@stamhoofd/backend 2.34.1 → 2.35.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.34.1",
+    "version": "2.35.0",
     "main": "./dist/index.js",
     "exports": {
         ".": {
@@ -36,14 +36,14 @@
         "@simonbackx/simple-encoding": "2.15.1",
         "@simonbackx/simple-endpoints": "1.14.0",
         "@simonbackx/simple-logging": "^1.0.1",
-        "@stamhoofd/backend-i18n": "2.34.1",
-        "@stamhoofd/backend-middleware": "2.34.1",
-        "@stamhoofd/email": "2.34.1",
-        "@stamhoofd/models": "2.34.1",
-        "@stamhoofd/queues": "2.34.1",
-        "@stamhoofd/sql": "2.34.1",
-        "@stamhoofd/structures": "2.34.1",
-        "@stamhoofd/utility": "2.34.1",
+        "@stamhoofd/backend-i18n": "2.35.0",
+        "@stamhoofd/backend-middleware": "2.35.0",
+        "@stamhoofd/email": "2.35.0",
+        "@stamhoofd/models": "2.35.0",
+        "@stamhoofd/queues": "2.35.0",
+        "@stamhoofd/sql": "2.35.0",
+        "@stamhoofd/structures": "2.35.0",
+        "@stamhoofd/utility": "2.35.0",
         "archiver": "^7.0.1",
         "aws-sdk": "^2.885.0",
         "axios": "1.6.8",
@@ -60,5 +60,5 @@
         "postmark": "4.0.2",
         "stripe": "^16.6.0"
     },
-    "gitHead": "4faa18ab00da5608caedb6f7e83143f41a046d4f"
+    "gitHead": "ce74626930b06206cdb56bf3dd52b8a03522f093"
 }

package/src/endpoints/global/events/PatchEventsEndpoint.ts

@@ -256,6 +256,24 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
             events.push(event)
         }
 
+        for (const id of request.body.getDeletes()) {
+            const event = await Event.getByID(id);
+            if (!event) {
+                throw new SimpleError({ code: "not_found", message: "Event not found", statusCode: 404 });
+            }
+
+            if (!(await Context.auth.canAccessEvent(event, PermissionLevel.Full))) {
+                throw Context.auth.error()
+            }
+
+            if(event.groupId) {
+                await PatchOrganizationRegistrationPeriodsEndpoint.deleteGroup(event.groupId)
+                event.groupId = null;
+            }
+            
+            await event.delete();
+        }
+
         return new Response(
             await AuthenticatedStructures.events(events)
         );

package/src/helpers/AdminPermissionChecker.ts

@@ -992,16 +992,21 @@ export class AdminPermissionChecker {
             })
         }
 
-        if (data.details.securityCode !== undefined) {
-            // Unset silently
-            data.details.securityCode = undefined
-        }
-
         const hasRecordAnswers = !!data.details.recordAnswers;
         const hasNotes = data.details.notes !== undefined;
         const isSetFinancialSupportTrue = data.details.shouldApplyReducedPrice;
         const isUserManager = this.isUserManager(member);
 
+        if (data.details.securityCode !== undefined) {
+            const hasFullAccess = await this.canAccessMember(member, PermissionLevel.Full);
+
+            // can only be set to null, and only if can access member with full access
+            if(!hasFullAccess || data.details.securityCode !== null) {
+                // Unset silently
+                data.details.securityCode = undefined
+            }
+        }
+
         if (hasRecordAnswers) {
             if (!(data.details.recordAnswers instanceof PatchMap)) {
                 throw new SimpleError({