@stamhoofd/backend 2.83.5 → 2.84.1

package/src/endpoints/global/events/PatchEventNotificationsEndpoint.test.ts

@@ -1,9 +1,9 @@
 import { PatchableArray, PatchMap, patchObject } from '@simonbackx/simple-encoding';
 import { Endpoint, Request } from '@simonbackx/simple-endpoints';
 import { EmailMocker } from '@stamhoofd/email';
-import { EmailTemplateFactory, EventFactory, EventNotification, EventNotificationFactory, EventNotificationTypeFactory, Organization, OrganizationFactory, RecordAnswerFactory, RecordCategoryFactory, RegistrationPeriodFactory, Token, User, UserFactory } from '@stamhoofd/models';
+import { EmailTemplateFactory, EventFactory, EventNotification, EventNotificationFactory, EventNotificationTypeFactory, Organization, OrganizationFactory, Platform, RecordAnswerFactory, RecordCategoryFactory, RegistrationPeriod, RegistrationPeriodFactory, Token, User, UserFactory } from '@stamhoofd/models';
 import { AccessRight, BaseOrganization, EmailTemplateType, Event, EventNotificationStatus, EventNotification as EventNotificationStruct, Permissions, PermissionsResourceType, RecordType, ResourcePermissions } from '@stamhoofd/structures';
-import { SHExpect, TestUtils } from '@stamhoofd/test-utils';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer';
 import { PatchEventNotificationsEndpoint } from './PatchEventNotificationsEndpoint';
 
@@ -150,7 +150,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         );
 
         await expect(TestRequest.patch({ body, user, organization })).rejects.toThrow(
-            SHExpect.simpleError({ code: 'invalid_field', field: 'typeId' }),
+            STExpect.simpleError({ code: 'invalid_field', field: 'typeId' }),
         );
     });
 
@@ -175,11 +175,17 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         );
 
         await expect(TestRequest.patch({ body, user, organization })).rejects.toThrow(
-            SHExpect.simpleError({ code: 'invalid_field', field: 'events' }),
+            STExpect.simpleError({ code: 'invalid_field', field: 'events' }),
         );
     });
 
     test('It throws when trying to create an event notification for a locked period', async () => {
+        // Clear all periods and organizations (to make sure the right locked period is used)
+        const platform = await Platform.getForEditing();
+        await platform.delete();
+        await Organization.delete();
+        await RegistrationPeriod.delete();
+
         await new RegistrationPeriodFactory({
             startDate: new Date(2050, 0, 1),
             endDate: new Date(2051, 11, 31),
@@ -209,7 +215,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
             }),
         );
         await expect(TestRequest.patch({ body, user, organization })).rejects.toThrow(
-            SHExpect.simpleError({ code: 'invalid_period', field: 'startDate' }),
+            STExpect.simpleError({ code: 'invalid_period', field: 'startDate' }),
         );
     });
 
@@ -237,7 +243,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         );
 
         await expect(TestRequest.patch({ body, user, organization })).rejects.toThrow(
-            SHExpect.simpleError({ code: 'invalid_field', field: 'events' }),
+            STExpect.simpleError({ code: 'invalid_field', field: 'events' }),
         );
     });
 
@@ -268,7 +274,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
             submittedBy: expect.objectContaining({ id: user.id }),
         });
 
-        expect(EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([
+        expect(await EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([
             expect.objectContaining({
                 to: 'event-notification-reviewer@example.com',
                 subject: EmailTemplateType.EventNotificationSubmittedReviewer,
@@ -314,7 +320,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
             submittedBy: expect.objectContaining({ id: user.id }),
         });
 
-        expect(EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([
+        expect(await EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([
             expect.objectContaining({
                 to: 'event-notification-reviewer@example.com',
                 subject: EmailTemplateType.EventNotificationSubmittedReviewer,
@@ -360,7 +366,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
             submittedBy: expect.objectContaining({ id: user.id }),
         });
 
-        expect(EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([
+        expect(await EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([
             expect.objectContaining({
                 to: 'event-notification-reviewer@example.com',
                 subject: EmailTemplateType.EventNotificationSubmittedReviewer,
@@ -397,7 +403,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         );
 
         await expect(TestRequest.patch({ body, user, organization })).rejects.toThrow(
-            SHExpect.simpleError({ code: 'permission_denied' }),
+            STExpect.simpleError({ code: 'permission_denied' }),
         );
     });
 
@@ -423,7 +429,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         );
 
         await expect(TestRequest.patch({ body, user, organization })).rejects.toThrow(
-            SHExpect.simpleError({ code: 'permission_denied' }),
+            STExpect.simpleError({ code: 'permission_denied' }),
         );
     });
 
@@ -449,7 +455,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         );
 
         await expect(TestRequest.patch({ body, user, organization })).rejects.toThrow(
-            SHExpect.simpleError({ code: 'permission_denied' }),
+            STExpect.simpleError({ code: 'permission_denied' }),
         );
     });
 
@@ -475,7 +481,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         );
 
         await expect(TestRequest.patch({ body, user, organization })).rejects.toThrow(
-            SHExpect.simpleError({ code: 'permission_denied' }),
+            STExpect.simpleError({ code: 'permission_denied' }),
         );
     });
 
@@ -501,7 +507,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         );
 
         await expect(TestRequest.patch({ body, user, organization })).rejects.toThrow(
-            SHExpect.simpleError({ code: 'permission_denied' }),
+            STExpect.simpleError({ code: 'permission_denied' }),
         );
     });
 
@@ -584,7 +590,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         );
 
         await expect(TestRequest.patch({ body, user, organization })).rejects.toThrow(
-            SHExpect.simpleError({ code: 'permission_denied' }),
+            STExpect.simpleError({ code: 'permission_denied' }),
         );
     });
 
@@ -638,7 +644,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         });
 
         // Check mails
-        expect(EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([
+        expect(await EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([
             expect.objectContaining({
                 to: user.email,
                 subject: EmailTemplateType.EventNotificationAccepted,
@@ -699,7 +705,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         });
 
         // Check mails
-        expect(EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([
+        expect(await EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([
             expect.objectContaining({
                 to: user.email,
                 subject: EmailTemplateType.EventNotificationPartiallyAccepted,
@@ -761,7 +767,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         });
 
         // Check mails
-        expect(EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([
+        expect(await EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([
             expect.objectContaining({
                 to: user.email,
                 subject: EmailTemplateType.EventNotificationRejected,
@@ -821,7 +827,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         });
 
         // Check mails
-        expect(EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([]);
+        expect(await EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([]);
     });
 
     test('An admin can edit an accepted event notification', async () => {
@@ -884,7 +890,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         });
 
         // Check mails
-        expect(EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([]);
+        expect(await EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([]);
     });
 
     test('An admin can delete an event notification', async () => {
@@ -928,7 +934,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         expect(result.body).toHaveLength(0);
 
         // Check mails
-        expect(EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([]);
+        expect(await EmailMocker.transactional.getSucceededEmails()).toIncludeSameMembers([]);
 
         // Check not exists
         const model = await EventNotification.getByID(eventNotification.id);
@@ -972,7 +978,7 @@ describe('Endpoint.PatchEventNotificationsEndpoint', () => {
         );
 
         await expect(TestRequest.patch({ body, user, organization })).rejects.toThrow(
-            SHExpect.simpleError({ code: 'permission_denied' }),
+            STExpect.simpleError({ code: 'permission_denied' }),
         );
     });
 });

package/src/endpoints/global/events/PatchEventsEndpoint.ts

@@ -32,6 +32,47 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
         return [false];
     }
 
+    async putEventGroup(event: Event, putGroup: GroupStruct) {
+        const period = await RegistrationPeriod.getByDate(event.startDate);
+
+        if (!period) {
+            throw new SimpleError({
+                code: 'invalid_period',
+                message: 'No period found for this start date',
+                human: Context.i18n.$t('5959a6a9-064a-413c-871f-c74a145ed569'),
+                field: 'startDate',
+            });
+        }
+
+        let group = await Group.getByID(putGroup.id);
+        const groupOrganizationId = group?.organizationId ?? putGroup.organizationId;
+
+        if (event.organizationId && groupOrganizationId !== event.organizationId) {
+            // Silently ignore organizationId if it is invalid
+            putGroup.organizationId = event.organizationId;
+        }
+
+        if (!group) {
+            putGroup.type = GroupType.EventRegistration;
+
+            group = await PatchOrganizationRegistrationPeriodsEndpoint.createGroup(
+                putGroup,
+                putGroup.organizationId,
+                period,
+            );
+        }
+        else {
+            if (group.type !== GroupType.EventRegistration) {
+                throw new SimpleError({
+                    code: 'invalid_group',
+                    message: 'Group is not of type EventRegistration',
+                });
+            }
+        }
+
+        return group;
+    }
+
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOptionalOrganizationScope();
         await Context.authenticate();
@@ -83,7 +124,7 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
                 });
             }
 
-            const eventOrganization = await this.checkEventAccess(event);
+            const eventOrganization = await Context.auth.checkEventAccess(event);
             event.id = put.id;
             event.name = put.name;
             event.startDate = put.startDate;
@@ -95,23 +136,7 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
             await PatchEventsEndpoint.checkEventLimits(event);
 
             if (put.group) {
-                const period = await RegistrationPeriod.getByDate(event.startDate);
-
-                if (!period) {
-                    throw new SimpleError({
-                        code: 'invalid_period',
-                        message: 'No period found for this start date',
-                        human: Context.i18n.$t('5959a6a9-064a-413c-871f-c74a145ed569'),
-                        field: 'startDate',
-                    });
-                }
-
-                put.group.type = GroupType.EventRegistration;
-                const group = await PatchOrganizationRegistrationPeriodsEndpoint.createGroup(
-                    put.group,
-                    put.group.organizationId,
-                    period,
-                );
+                const group = await this.putEventGroup(event, put.group);
                 await AuditLogService.setContext({ source: AuditLogSource.System }, async () => {
                     await event.syncGroupRequirements(group);
                 });
@@ -140,7 +165,7 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
                 });
             }
 
-            await this.checkEventAccess(event);
+            await Context.auth.checkEventAccess(event);
 
             if (patch.meta?.organizationCache) {
                 throw new SimpleError({
@@ -186,7 +211,7 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
                 });
             }
 
-            const eventOrganization = await this.checkEventAccess(event);
+            const eventOrganization = await Context.auth.checkEventAccess(event);
             if (eventOrganization) {
                 event.meta.organizationCache = NamedObject.create({ id: eventOrganization.id, name: eventOrganization.name });
             }
@@ -206,6 +231,8 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
 
             await PatchEventsEndpoint.checkEventLimits(event);
 
+            let group: Group | null = null;
+
             if (patch.group !== undefined) {
                 if (patch.group === null) {
                     // delete
@@ -226,33 +253,22 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     patch.group.type = GroupType.EventRegistration;
 
                     const period = await RegistrationPeriod.getByDate(event.startDate);
-                    await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(patch.group, period);
+                    group = await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(patch.group, period);
                 }
                 else {
-                    if (event.groupId) {
-                        // need to delete old group first
-                        await PatchOrganizationRegistrationPeriodsEndpoint.deleteGroup(event.groupId);
-                        event.groupId = null;
+                    if (event.groupId === patch.group.id) {
+                        // ignore: bad practice: puts are not allowed like this
+                        // risk of deleting data
                     }
-                    patch.group.type = GroupType.EventRegistration;
-
-                    const period = await RegistrationPeriod.getByDate(event.startDate);
-
-                    if (!period) {
-                        throw new SimpleError({
-                            code: 'invalid_period',
-                            message: 'No period found for this start date',
-                            human: Context.i18n.$t('5959a6a9-064a-413c-871f-c74a145ed569'),
-                            field: 'startDate',
-                        });
+                    else {
+                        if (event.groupId) {
+                            // need to delete old group first
+                            await PatchOrganizationRegistrationPeriodsEndpoint.deleteGroup(event.groupId);
+                            event.groupId = null;
+                        }
+                        group = await this.putEventGroup(event, patch.group);
+                        event.groupId = group.id;
                     }
-
-                    const group = await PatchOrganizationRegistrationPeriodsEndpoint.createGroup(
-                        patch.group,
-                        patch.group.organizationId,
-                        period,
-                    );
-                    event.groupId = group.id;
                 }
             }
             else {
@@ -262,13 +278,33 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     if (event.groupId) {
                         await AuditLogService.setContext({ source: AuditLogSource.System }, async () => {
                             if (event.groupId) {
-                                await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(GroupStruct.patch({ id: event.groupId }), period);
+                                group = await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(GroupStruct.patch({ id: event.groupId }), period);
                             }
                         });
                     }
                 }
             }
 
+            if (group || patch.organizationId !== undefined) {
+                if (event.organizationId === null) {
+                    // No validation required
+                }
+                else {
+                    // Validate organizationId of group
+                    if (event.groupId) {
+                        group = group ?? (await Group.getByID(event.groupId) ?? null);
+
+                        if (group && group.organizationId !== event.organizationId) {
+                            throw new SimpleError({
+                                code: 'invalid_group',
+                                message: 'Group is not of the same organization',
+                                human: $t('1f64237b-84c4-43e7-b752-2875fd1eb075'),
+                            });
+                        }
+                    }
+                }
+            }
+
             if (type.isLocationRequired === true) {
                 PatchEventsEndpoint.throwIfAddressIsMissing(event);
             }
@@ -293,7 +329,7 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
                 throw new SimpleError({ code: 'not_found', message: 'Event not found', statusCode: 404 });
             }
 
-            await this.checkEventAccess(event);
+            await Context.auth.checkEventAccess(event);
 
             if (event.groupId) {
                 await PatchOrganizationRegistrationPeriodsEndpoint.deleteGroup(event.groupId);
@@ -415,10 +451,6 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
         }
     }
 
-    private async checkEventAccess(event: Event) {
-        return await Context.auth.checkEventAccess(event);
-    }
-
     private static throwIfAddressIsMissing(event: Event) {
         const address = event.meta.location?.address;
 

package/src/endpoints/global/files/UploadFile.ts

@@ -1,15 +1,16 @@
+import { PutObjectCommand, S3Client } from '@aws-sdk/client-s3'; // ES Modules import
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { File } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
-import AWS from 'aws-sdk';
 import formidable from 'formidable';
 import { promises as fs } from 'fs';
 import { v4 as uuidv4 } from 'uuid';
 
+import { AutoEncoder, BooleanDecoder, Decoder, field } from '@simonbackx/simple-encoding';
 import { Context } from '../../../helpers/Context';
 import { limiter } from './UploadImage';
-import { AutoEncoder, BooleanDecoder, Decoder, field } from '@simonbackx/simple-encoding';
+import { Image } from '@stamhoofd/models';
 
 type Params = Record<string, never>;
 class Query extends AutoEncoder {
@@ -115,12 +116,6 @@ export class UploadFile extends Endpoint<Params, Query, Body, ResponseBody> {
 
         const fileContent = await fs.readFile(file.filepath);
 
-        const s3 = new AWS.S3({
-            endpoint: STAMHOOFD.SPACES_ENDPOINT,
-            accessKeyId: STAMHOOFD.SPACES_KEY,
-            secretAccessKey: STAMHOOFD.SPACES_SECRET,
-        });
-
         let prefix = (STAMHOOFD.SPACES_PREFIX ?? '');
         if (prefix.length > 0) {
             prefix += '/';
@@ -175,13 +170,6 @@ export class UploadFile extends Endpoint<Params, Query, Body, ResponseBody> {
 
         const filenameWithoutExt = file.originalFilename?.split('.').slice(0, -1).join('.') ?? fileId;
         const key = prefix + fileId + '/' + (Formatter.slug(filenameWithoutExt) + (uploadExt ? ('.' + uploadExt) : ''));
-        const params = {
-            Bucket: STAMHOOFD.SPACES_BUCKET,
-            Key: key,
-            Body: fileContent, // TODO
-            ContentType: file.mimetype ?? 'application/pdf',
-            ACL: request.query.isPrivate ? 'private' : 'public-read',
-        };
 
         const fileStruct = new File({
             id: fileId,
@@ -204,7 +192,14 @@ export class UploadFile extends Endpoint<Params, Query, Body, ResponseBody> {
             }
         }
 
-        await s3.putObject(params).promise();
+        const cmd = new PutObjectCommand({
+            Bucket: STAMHOOFD.SPACES_BUCKET,
+            Key: key,
+            Body: fileContent,
+            ContentType: file.mimetype ?? 'application/pdf',
+            ACL: request.query.isPrivate ? 'private' : 'public-read',
+        });
+        await Image.getS3Client().send(cmd);
 
         return new Response(fileStruct);
     }