npm - @stamhoofd/backend - Versions diffs - 2.91.0 → 2.92.0 - Mend

@stamhoofd/backend 2.91.0 → 2.92.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (19) hide show

package/src/endpoints/global/email/PatchEmailEndpoint.test.ts CHANGED Viewed

@@ -1,9 +1,10 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { Email, Organization, OrganizationFactory, RegistrationPeriod, RegistrationPeriodFactory, Token, User, UserFactory } from '@stamhoofd/models';
-import { EmailStatus, Email as EmailStruct, PermissionLevel, Permissions, Version } from '@stamhoofd/structures';
-import { TestUtils } from '@stamhoofd/test-utils';
+import { AccessRight, EmailStatus, Email as EmailStruct, OrganizationEmail, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions, Version } from '@stamhoofd/structures';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer';
 import { PatchEmailEndpoint } from './PatchEmailEndpoint';
+import { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
 const baseUrl = `/v${Version}/email`;
@@ -13,8 +14,13 @@ describe('Endpoint.PatchEmailEndpoint', () => {
     let organization: Organization;
     let token: Token;
     let user: User;
+    let sender: OrganizationEmail;
+    let sender2: OrganizationEmail;
-    const patchEmail = async (email: EmailStruct, token: Token, organization?: Organization) => {
+    let token2: Token;
+    let user2: User;
+    const patchEmail = async (email: AutoEncoderPatchType<EmailStruct>, token: Token, organization?: Organization) => {
         const id = email.id;
         const request = Request.buildJson('PATCH', `${baseUrl}/${id}`, organization?.getApiHost(), email);
         request.headers.authorization = 'Bearer ' + token.accessToken;
@@ -34,15 +40,360 @@ describe('Endpoint.PatchEmailEndpoint', () => {
         organization = await new OrganizationFactory({ period })
             .create();
+        sender = OrganizationEmail.create({
+            email: 'groepsleiding@voorbeeld.com',
+            name: 'Groepsleiding',
+        });
+        sender2 = OrganizationEmail.create({
+            email: 'kapoenen@voorbeeld.com',
+            name: 'Kapoenen',
+        });
+        organization.privateMeta.emails.push(sender);
+        organization.privateMeta.emails.push(sender2);
+        await organization.save();
         user = await new UserFactory({
             organization,
             permissions: Permissions.create({
-                level: PermissionLevel.Read,
+                level: PermissionLevel.None,
+                resources: new Map([
+                    [PermissionsResourceType.Senders, new Map([[sender.id, ResourcePermissions.create({
+                        resourceName: sender.name!,
+                        level: PermissionLevel.None,
+                        accessRights: [AccessRight.SendMessages],
+                    })]])],
+                ]),
             }),
         })
             .create();
         token = await Token.createToken(user);
+        user2 = await new UserFactory({
+            organization,
+            permissions: Permissions.create({
+                level: PermissionLevel.None,
+                resources: new Map([
+                    [PermissionsResourceType.Senders, new Map([[sender2.id, ResourcePermissions.create({
+                        resourceName: sender.name!,
+                        level: PermissionLevel.Write,
+                        accessRights: [AccessRight.SendMessages],
+                    })]])],
+                ]),
+            }),
+        })
+            .create();
+        token2 = await Token.createToken(user2);
+    });
+    test('Should throw for invalid senderId', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id;
+        email.organizationId = organization.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            status: EmailStatus.Sending,
+            senderId: 'invalid-sender-id',
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('invalid_sender'));
+    });
+    test('Should throw when patching other users email without sender id', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user2.id;
+        email.organizationId = organization.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            subject: 'new subject',
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('permission_denied'));
+    });
+    test('Should throw when patching other users email even when matching sender', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user2.id;
+        email.organizationId = organization.id;
+        email.senderId = sender.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            subject: 'new subject',
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('permission_denied'));
+    });
+    test('Should not throw when patching other users email when having write access to sender', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id; // other user
+        email.organizationId = organization.id;
+        email.senderId = sender2.id; // write access to this sender
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            subject: 'new subject',
+        });
+        await expect(patchEmail(body, token2, organization)).toResolve();
+    });
+    test('Should throw when patching if no permission for sender', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id;
+        email.organizationId = organization.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            senderId: sender2.id,
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('permission_denied'));
+    });
+    test('Should throw when sending if no permission for sender', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id;
+        email.organizationId = organization.id;
+        email.senderId = sender2.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            status: EmailStatus.Sending,
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('permission_denied'));
     });
     test('Should throw error if no unsubscribe button in email html', async () => {
@@ -84,11 +435,11 @@ describe('Endpoint.PatchEmailEndpoint', () => {
         await email.save();
-        const body = EmailStruct.create({ ...email, fromAddress: 'test@test.be', status: EmailStatus.Sending });
+        const body = EmailStruct.patch({ id: email.id, senderId: sender.id, status: EmailStatus.Sending });
         await expect(async () => await patchEmail(body, token, organization))
             .rejects
-            .toThrow('Missing unsubscribe button');
+            .toThrow(STExpect.errorWithCode('missing_unsubscribe_button'));
     });
     test('Should throw error if no unsubscribe button in email text', async () => {
@@ -130,10 +481,55 @@ describe('Endpoint.PatchEmailEndpoint', () => {
         await email.save();
-        const body = EmailStruct.create({ ...email, fromAddress: 'test@test.be', status: EmailStatus.Sending });
+        const body = EmailStruct.patch({ id: email.id, senderId: sender.id, status: EmailStatus.Sending });
         await expect(async () => await patchEmail(body, token, organization))
             .rejects
-            .toThrow('Missing unsubscribe button');
+            .toThrow(STExpect.errorWithCode('missing_unsubscribe_button'));
+    });
+    test('Can send an email', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email {{unsubscribeUrl}}</p>
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id;
+        email.organizationId = organization.id;
+        email.senderId = sender.id;
+        await email.save();
+        const body = EmailStruct.patch({ id: email.id, status: EmailStatus.Sending });
+        await expect(patchEmail(body, token, organization)).toResolve();
     });
 });

package/src/endpoints/global/email/PatchEmailEndpoint.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
-import { Email } from '@stamhoofd/models';
-import { EmailPreview, EmailStatus, Email as EmailStruct } from '@stamhoofd/structures';
+import { Email, Platform } from '@stamhoofd/models';
+import { EmailPreview, EmailStatus, Email as EmailStruct, PermissionLevel } from '@stamhoofd/structures';
 import { AutoEncoderPatchType, Decoder, patchObject } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
@@ -29,14 +29,15 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOptionalOrganizationScope();
-        const { user } = await Context.authenticate();
+        await Context.authenticate();
-        if (!Context.auth.canSendEmails()) {
+        if (!await Context.auth.canReadEmails(organization)) {
+            // Fast fail before query
             throw Context.auth.error();
         }
         const model = await Email.getByID(request.params.id);
-        if (!model || model.userId !== user.id || (model.organizationId !== (organization?.id ?? null))) {
+        if (!model || (model.organizationId !== (organization?.id ?? null))) {
             throw new SimpleError({
                 code: 'not_found',
                 human: 'Email not found',
@@ -45,6 +46,10 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             });
         }
+        if (!await Context.auth.canAccessEmail(model, PermissionLevel.Write)) {
+            throw Context.auth.error();
+        }
         if (model.status !== EmailStatus.Draft) {
             throw new SimpleError({
                 code: 'not_draft',
@@ -60,6 +65,47 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             model.subject = request.body.subject;
         }
+        if (request.body.senderId !== undefined) {
+            const list = organization ? organization.privateMeta.emails : (await Platform.getShared()).privateConfig.emails;
+            const sender = list.find(e => e.id === request.body.senderId);
+            if (sender) {
+                if (!await Context.auth.canSendEmailsFrom(organization, sender.id)) {
+                    throw Context.auth.error({
+                        message: 'Cannot send emails from this sender',
+                        human: $t('1b509614-30b0-484c-af72-57d4bc9ea788'),
+                    });
+                }
+                model.senderId = sender.id;
+                model.fromAddress = sender.email;
+                model.fromName = sender.name;
+            }
+            else {
+                throw new SimpleError({
+                    code: 'invalid_sender',
+                    human: 'Sender not found',
+                    message: $t(`94adb4e0-2ef1-4ee8-9f02-5a76efa51c1d`),
+                    statusCode: 400,
+                });
+            }
+        }
+        else if (model.senderId) {
+            // Update data, to avoid sending from an old address
+            const list = organization ? organization.privateMeta.emails : (await Platform.getShared()).privateConfig.emails;
+            const sender = list.find(e => e.id === model.senderId);
+            if (sender) {
+                model.fromAddress = sender.email;
+                model.fromName = sender.name;
+            }
+            else {
+                throw new SimpleError({
+                    code: 'invalid_sender',
+                    human: 'Sender not found',
+                    message: $t(`f08cccb3-faf9-473f-b729-16120fadec9c`),
+                    statusCode: 400,
+                });
+            }
+        }
         if (request.body.html !== undefined) {
             model.html = request.body.html;
         }
@@ -72,14 +118,6 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             model.json = request.body.json;
         }
-        if (request.body.fromAddress !== undefined) {
-            model.fromAddress = request.body.fromAddress;
-        }
-        if (request.body.fromName !== undefined) {
-            model.fromName = request.body.fromName;
-        }
         if (request.body.recipientFilter) {
             model.recipientFilter = patchObject(model.recipientFilter, request.body.recipientFilter);
             rebuild = true;
@@ -102,19 +140,26 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
         }
         if (request.body.status === EmailStatus.Sending || request.body.status === EmailStatus.Sent) {
+            if (!await Context.auth.canSendEmail(model)) {
+                throw Context.auth.error({
+                    message: 'Cannot send emails from this sender',
+                    human: $t('1b509614-30b0-484c-af72-57d4bc9ea788'),
+                });
+            }
             model.throwIfNotReadyToSend();
             const replacement = '{{unsubscribeUrl}}';
             if (model.html) {
                 // Check email contains an unsubscribe button
                 if (!model.html.includes(replacement)) {
                     throw new SimpleError({
-                        code: "missing_unsubscribe_button",
-                        message: "Missing unsubscribe button",
+                        code: 'missing_unsubscribe_button',
+                        message: 'Missing unsubscribe button',
                         human: $t(`dd55e04b-e5d9-4d9a-befc-443eef4175a8`),
-                        field: "html"
-                    })
+                        field: 'html',
+                    });
                 }
             }
@@ -122,11 +167,11 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 // Check email contains an unsubscribe button
                 if (!model.text.includes(replacement)) {
                     throw new SimpleError({
-                        code: "missing_unsubscribe_button",
-                        message: "Missing unsubscribe button",
+                        code: 'missing_unsubscribe_button',
+                        message: 'Missing unsubscribe button',
                         human: $t(`dd55e04b-e5d9-4d9a-befc-443eef4175a8`),
-                        field: "text"
-                    })
+                        field: 'text',
+                    });
                 }
             }

package/src/endpoints/organization/dashboard/webshops/DeleteWebshopEndpoint.ts CHANGED Viewed

@@ -1,9 +1,10 @@
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
-import { SimpleError } from '@simonbackx/simple-errors';
 import { BalanceItem, Order, Webshop } from '@stamhoofd/models';
 import { PermissionLevel } from '@stamhoofd/structures';
 import { Context } from '../../../../helpers/Context';
+import { UitpasService } from '../../../../services/uitpas/UitpasService';
+import { SimpleError } from '@simonbackx/simple-errors';
 type Params = { id: string };
 type Query = undefined;
@@ -42,6 +43,14 @@ export class DeleteWebshopEndpoint extends Endpoint<Params, Query, Body, Respons
             throw Context.auth.notFoundOrNoAccess();
         }
+        if (await UitpasService.areThereRegisteredTicketSales(webshop.id)) {
+            throw new SimpleError({
+                code: 'webshop_has_registered_ticket_sales',
+                message: `Webshop ${webshop.id} has registered ticket sales`,
+                human: $t(`0b3d6ea1-a70b-428c-9ba4-cc0c327ed415`),
+            });
+        }
         const orders = await Order.where({ webshopId: webshop.id });
         await BalanceItem.deleteForDeletedOrders(orders.map(o => o.id));
         await webshop.delete();

package/src/endpoints/organization/dashboard/webshops/PatchWebshopOrdersEndpoint.ts CHANGED Viewed

@@ -7,6 +7,7 @@ import { AuditLogSource, BalanceItemRelation, BalanceItemRelationType, BalanceIt
 import { Context } from '../../../../helpers/Context';
 import { AuditLogService } from '../../../../services/AuditLogService';
+import { shouldReserveUitpasNumbers, UitpasService } from '../../../../services/uitpas/UitpasService';
 type Params = { id: string };
 type Query = undefined;
@@ -132,6 +133,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                 // TODO: validate before updating stock
                 order.data.validate(webshopGetter.struct, organization.meta, request.i18n, true);
+                order.data.cart = await UitpasService.validateCart(organization.id, webshop.id, order.data.cart);
                 try {
                     await order.updateStock(null, true);
@@ -230,6 +232,8 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                 const previousToPay = model.totalToPay;
                 const previousStatus = model.status;
+                const shouldReserveBefore = shouldReserveUitpasNumbers(model.status);
                 model.status = patch.status ?? model.status;
                 // For now, we don't invalidate tickets, because they will get invalidated at scan time (the order status is checked)
@@ -240,13 +244,16 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                 const previousData = model.data.clone();
                 if (patch.data) {
                     model.data.patchOrPut(patch.data);
                     if (model.status !== OrderStatus.Deleted) {
                         // Make sure all data is up to date and validated (= possible corrections happen here too)
                         model.data.validate(webshopGetter.struct, organization.meta, request.i18n, true);
                     }
                 }
+                if ((patch.data || !shouldReserveBefore) && shouldReserveUitpasNumbers(model.status)) {
+                    model.data.cart = await UitpasService.validateCart(organization.id, webshop.id, model.data.cart, model.id);
+                }
                 if (model.status === OrderStatus.Deleted) {
                     model.data.removePersonalData();