+                user,
+            })).rejects.toThrow('Je hebt geen toegangsrechten om iemand uit te nodigen voor deze groep.');
+        });
+
+        test('Should fail if no read access to member', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const groupName = 'test groep';
+            const group = await new GroupFactory({ organization, name: new TranslatedString(groupName) }).create();
+            const resources = new Map();
+
+            resources.set(
+                PermissionsResourceType.Groups, new Map([[
+                    group.id,
+                    ResourcePermissions.create({
+                        level: PermissionLevel.Write,
+                    }),
+                ]]),
+            );
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.None,
+                    resources,
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addPut(RegistrationInvitationRequest.create({
+                groupId: group.id,
+                memberId: member.id,
+            }));
+
+            // assert
+            await expect(patchInvitations({
+                patch,
+                organization,
+                user,
+            })).rejects.toThrow('Je hebt geen toegangsrechten om dit lid uit te nodigen.');
+        });
+
+        test('Should fail if already registered', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const groupName = 'test groep';
+            const group = await new GroupFactory({ organization, name: new TranslatedString(groupName) }).create();
+            const resources = new Map();
+
+            resources.set(
+                PermissionsResourceType.Groups, new Map([[
+                    group.id,
+                    ResourcePermissions.create({
+                        level: PermissionLevel.Write,
+                    }),
+                ]]),
+            );
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.None,
+                    resources,
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization, user,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            await new RegistrationFactory({ member, group }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addPut(RegistrationInvitationRequest.create({
+                groupId: group.id,
+                memberId: member.id,
+            }));
+
+            // assert
+            await expect(patchInvitations({
+                patch,
+                organization,
+                user,
+            })).rejects.toThrow('The member is already registered for this group');
+        });
+    });
+
+    describe('Patch invitation', () => {
+        test('Should not be supported', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const groupName = 'test groep';
+            const group = await new GroupFactory({ organization, name: new TranslatedString(groupName) }).create();
+            const resources = new Map();
+
+            resources.set(
+                PermissionsResourceType.Groups, new Map([[
+                    group.id,
+                    ResourcePermissions.create({
+                        level: PermissionLevel.Write,
+                    }),
+                ]]),
+            );
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.None,
+                    resources,
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization, user,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addPatch(RegistrationInvitationRequest.patch({
+                id: 'does not matter',
+                groupId: group.id,
+                memberId: member.id,
+            }));
+
+            // assert
+            await expect(patchInvitations({
+                patch,
+                organization,
+                user,
+            })).rejects.toThrow('Patching invitations is not supported. Only puts and deletes are supported.');
+        });
+    });
+
+    describe('Delete invitation', () => {
+        test('Happy path', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const groupName = 'test groep';
+            const group = await new GroupFactory({ organization, name: new TranslatedString(groupName) }).create();
+            const resources = new Map();
+
+            resources.set(
+                PermissionsResourceType.Groups, new Map([[
+                    group.id,
+                    ResourcePermissions.create({
+                        level: PermissionLevel.Write,
+                    }),
+                ]]),
+            );
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.None,
+                    resources,
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization,
+                user,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const invitation = await new RegistrationInvitationFactory({ member, group, organization }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addDelete(invitation.id);
+
+            const response = await patchInvitations({
+                patch,
+                organization,
+                user,
+            });
+
+            // assert
+            expect(response.body).toBeDefined();
+            expect(response.body).toHaveLength(0);
+        });
+
+        test('Should be able to delete if access to group but not to member', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const groupName = 'test groep';
+            const group = await new GroupFactory({ organization, name: new TranslatedString(groupName) }).create();
+            const resources = new Map();
+
+            resources.set(
+                PermissionsResourceType.Groups, new Map([[
+                    group.id,
+                    ResourcePermissions.create({
+                        level: PermissionLevel.Write,
+                    }),
+                ]]),
+            );
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.None,
+                    resources,
+                }),
+            }).create();
+
+            // user has no access to this member
+            const member = await new MemberFactory({
+                organization,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const invitation = await new RegistrationInvitationFactory({ member, group, organization }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addDelete(invitation.id);
+
+            const response = await patchInvitations({
+                patch,
+                organization,
+                user,
+            });
+
+            // assert
+            expect(response.body).toBeDefined();
+            expect(response.body).toHaveLength(0);
+        });
+
+        test('Should fail if no write access to group', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const groupName = 'test groep';
+            const group = await new GroupFactory({ organization, name: new TranslatedString(groupName) }).create();
+            const resources = new Map();
+
+            resources.set(
+                PermissionsResourceType.Groups, new Map([[
+                    group.id,
+                    ResourcePermissions.create({
+                        level: PermissionLevel.Read,
+                    }),
+                ]]),
+            );
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.None,
+                    resources,
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization, user,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const invitation = await new RegistrationInvitationFactory({ member, group, organization }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addDelete(invitation.id);
+
+            await expect(patchInvitations({
+                patch,
+                organization,
+                user,
+            })).rejects.toThrow('Je hebt geen toegangsrechten om deze uitnodiging te verwijderen.');
+        });
+    });
+});