npm - @stamhoofd/backend - Versions diffs - 2.90.3 → 2.92.0 - Mend

@stamhoofd/backend 2.90.3 → 2.92.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (47) hide show

package/src/endpoints/global/email/PatchEmailEndpoint.test.ts CHANGED Viewed

@@ -1,9 +1,10 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { Email, Organization, OrganizationFactory, RegistrationPeriod, RegistrationPeriodFactory, Token, User, UserFactory } from '@stamhoofd/models';
-import { EmailStatus, Email as EmailStruct, PermissionLevel, Permissions, Version } from '@stamhoofd/structures';
-import { TestUtils } from '@stamhoofd/test-utils';
+import { AccessRight, EmailStatus, Email as EmailStruct, OrganizationEmail, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions, Version } from '@stamhoofd/structures';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer';
 import { PatchEmailEndpoint } from './PatchEmailEndpoint';
+import { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
 const baseUrl = `/v${Version}/email`;
@@ -13,8 +14,13 @@ describe('Endpoint.PatchEmailEndpoint', () => {
     let organization: Organization;
     let token: Token;
     let user: User;
+    let sender: OrganizationEmail;
+    let sender2: OrganizationEmail;
-    const patchEmail = async (email: EmailStruct, token: Token, organization?: Organization) => {
+    let token2: Token;
+    let user2: User;
+    const patchEmail = async (email: AutoEncoderPatchType<EmailStruct>, token: Token, organization?: Organization) => {
         const id = email.id;
         const request = Request.buildJson('PATCH', `${baseUrl}/${id}`, organization?.getApiHost(), email);
         request.headers.authorization = 'Bearer ' + token.accessToken;
@@ -34,15 +40,360 @@ describe('Endpoint.PatchEmailEndpoint', () => {
         organization = await new OrganizationFactory({ period })
             .create();
+        sender = OrganizationEmail.create({
+            email: 'groepsleiding@voorbeeld.com',
+            name: 'Groepsleiding',
+        });
+        sender2 = OrganizationEmail.create({
+            email: 'kapoenen@voorbeeld.com',
+            name: 'Kapoenen',
+        });
+        organization.privateMeta.emails.push(sender);
+        organization.privateMeta.emails.push(sender2);
+        await organization.save();
         user = await new UserFactory({
             organization,
             permissions: Permissions.create({
-                level: PermissionLevel.Read,
+                level: PermissionLevel.None,
+                resources: new Map([
+                    [PermissionsResourceType.Senders, new Map([[sender.id, ResourcePermissions.create({
+                        resourceName: sender.name!,
+                        level: PermissionLevel.None,
+                        accessRights: [AccessRight.SendMessages],
+                    })]])],
+                ]),
             }),
         })
             .create();
         token = await Token.createToken(user);
+        user2 = await new UserFactory({
+            organization,
+            permissions: Permissions.create({
+                level: PermissionLevel.None,
+                resources: new Map([
+                    [PermissionsResourceType.Senders, new Map([[sender2.id, ResourcePermissions.create({
+                        resourceName: sender.name!,
+                        level: PermissionLevel.Write,
+                        accessRights: [AccessRight.SendMessages],
+                    })]])],
+                ]),
+            }),
+        })
+            .create();
+        token2 = await Token.createToken(user2);
+    });
+    test('Should throw for invalid senderId', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id;
+        email.organizationId = organization.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            status: EmailStatus.Sending,
+            senderId: 'invalid-sender-id',
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('invalid_sender'));
+    });
+    test('Should throw when patching other users email without sender id', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user2.id;
+        email.organizationId = organization.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            subject: 'new subject',
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('permission_denied'));
+    });
+    test('Should throw when patching other users email even when matching sender', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user2.id;
+        email.organizationId = organization.id;
+        email.senderId = sender.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            subject: 'new subject',
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('permission_denied'));
+    });
+    test('Should not throw when patching other users email when having write access to sender', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id; // other user
+        email.organizationId = organization.id;
+        email.senderId = sender2.id; // write access to this sender
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            subject: 'new subject',
+        });
+        await expect(patchEmail(body, token2, organization)).toResolve();
+    });
+    test('Should throw when patching if no permission for sender', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id;
+        email.organizationId = organization.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            senderId: sender2.id,
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('permission_denied'));
+    });
+    test('Should throw when sending if no permission for sender', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id;
+        email.organizationId = organization.id;
+        email.senderId = sender2.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            status: EmailStatus.Sending,
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('permission_denied'));
     });
     test('Should throw error if no unsubscribe button in email html', async () => {
@@ -84,11 +435,11 @@ describe('Endpoint.PatchEmailEndpoint', () => {
         await email.save();
-        const body = EmailStruct.create({ ...email, fromAddress: 'test@test.be', status: EmailStatus.Sending });
+        const body = EmailStruct.patch({ id: email.id, senderId: sender.id, status: EmailStatus.Sending });
         await expect(async () => await patchEmail(body, token, organization))
             .rejects
-            .toThrow('Missing unsubscribe button');
+            .toThrow(STExpect.errorWithCode('missing_unsubscribe_button'));
     });
     test('Should throw error if no unsubscribe button in email text', async () => {
@@ -130,10 +481,55 @@ describe('Endpoint.PatchEmailEndpoint', () => {
         await email.save();
-        const body = EmailStruct.create({ ...email, fromAddress: 'test@test.be', status: EmailStatus.Sending });
+        const body = EmailStruct.patch({ id: email.id, senderId: sender.id, status: EmailStatus.Sending });
         await expect(async () => await patchEmail(body, token, organization))
             .rejects
-            .toThrow('Missing unsubscribe button');
+            .toThrow(STExpect.errorWithCode('missing_unsubscribe_button'));
+    });
+    test('Can send an email', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email {{unsubscribeUrl}}</p>
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id;
+        email.organizationId = organization.id;
+        email.senderId = sender.id;
+        await email.save();
+        const body = EmailStruct.patch({ id: email.id, status: EmailStatus.Sending });
+        await expect(patchEmail(body, token, organization)).toResolve();
     });
 });

package/src/endpoints/global/email/PatchEmailEndpoint.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
-import { Email } from '@stamhoofd/models';
-import { EmailPreview, EmailStatus, Email as EmailStruct } from '@stamhoofd/structures';
+import { Email, Platform } from '@stamhoofd/models';
+import { EmailPreview, EmailStatus, Email as EmailStruct, PermissionLevel } from '@stamhoofd/structures';
 import { AutoEncoderPatchType, Decoder, patchObject } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
@@ -29,14 +29,15 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOptionalOrganizationScope();
-        const { user } = await Context.authenticate();
+        await Context.authenticate();
-        if (!Context.auth.canSendEmails()) {
+        if (!await Context.auth.canReadEmails(organization)) {
+            // Fast fail before query
             throw Context.auth.error();
         }
         const model = await Email.getByID(request.params.id);
-        if (!model || model.userId !== user.id || (model.organizationId !== (organization?.id ?? null))) {
+        if (!model || (model.organizationId !== (organization?.id ?? null))) {
             throw new SimpleError({
                 code: 'not_found',
                 human: 'Email not found',
@@ -45,6 +46,10 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             });
         }
+        if (!await Context.auth.canAccessEmail(model, PermissionLevel.Write)) {
+            throw Context.auth.error();
+        }
         if (model.status !== EmailStatus.Draft) {
             throw new SimpleError({
                 code: 'not_draft',
@@ -60,6 +65,47 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             model.subject = request.body.subject;
         }
+        if (request.body.senderId !== undefined) {
+            const list = organization ? organization.privateMeta.emails : (await Platform.getShared()).privateConfig.emails;
+            const sender = list.find(e => e.id === request.body.senderId);
+            if (sender) {
+                if (!await Context.auth.canSendEmailsFrom(organization, sender.id)) {
+                    throw Context.auth.error({
+                        message: 'Cannot send emails from this sender',
+                        human: $t('1b509614-30b0-484c-af72-57d4bc9ea788'),
+                    });
+                }
+                model.senderId = sender.id;
+                model.fromAddress = sender.email;
+                model.fromName = sender.name;
+            }
+            else {
+                throw new SimpleError({
+                    code: 'invalid_sender',
+                    human: 'Sender not found',
+                    message: $t(`94adb4e0-2ef1-4ee8-9f02-5a76efa51c1d`),
+                    statusCode: 400,
+                });
+            }
+        }
+        else if (model.senderId) {
+            // Update data, to avoid sending from an old address
+            const list = organization ? organization.privateMeta.emails : (await Platform.getShared()).privateConfig.emails;
+            const sender = list.find(e => e.id === model.senderId);
+            if (sender) {
+                model.fromAddress = sender.email;
+                model.fromName = sender.name;
+            }
+            else {
+                throw new SimpleError({
+                    code: 'invalid_sender',
+                    human: 'Sender not found',
+                    message: $t(`f08cccb3-faf9-473f-b729-16120fadec9c`),
+                    statusCode: 400,
+                });
+            }
+        }
         if (request.body.html !== undefined) {
             model.html = request.body.html;
         }
@@ -72,14 +118,6 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             model.json = request.body.json;
         }
-        if (request.body.fromAddress !== undefined) {
-            model.fromAddress = request.body.fromAddress;
-        }
-        if (request.body.fromName !== undefined) {
-            model.fromName = request.body.fromName;
-        }
         if (request.body.recipientFilter) {
             model.recipientFilter = patchObject(model.recipientFilter, request.body.recipientFilter);
             rebuild = true;
@@ -102,19 +140,26 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
         }
         if (request.body.status === EmailStatus.Sending || request.body.status === EmailStatus.Sent) {
+            if (!await Context.auth.canSendEmail(model)) {
+                throw Context.auth.error({
+                    message: 'Cannot send emails from this sender',
+                    human: $t('1b509614-30b0-484c-af72-57d4bc9ea788'),
+                });
+            }
             model.throwIfNotReadyToSend();
             const replacement = '{{unsubscribeUrl}}';
             if (model.html) {
                 // Check email contains an unsubscribe button
                 if (!model.html.includes(replacement)) {
                     throw new SimpleError({
-                        code: "missing_unsubscribe_button",
-                        message: "Missing unsubscribe button",
+                        code: 'missing_unsubscribe_button',
+                        message: 'Missing unsubscribe button',
                         human: $t(`dd55e04b-e5d9-4d9a-befc-443eef4175a8`),
-                        field: "html"
-                    })
+                        field: 'html',
+                    });
                 }
             }
@@ -122,11 +167,11 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 // Check email contains an unsubscribe button
                 if (!model.text.includes(replacement)) {
                     throw new SimpleError({
-                        code: "missing_unsubscribe_button",
-                        message: "Missing unsubscribe button",
+                        code: 'missing_unsubscribe_button',
+                        message: 'Missing unsubscribe button',
                         human: $t(`dd55e04b-e5d9-4d9a-befc-443eef4175a8`),
-                        field: "text"
-                    })
+                        field: 'text',
+                    });
                 }
             }

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.ts CHANGED Viewed

@@ -3,7 +3,7 @@ import { AutoEncoderPatchType, ConvertArrayToPatchableArray, Decoder, isEmptyPat
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { AuditLog, BalanceItem, Document, Group, Member, MemberFactory, MemberPlatformMembership, MemberResponsibilityRecord, MemberWithRegistrations, mergeTwoMembers, Organization, Platform, RateLimiter, Registration, RegistrationPeriod, User } from '@stamhoofd/models';
-import { AuditLogReplacement, AuditLogReplacementType, AuditLogSource, AuditLogType, EmergencyContact, GroupType, MemberDetails, MemberResponsibility, MembersBlob, MemberWithRegistrationsBlob, Parent, PermissionLevel } from '@stamhoofd/structures';
+import { AuditLogReplacement, AuditLogReplacementType, AuditLogSource, AuditLogType, EmergencyContact, GroupType, MemberDetails, MemberResponsibility, MembersBlob, MemberWithRegistrationsBlob, Parent, PermissionLevel, SetupStepType } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { Email } from '@stamhoofd/email';
@@ -317,7 +317,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
                     throw new SimpleError({
                         code: 'invalid_field',
                         message: 'Invalid organization',
-                        human: Context.i18n.$t('d41cdbe3-57e3-4a2e-83bc-cb9e65c9c840'),
+                        human: platformResponsibility ? $t('ec6a555e-6bb1-4b5f-b17e-38eaa8a478b5') : $t('d41cdbe3-57e3-4a2e-83bc-cb9e65c9c840'),
                     });
                 }
@@ -688,7 +688,9 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
         }
         if (shouldUpdateSetupSteps && organization) {
-            SetupStepUpdater.updateForOrganization(organization).catch(console.error);
+            SetupStepUpdater.updateForOrganization(organization, { types: [
+                SetupStepType.Responsibilities,
+            ] }).catch(console.error);
         }
         return new Response(
@@ -957,7 +959,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
             throw new SimpleError({
                 code: 'known_member_missing_rights',
                 message: 'Creating known member without sufficient access rights',
-                human: $t(`{member} is al gekend in ons systeem, maar jouw e-mailadres niet. Om toegang te krijgen heb je de beveiligingscode nodig.`, { member: member.details.firstName }),
+                human: $t(`510807a1-d4c7-45fa-9e3b-ddc8764d3f6e`, { member: member.details.firstName }),
                 statusCode: 400,
             });
         }

package/src/endpoints/global/platform/PatchPlatformEnpoint.ts CHANGED Viewed

@@ -90,6 +90,10 @@ export class PatchPlatformEndpoint extends Endpoint<
                 throw Context.auth.error();
             }
+            if (request.body.config.organizationLevelRecordsConfiguration) {
+                shouldUpdateSetupSteps = true;
+            }
             const newConfig = request.body.config;
             // Update config
@@ -100,13 +104,11 @@ export class PatchPlatformEndpoint extends Endpoint<
                     platform.config = patchObject(platform.config, newConfig);
                     const currentConfig: PlatformConfig = platform.config;
-                    if (shouldCheckSteps) {
-                        shouldUpdateSetupSteps = this.shouldUpdateSetupSteps(
-                            currentConfig,
-                            newConfig,
-                            oldConfig,
-                        );
-                    }
+                    shouldUpdateSetupSteps = shouldUpdateSetupSteps || this.shouldUpdateSetupSteps(
+                        currentConfig,
+                        newConfig,
+                        oldConfig,
+                    );
                 }
                 else {
                     platform.config = patchObject(platform.config, newConfig);