@stamhoofd/backend 2.79.1 → 2.79.3

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.79.1",
+    "version": "2.79.3",
     "main": "./dist/index.js",
     "exports": {
         ".": {
@@ -38,14 +38,14 @@
         "@simonbackx/simple-encoding": "2.21.0",
         "@simonbackx/simple-endpoints": "1.19.1",
         "@simonbackx/simple-logging": "^1.0.1",
-        "@stamhoofd/backend-i18n": "2.79.1",
-        "@stamhoofd/backend-middleware": "2.79.1",
-        "@stamhoofd/email": "2.79.1",
-        "@stamhoofd/models": "2.79.1",
-        "@stamhoofd/queues": "2.79.1",
-        "@stamhoofd/sql": "2.79.1",
-        "@stamhoofd/structures": "2.79.1",
-        "@stamhoofd/utility": "2.79.1",
+        "@stamhoofd/backend-i18n": "2.79.3",
+        "@stamhoofd/backend-middleware": "2.79.3",
+        "@stamhoofd/email": "2.79.3",
+        "@stamhoofd/models": "2.79.3",
+        "@stamhoofd/queues": "2.79.3",
+        "@stamhoofd/sql": "2.79.3",
+        "@stamhoofd/structures": "2.79.3",
+        "@stamhoofd/utility": "2.79.3",
         "archiver": "^7.0.1",
         "aws-sdk": "^2.885.0",
         "axios": "1.6.8",
@@ -65,5 +65,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "88ae0a3e4edb57d36151c551a4c4e3ed59447e05"
+    "gitHead": "3b9878a9052295f3c5f9a661fbb8219ed87b23fe"
 }

package/src/decoders/StringArrayDecoder.ts

@@ -8,6 +8,9 @@ export class StringArrayDecoder<T> implements Decoder<T[]> {
     }
 
     decode(data: Data): T[] {
+        if (Array.isArray(data.value)) {
+            return data.array(this.decoder);
+        }
         const strValue = data.string;
 
         // Split on comma

package/src/endpoints/auth/CreateAdminEndpoint.ts

@@ -101,7 +101,7 @@ export class CreateAdminEndpoint extends Endpoint<Params, Query, Body, ResponseB
         const platformName = ((await Platform.getSharedStruct()).config.name);
 
         const name = organization?.name ?? platformName;
-        const what = organization ? $t('de vereniging {name} op {platform}', { name, platform: platformName }) : platformName;
+        const what = organization ? $t('a5c0dce2-01df-4a57-8d02-0b79cec9b89d', { name, platform: platformName }) : platformName;
 
         const emailTo = admin.getEmailTo();
         const email: string = typeof emailTo === 'string' ? emailTo : emailTo[0]?.email;

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.ts

@@ -1027,11 +1027,11 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
                     message: 'Maximum members reached',
                     human: responsibility.maximumMembers === 1
                         ? (model.groupId
-                                ? $t('Je kan maar één lid hebben met de functie {responsibility} in deze leeftijdsgroep', { responsibility: responsibility.name })
-                                : $t('Je kan maar één lid hebben met de functie {responsibility}', { responsibility: responsibility.name }))
+                                ? $t('e3e4ba16-7923-42bc-ae23-cd729ce06869', { responsibility: responsibility.name })
+                                : $t('77e408e8-59e5-42c2-b58d-956f7c391e5c', { responsibility: responsibility.name }))
                         : (model.groupId
-                                ? $t('Je kan maximum {count} leden hebben met de functie {responsibility} in deze leeftijdsgroep', { count: responsibility.maximumMembers.toFixed(), responsibility: responsibility.name })
-                                : $t('Je kan maximum {count} leden hebben met de functie {responsibility}', { count: responsibility.maximumMembers.toFixed(), responsibility: responsibility.name })),
+                                ? $t('10c13841-9f58-4651-a9b3-a34c8ce1a505', { count: responsibility.maximumMembers.toFixed(), responsibility: responsibility.name })
+                                : $t('01ef9768-89b5-48ea-955e-b896306a9a87', { count: responsibility.maximumMembers.toFixed(), responsibility: responsibility.name })),
                 });
             }
         }

package/src/endpoints/global/registration/RegisterMembersEndpoint.ts

@@ -247,7 +247,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
                     throw new SimpleError({
                         code: 'forbidden',
                         message: 'No permission to register in this group',
-                        human: $t('Je hebt geen toegangsrechten om een lid in te schrijven voor {group}', { group: group.settings.name }),
+                        human: $t('36e8f895-91df-4c88-88e7-d4f0e9d1b5bf', { group: group.settings.name }),
                         statusCode: 403,
                     });
                 }

package/src/endpoints/global/webshops/GetWebshopFromDomainEndpoint.ts

@@ -11,8 +11,8 @@ class Query extends AutoEncoder {
     @field({ decoder: StringDecoder })
     domain: string;
 
-    @field({ decoder: StringDecoder, nullable: true })
-    uri: string | null;
+    @field({ decoder: StringDecoder, optional: true })
+    uri = '';
 }
 
 type Body = undefined;

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -430,6 +430,9 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                         patch.waitingList,
                         model.organizationId,
                         requiredPeriod,
+                        {
+                            allowedIds: [patch.waitingList.id],
+                        },
                     );
                     model.waitingListId = group.id;
                 }
@@ -443,12 +446,14 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
     static async createGroup(struct: GroupStruct, organizationId: string, period: RegistrationPeriod, options?: { allowedIds?: string[] }): Promise<Group> {
         const allowedIds = options?.allowedIds ?? [];
 
-        if (!await Context.auth.hasFullAccess(organizationId)) {
-            if (allowedIds.includes(struct.id)) {
-                // Ok
-            }
-            else {
-                throw Context.auth.error('Je hebt geen toegangsrechten om groepen toe te voegen');
+        if (struct.type === GroupType.Membership || struct.type === GroupType.WaitingList) {
+            if (!await Context.auth.hasFullAccess(organizationId)) {
+                if (allowedIds.includes(struct.id)) {
+                    // Ok
+                }
+                else {
+                    throw Context.auth.error('Je hebt geen toegangsrechten om groepen toe te voegen');
+                }
             }
         }
 
@@ -493,15 +498,15 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             user.permissions!.organizationPermissions.set(organizationId, organizationPermissions.patch(patch));
             console.log('Automatically granted author full permissions to resource', 'group', model.id, 'user', user.id, 'patch', patch.encode({ version: Version }));
             await user.save();
-        }
 
-        // Check if current user has permissions to this new group -> else fail with error
-        if (!await Context.auth.canAccessGroup(model, PermissionLevel.Full)) {
-            throw new SimpleError({
-                code: 'missing_permissions',
-                message: 'You cannot restrict your own permissions',
-                human: 'Je kan geen inschrijvingsgroep maken zonder dat je zelf volledige toegang hebt tot de nieuwe groep',
-            });
+            // Check if current user has permissions to this new group -> else fail with error
+            if (!await Context.auth.canAccessGroup(model, PermissionLevel.Full)) {
+                throw new SimpleError({
+                    code: 'missing_permissions',
+                    message: 'You cannot restrict your own permissions',
+                    human: 'Je kan geen inschrijvingsgroep maken zonder dat je zelf volledige toegang hebt tot de nieuwe groep',
+                });
+            }
         }
 
         if (struct.waitingList) {
@@ -523,6 +528,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                     struct.waitingList,
                     model.organizationId,
                     period,
+                    { allowedIds: [struct.waitingList.id] },
                 );
                 model.waitingListId = group.id;
             }

package/src/helpers/AdminPermissionChecker.ts

@@ -92,7 +92,7 @@ export class AdminPermissionChecker {
     }
 
     memberNotFoundOrNoAccess(): SimpleError {
-        return this.notFoundOrNoAccess($t('Je hebt geen toegang tot dit lid of het bestaat niet'));
+        return this.notFoundOrNoAccess($t('d24814a3-aedc-4569-9ab3-f854027c4e9f'));
     }
 
     notFoundOrNoAccess(message?: string): SimpleError {
@@ -195,11 +195,13 @@ export class AdminPermissionChecker {
         }
 
         // Check parent categories
-        const organizationPeriod = await this.getOrganizationCurrentPeriod(organization);
-        const parentCategories = group.getParentCategories(organizationPeriod.settings.categories);
-        for (const category of parentCategories) {
-            if (organizationPermissions.hasResourceAccess(PermissionsResourceType.GroupCategories, category.id, permissionLevel)) {
-                return true;
+        if (group.type === GroupType.Membership) {
+            const organizationPeriod = await this.getOrganizationCurrentPeriod(organization);
+            const parentCategories = group.getParentCategories(organizationPeriod.settings.categories);
+            for (const category of parentCategories) {
+                if (organizationPermissions.hasResourceAccess(PermissionsResourceType.GroupCategories, category.id, permissionLevel)) {
+                    return true;
+                }
             }
         }
 

package/src/services/FileSignService.ts

@@ -70,7 +70,9 @@ export class FileSignService {
                 if (e instanceof jose.errors.JWSSignatureVerificationFailed) {
                     return false;
                 }
-                console.error('Failed to verify file signature:', e);
+                if (STAMHOOFD.environment !== 'test') {
+                    console.error('Failed to verify file signature:', e);
+                }
                 return false;
             }
         };
@@ -120,15 +122,19 @@ export class FileSignService {
         }
     }
 
-    static async fillSignedUrlsForStruct(data: any) {
+    static async fillSignedUrlsForStruct(data: any, looped = new Set()) {
         if (data instanceof File) {
             return (await data.withSignedUrl()) ?? undefined; // never return null if it fails because we'll want to use the original file in that case
         }
+        if (looped.has(data)) {
+            return;
+        }
+        looped.add(data);
 
         if (Array.isArray(data)) {
             for (let i = 0; i < data.length; i++) {
                 const value = data[i];
-                const r = await this.fillSignedUrlsForStruct(value);
+                const r = await this.fillSignedUrlsForStruct(value, looped);
                 if (r !== undefined) {
                     data[i] = r;
                 }
@@ -138,7 +144,7 @@ export class FileSignService {
 
         if (data instanceof Map) {
             for (const [key, value] of data.entries()) {
-                const r = await this.fillSignedUrlsForStruct(value);
+                const r = await this.fillSignedUrlsForStruct(value, looped);
 
                 if (r !== undefined) {
                     data.set(key, r);
@@ -151,7 +157,7 @@ export class FileSignService {
         // Loop all keys and search for File objects + replace them with the signed variant
         if (typeof data === 'object' && data !== null) {
             for (const key in data) {
-                const r = await this.fillSignedUrlsForStruct(data[key]);
+                const r = await this.fillSignedUrlsForStruct(data[key], looped);
                 if (r !== undefined) {
                     data[key] = r;
                 }
@@ -160,7 +166,12 @@ export class FileSignService {
         }
     }
 
-    static async verifyFilesInStruct(data: any) {
+    static async verifyFilesInStruct(data: any, looped = new Set()) {
+        if (looped.has(data)) {
+            return;
+        }
+        looped.add(data);
+
         if (data instanceof File) {
             if (!data.isPrivate) {
                 return;
@@ -183,14 +194,14 @@ export class FileSignService {
 
         if (Array.isArray(data)) {
             for (const value of data) {
-                await this.verifyFilesInStruct(value);
+                await this.verifyFilesInStruct(value, looped);
             }
             return;
         }
 
         if (data instanceof Map) {
             for (const [key, value] of data.entries()) {
-                await this.verifyFilesInStruct(value);
+                await this.verifyFilesInStruct(value, looped);
             }
             return;
         }
@@ -198,7 +209,7 @@ export class FileSignService {
         // Loop all keys and search for File objects + replace them with the signed variant
         if (typeof data === 'object' && data !== null) {
             for (const key in data) {
-                await this.verifyFilesInStruct(data[key]);
+                await this.verifyFilesInStruct(data[key], looped);
             }
             return;
         }

package/tests/e2e/private-files.test.ts

@@ -7,6 +7,7 @@ import { PermissionLevel, Permissions } from '@stamhoofd/structures';
 import { PatchUserMembersEndpoint } from '../../src/endpoints/global/registration/PatchUserMembersEndpoint';
 import { testServer } from '../helpers/TestServer';
 import { GetUserMembersEndpoint } from '../../src/endpoints/global/registration/GetUserMembersEndpoint';
+import { FileSignService } from '../../src/services/FileSignService';
 
 const baseUrl = `/v${Version}/members`;
 const endpoint = new PatchUserMembersEndpoint();
@@ -413,6 +414,181 @@ describe('E2E.PrivateFiles', () => {
         expect(answer.file!.signedUrl).not.toEqual('https://test.com/test.exe'); // It got replaced with a proper signed url
     });
 
+    describe('fillSignedUrlsForStruct', () => {
+        test('Can handle circular references', async () => {
+            // A malicious user could try to set a private file to a member in order to get
+            // access to the signed URL. This should not be possible without a valid signature
+            const privateFile = new File({
+                id: 'test',
+                server: 'test.com',
+                path: 'test.txt',
+                size: 100,
+                isPrivate: true,
+            });
+            await privateFile.sign();
+
+            const data = {
+                hello: 'true',
+                world: 'false',
+                circular: {
+                    data: {
+                        here: null as any,
+                    },
+                    file: privateFile,
+                },
+            };
+
+            data.circular.data.here = data;
+
+            await FileSignService.fillSignedUrlsForStruct(data);
+            expect(data.circular.file.signedUrl).toBeString();
+        });
+
+        test('Can handle duplicate files', async () => {
+            // A malicious user could try to set a private file to a member in order to get
+            // access to the signed URL. This should not be possible without a valid signature
+            const privateFile = new File({
+                id: 'test',
+                server: 'test.com',
+                path: 'test.txt',
+                size: 100,
+                isPrivate: true,
+            });
+            await privateFile.sign();
+
+            const data = {
+                hello: 'true',
+                world: 'false',
+                circular: {
+                    file1: privateFile,
+                    file2: privateFile,
+                },
+                arr: [
+                    privateFile,
+                    privateFile,
+                ],
+            };
+
+            await FileSignService.fillSignedUrlsForStruct(data);
+            expect(data.circular.file1.signedUrl).toBeString();
+            expect(data.circular.file2.signedUrl).toBeString();
+            expect(data.arr[0].signedUrl).toBeString();
+            expect(data.arr[1].signedUrl).toBeString();
+        });
+    });
+
+    describe('verifyFilesInStruct', () => {
+        test('Can handle circular references that are properly signed', async () => {
+            // A malicious user could try to set a private file to a member in order to get
+            // access to the signed URL. This should not be possible without a valid signature
+            const privateFile = new File({
+                id: 'test',
+                server: 'test.com',
+                path: 'test.txt',
+                size: 100,
+                isPrivate: true,
+            });
+            await privateFile.sign();
+
+            const data = {
+                hello: 'true',
+                world: 'false',
+                circular: {
+                    data: {
+                        here: null as any,
+                    },
+                    file: privateFile,
+                },
+            };
+
+            data.circular.data.here = data;
+
+            await expect(FileSignService.verifyFilesInStruct(data)).toResolve();
+        });
+
+        test('Can handle duplicate files that are properly signed', async () => {
+            // A malicious user could try to set a private file to a member in order to get
+            // access to the signed URL. This should not be possible without a valid signature
+            const privateFile = new File({
+                id: 'test',
+                server: 'test.com',
+                path: 'test.txt',
+                size: 100,
+                isPrivate: true,
+            });
+            await privateFile.sign();
+
+            const data = {
+                hello: 'true',
+                world: 'false',
+                circular: {
+                    file1: privateFile,
+                    file2: privateFile,
+                },
+                arr: [
+                    privateFile,
+                    privateFile,
+                ],
+            };
+
+            await expect(FileSignService.verifyFilesInStruct(data)).toResolve();
+        });
+
+        test('Can handle circular references with files that are not signed', async () => {
+            // A malicious user could try to set a private file to a member in order to get
+            // access to the signed URL. This should not be possible without a valid signature
+            const privateFile = new File({
+                id: 'test',
+                server: 'test.com',
+                path: 'test.txt',
+                size: 100,
+                isPrivate: true,
+            });
+
+            const data = {
+                hello: 'true',
+                world: 'false',
+                circular: {
+                    data: {
+                        here: null as any,
+                    },
+                    file: privateFile,
+                },
+            };
+
+            data.circular.data.here = data;
+
+            await expect(FileSignService.verifyFilesInStruct(data)).rejects.toThrow(/Invalid signature for file/);
+        });
+
+        test('Can handle duplicate files that are not signed', async () => {
+            // A malicious user could try to set a private file to a member in order to get
+            // access to the signed URL. This should not be possible without a valid signature
+            const privateFile = new File({
+                id: 'test',
+                server: 'test.com',
+                path: 'test.txt',
+                size: 100,
+                isPrivate: true,
+            });
+
+            const data = {
+                hello: 'true',
+                world: 'false',
+                circular: {
+                    file1: privateFile,
+                    file2: privateFile,
+                },
+                arr: [
+                    privateFile,
+                    privateFile,
+                ],
+            };
+
+            await expect(FileSignService.verifyFilesInStruct(data)).rejects.toThrow(/Invalid signature for file/);
+        });
+    });
+
     /**
      * Tests that when an unverified file is stored on the server with a signed url, the server will never return that signed url.
      */