@stamhoofd/backend 2.133.0 → 2.135.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.133.0",
+    "version": "2.135.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -53,24 +53,24 @@
         "@bwip-js/node": "4.11.1",
         "@mollie/api-client": "4.5.0",
         "@simonbackx/simple-database": "1.37.1",
-        "@simonbackx/simple-encoding": "2.26.10",
+        "@simonbackx/simple-encoding": "2.26.11",
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.133.0",
-        "@stamhoofd/backend-i18n": "2.133.0",
-        "@stamhoofd/backend-middleware": "2.133.0",
-        "@stamhoofd/crons": "2.133.0",
-        "@stamhoofd/email": "2.133.0",
-        "@stamhoofd/excel-writer": "2.133.0",
-        "@stamhoofd/logging": "2.133.0",
-        "@stamhoofd/models": "2.133.0",
-        "@stamhoofd/object-differ": "2.133.0",
-        "@stamhoofd/queues": "2.133.0",
-        "@stamhoofd/sql": "2.133.0",
-        "@stamhoofd/structures": "2.133.0",
-        "@stamhoofd/types": "2.133.0",
-        "@stamhoofd/utility": "2.133.0",
+        "@stamhoofd/backend-env": "2.135.0",
+        "@stamhoofd/backend-i18n": "2.135.0",
+        "@stamhoofd/backend-middleware": "2.135.0",
+        "@stamhoofd/crons": "2.135.0",
+        "@stamhoofd/email": "2.135.0",
+        "@stamhoofd/excel-writer": "2.135.0",
+        "@stamhoofd/logging": "2.135.0",
+        "@stamhoofd/models": "2.135.0",
+        "@stamhoofd/object-differ": "2.135.0",
+        "@stamhoofd/queues": "2.135.0",
+        "@stamhoofd/sql": "2.135.0",
+        "@stamhoofd/structures": "2.135.0",
+        "@stamhoofd/types": "2.135.0",
+        "@stamhoofd/utility": "2.135.0",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.133.0",
+        "@stamhoofd/test-utils": "2.135.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "65d5f0a31f87b8e3b7a23349f08cf7943ef15bda"
+    "gitHead": "df20ecb0e4b10af877d2e37e92e39100afe342e8"
 }

package/src/crons/invoices.ts

@@ -52,10 +52,12 @@ async function createInvoicesFor(organization: Organization) {
     const today = Formatter.luxon();
     const startDate = today.day <= 15 ? today.minus({ month: 2 }).startOf('month') : today.minus({ month: 1 }).startOf('month');
 
-    // Don't invoice below 10 euro - unless we reached the timeout date for invoices (end of month + 15 days - 5 days margin)
-    const invoiceLimit = STAMHOOFD.environment === 'development' ? 0 : 10_0000;
+    // Don't invoice below 4 euro - unless we reached the timeout date for invoices (end of month + 15 days - 5 days margin) OR + 15 day offset
+    const invoiceLimit = STAMHOOFD.environment === 'development' ? 0 : 4_0000;
     function getPaymentTimeoutDate(p: Payment) {
-        return Formatter.luxon(p.paidAt ?? p.createdAt).plus({ month: 1 }).set({ day: 10 }).startOf('day').toJSDate();
+        const a = Formatter.luxon(p.paidAt ?? p.createdAt).plus({ month: 1 }).set({ day: 10 }).startOf('day').toJSDate();
+        const b = Formatter.luxon(p.paidAt ?? p.createdAt).plus({ days: 15 }).startOf('day').toJSDate();
+        return new Date(Math.min(a.getTime(), b.getTime()));
     }
 
     console.log('Fetching all payments between ' + Formatter.dateTime(startDate.toJSDate()) + ' and now for ' + organization.name);

package/src/endpoints/auth/VerifyEmailEndpoint.test.ts

@@ -0,0 +1,154 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { AuditLog, EmailVerificationCode, OrganizationFactory, Token, User, UserFactory } from '@stamhoofd/models';
+import type { Organization } from '@stamhoofd/models';
+import { AuditLogType, PermissionLevel, PermissionRole, Permissions, Token as TokenStruct } from '@stamhoofd/structures';
+import { TestUtils } from '@stamhoofd/test-utils';
+
+import { testServer } from '../../../tests/helpers/TestServer.js';
+import { VerifyEmailEndpoint } from './VerifyEmailEndpoint.js';
+
+describe('Endpoint.VerifyEmail', () => {
+    const endpoint = new VerifyEmailEndpoint();
+
+    beforeEach(() => {
+        TestUtils.setEnvironment('userMode', 'organization');
+    });
+
+    /**
+     * Create a user with permissions for the given organization.
+     */
+    async function createUserWithPermissions(organization: Organization, email: string, permissions?: Permissions) {
+        return await new UserFactory({
+            organization,
+            email,
+            permissions,
+        }).create();
+    }
+
+    /**
+     * Build a verification code for the given user that will change the user's email to `newEmail`
+     * on verification, and run the endpoint with it.
+     */
+    async function verifyEmail(organization: Organization, user: User, newEmail: string) {
+        const code = await EmailVerificationCode.createFor(user, newEmail);
+
+        const request = Request.buildJson('POST', '/verify-email', organization.getApiHost(), {
+            token: code.token,
+            code: code.code,
+        });
+
+        return await testServer.test(endpoint, request);
+    }
+
+    test('merges the permissions of the deleted user into the kept user', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        // The user that keeps existing and changes its email to the other user's email
+        const keptUser = await createUserWithPermissions(organization, 'kept@example.com', Permissions.create({
+            roles: [PermissionRole.create({ id: 'role-a', name: 'Role A' })],
+        }));
+
+        // The user that will be found by its email and merged into (and deleted)
+        const otherUser = await createUserWithPermissions(organization, 'other@example.com', Permissions.create({
+            level: PermissionLevel.Full,
+            roles: [PermissionRole.create({ id: 'role-b', name: 'Role B' })],
+        }));
+
+        const response = await verifyEmail(organization, keptUser, otherUser.email);
+        expect(response.status).toBe(200);
+
+        // The other user is deleted
+        expect(await User.getByID(otherUser.id)).toBeUndefined();
+
+        // The kept user now holds both users' permissions for the organization
+        const refreshed = await User.getByID(keptUser.id);
+        expect(refreshed).toBeDefined();
+        expect(refreshed!.email).toBe('other@example.com');
+
+        const merged = refreshed!.permissions!.organizationPermissions.get(organization.id);
+        expect(merged).toBeDefined();
+        expect(merged!.level).toBe(PermissionLevel.Full);
+        expect(merged!.roles.map(r => r.id).sort()).toEqual(['role-a', 'role-b']);
+    });
+
+    test('adopts the permissions of the deleted user when the kept user has none', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        // The kept user has no permissions
+        const keptUser = await createUserWithPermissions(organization, 'kept@example.com');
+        expect(keptUser.permissions).toBeNull();
+
+        const otherUser = await createUserWithPermissions(organization, 'other@example.com', Permissions.create({
+            roles: [PermissionRole.create({ id: 'role-b', name: 'Role B' })],
+        }));
+
+        const response = await verifyEmail(organization, keptUser, otherUser.email);
+        expect(response.status).toBe(200);
+
+        expect(await User.getByID(otherUser.id)).toBeUndefined();
+
+        const refreshed = await User.getByID(keptUser.id);
+        const merged = refreshed!.permissions?.organizationPermissions.get(organization.id);
+        expect(merged).toBeDefined();
+        expect(merged!.roles.map(r => r.id)).toEqual(['role-b']);
+    });
+
+    test('reassigns audit logs of the deleted user to the kept user', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const keptUser = await createUserWithPermissions(organization, 'kept@example.com');
+        const otherUser = await createUserWithPermissions(organization, 'other@example.com');
+
+        // An audit log performed by the user that will be deleted
+        const auditLog = new AuditLog();
+        auditLog.type = AuditLogType.Unknown;
+        auditLog.userId = otherUser.id;
+        auditLog.organizationId = organization.id;
+        auditLog.description = 'Performed by the other user';
+        await auditLog.save();
+
+        const response = await verifyEmail(organization, keptUser, otherUser.email);
+        expect(response.status).toBe(200);
+
+        expect(await User.getByID(otherUser.id)).toBeUndefined();
+
+        // The audit log is now attributed to the kept user
+        const refreshedLog = await AuditLog.getByID(auditLog.id);
+        expect(refreshedLog).toBeDefined();
+        expect(refreshedLog!.userId).toBe(keptUser.id);
+    });
+
+    test('verifies the email and returns a valid token when merging without throwing', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const keptUser = await createUserWithPermissions(organization, 'kept@example.com', Permissions.create({
+            roles: [PermissionRole.create({ id: 'role-a', name: 'Role A' })],
+        }));
+        const otherUser = await createUserWithPermissions(organization, 'other@example.com', Permissions.create({
+            roles: [PermissionRole.create({ id: 'role-b', name: 'Role B' })],
+        }));
+
+        // Also add an audit log to exercise all merge branches together
+        const auditLog = new AuditLog();
+        auditLog.type = AuditLogType.Unknown;
+        auditLog.userId = otherUser.id;
+        auditLog.organizationId = organization.id;
+        await auditLog.save();
+
+        const response = await verifyEmail(organization, keptUser, otherUser.email);
+
+        expect(response.body).toBeInstanceOf(TokenStruct);
+        if (!(response.body instanceof TokenStruct)) {
+            throw new Error('Expected TokenStruct');
+        }
+
+        // The returned token belongs to the kept user
+        const token = await Token.getByAccessToken(response.body.accessToken);
+        expect(token).toBeDefined();
+        expect(token!.user.id).toBe(keptUser.id);
+
+        const refreshed = await User.getByID(keptUser.id);
+        expect(refreshed!.verified).toBe(true);
+        expect(refreshed!.email).toBe('other@example.com');
+    });
+});

package/src/endpoints/auth/VerifyEmailEndpoint.ts

@@ -6,6 +6,7 @@ import { EmailVerificationCode, Token, User } from '@stamhoofd/models';
 import { Token as TokenStruct, VerifyEmailRequest } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context.js';
+import { BalanceItemService } from '../../services/BalanceItemService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -77,6 +78,9 @@ export class VerifyEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
             if (other) {
                 // Delete the other user, but merge data
                 await user.merge(other);
+                if (user.organizationId) {
+                    BalanceItemService.scheduleUserUpdate(user.organizationId, user.id);
+                }
             }
 
             // change user email

package/src/endpoints/global/members/GetMembersEndpoint.test.ts

@@ -1,8 +1,9 @@
 import type { Endpoint } from '@simonbackx/simple-endpoints';
 import { Request } from '@simonbackx/simple-endpoints';
-import type { RegistrationPeriod } from '@stamhoofd/models';
+import type { MemberWithUsersRegistrationsAndGroups, RegistrationPeriod } from '@stamhoofd/models';
 import { EventFactory, GroupFactory, MemberFactory, OrganizationFactory, RecordCategoryFactory, RegistrationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
-import { AccessRight, EventMeta, GroupType, LimitedFilteredRequest, NamedObject, PermissionLevel, PermissionRoleDetailed, Permissions, PermissionsResourceType, RecordAnswer, RecordTextAnswer, RecordType, ResourcePermissions } from '@stamhoofd/structures';
+import type { SortList } from '@stamhoofd/structures';
+import { AccessRight, EventMeta, GroupType, LimitedFilteredRequest, NamedObject, PermissionLevel, PermissionRoleDetailed, Permissions, PermissionsResourceType, RecordAnswer, RecordTextAnswer, RecordType, ResourcePermissions, SortItemDirection } from '@stamhoofd/structures';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { GetMembersEndpoint } from './GetMembersEndpoint.js';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
@@ -1959,4 +1960,225 @@ describe('Endpoint.GetMembersEndpoint', () => {
             ]);
         });
     });
+
+    describe('Sorting', () => {
+        // Deliberately not in chronological order, so a passing test cannot be explained by insertion order
+        const january = new Date(Date.UTC(2023, 0, 10, 8, 30, 0));
+        const february = new Date(Date.UTC(2023, 1, 1, 0, 0, 0));
+        const march = new Date(Date.UTC(2023, 2, 5, 12, 0, 0));
+        const may = new Date(Date.UTC(2023, 4, 15, 16, 45, 0));
+        const june = new Date(Date.UTC(2023, 5, 20, 22, 15, 0));
+
+        /**
+         * Creates one member per passed value, all registered in the same group of a new organization,
+         * and returns an admin with full access to that organization.
+         */
+        async function setupMembers(lastRegisteredAtValues: (Date | null)[]) {
+            const organization = await new OrganizationFactory({ period }).create();
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }).create();
+
+            const token = await Token.createToken(user);
+            const group = await new GroupFactory({ organization, period }).create();
+
+            const members: MemberWithUsersRegistrationsAndGroups[] = [];
+
+            for (const lastRegisteredAt of lastRegisteredAtValues) {
+                const member = await new MemberFactory({}).create();
+                await new RegistrationFactory({ member, group }).create();
+
+                // The registration factory does not maintain lastRegisteredAt (only RegistrationService does),
+                // so we set it explicitly to get deterministic values - including legacy members that never got one.
+                member.lastRegisteredAt = lastRegisteredAt;
+                await member.save();
+
+                members.push(member);
+            }
+
+            return { host: organization.getApiHost(), token, members };
+        }
+
+        /**
+         * Requests every page by following the 'next' request the endpoint returns, exactly like the frontend does.
+         * That next request is built from the sorter's getValue, so this covers the full sort + pagination flow:
+         * getValue -> page filter -> encoded in the query -> decoded -> compiled back to SQL.
+         *
+         * Returns the ids of all members across all pages, in the order they were received.
+         */
+        async function fetchAllPages({ host, token, sort, limit }: { host: string; token: Token; sort: SortList; limit: number }) {
+            const ids: string[] = [];
+            let query: LimitedFilteredRequest | undefined = new LimitedFilteredRequest({ sort, limit });
+            let pages = 0;
+
+            while (query) {
+                const request = Request.get({
+                    path: baseUrl,
+                    host,
+                    query,
+                    headers: {
+                        authorization: 'Bearer ' + token.accessToken,
+                    },
+                });
+
+                const response = await testServer.test(endpoint, request);
+                expect(response.status).toBe(200);
+
+                ids.push(...response.body.results.members.map(m => m.id));
+                query = response.body.next;
+                pages += 1;
+
+                if (pages > 10) {
+                    throw new Error('Pagination did not terminate');
+                }
+            }
+
+            return ids;
+        }
+
+        test('Members are sorted by lastRegisteredAt ascending across all pages', async () => {
+            const { host, token, members } = await setupMembers([march, january, june, february, may]);
+            const [marchMember, januaryMember, juneMember, februaryMember, mayMember] = members;
+
+            // A limit lower than the total forces the endpoint to build a next page filter from getValue
+            const ids = await fetchAllPages({
+                host,
+                token,
+                sort: [{ key: 'lastRegisteredAt', order: SortItemDirection.ASC }],
+                limit: 2,
+            });
+
+            expect(ids).toEqual([
+                januaryMember.id,
+                februaryMember.id,
+                marchMember.id,
+                mayMember.id,
+                juneMember.id,
+            ]);
+        });
+
+        test('Members are sorted by lastRegisteredAt descending across all pages', async () => {
+            const { host, token, members } = await setupMembers([march, january, june, february, may]);
+            const [marchMember, januaryMember, juneMember, februaryMember, mayMember] = members;
+
+            const ids = await fetchAllPages({
+                host,
+                token,
+                sort: [{ key: 'lastRegisteredAt', order: SortItemDirection.DESC }],
+                limit: 2,
+            });
+
+            expect(ids).toEqual([
+                juneMember.id,
+                mayMember.id,
+                marchMember.id,
+                februaryMember.id,
+                januaryMember.id,
+            ]);
+        });
+
+        test('Members without a lastRegisteredAt are sorted first when ascending', async () => {
+            const { host, token, members } = await setupMembers([march, null, january]);
+            const [marchMember, neverRegisteredMember, januaryMember] = members;
+
+            // A limit of 1 puts the page boundary right after the member without a lastRegisteredAt,
+            // so the next page filter is built from a null value.
+            const ids = await fetchAllPages({
+                host,
+                token,
+                sort: [{ key: 'lastRegisteredAt', order: SortItemDirection.ASC }],
+                limit: 1,
+            });
+
+            expect(ids).toEqual([
+                neverRegisteredMember.id,
+                januaryMember.id,
+                marchMember.id,
+            ]);
+        });
+
+        test('Members without a lastRegisteredAt are sorted last when descending', async () => {
+            const { host, token, members } = await setupMembers([march, null, january]);
+            const [marchMember, neverRegisteredMember, januaryMember] = members;
+
+            const ids = await fetchAllPages({
+                host,
+                token,
+                sort: [{ key: 'lastRegisteredAt', order: SortItemDirection.DESC }],
+                limit: 1,
+            });
+
+            expect(ids).toEqual([
+                marchMember.id,
+                januaryMember.id,
+                neverRegisteredMember.id,
+            ]);
+        });
+
+        test('The next page filter compares lastRegisteredAt as a UTC datetime string', async () => {
+            const { host, token, members } = await setupMembers([january, february]);
+            const [januaryMember] = members;
+
+            const request = Request.get({
+                path: baseUrl,
+                host,
+                query: new LimitedFilteredRequest({
+                    sort: [{ key: 'lastRegisteredAt', order: SortItemDirection.ASC }],
+                    limit: 1,
+                }),
+                headers: {
+                    authorization: 'Bearer ' + token.accessToken,
+                },
+            });
+
+            const response = await testServer.test(endpoint, request);
+            expect(response.status).toBe(200);
+            expect(response.body.results.members).toHaveLength(1);
+
+            // The value has to be formatted in UTC, because that is how MySQL stores the datetime column.
+            // Comparing against a raw Date or a localized string would shift the page boundary.
+            expect(response.body.next?.pageFilter).toMatchObject({
+                $or: [
+                    { lastRegisteredAt: { $gt: '2023-01-10 08:30:00' } },
+                    {
+                        $and: [
+                            { lastRegisteredAt: '2023-01-10 08:30:00' },
+                            { id: { $gt: januaryMember.id } },
+                        ],
+                    },
+                ],
+            });
+        });
+
+        test('Members are sorted by createdAt across all pages, even if they never registered', async () => {
+            const { host, token, members } = await setupMembers([null, null, null]);
+            const [first, second, third] = members;
+
+            // createdAt keeps an explicitly set value on save
+            first.createdAt = march;
+            second.createdAt = january;
+            third.createdAt = february;
+
+            await first.save();
+            await second.save();
+            await third.save();
+
+            const ids = await fetchAllPages({
+                host,
+                token,
+                sort: [{ key: 'createdAt', order: SortItemDirection.ASC }],
+                limit: 1,
+            });
+
+            expect(ids).toEqual([
+                second.id,
+                third.id,
+                first.id,
+            ]);
+        });
+    });
 });