@stamhoofd/backend 2.78.3 → 2.79.0

package/src/endpoints/organization/dashboard/registration-periods/GetOrganizationRegistrationPeriodsEndpoint.test.ts

@@ -0,0 +1,164 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { GroupFactory, Organization, OrganizationFactory, OrganizationRegistrationPeriodFactory, RegistrationPeriod, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import { GroupType, PermissionLevel, Permissions, Version } from '@stamhoofd/structures';
+import { testServer } from '../../../../../tests/helpers/TestServer';
+import { PatchRegistrationPeriodsEndpoint } from './GetOrganizationRegistrationPeriodsEndpoint';
+
+const baseUrl = `/v${Version}/organization/registration-periods`;
+
+describe('Endpoint.GetOrganizationRegistrationPeriods', () => {
+    const endpoint = new PatchRegistrationPeriodsEndpoint();
+
+    let registrationPeriod1: RegistrationPeriod;
+    let registrationPeriod2: RegistrationPeriod;
+
+    const get = async (organization: Organization, token: Token) => {
+        const request = Request.buildJson('GET', baseUrl, organization.getApiHost());
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+        return await testServer.test(endpoint, request);
+    };
+
+    beforeAll(async () => {
+        registrationPeriod2 = await new RegistrationPeriodFactory({
+            startDate: new Date(2022, 0, 1),
+            endDate: new Date(2022, 11, 31),
+        }).create();
+
+        registrationPeriod1 = await new RegistrationPeriodFactory({
+            startDate: new Date(2023, 0, 1),
+            endDate: new Date(2023, 11, 31),
+            previousPeriodId: registrationPeriod2.id,
+        }).create();
+    });
+
+    const initOrganization = async (registrationPeriod: RegistrationPeriod) => {
+        return await new OrganizationFactory({ period: registrationPeriod })
+            .create();
+    };
+
+    describe('groups', () => {
+        test('Should contain waiting lists', async () => {
+            // arrange
+            const organization = await initOrganization(registrationPeriod1);
+            await new OrganizationRegistrationPeriodFactory({
+                organization,
+                period: registrationPeriod1,
+            }).create();
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            })
+                .create();
+            const token = await Token.createToken(user);
+
+            const otherOrganization = await initOrganization(registrationPeriod1);
+
+            const waitingList1 = await new GroupFactory({
+                organization,
+                type: GroupType.WaitingList,
+            }).create();
+
+            const waitingList2 = await new GroupFactory({
+                organization,
+                type: GroupType.WaitingList,
+            }).create();
+
+            // waiting list of other organization
+            await new GroupFactory({
+                organization: otherOrganization,
+                type: GroupType.WaitingList,
+            }).create();
+
+            const groupWithWaitingList = await new GroupFactory({
+                organization,
+            }).create();
+
+            groupWithWaitingList.waitingListId = waitingList1.id;
+            await groupWithWaitingList.save();
+
+            // act
+            const result = await get(organization, token);
+
+            // assert
+            expect(result.body).toBeDefined();
+            expect(result.body.organizationPeriods.length).toBe(1);
+            const organizationPeriod = result.body.organizationPeriods[0];
+            const groups = organizationPeriod.groups;
+            expect(groups.length).toBe(3);
+            expect(groups).toEqual(expect.arrayContaining([
+                expect.objectContaining({
+                    id: groupWithWaitingList.id,
+                }),
+                expect.objectContaining({
+                    id: waitingList1.id,
+                }),
+                expect.objectContaining({
+                    id: waitingList2.id,
+                }),
+            ]));
+            expect(organizationPeriod.waitingLists.length).toBe(2);
+        });
+
+        test('Should contain only groups of the organization registration period', async () => {
+            // arrange
+            const organization = await initOrganization(registrationPeriod1);
+            await new OrganizationRegistrationPeriodFactory({
+                organization,
+                period: registrationPeriod1,
+            }).create();
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            })
+                .create();
+
+            const token = await Token.createToken(user);
+
+            const group1 = await new GroupFactory({
+                organization,
+                period: registrationPeriod1,
+            }).create();
+
+            const group2 = await new GroupFactory({
+                organization,
+                period: registrationPeriod1,
+            }).create();
+
+            // group list of other organization
+            const otherOrganization = await initOrganization(registrationPeriod1);
+
+            await new GroupFactory({
+                organization: otherOrganization,
+            }).create();
+
+            // group of other period
+            await new GroupFactory({
+                organization,
+                period: registrationPeriod2,
+            }).create();
+
+            // act
+            const result = await get(organization, token);
+
+            // assert
+            expect(result.body).toBeDefined();
+            expect(result.body.organizationPeriods.length).toBe(1);
+            const groups = result.body.organizationPeriods[0].groups;
+            expect(groups.length).toBe(2);
+            expect(groups).toEqual(expect.arrayContaining([
+                expect.objectContaining({
+                    id: group1.id,
+                }),
+                expect.objectContaining({
+                    id: group2.id,
+                }),
+            ]));
+        });
+    });
+});

package/src/helpers/AdminPermissionChecker.ts

@@ -1,7 +1,7 @@
 import { AutoEncoderPatchType, PatchMap } from '@simonbackx/simple-encoding';
 import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
 import { BalanceItem, CachedBalance, Document, EmailTemplate, Event, EventNotification, Group, Member, MemberPlatformMembership, MemberWithRegistrations, Order, Organization, OrganizationRegistrationPeriod, Payment, Registration, User, Webshop } from '@stamhoofd/models';
-import { AccessRight, EventPermissionChecker, FinancialSupportSettings, GroupCategory, GroupStatus, MemberWithRegistrationsBlob, PermissionLevel, PermissionsResourceType, Platform as PlatformStruct, RecordCategory, RecordSettings } from '@stamhoofd/structures';
+import { AccessRight, EventPermissionChecker, FinancialSupportSettings, GroupCategory, GroupStatus, GroupType, MemberWithRegistrationsBlob, PermissionLevel, PermissionsResourceType, Platform as PlatformStruct, RecordCategory, RecordSettings } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { addTemporaryMemberAccess, hasTemporaryMemberAccess } from './TemporaryMemberAccess';
 import { MemberRecordStore } from '../services/MemberRecordStore';
@@ -91,6 +91,10 @@ export class AdminPermissionChecker {
         });
     }
 
+    memberNotFoundOrNoAccess(): SimpleError {
+        return this.notFoundOrNoAccess($t('Je hebt geen toegang tot dit lid of het bestaat niet'));
+    }
+
     notFoundOrNoAccess(message?: string): SimpleError {
         return new SimpleError({
             code: 'not_found',
@@ -181,6 +185,15 @@ export class AdminPermissionChecker {
             return true;
         }
 
+        if (group.type === GroupType.EventRegistration) {
+            // Check if we can access the event
+            const event = await Event.select().where('groupId', group.id).first(false);
+
+            if (event && event.organizationId === group.organizationId && await this.canAccessEvent(event)) {
+                return true;
+            }
+        }
+
         // Check parent categories
         const organizationPeriod = await this.getOrganizationCurrentPeriod(organization);
         const parentCategories = group.getParentCategories(organizationPeriod.settings.categories);
@@ -193,6 +206,18 @@ export class AdminPermissionChecker {
         return false;
     }
 
+    async canRegisterMembersInGroup(group: Group, asOrganizationId: string | null) {
+        if (await this.canAccessGroup(group, PermissionLevel.Write)) {
+            return true;
+        }
+        if (asOrganizationId) {
+            if (group.settings.allowRegistrationsByOrganization) {
+                return await this.hasFullAccess(asOrganizationId);
+            }
+        }
+        return false;
+    }
+
     /**
      * Will throw error if not allowed to edit/add/delete this event
      * @param event
@@ -1043,6 +1068,20 @@ export class AdminPermissionChecker {
             };
         }
 
+        // It is possible that this is a platform admin, and inherits automatic permissions for tags. So'll need to loop all the organizations where this member has an active registration for
+        if (!record.organizationId && this.platformPermissions) {
+            const organizations = Formatter.uniqueArray(member.registrations.map(r => r.organizationId));
+            for (const organizationId of organizations) {
+                const organizationPermissions = await this.getOrganizationPermissions(organizationId);
+                if (organizationPermissions && organizationPermissions.hasResourceAccess(PermissionsResourceType.RecordCategories, record.rootCategoryId, level)) {
+                    return {
+                        canAccess: true,
+                        record: record.record,
+                    };
+                }
+            }
+        }
+
         return {
             canAccess: false,
             record: record.record,
@@ -1088,8 +1127,8 @@ export class AdminPermissionChecker {
         if (isUserManager) {
             // For a user manager without an organization, we don't delete data, because when registering a new member, it doesn't have any organizations yet...
             if (!(await this.canAccessMember(member, PermissionLevel.Full))) {
-                cloned.details.securityCode = null;
                 cloned.details.notes = null;
+                // a user manager can see the security codes
             }
 
             return cloned;

package/src/helpers/AuthenticatedStructures.ts

@@ -1,6 +1,6 @@
 import { SimpleError } from '@simonbackx/simple-errors';
 import { AuditLog, BalanceItem, CachedBalance, Document, Event, EventNotification, Group, Member, MemberPlatformMembership, MemberResponsibilityRecord, MemberWithRegistrations, Order, Organization, OrganizationRegistrationPeriod, Payment, Registration, RegistrationPeriod, Ticket, User, Webshop } from '@stamhoofd/models';
-import { AuditLogReplacement, AuditLogReplacementType, AuditLog as AuditLogStruct, DetailedReceivableBalance, Document as DocumentStruct, EventNotification as EventNotificationStruct, Event as EventStruct, GenericBalance, Group as GroupStruct, MemberPlatformMembership as MemberPlatformMembershipStruct, MemberWithRegistrationsBlob, MembersBlob, NamedObject, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, Organization as OrganizationStruct, PaymentGeneral, PermissionLevel, Platform, PrivateOrder, PrivateWebshop, ReceivableBalanceObject, ReceivableBalanceObjectContact, ReceivableBalance as ReceivableBalanceStruct, ReceivableBalanceType, TicketPrivate, UserWithMembers, WebshopPreview, Webshop as WebshopStruct } from '@stamhoofd/structures';
+import { AuditLogReplacement, AuditLogReplacementType, AuditLog as AuditLogStruct, DetailedReceivableBalance, Document as DocumentStruct, EventNotification as EventNotificationStruct, Event as EventStruct, GenericBalance, Group as GroupStruct, GroupType, MemberPlatformMembership as MemberPlatformMembershipStruct, MemberWithRegistrationsBlob, MembersBlob, NamedObject, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, Organization as OrganizationStruct, PaymentGeneral, PermissionLevel, Platform, PrivateOrder, PrivateWebshop, ReceivableBalanceObject, ReceivableBalanceObjectContact, ReceivableBalance as ReceivableBalanceStruct, ReceivableBalanceType, TicketPrivate, UserWithMembers, WebshopPreview, Webshop as WebshopStruct } from '@stamhoofd/structures';
 import { Sorter } from '@stamhoofd/utility';
 
 import { SQL } from '@stamhoofd/sql';
@@ -58,11 +58,29 @@ export class AuthenticatedStructures {
 
     static async groups(groups: Group[]) {
         const waitingListIds = Formatter.uniqueArray(groups.map(g => g.waitingListId).filter(id => id !== null));
-        const waitingLists = waitingListIds.length > 0 ? await Group.getByIDs(...waitingListIds) : [];
+
+        const waitingLists: Group[] = [];
+        const waitingListsToFetch: string[] = [];
+
+        for (const waitingListId of waitingListIds) {
+            const existingGroup = groups.find(g => g.id === waitingListId);
+
+            if (existingGroup) {
+                waitingLists.push(existingGroup);
+            }
+            else {
+                waitingListsToFetch.push(waitingListId);
+            }
+        }
+
+        if (waitingListsToFetch.length) {
+            const fetchedWaitingLists = await Group.getByIDs(...waitingListsToFetch);
+            waitingLists.push(...fetchedWaitingLists);
+        }
 
         const structs: GroupStruct[] = [];
         for (const group of groups) {
-            const waitingList = waitingLists.find(g => g.id == group.waitingListId) ?? null;
+            const waitingList = waitingLists.find(g => g.id === group.waitingListId) ?? null;
             const waitingListStruct = waitingList ? GroupStruct.create(waitingList) : null;
             if (waitingList && waitingListStruct && !await Context.optionalAuth?.canAccessGroup(waitingList)) {
                 waitingListStruct.privateSettings = null;
@@ -88,31 +106,70 @@ export class AuthenticatedStructures {
             return [];
         }
 
+        const periodIds = periods ? Formatter.uniqueArray(periods.map(p => p.id)) : Formatter.uniqueArray(organizationRegistrationPeriods.map(p => p.periodId));
+
         if (!periods) {
-            const periodIds = Formatter.uniqueArray(organizationRegistrationPeriods.map(p => p.periodId));
             periods = await RegistrationPeriod.getByIDs(...periodIds);
         }
 
+        const organizationIds = Formatter.uniqueArray(organizationRegistrationPeriods.map(r => r.organizationId));
+
         const groupIds = Formatter.uniqueArray(organizationRegistrationPeriods.flatMap(p => p.settings.categories.flatMap(c => c.groupIds)));
-        const groups = groupIds.length ? await Group.getByIDs(...groupIds) : [];
+
+        let groups: Group[] = [];
+
+        const whereWaitingList = SQL.where('organizationId', organizationIds)
+            .and('periodId', periodIds)
+            .and('type', GroupType.WaitingList)
+            .and('deletedAt', null);
+
+        if (groupIds.length) {
+            const whereGroupIds = SQL.where('id', groupIds);
+
+            if (organizationIds.length && periodIds.length) {
+                groups = await Group.select()
+                    .where(whereGroupIds)
+                    .orWhere(whereWaitingList)
+                    .fetch();
+            }
+            else {
+                groups = await Group.select()
+                    .where(whereGroupIds).fetch();
+            }
+        }
+        else if (organizationIds.length && periodIds.length) {
+            groups = await Group.select()
+                .where(whereWaitingList)
+                .fetch();
+        }
 
         const groupStructs = await this.groups(groups);
 
         const structs: OrganizationRegistrationPeriodStruct[] = [];
         for (const organizationPeriod of organizationRegistrationPeriods) {
-            const period = periods.find(p => p.id == organizationPeriod.periodId) ?? null;
+            const period = periods.find(p => p.id === organizationPeriod.periodId) ?? null;
             if (!period) {
                 continue;
             }
-            const groupIds = Formatter.uniqueArray(organizationPeriod.settings.categories.flatMap(c => c.groupIds));
 
-            structs.push(
-                OrganizationRegistrationPeriodStruct.create({
-                    ...organizationPeriod,
-                    period: period.getStructure(),
-                    groups: groupStructs.filter(gg => groupIds.includes(gg.id)).sort(GroupStruct.defaultSort),
-                }),
-            );
+            const struct = OrganizationRegistrationPeriodStruct.create({
+                ...organizationPeriod,
+                period: period.getStructure(),
+                groups: groupStructs.filter((gg) => {
+                    if (gg.organizationId !== organizationPeriod.organizationId) {
+                        return false;
+                    }
+
+                    if (gg.periodId !== organizationPeriod.periodId) {
+                        return false;
+                    }
+
+                    return true;
+                })
+                    .sort(GroupStruct.defaultSort),
+            });
+
+            structs.push(struct);
         }
 
         return structs;
@@ -767,11 +824,11 @@ export class AuthenticatedStructures {
                                     ]
                                 : []),
 
-                            ...(member.details.parentsHaveAccess
-                                ? member.details.parents.filter(p => !!p.email).map(p => ReceivableBalanceObjectContact.create({
+                            ...((member.details.defaultAge <= 18 || member.details.getMemberEmails().length === 0)
+                                ? member.details.parents.filter(p => p.getEmails().length > 0).map(p => ReceivableBalanceObjectContact.create({
                                     firstName: p.firstName ?? '',
                                     lastName: p.lastName ?? '',
-                                    emails: [p.email!],
+                                    emails: p.getEmails(),
                                     meta: {
                                         type: 'parent',
                                         responsibilityIds: [],
@@ -810,11 +867,11 @@ export class AuthenticatedStructures {
                                     ]
                                 : []),
 
-                            ...(member.details.parentsHaveAccess
-                                ? member.details.parents.filter(p => !!p.email).map(p => ReceivableBalanceObjectContact.create({
+                            ...((member.details.defaultAge <= 18 || member.details.getMemberEmails().length === 0)
+                                ? member.details.parents.filter(p => p.getEmails().length > 0).map(p => ReceivableBalanceObjectContact.create({
                                     firstName: p.firstName ?? '',
                                     lastName: p.lastName ?? '',
-                                    emails: [p.email!],
+                                    emails: p.getEmails(),
                                     meta: {
                                         type: 'parent',
                                         responsibilityIds: [],

package/src/helpers/ForwardHandler.test.ts

@@ -34,7 +34,9 @@ describe('ForwardHandler', () => {
                 },
             ],
             subject: 'Hello',
-            replyTo: 'someone@example.com',
+            replyTo: {
+                email: 'someone@example.com',
+            },
         });
         expect(options!.text).toContain('Content hier');
     });
@@ -67,7 +69,9 @@ describe('ForwardHandler', () => {
                 },
             ],
             subject: 'Hello',
-            replyTo: 'someone@example.com',
+            replyTo: {
+                email: 'someone@example.com',
+            },
         });
         expect(options!.text).toContain('Content hier');
     });
@@ -92,7 +96,9 @@ describe('ForwardHandler', () => {
                 },
             ],
             subject: 'Hello',
-            replyTo: 'someone@example.com',
+            replyTo: {
+                email: 'someone@example.com',
+            },
         });
         expect(options!.text).toContain('Content hier');
 
@@ -119,7 +125,9 @@ describe('ForwardHandler', () => {
 
         expect(options).toMatchObject({
             subject: 'Hello',
-            replyTo: 'someone@example.com',
+            replyTo: {
+                email: 'someone@example.com',
+            },
         });
         expect(options!.to).toIncludeAllMembers([
             {
@@ -207,7 +215,10 @@ describe('ForwardHandler', () => {
             dmarcVerdict: { status: 'PASS' },
         });
         expect(options).toMatchObject({
-            to: 'hallo@stamhoofd.be',
+            to: [{
+                email: 'hallo@stamhoofd.be',
+                name: 'Stamhoofd',
+            }],
             subject: 'E-mail unsubscribe mislukt',
         });
     });

package/src/helpers/ForwardHandler.ts

@@ -1,6 +1,6 @@
 /* eslint-disable @typescript-eslint/no-unsafe-argument */
-/* eslint-disable @typescript-eslint/no-redundant-type-constituents */
-import { Email, EmailAddress, EmailInterfaceRecipient } from '@stamhoofd/email';
+
+import { Email, EmailAddress, EmailInterface, EmailInterfaceRecipient } from '@stamhoofd/email';
 import { Organization } from '@stamhoofd/models';
 import { Formatter } from '@stamhoofd/utility';
 import { simpleParser } from 'mailparser';
@@ -49,7 +49,7 @@ export class ForwardHandler {
                     // Forward
                     return {
                         from: Email.getWebmasterFromEmail(),
-                        to: Email.getWebmasterToEmail(),
+                        to: [Email.getWebmasterToEmail()],
                         subject: 'E-mail unsubscribe mislukt',
                         text: 'Beste,\n\nEr werd een unsubscribe gemeld op ' + email + ' die niet kon worden verwerkt. Gelieve dit na te kijken.\n\nStamhoofd',
                     };
@@ -64,7 +64,7 @@ export class ForwardHandler {
         }
 
         // Send a new e-mail
-        let defaultEmail: EmailInterfaceRecipient[] | string = Email.getWebmasterToEmail();
+        let defaultEmail: EmailInterfaceRecipient[] = [Email.getWebmasterToEmail()];
         let organizationEmails: EmailInterfaceRecipient[] = [];
         const extraDescription = 'Dit bericht werd verstuurd naar ' + email + ', en werd automatisch doorgestuurd naar alle beheerders. Stel in Stamhoofd de e-mailadressen in om ervoor te zorgen dat antwoorden naar een specifiek e-mailadres worden verstuurd.';
 
@@ -80,8 +80,12 @@ export class ForwardHandler {
 
             // Send back to receiver without including the original message to avoid spam
             return {
-                from: email ?? Email.getWebmasterToEmail(),
-                to: from,
+                from: email
+                    ? {
+                            email,
+                        }
+                    : Email.getWebmasterToEmail(),
+                to: [{ email: from }],
                 subject: 'Ongeldig e-mailadres',
                 text: 'Beste,\n\nDe vereniging die je probeert te bereiken via ' + email + ' is helaas niet bereikbaar via dit e-mailadres. Dit e-mailadres wordt enkel gebruikt voor het versturen van automatische e-mails in naam van een vereniging. Probeer de vereniging te contacteren via een ander e-mailadres.\n\nBedankt.',
             };
@@ -123,10 +127,18 @@ export class ForwardHandler {
             }
         }
 
-        const options = {
-            from: email ?? Email.getWebmasterToEmail(),
+        const options: EmailInterface = {
+            from: email
+                ? {
+                        email,
+                    }
+                : Email.getWebmasterToEmail(),
             to: defaultEmail,
-            replyTo: parsed.from?.text,
+            replyTo: parsed.from?.text
+                ? {
+                        email: parsed.from?.text,
+                    }
+                : undefined,
             subject: parsed.subject ?? 'Doorgestuurd bericht',
             text: parsed.text ? extraDescription + '\n\n' + parsed.text : undefined,
             html: html,