@stamhoofd/backend 2.26.0 → 2.27.2

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.26.0",
+    "version": "2.27.2",
     "main": "./dist/index.js",
     "exports": {
         ".": {
@@ -36,14 +36,14 @@
         "@simonbackx/simple-encoding": "2.15.1",
         "@simonbackx/simple-endpoints": "1.14.0",
         "@simonbackx/simple-logging": "^1.0.1",
-        "@stamhoofd/backend-i18n": "2.26.0",
-        "@stamhoofd/backend-middleware": "2.26.0",
-        "@stamhoofd/email": "2.26.0",
-        "@stamhoofd/models": "2.26.0",
-        "@stamhoofd/queues": "2.26.0",
-        "@stamhoofd/sql": "2.26.0",
-        "@stamhoofd/structures": "2.26.0",
-        "@stamhoofd/utility": "2.26.0",
+        "@stamhoofd/backend-i18n": "2.27.2",
+        "@stamhoofd/backend-middleware": "2.27.2",
+        "@stamhoofd/email": "2.27.2",
+        "@stamhoofd/models": "2.27.2",
+        "@stamhoofd/queues": "2.27.2",
+        "@stamhoofd/sql": "2.27.2",
+        "@stamhoofd/structures": "2.27.2",
+        "@stamhoofd/utility": "2.27.2",
         "archiver": "^7.0.1",
         "aws-sdk": "^2.885.0",
         "axios": "1.6.8",
@@ -60,5 +60,5 @@
         "postmark": "4.0.2",
         "stripe": "^16.6.0"
     },
-    "gitHead": "28425ef8a576223beaec1677bcd89e405dac20e4"
+    "gitHead": "4c7804970b02fa339d884ace0105a6efc6dab179"
 }

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -81,6 +81,9 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             let deleteUnreachable = false
             const allowedIds: string[] = []
 
+            //#region prevent patch category lock if no full platform access
+            const originalCategories = organizationPeriod.settings.categories;
+
             if (await Context.auth.hasFullAccess(organization.id)) {
                 if (patch.settings) {
                     if(patch.settings.categories) {
@@ -117,6 +120,49 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                 }
             }
 
+            //#region handle locked categories
+            if(!Context.auth.hasPlatformFullAccess()) {
+                const categoriesAfterPatch = organizationPeriod.settings.categories;
+
+                for(const categoryBefore of originalCategories) {
+                    const locked = categoryBefore.settings.locked;
+
+                    if(locked) {
+                        // todo: use existing function, now a category could still be deleted if the category is moved to another category and that catetory is deleted
+                        const categoryId = categoryBefore.id;
+                        const refCountBefore = originalCategories.filter(c => c.categoryIds.includes(categoryId)).length;
+                        const refCountAfter = categoriesAfterPatch.filter(c => c.categoryIds.includes(categoryId)).length;
+                        const isDeleted = refCountAfter < refCountBefore;
+
+                        if(isDeleted) {
+                            throw Context.auth.error('Je hebt geen toegangsrechten om deze vergrendelde categorie te verwijderen.')
+                        }
+                    }
+
+                    const categoryAfter = categoriesAfterPatch.find(c => c.id === categoryBefore.id);
+                    
+                    if(!categoryAfter) {
+                        if(locked) {
+                            throw Context.auth.error('Je hebt geen toegangsrechten om deze vergrendelde categorie te verwijderen.')
+                        }
+                    } else if(locked !== categoryAfter.settings.locked) {
+                        throw Context.auth.error('Je hebt geen toegangsrechten om deze categorie te vergrendelen of ontgrendelen.')
+                    }
+
+                    if(!locked || !categoryAfter) {
+                        continue;
+                    }
+
+                    const settingsBefore = categoryBefore.settings;
+                    const settingsAfter = categoryAfter.settings;
+
+                    if(settingsBefore.name !== settingsAfter.name) {
+                        throw Context.auth.error('Je hebt geen toegangsrechten de naam van deze vergrendelde categorie te wijzigen.')
+                    }
+                }
+            }
+            //#endregion
+
             await organizationPeriod.save();
 
             // Check changes to groups