@stamhoofd/backend 2.78.3 → 2.79.0

package/src/helpers/MemberUserSyncer.ts

@@ -1,11 +1,11 @@
-import { CachedBalance, Member, MemberResponsibilityRecord, MemberWithRegistrations, Organization, Platform, User } from '@stamhoofd/models';
+import { CachedBalance, Member, MemberResponsibilityRecord, MemberWithUsers, Organization, Platform, User } from '@stamhoofd/models';
+import { QueueHandler } from '@stamhoofd/queues';
 import { SQL } from '@stamhoofd/sql';
 import { AuditLogSource, MemberDetails, PermissionRole, Permissions, UserPermissions } from '@stamhoofd/structures';
-import crypto from 'crypto';
+import { Formatter } from '@stamhoofd/utility';
 import basex from 'base-x';
+import crypto from 'crypto';
 import { AuditLogService } from '../services/AuditLogService';
-import { Formatter } from '@stamhoofd/utility';
-import { QueueHandler } from '@stamhoofd/queues';
 
 const ALPHABET = '123456789ABCDEFGHJKMNPQRSTUVWXYZ'; // Note: we removed 0, O, I and l to make it easier for humans
 const customBase = basex(ALPHABET);
@@ -28,89 +28,101 @@ export class MemberUserSyncerStatic {
      * - responsibilities have changed
      * - email addresses have changed
      */
-    async onChangeMember(member: MemberWithRegistrations, unlinkUsers: boolean = false) {
-        await AuditLogService.setContext({ source: AuditLogSource.System }, async () => {
-            const { userEmails, parentAndUnverifiedEmails } = this.getMemberAccessEmails(member.details);
+    async onChangeMember(member: Member) {
+        await QueueHandler.schedule('change-member/' + member.id, async () => {
+            await AuditLogService.setContext({ source: AuditLogSource.System }, async () => {
+                // Note: Refresh member data is not really required because we'll just schedule a new task if it changes again
+                // Reload member users
+                await Member.users.load(member);
+                if (!Member.users.isLoaded(member)) {
+                    throw new Error('Failed to load users for member ' + member.id);
+                }
 
-            // Make sure all these users have access to the member
-            for (const email of userEmails) {
-            // Link users that are found with these email addresses.
-                await this.linkUser(email, member, false, true);
-            }
+                const { userEmails, parentEmails, unverifiedEmails, allEmails } = this.getMemberAccessEmails(member.details);
 
-            for (const email of parentAndUnverifiedEmails) {
-                if (userEmails.includes(email)) {
-                    continue;
+                // Make sure all these users have access to the member
+                for (const email of userEmails) {
+                    // Link users that are found with these email addresses.
+                    await this.linkUser(email, member, false, {
+                        firstName: member.details.firstName,
+                        lastName: member.details.lastName,
+                    });
                 }
 
-                // Link parents and unverified emails
-                // Now we add the responsibility permissions to the parent if there are no userEmails
-                const asParent = userEmails.length > 0 || !member.details.unverifiedEmails.includes(email) || member.details.defaultAge < 16;
-                await this.linkUser(email, member, asParent, true);
-            }
+                for (const parent of member.details.parents) {
+                    for (const email of parent.getEmails()) {
+                        if (userEmails.includes(email.toLocaleLowerCase())) {
+                            continue;
+                        }
 
-            if (unlinkUsers && !member.details.parentsHaveAccess) {
-            // Remove access of users that are not in this list
-            // NOTE: we should only do this once a year (preferably on the birthday of the member)
-            // only once because otherwise users loose the access to a member during the creation of the member, or when they have changed their email address
-            // users can regain access to a member after they have lost control by using the normal verification flow when detecting duplicate members
+                        // Link parents and unverified emails
+                        await this.linkUser(email, member, true, {
+                            firstName: parent.firstName,
+                            lastName: parent.lastName,
+                        });
+                    }
+                }
 
-                for (const user of member.users) {
-                    if (!userEmails.includes(user.email) && !parentAndUnverifiedEmails.includes(user.email)) {
-                        await this.unlinkUser(user, member);
+                // Make sure all these users have access to the member
+                for (const email of unverifiedEmails) {
+                    if (userEmails.includes(email)) {
+                        continue;
+                    }
+                    if (parentEmails.includes(email)) {
+                        continue;
                     }
+
+                    // Do not update name + do not link as member (no permissions inheritance here)
+                    await this.linkUser(email, member, true);
                 }
-            }
-            else {
-            // Only auto unlink users that do not have an account
-                for (const user of member.users) {
-                    if (!userEmails.includes(user.email) && !parentAndUnverifiedEmails.includes(user.email)) {
+
+                // Only auto unlink users that do not have an account
+                // note: we create a copy of the users array here because it is modified in the loop
+                for (const user of [...member.users]) {
+                    if (!allEmails.includes(user.email.toLocaleLowerCase())) {
                         if (!user.hasAccount()) {
                             await this.unlinkUser(user, member);
                         }
                         else {
-                        // Make sure only linked as a parent, not as user self
-                        // This makes sure we don't inherit permissions and aren't counted as 'being' the member
+                            // Make sure only linked as a parent, not as user self
+                            // This makes sure we don't inherit permissions and aren't counted as 'being' the member
                             await this.linkUser(user.email, member, true);
                         }
                     }
                 }
-            }
 
-            if (member.details.securityCode === null) {
-                console.log('Generating security code for member ' + member.id);
+                if (member.details.securityCode === null) {
+                    console.log('Generating security code for member ' + member.id);
 
-                const length = 16;
-                const code = customBase.encode(await randomBytes(100)).toUpperCase().substring(0, length);
-                member.details.securityCode = code;
-                await member.save();
-            }
+                    const length = 16;
+                    const code = customBase.encode(await randomBytes(100)).toUpperCase().substring(0, length);
+                    member.details.securityCode = code;
+                    await member.save();
+                }
+            });
         });
     }
 
     getMemberAccessEmails(details: MemberDetails) {
-        const userEmails = [...details.alternativeEmails];
-
-        if (details.email) {
-            userEmails.push(details.email);
-        }
-
-        const unverifiedEmails: string[] = details.unverifiedEmails;
-        const parentAndUnverifiedEmails = details.parentsHaveAccess ? details.parents.flatMap(p => p.email ? [p.email, ...p.alternativeEmails] : p.alternativeEmails).concat(unverifiedEmails) : details.unverifiedEmails;
+        const userEmails = details.getMemberEmails().map(e => e.toLocaleLowerCase());
+        const parentEmails = details.getParentEmails().map(e => e.toLocaleLowerCase());
+        const unverifiedEmails = details.unverifiedEmails.map(e => e.toLocaleLowerCase());
+        const allEmails = [...userEmails, ...parentEmails, ...unverifiedEmails];
 
         return {
+            allEmails,
             userEmails,
-            parentAndUnverifiedEmails,
-            emails: userEmails.concat(parentAndUnverifiedEmails),
+            parentEmails,
+            unverifiedEmails,
         };
     }
 
     doesEmailHaveAccess(details: MemberDetails, email: string) {
-        const { emails } = this.getMemberAccessEmails(details);
-        return emails.includes(email);
+        const { allEmails } = this.getMemberAccessEmails(details);
+        return allEmails.includes(email.toLocaleLowerCase());
     }
 
-    async onDeleteMember(member: MemberWithRegistrations) {
+    async onDeleteMember(member: MemberWithUsers) {
         await AuditLogService.setContext({ source: AuditLogSource.System }, async () => {
             for (const u of member.users) {
                 console.log('Unlinking user ' + u.email + ' from deleted member ' + member.id);
@@ -245,7 +257,7 @@ export class MemberUserSyncerStatic {
         await user.save();
     }
 
-    async unlinkUser(user: User, member: MemberWithRegistrations) {
+    async unlinkUser(user: User, member: MemberWithUsers) {
         console.log('Removing access for ' + user.id + ' to member ' + member.id);
         await Member.users.reverse('members').unlink(user, member);
 
@@ -254,6 +266,11 @@ export class MemberUserSyncerStatic {
 
         if (user.memberId === member.id) {
             user.memberId = null;
+
+            if (user.firstName === member.details.firstName && user.lastName === member.details.lastName) {
+                user.firstName = null;
+                user.lastName = null;
+            }
         }
 
         // Update model relation to correct response
@@ -265,64 +282,84 @@ export class MemberUserSyncerStatic {
         await this.updateInheritedPermissions(user);
     }
 
-    async linkUser(email: string, member: MemberWithRegistrations, asParent: boolean, updateNameIfEqual = true) {
+    private async resolveUserWithMultipleMembers(currentMemberId: string, otherMember: Member): Promise<'current' | 'other'> {
+        const otherMemberId = otherMember.id;
+        const responsibilities = await this.getResponsibilitiesForMembers([otherMemberId, currentMemberId]);
+        const responsibilitiesOther = responsibilities.filter(r => r.memberId === otherMemberId && r.getBaseStructure().isActive);
+        const responsibilitiesCurrent = responsibilities.filter(r => r.memberId === currentMemberId && r.getBaseStructure().isActive);
+
+        if (responsibilitiesOther.length > 0 && responsibilitiesCurrent.length === 0) {
+            return 'other';
+        }
+
+        if (responsibilitiesCurrent.length > 0 && responsibilitiesOther.length === 0) {
+            return 'current';
+        }
+        const currentMember = await Member.getByID(currentMemberId);
+        if (!currentMember) {
+            return 'other';
+        }
+
+        if (responsibilitiesOther.length > 0 && responsibilitiesCurrent.length > 0) {
+            // Resolve to oldest created member (this is always the most secure option)
+            if (currentMember.createdAt <= otherMember.createdAt) {
+                return 'current';
+            }
+
+            return 'other';
+        }
+
+        // Resolve to newest member
+        if (currentMember.createdAt > otherMember.createdAt) {
+            return 'current';
+        }
+
+        return 'other';
+    }
+
+    async linkUser(email: string, member: MemberWithUsers, asParent: boolean, name: { firstName: string; lastName: string } | null = null) {
         // This needs to happen in the queue to prevent creating duplicate users in the database
         await QueueHandler.schedule('link-user/' + email, async () => {
-            console.log('Linking user', email, 'to member', member.id, 'as parent', asParent, 'update name if equal', updateNameIfEqual);
-
             let user = member.users.find(u => u.email.toLocaleLowerCase() === email.toLocaleLowerCase()) ?? await User.getForAuthentication(member.organizationId, email, { allowWithoutAccount: true });
 
             if (user) {
-                // console.log("Giving an existing user access to a member: " + user.id + ' - ' + member.id)
                 if (!asParent) {
+                    let setMemberId = true;
                     if (user.memberId && user.memberId !== member.id) {
-                        console.error('Found conflicting user with multiple members', user.id, 'members', user.memberId, 'to', member.id);
-
-                        const otherMember = await Member.getWithRegistrations(user.memberId);
-
-                        if (otherMember) {
-                            if (otherMember.registrations.length > 0 && member.registrations.length === 0) {
-                                // Choose the other member
-                                // don't make changes
-                                console.error('Resolved to current member - no changes made');
-                                return;
-                            }
-
-                            const responsibilities = await this.getResponsibilitiesForMembers([otherMember.id, member.id]);
-                            const responsibilitiesOther = responsibilities.filter(r => r.memberId === otherMember.id);
-                            const responsibilitiesCurrent = responsibilities.filter(r => r.memberId === member.id);
-
-                            if (responsibilitiesOther.length >= responsibilitiesCurrent.length) {
-                                console.error('Resolved to current member because of more responsibilities - no changes made');
-                                return;
-                            }
+                        const resolveTo = await this.resolveUserWithMultipleMembers(user.memberId, member);
+
+                        if (resolveTo === 'current') {
+                            // Do not change memberId
+                            setMemberId = false;
                         }
                     }
 
-                    if (updateNameIfEqual) {
-                        user.firstName = member.details.firstName;
-                        user.lastName = member.details.lastName;
+                    if (setMemberId) {
+                        if (name) {
+                            user.firstName = name.firstName;
+                            user.lastName = name.lastName;
+                        }
+                        user.memberId = member.id;
                     }
-                    user.memberId = member.id;
                     await this.updateInheritedPermissions(user);
                 }
                 else {
                     let shouldSave = false;
 
-                    if (!user.firstName && !user.lastName) {
-                        const parents = member.details.parents.filter(p => p.email === email);
-                        if (parents.length === 1) {
-                            if (updateNameIfEqual) {
-                                user.firstName = parents[0].firstName;
-                                user.lastName = parents[0].lastName;
-                            }
+                    // Clear clearly wrong name
+                    if (user.firstName?.toLocaleLowerCase() === member.details.firstName?.toLocaleLowerCase() && user.lastName?.toLocaleLowerCase() === member.details.lastName?.toLocaleLowerCase()) {
+                        if (!name || (name.firstName !== user.firstName && name.lastName !== user.lastName)) {
+                            user.firstName = null;
+                            user.lastName = null;
                             shouldSave = true;
                         }
                     }
 
-                    if (user.firstName === member.details.firstName && user.lastName === member.details.lastName) {
-                        user.firstName = null;
-                        user.lastName = null;
+                    if (!user.firstName && !user.lastName) {
+                        if (name) {
+                            user.firstName = name.firstName;
+                            user.lastName = name.lastName;
+                        }
                         shouldSave = true;
                     }
 
@@ -341,25 +378,17 @@ export class MemberUserSyncerStatic {
                 user = new User();
                 user.organizationId = member.organizationId;
                 user.email = email;
+                if (name) {
+                    user.firstName = name.firstName;
+                    user.lastName = name.lastName;
+                }
 
                 if (!asParent) {
-                    if (updateNameIfEqual) {
-                        user.firstName = member.details.firstName;
-                        user.lastName = member.details.lastName;
-                    }
                     user.memberId = member.id;
                     await this.updateInheritedPermissions(user);
                 }
                 else {
-                    const parents = member.details.parents.filter(p => p.email === email);
-                    if (parents.length === 1) {
-                        if (updateNameIfEqual) {
-                            user.firstName = parents[0].firstName;
-                            user.lastName = parents[0].lastName;
-                        }
-                    }
-
-                    if (user.firstName === member.details.firstName && user.lastName === member.details.lastName) {
+                    if (!name && user.firstName?.toLocaleLowerCase() === member.details.firstName?.toLocaleLowerCase() && user.lastName?.toLocaleLowerCase() === member.details.lastName?.toLocaleLowerCase()) {
                         user.firstName = null;
                         user.lastName = null;
                     }

package/src/helpers/TagHelper.ts

@@ -10,12 +10,12 @@ export class TagHelper extends SharedTagHelper {
 
         await AuditLogService.setContext({ source: AuditLogSource.System }, async () => {
             await QueueHandler.schedule(queueId, async () => {
-                let platform = await Platform.getShared();
+                const sharedPlatform = await Platform.getShared();
 
                 const tagCounts = new Map<string, number>();
 
                 for await (const organization of Organization.select().all()) {
-                    organization.meta.tags = this.getAllTagsFromHierarchy(organization.meta.tags, platform.config.tags);
+                    organization.meta.tags = this.getAllTagsFromHierarchy(organization.meta.tags, sharedPlatform.config.tags);
 
                     for (const tag of organization.meta.tags) {
                         tagCounts.set(tag, (tagCounts.get(tag) ?? 0) + 1);
@@ -24,7 +24,7 @@ export class TagHelper extends SharedTagHelper {
                 }
 
                 // Reload platform to avoid race conditions
-                platform = await Platform.getShared();
+                const platform = await Platform.getForEditing();
                 for (const [tag, count] of tagCounts.entries()) {
                     const tagObject = platform.config.tags.find(t => t.id === tag);
                     if (tagObject) {

package/src/seeds/1734596144-fill-previous-period-id.ts

@@ -44,7 +44,7 @@ export default new Migration(async () => {
     console.log('Updated ' + c + ' registration periods');
 
     // Now update platform
-    const platform = await Platform.getShared();
+    const platform = await Platform.getForEditing();
     await platform.setPreviousPeriodId();
     await platform.save();
 

package/src/seeds/1741008870-fix-auditlog-description.ts

@@ -0,0 +1,50 @@
+import { Migration } from '@simonbackx/simple-database';
+import { AuditLog } from '@stamhoofd/models';
+import { scalarToSQLExpression, SQL, SQLWhereLike } from '@stamhoofd/sql';
+
+export default new Migration(async () => {
+    if (STAMHOOFD.environment === 'test') {
+        console.log('skipped in tests');
+        return;
+    }
+
+    if (STAMHOOFD.platformName !== 'keeo') {
+        console.log('skipped for platform (only run for keeo): ' + STAMHOOFD.platformName);
+        return;
+    }
+
+    console.log('Start fixing audit log descriptions.');
+
+    const batchSize = 100;
+    let count = 0;
+
+    for await (const log of AuditLog.select()
+        .where(new SQLWhereLike(
+            SQL.column('audit_logs', 'description'),
+            scalarToSQLExpression(`%werd verplaatst van % naar %, door%`),
+        )).limit(batchSize).all()) {
+        if (log.meta.get('fixed') === 1) {
+            continue;
+        }
+        log.description = fixDescription(log.description);
+        log.meta.set('fixed', 1);
+        await log.save();
+        count += 1;
+    }
+
+    console.log('Finished saving ' + count + ' audit logs.');
+});
+
+function fixDescription(description: string): string {
+    const regex = /werd verplaatst van (.+) naar (.*), door/;
+    const result = description.match(regex);
+    if (!result) {
+        throw new Error(`Could not fix audit log description, no regex match found: ${description}`);
+    }
+
+    const to = result[1];
+    const from = result[2];
+
+    const fixed = description.replace(regex, `werd verplaatst van ${from} naar ${to}, door`);
+    return fixed;
+}

package/src/seeds/1741011468-fix-auditlog-description-uft16.ts

@@ -0,0 +1,88 @@
+import { Migration } from '@simonbackx/simple-database';
+import { AuditLog } from '@stamhoofd/models';
+import { scalarToSQLExpression, SQL, SQLWhereLike } from '@stamhoofd/sql';
+
+const replacements: [from: string, to: string][] = [
+    ['u00eb', 'ë'],
+    ['u00E9', 'é'],
+    ['U00EF', 'ï'],
+    ['U00E6', 'æ'],
+    ['U00F6', 'ö'],
+    ['U00E0', 'à'],
+    ['U00E1', 'á'],
+    ['U00E7', 'ç'],
+    ['U00E4', 'ä'],
+    ['U00E5', 'å'],
+    ['U00E8', 'è'],
+    ['U00F3', 'ó'],
+    ['U00ED', 'í'],
+    ['U00C4', 'Ä'],
+    ['U00C1', 'Á'],
+    ['U00FC', 'ü'],
+    ['U00F4', 'ö'],
+    ['U00D6', 'Ö'],
+    ['U00C9', 'É'],
+    ['U00F2', 'ò'],
+    ['U00E2', 'â'],
+    ['U00F2', 'ò'],
+    ['U00F2', 'ò'],
+    ['U00E2', 'â'],
+    ['U00EC', 'ì'],
+    ['U00C5', 'Å'],
+    ['U00EE', 'î'],
+    ['U00A9', '©'],
+    ['U00C3', 'Ã'],
+    ['U00C7', 'Ç'],
+    ['U00F9', 'ù'],
+    ['U00EA', 'ê'],
+    ['U00FF', 'ÿ'],
+    ['U00CA', 'Ê'],
+    ['U00CD', 'Í'],
+    ['U00A8', '¨'],
+    ['U00AF', '¯'],
+    ['U00AB', '«'],
+    ['U00CE', 'Î'],
+];
+
+export default new Migration(async () => {
+    if (STAMHOOFD.environment === 'test') {
+        console.log('skipped in tests');
+        return;
+    }
+
+    if (STAMHOOFD.platformName !== 'keeo') {
+        console.log('skipped for platform (only run for keeo): ' + STAMHOOFD.platformName);
+        return;
+    }
+
+    console.log('Start fixing audit log uft16 descriptions.');
+
+    const batchSize = 100;
+    let count = 0;
+
+    for await (const log of AuditLog.select()
+        .where(new SQLWhereLike(
+            SQL.column('audit_logs', 'description'),
+            scalarToSQLExpression(`%u00%`),
+        ))
+        .limit(batchSize).all()) {
+        if (log.meta.get('fixed-uft16') === 1) {
+            continue;
+        }
+        log.description = fixDescription(log.description);
+        log.meta.set('fixed-uft16', 1);
+        await log.save();
+        count += 1;
+    }
+
+    console.log('Finished saving ' + count + ' audit logs uft16.');
+});
+
+function fixDescription(description: string): string {
+    let result = description;
+    replacements.forEach(([from, to]) => {
+        result = result.replace(new RegExp(from.toLowerCase(), 'g'), to);
+    });
+
+    return result;
+}

package/src/services/FileSignService.ts

@@ -22,7 +22,7 @@ export class FileSignService {
         const alg = STAMHOOFD.FILE_SIGNING_ALG || 'ES256';
 
         if (!STAMHOOFD.FILE_SIGNING_PUBLIC_KEY || !STAMHOOFD.FILE_SIGNING_PRIVATE_KEY) {
-            if (STAMHOOFD.environment !== 'development') {
+            if (STAMHOOFD.environment !== 'development' && STAMHOOFD.environment !== 'test') {
                 throw new Error('Missing environment variables for file signing. Please make sure FILE_SIGNING_PUBLIC_KEY, FILE_SIGNING_PRIVATE_KEY and FILE_SIGNING_ALG are set.');
             }
 

package/src/services/PlatformMembershipService.ts

@@ -169,6 +169,13 @@ export class PlatformMembershipService {
                         console.warn('No periods found for member ' + me.id);
                     }
                 }
+                const types = platform.config.membershipTypes.filter(m => m.behaviour === PlatformMembershipTypeBehaviour.Period).map(m => m.id);
+                if (types.length === 0) {
+                    if (!silent) {
+                        console.warn('No membership types found for memberships');
+                    }
+                    return;
+                }
 
                 // Every (not-locked) period can have a generated membership
                 for (const period of periods) {
@@ -200,8 +207,6 @@ export class PlatformMembershipService {
                         }];
                     });
 
-                    const types = platform.config.membershipTypes.filter(m => m.behaviour === PlatformMembershipTypeBehaviour.Period).map(m => m.id);
-
                     // Get active memberships for this member that
                     const activeMemberships = await MemberPlatformMembership.where({
                         memberId: me.id,

package/src/services/SSOService.ts

@@ -130,7 +130,7 @@ export class SSOService {
 
     static async fromContext(provider: LoginProviderType) {
         const organization = Context.organization;
-        const platform = await Platform.getShared();
+        const platform = await Platform.getForEditing();
 
         const service = new SSOService({ provider, platform, organization });
         service.validateConfiguration();

package/tests/e2e/register.test.ts

@@ -1035,7 +1035,7 @@ describe('E2E.Register', () => {
                     ]),
                 });
 
-                const platform = await Platform.getShared();
+                const platform = await Platform.getForEditing();
 
                 platform.config.membershipTypes = [
                     platformMembershipType,
@@ -1135,7 +1135,7 @@ describe('E2E.Register', () => {
                     ]),
                 });
 
-                const platform = await Platform.getShared();
+                const platform = await Platform.getForEditing();
 
                 platform.config.membershipTypes = [
                     platformMembershipType,