@stamhoofd/backend 2.137.4 → 2.138.0

package/src/services/EventNotificationService.ts

@@ -1,5 +1,6 @@
 import { SimpleError } from '@simonbackx/simple-errors';
-import { EventNotification, Member, MemberResponsibilityRecord, Organization, Platform, sendEmailTemplate, User } from '@stamhoofd/models';
+import { EventNotification, Member, MemberResponsibilityRecord, Organization, Platform, User } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 import type { EmailTemplateType } from '@stamhoofd/structures';
 import { PermissionLevel, Recipient, RecordCategory, Replacement } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';

package/src/services/FileSignService.test.ts

@@ -0,0 +1,85 @@
+import { S3Client } from '@aws-sdk/client-s3';
+import { File } from '@stamhoofd/structures';
+import { TestUtils } from '@stamhoofd/test-utils';
+
+import { FileSignService } from './FileSignService.js';
+
+describe('FileSignService', () => {
+    let originalClient: S3Client;
+
+    beforeEach(() => {
+        TestUtils.setEnvironment('SPACES_BUCKET', 'test-bucket');
+        TestUtils.setEnvironment('SPACES_ENDPOINT', 'test.digitaloceanspaces.com');
+
+        originalClient = FileSignService.s3;
+        FileSignService.s3 = new S3Client({
+            forcePathStyle: false,
+            endpoint: 'https://test.digitaloceanspaces.com',
+            credentials: {
+                accessKeyId: 'test-key',
+                secretAccessKey: 'test-secret',
+            },
+            region: 'eu-west-1',
+        });
+    });
+
+    afterEach(() => {
+        FileSignService.s3 = originalClient;
+    });
+
+    const buildFile = (data: { path: string; contentType?: string | null }) => {
+        return new File({
+            id: '1c9ab9e6-1234-4c5e-9f1a-000000000000',
+            server: 'https://test-bucket.test.digitaloceanspaces.com',
+            path: data.path,
+            size: 100,
+            isPrivate: true,
+            contentType: data.contentType ?? null,
+        });
+    };
+
+    const getSignedQuery = async (file: File) => {
+        const signed = await FileSignService.withSignedUrl(file);
+        expect(signed?.signedUrl).toBeDefined();
+        return new URL(signed!.signedUrl!).searchParams;
+    };
+
+    test('A signed url never renders a file type a browser could execute', async () => {
+        const query = await getSignedQuery(buildFile({ path: 'users/1/abc/report.docx', contentType: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document' }));
+
+        expect(query.get('response-content-disposition')).toBe('attachment');
+
+        // The response headers are part of what is signed, so they can't be stripped from the url
+        expect(query.get('X-Amz-SignedHeaders')).toBeDefined();
+        expect(query.get('X-Amz-Signature')).toBeTruthy();
+    });
+
+    test('A signed url renders file types a browser cannot execute', async () => {
+        const pdf = await getSignedQuery(buildFile({ path: 'users/1/abc/invoice.pdf', contentType: 'application/pdf' }));
+        expect(pdf.get('response-content-disposition')).toBe('inline');
+
+        const image = await getSignedQuery(buildFile({ path: 'users/1/abc/photo.jpg', contentType: 'image/jpeg' }));
+        expect(image.get('response-content-disposition')).toBe('inline');
+    });
+
+    test('It downloads files that were uploaded before we validated content types', async () => {
+        // These were stored with a content type chosen by the uploader, and with an extension derived from it
+        const svg = await getSignedQuery(buildFile({ path: 'users/1/abc/evil.svg', contentType: 'image/svg+xml' }));
+        expect(svg.get('response-content-disposition')).toBe('attachment');
+
+        const html = await getSignedQuery(buildFile({ path: 'users/1/abc/evil', contentType: 'text/html' }));
+        expect(html.get('response-content-disposition')).toBe('attachment');
+
+        // Both the extension and the content type have to be safe
+        const disguised = await getSignedQuery(buildFile({ path: 'users/1/abc/evil.pdf', contentType: 'text/html' }));
+        expect(disguised.get('response-content-disposition')).toBe('attachment');
+    });
+
+    test('It uses the path when a file has no content type, like the images we generate', async () => {
+        const image = await getSignedQuery(buildFile({ path: 'users/1/abc/def.png', contentType: null }));
+        expect(image.get('response-content-disposition')).toBe('inline');
+
+        const unknown = await getSignedQuery(buildFile({ path: 'users/1/abc/def', contentType: null }));
+        expect(unknown.get('response-content-disposition')).toBe('attachment');
+    });
+});

package/src/services/FileSignService.ts

@@ -4,7 +4,7 @@ import {
 } from '@aws-sdk/s3-request-presigner';
 import type { DecodedRequest, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { File } from '@stamhoofd/structures';
+import { File, supportedFileTypes } from '@stamhoofd/structures';
 import chalk from 'chalk';
 import * as jose from 'jose';
 
@@ -103,6 +103,27 @@ export class FileSignService {
         };
     }
 
+    /**
+     * Files uploaded before we validated content types can have any content type, so we decide here - and not
+     * from the stored object - whether a browser may render a file. Note that this only protects private
+     * files: public files are served straight from the file server, without a signed url.
+     */
+    static getContentDisposition(file: File): 'inline' | 'attachment' {
+        // The path is generated by us and always ends with the extension the file was stored with, so it says
+        // more about how the file server will serve this file than the content type does. Files we generate
+        // ourselves (like the images of the Image model) don't even have a content type.
+        if (!supportedFileTypes.resolveUpload({ filename: file.path })?.canRenderInline) {
+            return 'attachment';
+        }
+
+        // When a file also carries a content type, both have to be safe
+        if (file.contentType && !supportedFileTypes.resolveUpload({ contentType: file.contentType })?.canRenderInline) {
+            return 'attachment';
+        }
+
+        return 'inline';
+    }
+
     static async withSignedUrl(file: File, duration = 60 * 60) {
         if (file.signedUrl) {
             console.error('Warning: file already signed');
@@ -112,6 +133,7 @@ export class FileSignService {
             const command = new GetObjectCommand({
                 Bucket: STAMHOOFD.SPACES_BUCKET,
                 Key: file.path,
+                ResponseContentDisposition: this.getContentDisposition(file),
             });
             const url = await getSignedUrl(this.s3, command, { expiresIn: duration });
 

package/src/services/InvoicePdfService.ts

@@ -295,7 +295,7 @@ export class InvoicePdfService {
                     throw new SimpleError({
                         code: 'pdf_creation_timeout',
                         message: 'Failed to generate invoice PDF',
-                        human: $t('Er ging iets mis bij het aanmaken van de factuur'),
+                        human: $t('%ZgV'),
                     });
                 }
             }
@@ -306,13 +306,13 @@ export class InvoicePdfService {
                 throw new SimpleError({
                     code: 'pdf_creation_timeout',
                     message: 'Failed to generate invoice PDF: timeout',
-                    human: $t('Er ging iets mis bij het aanmaken van de factuur'),
+                    human: $t('%ZgV'),
                 });
             }
             throw new SimpleError({
                 code: 'pdf_creation_failed',
                 message: 'Failed to generate invoice PDF',
-                human: $t('Er ging iets mis bij het aanmaken van de factuur'),
+                human: $t('%ZgV'),
             });
         } finally {
             clearTimeout(timeout);

package/src/services/InvoiceService.ts

@@ -1,6 +1,7 @@
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Email } from '@stamhoofd/email';
-import { BalanceItem, Invoice, InvoicedBalanceItem, Organization, Payment, sendEmailTemplate } from '@stamhoofd/models';
+import { BalanceItem, Invoice, InvoicedBalanceItem, Organization, Payment } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 import { InvoiceCounter } from '@stamhoofd/models/helpers/InvoiceCounter.js';
 import type { Invoice as InvoiceStruct } from '@stamhoofd/structures';
 import { EmailTemplateType, PaymentStatus, Recipient, Replacement } from '@stamhoofd/structures';
@@ -9,6 +10,7 @@ import { ViesHelper } from '../helpers/ViesHelper.js';
 import { BalanceItemService } from './BalanceItemService.js';
 import { InvoicePdfService } from './InvoicePdfService.js';
 import { InvoiceXMlService } from './InvoiceXMLService.js';
+import { OrganizationAdminService } from './OrganizationAdminService.js';
 
 export class InvoiceService {
     static async createFrom(organization: Organization, struct: InvoiceStruct, options?: { payments?: Payment[]; balanceItems?: BalanceItem[] }) {
@@ -435,7 +437,7 @@ export class InvoiceService {
         if (!email && invoice.payingOrganizationId) {
             const payingOrganization = await Organization.getByID(invoice.payingOrganizationId);
             if (payingOrganization) {
-                email = (await payingOrganization.getInvoicingToEmail()) ?? undefined;
+                email = (await OrganizationAdminService.getInvoicingToEmail(payingOrganization)) ?? undefined;
             }
         }
 

package/src/services/InvoiceXMLService.ts

@@ -7,6 +7,7 @@ import { Country } from '@stamhoofd/types/Country';
 import { Formatter, STMath } from '@stamhoofd/utility';
 import { v4 as uuidv4 } from 'uuid';
 import { InvoicePdfService } from './InvoicePdfService.js';
+import { OrganizationAdminService } from './OrganizationAdminService.js';
 
 export class InvoiceXMlService {
     static async buildXml(invoice: Invoice) {
@@ -68,7 +69,7 @@ export class InvoiceXMlService {
         if (!customerEmail && invoice.payingOrganizationId) {
             const payingOrganization = await Organization.getByID(invoice.payingOrganizationId);
             if (payingOrganization) {
-                customerEmail = (await payingOrganization.getInvoicingToEmail()) ?? null;
+                customerEmail = (await OrganizationAdminService.getInvoicingToEmail(payingOrganization)) ?? null;
             }
         }
 

package/src/services/OrderService.test.ts

@@ -0,0 +1,308 @@
+import { I18n } from '@stamhoofd/backend-i18n';
+import { EmailMocker } from '@stamhoofd/email';
+import type { Organization } from '@stamhoofd/models';
+import { EmailTemplateFactory, Order, OrganizationFactory, Payment, Webshop, WebshopCounter, WebshopFactory } from '@stamhoofd/models';
+import { Cart, CartItem, Customer, EmailContent, EmailTemplateType, OrderData, OrderStatus, PaymentMethod, PaymentStatus, Product, ProductPrice, ProductType, WebshopMetaData, WebshopStatus, WebshopTicketType } from '@stamhoofd/structures';
+import { TestUtils } from '@stamhoofd/test-utils';
+import { Country } from '@stamhoofd/types/Country';
+import { Language } from '@stamhoofd/types/Language';
+import { OrderService } from './OrderService.js';
+
+/**
+ * The order emails are rendered in the language the customer ordered in. The status name below is
+ * rendered through $t inside the order recipient replacements, and is hardcoded on purpose so we
+ * don't verify $t with the same $t machinery we're testing.
+ * (translations of OrderStatus.Created in shared/locales/dist/locales/digit/{nl,fr}-BE.json)
+ */
+const orderStatusName = {
+    [Language.Dutch]: 'Nieuw',
+    [Language.French]: 'Nouveau',
+};
+
+function createCustomer() {
+    return Customer.create({
+        firstName: 'John',
+        lastName: 'Doe',
+        email: 'john@example.com',
+    });
+}
+
+async function createOrder(webshop: Webshop, options: { consumerLanguage?: Language; valid?: boolean; cart?: Cart; paymentMethod?: PaymentMethod } = {}) {
+    const order = new Order();
+    order.organizationId = webshop.organizationId;
+    order.webshopId = webshop.id;
+    order.status = OrderStatus.Created;
+    order.consumerLanguage = options.consumerLanguage ?? Language.Dutch;
+    order.data = OrderData.create({
+        paymentMethod: options.paymentMethod ?? PaymentMethod.Transfer,
+        customer: createCustomer(),
+        cart: options.cart ?? Cart.create({}),
+    });
+
+    if (options.valid ?? true) {
+        order.validAt = new Date();
+        order.number = await WebshopCounter.getNextNumber(webshop);
+    }
+
+    await order.save();
+    return order;
+}
+
+function loadRelations(order: Order, webshop: Webshop, organization: Organization) {
+    return order.setRelation(Order.webshop, webshop.setRelation(Webshop.organization, organization));
+}
+
+async function createTransferPayment(organization: Organization) {
+    const payment = new Payment();
+    payment.organizationId = organization.id;
+    payment.method = PaymentMethod.Transfer;
+    payment.status = PaymentStatus.Succeeded;
+    payment.price = 1000;
+    payment.paidAt = new Date();
+    await payment.save();
+    return payment;
+}
+
+describe('OrderService', () => {
+    describe('sendEmailTemplate', () => {
+        test('renders the email in the language the customer ordered in, not the ambient language', async () => {
+            // Make French a valid locale so its real translations (loaded from disk) are actually used.
+            TestUtils.setEnvironment('locales', { [Country.Belgium]: [Language.Dutch, Language.French] });
+
+            const organization = await new OrganizationFactory({}).create();
+            const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
+
+            await new EmailTemplateFactory({
+                organization,
+                webshopId: webshop.id,
+                type: EmailTemplateType.OrderConfirmationOnline,
+                subject: 'Bevestiging',
+                html: '<p>{{orderStatus}}</p>',
+                text: '{{orderStatus}}',
+            }).create();
+
+            const order = await createOrder(webshop, { consumerLanguage: Language.French });
+            const loadedOrder = loadRelations(order, webshop, organization);
+
+            // The ambient language is Dutch while the customer ordered in French
+            await I18n.runWithLocale(new I18n(Language.Dutch, Country.Belgium), async () => {
+                await OrderService.sendEmailTemplate(loadedOrder, {
+                    type: EmailTemplateType.OrderConfirmationOnline,
+                });
+            });
+
+            const emails = await EmailMocker.transactional.getSucceededEmails();
+            expect(emails).toHaveLength(1);
+            expect(emails[0].html).toContain(orderStatusName[Language.French]);
+            expect(emails[0].html).not.toContain(orderStatusName[Language.Dutch]);
+        });
+
+        test('does not send anything for an archived webshop', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const webshop = await new WebshopFactory({
+                organizationId: organization.id,
+                meta: WebshopMetaData.patch({ status: WebshopStatus.Archived }),
+            }).create();
+
+            await new EmailTemplateFactory({
+                organization,
+                webshopId: webshop.id,
+                type: EmailTemplateType.OrderConfirmationOnline,
+                subject: 'Bevestiging',
+                html: '<p>Bevestiging</p>',
+                text: 'Bevestiging',
+            }).create();
+
+            const order = await createOrder(webshop);
+            const loadedOrder = loadRelations(order, webshop, organization);
+
+            await OrderService.sendEmailTemplate(loadedOrder, {
+                type: EmailTemplateType.OrderConfirmationOnline,
+            });
+
+            expect(await EmailMocker.transactional.getSucceededEmails()).toHaveLength(0);
+        });
+    });
+
+    describe('markValid', () => {
+        test('sends the notification email without the customer name and in the webshop language', async () => {
+            TestUtils.setEnvironment('locales', { [Country.Belgium]: [Language.Dutch, Language.French] });
+
+            const organization = await new OrganizationFactory({}).create();
+            const webshop = await new WebshopFactory({
+                organizationId: organization.id,
+                meta: WebshopMetaData.patch({ defaultLanguage: Language.French }),
+            }).create();
+            webshop.privateMeta.notificationEmails = ['admin@example.com'];
+            await webshop.save();
+
+            await new EmailTemplateFactory({
+                organization,
+                webshopId: webshop.id,
+                type: EmailTemplateType.OrderConfirmationOnline,
+                subject: 'Bevestiging',
+                html: '<p>Bevestiging</p>',
+                text: 'Bevestiging',
+            }).create();
+
+            // Default (Dutch) content + a French translation, so we can tell which language was selected
+            await new EmailTemplateFactory({
+                organization,
+                webshopId: webshop.id,
+                type: EmailTemplateType.OrderNotification,
+                subject: 'Nederlandse melding',
+                html: '<p>NL [{{firstName}}][{{lastName}}] {{orderUrl}}</p>',
+                text: 'Nederlandse melding',
+                language: Language.Dutch,
+                translations: new Map([
+                    [Language.French, EmailContent.create({
+                        subject: 'Franse melding',
+                        html: '<p>FR [{{firstName}}][{{lastName}}] {{orderUrl}}</p>',
+                        text: 'Franse melding',
+                    })],
+                ]),
+            }).create();
+
+            // The customer ordered in Dutch, the webshop default language is French
+            const order = await createOrder(webshop, { consumerLanguage: Language.Dutch, valid: false });
+            const loadedOrder = loadRelations(order, webshop, organization);
+
+            await OrderService.markValid(loadedOrder, null, []);
+
+            const emails = await EmailMocker.transactional.getSucceededEmails();
+            expect(emails).toHaveLength(2);
+
+            const customerEmail = emails.find(e => e.to.includes('john@example.com'));
+            const notification = emails.find(e => e.to.includes('admin@example.com'));
+            expect(customerEmail).toBeDefined();
+            expect(notification).toBeDefined();
+
+            // The customer name is cleared, so the notification is not addressed to the customer
+            expect(notification!.to).toBe('admin@example.com');
+
+            // The firstName/lastName replacements are dropped, so the customer name doesn't leak
+            expect(notification!.html).toContain('[][]');
+            expect(notification!.html).not.toContain('John');
+            expect(notification!.html).not.toContain('Doe');
+
+            // The language falls back to the webshop default (French), not the customer's (Dutch)
+            expect(notification!.subject).toBe('Franse melding');
+            expect(notification!.html).toContain('FR ');
+
+            // The orderUrl of the notification points at the dashboard, not at the webshop order page
+            expect(notification!.html).toContain('/webshops/');
+
+            // The customer still receives their own confirmation
+            expect(customerEmail!.subject).toBe('Bevestiging');
+        });
+    });
+
+    describe('markPaid', () => {
+        test('sends the tickets email when tickets were created', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const productPrice = ProductPrice.create({ name: 'Standaard', price: 0 });
+            const ticketProduct = Product.create({
+                name: 'Ticket',
+                type: ProductType.Ticket,
+                prices: [productPrice],
+            });
+
+            const webshop = await new WebshopFactory({
+                organizationId: organization.id,
+                meta: WebshopMetaData.patch({ ticketType: WebshopTicketType.Tickets }),
+                products: [ticketProduct],
+            }).create();
+
+            await new EmailTemplateFactory({
+                organization,
+                webshopId: webshop.id,
+                type: EmailTemplateType.TicketsReceivedTransfer,
+                subject: 'Tickets ontvangen',
+                html: '<p>Tickets ontvangen</p>',
+                text: 'Tickets ontvangen',
+            }).create();
+
+            await new EmailTemplateFactory({
+                organization,
+                webshopId: webshop.id,
+                type: EmailTemplateType.OrderReceivedTransfer,
+                subject: 'Betaling ontvangen',
+                html: '<p>Betaling ontvangen</p>',
+                text: 'Betaling ontvangen',
+            }).create();
+
+            const order = await createOrder(webshop, {
+                cart: Cart.create({
+                    items: [CartItem.create({ product: ticketProduct, productPrice, amount: 1 })],
+                }),
+            });
+
+            const payment = await createTransferPayment(organization);
+            await OrderService.markPaid(order, payment, organization, webshop);
+
+            const emails = await EmailMocker.transactional.getSucceededEmails();
+            expect(emails).toHaveLength(1);
+            expect(emails[0].subject).toBe('Tickets ontvangen');
+        });
+
+        test('sends the paid email for a transfer payment when no tickets were created', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
+
+            await new EmailTemplateFactory({
+                organization,
+                webshopId: webshop.id,
+                type: EmailTemplateType.TicketsReceivedTransfer,
+                subject: 'Tickets ontvangen',
+                html: '<p>Tickets ontvangen</p>',
+                text: 'Tickets ontvangen',
+            }).create();
+
+            await new EmailTemplateFactory({
+                organization,
+                webshopId: webshop.id,
+                type: EmailTemplateType.OrderReceivedTransfer,
+                subject: 'Betaling ontvangen',
+                html: '<p>Betaling ontvangen</p>',
+                text: 'Betaling ontvangen',
+            }).create();
+
+            const order = await createOrder(webshop);
+            const payment = await createTransferPayment(organization);
+
+            await OrderService.markPaid(order, payment, organization, webshop);
+
+            const emails = await EmailMocker.transactional.getSucceededEmails();
+            expect(emails).toHaveLength(1);
+            expect(emails[0].subject).toBe('Betaling ontvangen');
+        });
+
+        test('does not send the paid email for a non-transfer payment when no tickets were created', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
+
+            await new EmailTemplateFactory({
+                organization,
+                webshopId: webshop.id,
+                type: EmailTemplateType.OrderReceivedTransfer,
+                subject: 'Betaling ontvangen',
+                html: '<p>Betaling ontvangen</p>',
+                text: 'Betaling ontvangen',
+            }).create();
+
+            const order = await createOrder(webshop, { paymentMethod: PaymentMethod.PointOfSale });
+
+            const payment = new Payment();
+            payment.organizationId = organization.id;
+            payment.method = PaymentMethod.PointOfSale;
+            payment.status = PaymentStatus.Succeeded;
+            payment.price = 1000;
+            payment.paidAt = new Date();
+            await payment.save();
+
+            await OrderService.markPaid(order, payment, organization, webshop);
+
+            expect(await EmailMocker.transactional.getSucceededEmails()).toHaveLength(0);
+        });
+    });
+});