@stamhoofd/backend 2.80.1 → 2.82.0

package/src/endpoints/organization/dashboard/users/CreateApiUserEndpoint.test.ts

@@ -0,0 +1,106 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+
+import { testServer } from '../../../../../tests/helpers/TestServer';
+import { PatchApiUserEndpoint } from './PatchApiUserEndpoint';
+import { SHExpect, TestUtils } from '@stamhoofd/test-utils';
+import { ApiUser, ApiUserRateLimits, PermissionLevel, Permissions, UserMeta, UserPermissions } from '@stamhoofd/structures';
+import { CreateApiUserEndpoint } from './CreateApiUserEndpoint';
+
+describe('Endpoint.CreateApiUserEndpoint', () => {
+    // Test endpoint
+    const endpoint = new CreateApiUserEndpoint();
+
+    beforeEach(() => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
+    test('Only a platform admin can set the rate limits of a key', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            globalPermissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+            meta: UserMeta.create({
+                rateLimits: ApiUserRateLimits.High,
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+        const response = await testServer.test(endpoint, createRequest);
+
+        expect(response.body).toBeDefined();
+        expect(response.body.meta?.rateLimits).toEqual(ApiUserRateLimits.High);
+    });
+
+    test('An organization admin cannot set rate limits', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+            meta: UserMeta.create({
+                rateLimits: ApiUserRateLimits.High,
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+
+        await expect(testServer.test(endpoint, createRequest)).rejects.toThrow(SHExpect.simpleError({
+            code: 'permission_denied',
+        }));
+    });
+
+    test('An API-key cannot have permissions outside its organization', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                    ['other', Permissions.create({ level: PermissionLevel.Full })],
+                ]),
+                globalPermissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, createRequest);
+
+        expect(response.body).toBeDefined();
+        expect(response.body.permissions).toEqual(
+            UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+                globalPermissions: null,
+            }),
+        );
+    });
+});

package/src/endpoints/organization/dashboard/users/CreateApiUserEndpoint.ts

@@ -2,15 +2,15 @@ import { Decoder } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Token, User } from '@stamhoofd/models';
-import { ApiUser, ApiUserWithToken, UserPermissions } from '@stamhoofd/structures';
+import { ApiUser, ApiUserWithToken, UserMeta, UserPermissions } from '@stamhoofd/structures';
 
 import { Context } from '../../../../helpers/Context';
 type Params = Record<string, never>;
 type Query = undefined;
 type Body = ApiUser;
-type ResponseBody = ApiUser;
+type ResponseBody = ApiUserWithToken;
 
-export class CreateAdminEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+export class CreateApiUserEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
     bodyDecoder = ApiUser as Decoder<ApiUser>;
 
     protected doesMatch(request: Request): [true, Params] | [false] {
@@ -56,6 +56,19 @@ export class CreateAdminEndpoint extends Endpoint<Params, Query, Body, ResponseB
         }
 
         admin.permissions = UserPermissions.limitedAdd(null, request.body.permissions, organization.id);
+
+        if (request.body.meta) {
+            const rateLimits = request.body.meta.rateLimits;
+            if (rateLimits) {
+                if (!Context.auth.hasPlatformFullAccess()) {
+                    throw Context.auth.error($t('Je hebt geen rechten om de rate limits van API-keys te wijzigen'));
+                }
+
+                admin.meta = admin.meta ?? UserMeta.create({});
+                admin.meta.rateLimits = rateLimits;
+            }
+        }
+
         await admin.save();
 
         // Set id

package/src/endpoints/organization/dashboard/users/PatchApiUserEndpoint.test.ts

@@ -0,0 +1,247 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+
+import { testServer } from '../../../../../tests/helpers/TestServer';
+import { PatchApiUserEndpoint } from './PatchApiUserEndpoint';
+import { SHExpect, TestUtils } from '@stamhoofd/test-utils';
+import { ApiUser, ApiUserRateLimits, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions, UserMeta, UserPermissions } from '@stamhoofd/structures';
+import { CreateApiUserEndpoint } from './CreateApiUserEndpoint';
+import { PatchMap } from '@simonbackx/simple-encoding';
+
+describe('Endpoint.PatchApiUserEndpoint', () => {
+    // Test endpoint
+    const createEndpoint = new CreateApiUserEndpoint();
+    const endpoint = new PatchApiUserEndpoint();
+
+    beforeEach(() => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
+    test('Only a platform admin can alter the rate limits of a key', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            globalPermissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+        const createResponse = await testServer.test(createEndpoint, createRequest);
+
+        const apiUserId = createResponse.body.id;
+
+        const r = Request.buildJson('PATCH', '/api-keys/' + apiUserId, organization.getApiHost(), ApiUser.patch({
+            id: apiUserId,
+            meta: UserMeta.patch({
+                rateLimits: ApiUserRateLimits.High,
+            }),
+        }));
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, r);
+        expect(response.body).toBeDefined();
+        expect(response.body.id).toEqual(apiUserId);
+        expect(response.body.meta?.rateLimits).toEqual(ApiUserRateLimits.High);
+    });
+
+    test('An organization admin cannot alter rate limits', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+        const createResponse = await testServer.test(createEndpoint, createRequest);
+
+        const apiUserId = createResponse.body.id;
+
+        const r = Request.buildJson('PATCH', '/api-keys/' + apiUserId, organization.getApiHost(), ApiUser.patch({
+            id: apiUserId,
+            meta: UserMeta.patch({
+                rateLimits: ApiUserRateLimits.High,
+            }),
+        }));
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        await expect(testServer.test(endpoint, r)).rejects.toThrow(SHExpect.simpleError({
+            code: 'permission_denied',
+        }));
+    });
+
+    test('You cannot grant an API-key permissions outside its organization using a put', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+        const createResponse = await testServer.test(createEndpoint, createRequest);
+        const apiUserId = createResponse.body.id;
+
+        const r = Request.buildJson('PATCH', '/api-keys/' + apiUserId, organization.getApiHost(), ApiUser.patch({
+            id: apiUserId,
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                    ['other', Permissions.create({ level: PermissionLevel.Full })],
+                ]),
+                globalPermissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }),
+        }));
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, r);
+        expect(response.body).toBeDefined();
+        expect(response.body.id).toEqual(apiUserId);
+        expect(response.body.permissions).toEqual(
+            UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+                globalPermissions: null,
+            }),
+        );
+    });
+
+    test('You cannot grant an API-key permissions outside its organization using a patch', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+        const createResponse = await testServer.test(createEndpoint, createRequest);
+        const apiUserId = createResponse.body.id;
+
+        const r = Request.buildJson('PATCH', '/api-keys/' + apiUserId, organization.getApiHost(), ApiUser.patch({
+            id: apiUserId,
+            permissions: UserPermissions.patch({
+                organizationPermissions: new PatchMap([
+                    ['other', Permissions.create({ level: PermissionLevel.Full })],
+                ]),
+                globalPermissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }),
+        }));
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, r);
+        expect(response.body).toBeDefined();
+        expect(response.body.id).toEqual(apiUserId);
+        expect(response.body.permissions).toEqual(
+            UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+                globalPermissions: null,
+            }),
+        );
+    });
+
+    test('You can grant an API-key permissions using a patch', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+        const createResponse = await testServer.test(createEndpoint, createRequest);
+        const apiUserId = createResponse.body.id;
+
+        const r = Request.buildJson('PATCH', '/api-keys/' + apiUserId, organization.getApiHost(), ApiUser.patch({
+            id: apiUserId,
+            permissions: UserPermissions.patch({
+                organizationPermissions: new PatchMap([
+                    [organization.id, Permissions.patch({
+                        resources: new PatchMap([[
+                            PermissionsResourceType.Groups,
+                            new Map([
+                                ['group-id', ResourcePermissions.create({
+                                    level: PermissionLevel.Full,
+                                })],
+                            ]),
+                        ]]),
+                    })],
+                ]),
+            }),
+        }));
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, r);
+        expect(response.body).toBeDefined();
+        expect(response.body.id).toEqual(apiUserId);
+        expect(response.body.permissions).toEqual(
+            UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({
+                        level: PermissionLevel.Read,
+                        resources: new Map([[
+                            PermissionsResourceType.Groups,
+                            new Map([
+                                ['group-id', ResourcePermissions.create({
+                                    level: PermissionLevel.Full,
+                                })],
+                            ]),
+                        ]]),
+                    })],
+                ]),
+                globalPermissions: null,
+            }),
+        );
+    });
+});

package/src/endpoints/{auth → organization/dashboard/users}/PatchApiUserEndpoint.ts

@@ -1,17 +1,16 @@
-import { AutoEncoderPatchType, Decoder } from '@simonbackx/simple-encoding';
+import { AutoEncoderPatchType, Decoder, isPatch } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Token, User } from '@stamhoofd/models';
-import { ApiUser, PermissionLevel, UserPermissions } from '@stamhoofd/structures';
-
-import { Context } from '../../helpers/Context';
+import { ApiUser, PermissionLevel, UserMeta, UserPermissions } from '@stamhoofd/structures';
+import { Context } from '../../../../helpers/Context';
 
 type Params = { id: string };
 type Query = undefined;
 type Body = AutoEncoderPatchType<ApiUser>;
 type ResponseBody = ApiUser;
 
-export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+export class PatchApiUserEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
     bodyDecoder = ApiUser.patchType() as Decoder<AutoEncoderPatchType<ApiUser>>;
 
     protected doesMatch(request: Request): [true, Params] | [false] {
@@ -85,6 +84,26 @@ export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBod
             }
         }
 
+        if (request.body.meta) {
+            if (!isPatch(request.body.meta)) {
+                throw new SimpleError({
+                    code: 'invalid_request',
+                    message: 'Invalid request: meta is not a patch',
+                    statusCode: 400,
+                });
+            }
+
+            const rateLimits = request.body.meta.rateLimits;
+            if (rateLimits && rateLimits !== editUser.meta?.rateLimits) {
+                if (!Context.auth.hasPlatformFullAccess()) {
+                    throw Context.auth.error($t('Je hebt geen rechten om de rate limits van API-keys te wijzigen'));
+                }
+
+                editUser.meta = editUser.meta ?? UserMeta.create({});
+                editUser.meta.rateLimits = rateLimits;
+            }
+        }
+
         await editUser.save();
 
         return new Response(await Token.getAPIUserWithToken(editUser));

package/src/endpoints/organization/shared/auth/GetOrganizationEndpoint.test.ts

@@ -2,6 +2,7 @@ import { Request } from '@simonbackx/simple-endpoints';
 import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
 import { Organization, PermissionLevel, Permissions } from '@stamhoofd/structures';
 
+import { TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../../tests/helpers/TestServer';
 import { GetOrganizationEndpoint } from './GetOrganizationEndpoint';
 
@@ -9,6 +10,10 @@ describe('Endpoint.GetOrganization', () => {
     // Test endpoint
     const endpoint = new GetOrganizationEndpoint();
 
+    beforeEach(async () => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
     test('Get organization as signed in user', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();

package/src/endpoints/organization/webshops/GetWebshopEndpoint.test.ts

@@ -1,7 +1,8 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { OrganizationFactory, Token, UserFactory, WebshopFactory } from '@stamhoofd/models';
-import { PermissionLevel, Permissions, PrivateWebshop, Webshop as WebshopStruct } from '@stamhoofd/structures';
+import { PermissionLevel, Permissions } from '@stamhoofd/structures';
 
+import { TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer';
 import { GetWebshopEndpoint } from './GetWebshopEndpoint';
 
@@ -9,6 +10,10 @@ describe('Endpoint.GetWebshop', () => {
     // Test endpoint
     const endpoint = new GetWebshopEndpoint();
 
+    beforeEach(async () => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
     test('Get webshop as signed in user', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();

package/src/excel-loaders/event-notifications.ts

@@ -0,0 +1,133 @@
+import { XlsxBuiltInNumberFormat, XlsxTransformerSheet } from '@stamhoofd/excel-writer';
+import { EventNotification, EventNotificationStatus, EventNotificationStatusHelper, ExcelExportType, LimitedFilteredRequest, Platform as PlatformStruct } from '@stamhoofd/structures';
+import { Formatter } from '@stamhoofd/utility';
+import { GetEventNotificationsEndpoint } from '../endpoints/global/events/GetEventNotificationsEndpoint';
+import { ExportToExcelEndpoint } from '../endpoints/global/files/ExportToExcelEndpoint';
+import { XlsxTransformerColumnHelper } from '../helpers/XlsxTransformerColumnHelper';
+
+// Assign to a typed variable to assure we have correct type checking in place
+const sheet: XlsxTransformerSheet<EventNotification, EventNotification> = {
+    id: 'event-notifications',
+    name: 'Meldingen',
+    columns: [
+        {
+            id: 'id',
+            name: 'ID',
+            width: 40,
+            getValue: (notification: EventNotification) => ({
+                value: notification.id,
+            }),
+        },
+        {
+            id: 'name',
+            name: 'Naam activiteit',
+            width: 40,
+            getValue: (notification: EventNotification) => ({
+                value: notification.events.map(e => e.name).join(', '),
+            }),
+        },
+        {
+            id: 'organization.name',
+            name: 'Groep',
+            width: 40,
+            getValue: (notification: EventNotification) => ({
+                value: notification.organization.name,
+            }),
+        },
+        {
+            id: 'organization.uri',
+            name: 'Groepsnummer',
+            width: 30,
+            getValue: (notification: EventNotification) => ({
+                value: notification.organization.uri,
+            }),
+        },
+        {
+            id: 'status',
+            name: 'Status',
+            width: 30,
+            getValue: (notification: EventNotification) => ({
+                value: Formatter.capitalizeFirstLetter(EventNotificationStatusHelper.getName(notification.status)),
+            }),
+        },
+        {
+            id: 'feedbackText',
+            name: 'Opmerkingen',
+            width: 80,
+            getValue: (notification: EventNotification) => ({
+                value: notification.status !== EventNotificationStatus.Accepted ? notification.feedbackText : null,
+                style: {
+                    alignment: {
+                        wrapText: true,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'startDate',
+            name: 'Startdatum',
+            width: 20,
+            getValue: (notification: EventNotification) => ({
+                value: notification.startDate,
+                style: {
+                    numberFormat: {
+                        id: XlsxBuiltInNumberFormat.DateSlash,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'endDate',
+            name: 'Einddatum',
+            width: 20,
+            getValue: (notification: EventNotification) => ({
+                value: notification.endDate,
+                style: {
+                    numberFormat: {
+                        id: XlsxBuiltInNumberFormat.DateSlash,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'submittedAt',
+            name: 'Ingediend op',
+            width: 20,
+            getValue: (notification: EventNotification) => ({
+                value: notification.submittedAt,
+                style: {
+                    numberFormat: {
+                        id: XlsxBuiltInNumberFormat.DateSlash,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'submittedBy',
+            name: 'Ingediend door',
+            width: 40,
+            getValue: (notification: EventNotification) => ({
+                value: notification.submittedBy?.name ?? '',
+            }),
+        },
+
+        // Dynamic records
+        XlsxTransformerColumnHelper.createRecordAnswersColumns({
+            matchId: 'recordAnswers',
+            getRecordAnswers: (notification: EventNotification) => notification.recordAnswers,
+            getRecordCategories: () => {
+                const platform = PlatformStruct.shared;
+                return platform.config.eventNotificationTypes.flatMap(r => r.recordCategories);
+            },
+        }),
+    ],
+};
+
+ExportToExcelEndpoint.loaders.set(ExcelExportType.EventNotifications, {
+    fetch: async (query: LimitedFilteredRequest) => {
+        return await GetEventNotificationsEndpoint.buildData(query);
+    },
+    sheets: [
+        sheet,
+    ],
+});

package/src/excel-loaders/index.ts

@@ -0,0 +1,5 @@
+import './members';
+import './payments';
+import './organizations';
+import './receivable-balances';
+import './event-notifications';