@stamhoofd/backend 2.77.3 → 2.77.4

package/index.ts

@@ -19,6 +19,7 @@ import { AuditLogService } from './src/services/AuditLogService';
 import { DocumentService } from './src/services/DocumentService';
 import { FileSignService } from './src/services/FileSignService';
 import { PlatformMembershipService } from './src/services/PlatformMembershipService';
+import { UniqueUserService } from './src/services/UniqueUserService';
 
 process.on('unhandledRejection', (error: Error) => {
     console.error('unhandledRejection');
@@ -49,13 +50,21 @@ const seeds = async () => {
         console.error(e);
     }
 };
+const bootTime = process.hrtime();
 
 const start = async () => {
     console.log('Running server at v' + Version);
     loadLogger();
+
     await GlobalHelper.load();
+    await UniqueUserService.check();
+
+    // Init platform shared struct: otherwise permissions won't work with missing responsibilities
+    await Platform.getSharedStruct();
 
     const router = new Router();
+
+    // Note: we should load endpoints one by once to have a reliable order of url matching
     await router.loadAllEndpoints(__dirname + '/src/endpoints/global/*');
     await router.loadAllEndpoints(__dirname + '/src/endpoints/admin/*');
     await router.loadAllEndpoints(__dirname + '/src/endpoints/auth');
@@ -95,9 +104,6 @@ const start = async () => {
     // Add CORS headers
     routerServer.addResponseMiddleware(CORSMiddleware);
 
-    // Init platform shared struct: otherwise permissions won't work with missing responsibilities
-    await Platform.getSharedStruct();
-
     // Register Excel loaders
     await import('./src/excel-loaders/members');
     await import('./src/excel-loaders/payments');
@@ -111,6 +117,9 @@ const start = async () => {
 
     routerServer.listen(STAMHOOFD.PORT ?? 9090);
 
+    const hrend = process.hrtime(bootTime);
+    console.log('🟢 HTTP server started in ' + Math.ceil(hrend[0] * 1000 + hrend[1] / 1000000) + 'ms');
+
     resumeEmails().catch(console.error);
 
     if (routerServer.server) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.77.3",
+    "version": "2.77.4",
     "main": "./dist/index.js",
     "exports": {
         ".": {
@@ -37,14 +37,14 @@
         "@simonbackx/simple-encoding": "2.20.0",
         "@simonbackx/simple-endpoints": "1.19.1",
         "@simonbackx/simple-logging": "^1.0.1",
-        "@stamhoofd/backend-i18n": "2.77.3",
-        "@stamhoofd/backend-middleware": "2.77.3",
-        "@stamhoofd/email": "2.77.3",
-        "@stamhoofd/models": "2.77.3",
-        "@stamhoofd/queues": "2.77.3",
-        "@stamhoofd/sql": "2.77.3",
-        "@stamhoofd/structures": "2.77.3",
-        "@stamhoofd/utility": "2.77.3",
+        "@stamhoofd/backend-i18n": "2.77.4",
+        "@stamhoofd/backend-middleware": "2.77.4",
+        "@stamhoofd/email": "2.77.4",
+        "@stamhoofd/models": "2.77.4",
+        "@stamhoofd/queues": "2.77.4",
+        "@stamhoofd/sql": "2.77.4",
+        "@stamhoofd/structures": "2.77.4",
+        "@stamhoofd/utility": "2.77.4",
         "archiver": "^7.0.1",
         "aws-sdk": "^2.885.0",
         "axios": "1.6.8",
@@ -64,5 +64,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "73e6c9aec7a8e3feed99014f54fdae6890b346ce"
+    "gitHead": "e41b2942f787a4e8eb1f77ebb7c9b68d33fb4e69"
 }

package/src/email-recipient-loaders/members.ts

@@ -25,9 +25,19 @@ Email.recipientLoaders.set(EmailRecipientFilterType.Members, {
 
     count: async (query: LimitedFilteredRequest) => {
         query.filter = mergeFilters([query.filter, {
-            email: {
-                $neq: null,
-            },
+            $and: [
+                {
+                    email: {
+                        $neq: null,
+                    },
+                },
+                {
+                    email: {
+                        $neq: '',
+                    },
+                },
+            ],
+
         }]);
         const q = await GetMembersEndpoint.buildQuery(query);
         return await q.count();

package/src/endpoints/global/platform/PatchPlatformEnpoint.ts

@@ -11,6 +11,7 @@ import { PeriodHelper } from '../../../helpers/PeriodHelper';
 import { SetupStepUpdater } from '../../../helpers/SetupStepUpdater';
 import { TagHelper } from '../../../helpers/TagHelper';
 import { PlatformMembershipService } from '../../../services/PlatformMembershipService';
+import { MemberUserSyncer } from '../../../helpers/MemberUserSyncer';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -49,6 +50,7 @@ export class PatchPlatformEndpoint extends Endpoint<
         }
 
         const platform = await Platform.getShared();
+        let shouldUpdateUserPermissions = false;
 
         if (request.body.privateConfig) {
             // Did we patch roles?
@@ -62,6 +64,7 @@ export class PatchPlatformEndpoint extends Endpoint<
                     platform.privateConfig.roles,
                     request.body.privateConfig.roles,
                 );
+                shouldUpdateUserPermissions = true;
             }
 
             if (request.body.privateConfig.emails) {
@@ -234,6 +237,10 @@ export class PatchPlatformEndpoint extends Endpoint<
             SetupStepUpdater.updateSetupStepsForAllOrganizationsInCurrentPeriod().catch(console.error);
         }
 
+        if (shouldUpdateUserPermissions) {
+            await MemberUserSyncer.updatePermissionsForPlatform();
+        }
+
         return new Response(await Platform.getSharedPrivateStruct());
     }
 

package/src/endpoints/organization/dashboard/organization/PatchOrganizationEndpoint.ts

@@ -11,6 +11,7 @@ import { Context } from '../../../../helpers/Context';
 import { SetupStepUpdater } from '../../../../helpers/SetupStepUpdater';
 import { TagHelper } from '../../../../helpers/TagHelper';
 import { ViesHelper } from '../../../../helpers/ViesHelper';
+import { MemberUserSyncer } from '../../../../helpers/MemberUserSyncer';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -65,6 +66,7 @@ export class PatchOrganizationEndpoint extends Endpoint<Params, Query, Body, Res
 
         const errors = new SimpleErrors();
         let shouldUpdateSetupSteps = false;
+        let shouldUpdateUserPermissions = false;
         let updateTags = false;
 
         if (await Context.auth.hasFullAccess(organization.id)) {
@@ -128,6 +130,10 @@ export class PatchOrganizationEndpoint extends Endpoint<Params, Query, Body, Res
                 organization.privateMeta.balanceNotificationSettings = patchObject(organization.privateMeta.balanceNotificationSettings, request.body.privateMeta.balanceNotificationSettings);
                 organization.privateMeta.recordAnswers = request.body.privateMeta.recordAnswers.applyTo(organization.privateMeta.recordAnswers);
 
+                if (request.body.privateMeta.responsibilities || request.body.privateMeta.roles) {
+                    shouldUpdateUserPermissions = true;
+                }
+
                 if (request.body.privateMeta.mollieProfile !== undefined) {
                     organization.privateMeta.mollieProfile = patchObject(organization.privateMeta.mollieProfile, request.body.privateMeta.mollieProfile);
                 }
@@ -392,6 +398,10 @@ export class PatchOrganizationEndpoint extends Endpoint<Params, Query, Body, Res
             await SetupStepUpdater.updateForOrganization(organization);
         }
 
+        if (shouldUpdateUserPermissions) {
+            await MemberUserSyncer.updatePermissionsForOrganization(organization.id);
+        }
+
         if (updateTags) {
             await TagHelper.updateOrganizations();
         }

package/src/helpers/AdminPermissionChecker.ts

@@ -852,8 +852,6 @@ export class AdminPermissionChecker {
      * Return a list of RecordSettings the current user can view or edit
      */
     async getAccessibleRecordCategories(member: MemberWithRegistrations, level: PermissionLevel = PermissionLevel.Read): Promise<RecordCategory[]> {
-        const isUserManager = this.isUserManager(member);
-
         // First list all organizations this member is part of
         const organizations: Organization[] = [];
 
@@ -875,14 +873,6 @@ export class AdminPermissionChecker {
         // Check if we have access to their data
         const recordCategories: RecordCategory[] = [];
         for (const organization of organizations) {
-            if (isUserManager) {
-                for (const category of organization.meta.recordsConfiguration.recordCategories) {
-                    if (category.checkPermissionForUserManager(level)) {
-                        recordCategories.push(category);
-                    }
-                }
-            }
-
             const permissions = await this.getOrganizationPermissions(organization);
 
             if (!permissions) {
@@ -891,7 +881,7 @@ export class AdminPermissionChecker {
 
             // Now add all records of this organization
             for (const category of organization.meta.recordsConfiguration.recordCategories) {
-                if (isUserManager && recordCategories.find(c => c.id === category.id)) {
+                if (recordCategories.find(c => c.id === category.id)) {
                     // Already added
                     continue;
                 }
@@ -916,7 +906,7 @@ export class AdminPermissionChecker {
 
         // Platform data
         const platformPermissions = this.platformPermissions;
-        if (platformPermissions || isUserManager) {
+        if (platformPermissions) {
             for (const category of this.platform.config.recordsConfiguration.recordCategories) {
                 if (recordCategories.find(c => c.id === category.id)) {
                     // Already added
@@ -926,11 +916,6 @@ export class AdminPermissionChecker {
                 if (platformPermissions?.hasResourceAccess(PermissionsResourceType.RecordCategories, category.id, level)) {
                     recordCategories.push(category);
                 }
-                else if (isUserManager) {
-                    if (category.checkPermissionForUserManager(level)) {
-                        recordCategories.push(category);
-                    }
-                }
             }
         }
 
@@ -1069,21 +1054,45 @@ export class AdminPermissionChecker {
     async getAccessibleRecordSet(member: MemberWithRegistrations, level: PermissionLevel = PermissionLevel.Read): Promise<Set<string>> {
         const categories = await this.getAccessibleRecordCategories(member, level);
         const set = new Set<string>();
+
+        for (const category of categories) {
+            for (const record of category.getAllRecords()) {
+                set.add(record.id);
+            }
+        }
+
         const isUserManager = this.isUserManager(member);
 
+        // Also include those we can access as user manager
         if (isUserManager) {
-            for (const category of categories) {
-                for (const record of category.getAllRecords()) {
-                    if (record.checkPermissionForUserManager(level)) {
-                        set.add(record.id);
+            const allCategories = this.platform.config.recordsConfiguration.recordCategories.slice();
+
+            // First list all organizations this member is part of
+            const organizations: Organization[] = [];
+
+            if (member.organizationId) {
+                if (this.checkScope(member.organizationId)) {
+                    organizations.push(await this.getOrganization(member.organizationId));
+                }
+            }
+
+            for (const registration of member.registrations) {
+                if (this.checkScope(registration.organizationId)) {
+                    if (!organizations.find(o => o.id === registration.organizationId)) {
+                        organizations.push(await this.getOrganization(registration.organizationId));
                     }
                 }
             }
-        }
-        else {
-            for (const category of categories) {
+
+            for (const organization of organizations) {
+                allCategories.push(...organization.meta.recordsConfiguration.recordCategories);
+            }
+
+            for (const category of allCategories) {
                 for (const record of category.getAllRecords()) {
-                    set.add(record.id);
+                    if (record.checkPermissionForUserManager(level)) {
+                        set.add(record.id);
+                    }
                 }
             }
         }

package/src/helpers/MemberUserSyncer.ts

@@ -1,6 +1,6 @@
-import { CachedBalance, Member, MemberResponsibilityRecord, MemberWithRegistrations, User } from '@stamhoofd/models';
+import { CachedBalance, Member, MemberResponsibilityRecord, MemberWithRegistrations, Organization, Platform, User } from '@stamhoofd/models';
 import { SQL } from '@stamhoofd/sql';
-import { AuditLogSource, MemberDetails, Permissions, UserPermissions } from '@stamhoofd/structures';
+import { AuditLogSource, MemberDetails, PermissionRole, Permissions, UserPermissions } from '@stamhoofd/structures';
 import crypto from 'crypto';
 import basex from 'base-x';
 import { AuditLogService } from '../services/AuditLogService';
@@ -129,6 +129,20 @@ export class MemberUserSyncerStatic {
         return MemberResponsibilityRecord.fromRows(rows, MemberResponsibilityRecord.table);
     }
 
+    async updatePermissionsForOrganization(organizationId: string) {
+        const admins = await User.getAdmins(organizationId);
+        for (const admin of admins) {
+            await this.updateInheritedPermissions(admin);
+        }
+    }
+
+    async updatePermissionsForPlatform() {
+        const admins = await User.getPlatformAdmins();
+        for (const admin of admins) {
+            await this.updateInheritedPermissions(admin);
+        }
+    }
+
     async updateInheritedPermissions(user: User) {
         const responsibilities = user.memberId ? (await this.getResponsibilitiesForMembers([user.memberId])) : [];
 
@@ -173,6 +187,54 @@ export class MemberUserSyncerStatic {
             }
         }
 
+        // Update roles (remove roles from permissions that no longer exist)
+        for (const organizationId of user.permissions.organizationPermissions.keys()) {
+            const organizationPermissions = user.permissions.organizationPermissions.get(organizationId);
+            if (!organizationPermissions) {
+                continue;
+            }
+
+            const roles = organizationPermissions.roles;
+            if (roles.length === 0) {
+                continue;
+            }
+
+            const organization = await Organization.getByID(organizationId);
+            if (!organization) {
+                // Delete key
+                user.permissions.organizationPermissions.delete(organizationId);
+                continue;
+            }
+
+            const availableRoles = organization.privateMeta.roles;
+            const newRoles: PermissionRole[] = [];
+            for (const role of roles) {
+                const roleInfo = availableRoles.find(r => r.id === role.id);
+                if (roleInfo) {
+                    role.name = roleInfo.name;
+                    newRoles.push(role);
+                }
+            }
+            organizationPermissions.roles = newRoles;
+        }
+
+        const globalPermissions = user.permissions.globalPermissions;
+        if (globalPermissions) {
+            const roles = globalPermissions.roles;
+            if (roles.length > 0) {
+                const availableRoles = (await Platform.getSharedPrivateStruct()).privateConfig.roles;
+                const newRoles: PermissionRole[] = [];
+                for (const role of roles) {
+                    const roleInfo = availableRoles.find(r => r.id === role.id);
+                    if (roleInfo) {
+                        role.name = roleInfo.name;
+                        newRoles.push(role);
+                    }
+                }
+                globalPermissions.roles = newRoles;
+            }
+        }
+
         // Platform permissions
         user.permissions.clearEmptyPermissions();
 

package/src/services/UniqueUserService.ts

@@ -0,0 +1,61 @@
+import { Database } from '@simonbackx/simple-database';
+import { logger, StyledText } from '@simonbackx/simple-logging';
+import chalk from 'chalk';
+
+const UNIQUE_KEY_NAME = 'email';
+
+/**
+ * This service is responsible for creating MySQL unique constraints on boot depending on the environment configuration.
+ * If STAMHOOFD.userMode = 'platform' then we'll create a unique constraint on the email column of the user table.
+ * If not, we'll delete the constraint if it exists.
+ */
+export class UniqueUserService {
+    static async hasUniqueConstraint() {
+        const [results] = await Database.select('SHOW INDEX FROM `users` WHERE Key_name = ?', [UNIQUE_KEY_NAME]);
+        return results.length > 0;
+    }
+
+    static async check() {
+        await logger.setContext({
+            prefixes: [
+                new StyledText(`[UniqueUserService] `).addClass('unique-user-service', 'tag'),
+            ],
+            tags: ['unique-user-service'],
+        }, async () => {
+            if (STAMHOOFD.userMode === 'platform') {
+                if (!(await this.hasUniqueConstraint())) {
+                    console.warn('Unique constraint is missing. Creating it now...');
+                    await this.createConstraint();
+                }
+            }
+            else {
+                if (await this.hasUniqueConstraint()) {
+                    console.warn('Unique constraint exists but should be removed. Deleting it now...');
+                    await this.dropConstraint();
+                }
+            }
+        });
+    }
+
+    static async createConstraint() {
+        try {
+            await Database.statement('ALTER TABLE `users` ADD UNIQUE INDEX `' + UNIQUE_KEY_NAME + '` (`email`) USING BTREE;');
+            console.log('Unique constraint created.');
+        }
+        catch (e) {
+            console.error(chalk.red('Failed to create unique constraint on email column of users table:'));
+            console.error(e);
+        }
+    }
+
+    static async dropConstraint() {
+        try {
+            await Database.statement('ALTER TABLE `users` DROP INDEX `' + UNIQUE_KEY_NAME + '`;');
+            console.log('Unique constraint dropped.');
+        }
+        catch (e) {
+            console.error(chalk.red('Failed to drop unique constraint on email column of users table:'));
+            console.error(e);
+        }
+    }
+}