npm - @stamhoofd/backend - Versions diffs - 2.91.0 → 2.93.0 - Mend

@stamhoofd/backend 2.91.0 → 2.93.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (36) hide show

package/src/endpoints/global/email/PatchEmailEndpoint.test.ts CHANGED Viewed

@@ -1,9 +1,10 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { Email, Organization, OrganizationFactory, RegistrationPeriod, RegistrationPeriodFactory, Token, User, UserFactory } from '@stamhoofd/models';
-import { EmailStatus, Email as EmailStruct, PermissionLevel, Permissions, Version } from '@stamhoofd/structures';
-import { TestUtils } from '@stamhoofd/test-utils';
+import { AccessRight, EmailStatus, Email as EmailStruct, OrganizationEmail, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions, Version } from '@stamhoofd/structures';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer';
 import { PatchEmailEndpoint } from './PatchEmailEndpoint';
+import { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
 const baseUrl = `/v${Version}/email`;
@@ -13,8 +14,13 @@ describe('Endpoint.PatchEmailEndpoint', () => {
     let organization: Organization;
     let token: Token;
     let user: User;
+    let sender: OrganizationEmail;
+    let sender2: OrganizationEmail;
-    const patchEmail = async (email: EmailStruct, token: Token, organization?: Organization) => {
+    let token2: Token;
+    let user2: User;
+    const patchEmail = async (email: AutoEncoderPatchType<EmailStruct>, token: Token, organization?: Organization) => {
         const id = email.id;
         const request = Request.buildJson('PATCH', `${baseUrl}/${id}`, organization?.getApiHost(), email);
         request.headers.authorization = 'Bearer ' + token.accessToken;
@@ -34,15 +40,360 @@ describe('Endpoint.PatchEmailEndpoint', () => {
         organization = await new OrganizationFactory({ period })
             .create();
+        sender = OrganizationEmail.create({
+            email: 'groepsleiding@voorbeeld.com',
+            name: 'Groepsleiding',
+        });
+        sender2 = OrganizationEmail.create({
+            email: 'kapoenen@voorbeeld.com',
+            name: 'Kapoenen',
+        });
+        organization.privateMeta.emails.push(sender);
+        organization.privateMeta.emails.push(sender2);
+        await organization.save();
         user = await new UserFactory({
             organization,
             permissions: Permissions.create({
-                level: PermissionLevel.Read,
+                level: PermissionLevel.None,
+                resources: new Map([
+                    [PermissionsResourceType.Senders, new Map([[sender.id, ResourcePermissions.create({
+                        resourceName: sender.name!,
+                        level: PermissionLevel.None,
+                        accessRights: [AccessRight.SendMessages],
+                    })]])],
+                ]),
             }),
         })
             .create();
         token = await Token.createToken(user);
+        user2 = await new UserFactory({
+            organization,
+            permissions: Permissions.create({
+                level: PermissionLevel.None,
+                resources: new Map([
+                    [PermissionsResourceType.Senders, new Map([[sender2.id, ResourcePermissions.create({
+                        resourceName: sender.name!,
+                        level: PermissionLevel.Write,
+                        accessRights: [AccessRight.SendMessages],
+                    })]])],
+                ]),
+            }),
+        })
+            .create();
+        token2 = await Token.createToken(user2);
+    });
+    test('Should throw for invalid senderId', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id;
+        email.organizationId = organization.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            status: EmailStatus.Sending,
+            senderId: 'invalid-sender-id',
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('invalid_sender'));
+    });
+    test('Should throw when patching other users email without sender id', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user2.id;
+        email.organizationId = organization.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            subject: 'new subject',
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('permission_denied'));
+    });
+    test('Should throw when patching other users email even when matching sender', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user2.id;
+        email.organizationId = organization.id;
+        email.senderId = sender.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            subject: 'new subject',
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('permission_denied'));
+    });
+    test('Should not throw when patching other users email when having write access to sender', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id; // other user
+        email.organizationId = organization.id;
+        email.senderId = sender2.id; // write access to this sender
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            subject: 'new subject',
+        });
+        await expect(patchEmail(body, token2, organization)).toResolve();
+    });
+    test('Should throw when patching if no permission for sender', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id;
+        email.organizationId = organization.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            senderId: sender2.id,
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('permission_denied'));
+    });
+    test('Should throw when sending if no permission for sender', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email</p>
+        {{unsubscribeUrl}}
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id;
+        email.organizationId = organization.id;
+        email.senderId = sender2.id;
+        await email.save();
+        const body = EmailStruct.patch({
+            id: email.id,
+            status: EmailStatus.Sending,
+        });
+        await expect(async () => await patchEmail(body, token, organization))
+            .rejects
+            .toThrow(STExpect.errorWithCode('permission_denied'));
     });
     test('Should throw error if no unsubscribe button in email html', async () => {
@@ -84,11 +435,11 @@ describe('Endpoint.PatchEmailEndpoint', () => {
         await email.save();
-        const body = EmailStruct.create({ ...email, fromAddress: 'test@test.be', status: EmailStatus.Sending });
+        const body = EmailStruct.patch({ id: email.id, senderId: sender.id, status: EmailStatus.Sending });
         await expect(async () => await patchEmail(body, token, organization))
             .rejects
-            .toThrow('Missing unsubscribe button');
+            .toThrow(STExpect.errorWithCode('missing_unsubscribe_button'));
     });
     test('Should throw error if no unsubscribe button in email text', async () => {
@@ -130,10 +481,55 @@ describe('Endpoint.PatchEmailEndpoint', () => {
         await email.save();
-        const body = EmailStruct.create({ ...email, fromAddress: 'test@test.be', status: EmailStatus.Sending });
+        const body = EmailStruct.patch({ id: email.id, senderId: sender.id, status: EmailStatus.Sending });
         await expect(async () => await patchEmail(body, token, organization))
             .rejects
-            .toThrow('Missing unsubscribe button');
+            .toThrow(STExpect.errorWithCode('missing_unsubscribe_button'));
+    });
+    test('Can send an email', async () => {
+        const email = new Email();
+        email.subject = 'test subject';
+        email.status = EmailStatus.Draft;
+        email.text = 'test email {{unsubscribeUrl}}';
+        email.html = `<!DOCTYPE html>
+        <html>
+        <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+        <title>test</title>
+        </head>
+        <body>
+        <p style="margin: 0; padding: 0; line-height: 1.4;">test email {{unsubscribeUrl}}</p>
+        </body>
+        </html>`;
+        email.json = {
+            content: [
+                {
+                    content: [
+                        {
+                            text: 'test email',
+                            type: 'text',
+                        },
+                    ],
+                    type: 'paragraph',
+                },
+            ],
+            type: 'doc',
+        };
+        email.userId = user.id;
+        email.organizationId = organization.id;
+        email.senderId = sender.id;
+        await email.save();
+        const body = EmailStruct.patch({ id: email.id, status: EmailStatus.Sending });
+        await expect(patchEmail(body, token, organization)).toResolve();
     });
 });

package/src/endpoints/global/email/PatchEmailEndpoint.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
-import { Email } from '@stamhoofd/models';
-import { EmailPreview, EmailStatus, Email as EmailStruct } from '@stamhoofd/structures';
+import { Email, Platform } from '@stamhoofd/models';
+import { EmailPreview, EmailRecipientsStatus, EmailStatus, Email as EmailStruct, PermissionLevel } from '@stamhoofd/structures';
 import { AutoEncoderPatchType, Decoder, patchObject } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
@@ -29,14 +29,15 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOptionalOrganizationScope();
-        const { user } = await Context.authenticate();
+        await Context.authenticate();
-        if (!Context.auth.canSendEmails()) {
+        if (!await Context.auth.canReadEmails(organization)) {
+            // Fast fail before query
             throw Context.auth.error();
         }
         const model = await Email.getByID(request.params.id);
-        if (!model || model.userId !== user.id || (model.organizationId !== (organization?.id ?? null))) {
+        if (!model || (model.organizationId !== (organization?.id ?? null))) {
             throw new SimpleError({
                 code: 'not_found',
                 human: 'Email not found',
@@ -45,6 +46,10 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             });
         }
+        if (!await Context.auth.canAccessEmail(model, PermissionLevel.Write)) {
+            throw Context.auth.error();
+        }
         if (model.status !== EmailStatus.Draft) {
             throw new SimpleError({
                 code: 'not_draft',
@@ -60,6 +65,47 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             model.subject = request.body.subject;
         }
+        if (request.body.senderId !== undefined) {
+            const list = organization ? organization.privateMeta.emails : (await Platform.getShared()).privateConfig.emails;
+            const sender = list.find(e => e.id === request.body.senderId);
+            if (sender) {
+                if (!await Context.auth.canSendEmailsFrom(organization, sender.id)) {
+                    throw Context.auth.error({
+                        message: 'Cannot send emails from this sender',
+                        human: $t('1b509614-30b0-484c-af72-57d4bc9ea788'),
+                    });
+                }
+                model.senderId = sender.id;
+                model.fromAddress = sender.email;
+                model.fromName = sender.name;
+            }
+            else {
+                throw new SimpleError({
+                    code: 'invalid_sender',
+                    human: 'Sender not found',
+                    message: $t(`94adb4e0-2ef1-4ee8-9f02-5a76efa51c1d`),
+                    statusCode: 400,
+                });
+            }
+        }
+        else if (model.senderId) {
+            // Update data, to avoid sending from an old address
+            const list = organization ? organization.privateMeta.emails : (await Platform.getShared()).privateConfig.emails;
+            const sender = list.find(e => e.id === model.senderId);
+            if (sender) {
+                model.fromAddress = sender.email;
+                model.fromName = sender.name;
+            }
+            else {
+                throw new SimpleError({
+                    code: 'invalid_sender',
+                    human: 'Sender not found',
+                    message: $t(`f08cccb3-faf9-473f-b729-16120fadec9c`),
+                    statusCode: 400,
+                });
+            }
+        }
         if (request.body.html !== undefined) {
             model.html = request.body.html;
         }
@@ -72,15 +118,16 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             model.json = request.body.json;
         }
-        if (request.body.fromAddress !== undefined) {
-            model.fromAddress = request.body.fromAddress;
-        }
-        if (request.body.fromName !== undefined) {
-            model.fromName = request.body.fromName;
-        }
         if (request.body.recipientFilter) {
+            if (model.status !== EmailStatus.Draft) {
+                throw new SimpleError({
+                    code: 'not_draft',
+                    human: 'Email is not a draft',
+                    message: $t(`Je kan de ontvangerslijst alleen aanpassen als de e-mail nog een concept is`),
+                    statusCode: 400,
+                });
+            }
             model.recipientFilter = patchObject(model.recipientFilter, request.body.recipientFilter);
             rebuild = true;
         }
@@ -95,26 +142,33 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
         if (rebuild) {
             await model.buildExampleRecipient();
-            model.updateCount();
             // Force null - because we have stale data
-            model.recipientCount = null;
+            model.emailRecipientsCount = null;
+            model.updateCount();
         }
-        if (request.body.status === EmailStatus.Sending || request.body.status === EmailStatus.Sent) {
+        if (request.body.status === EmailStatus.Sending || request.body.status === EmailStatus.Sent || request.body.status === EmailStatus.Queued) {
+            if (!await Context.auth.canSendEmail(model)) {
+                throw Context.auth.error({
+                    message: 'Cannot send emails from this sender',
+                    human: $t('1b509614-30b0-484c-af72-57d4bc9ea788'),
+                });
+            }
             model.throwIfNotReadyToSend();
             const replacement = '{{unsubscribeUrl}}';
             if (model.html) {
                 // Check email contains an unsubscribe button
                 if (!model.html.includes(replacement)) {
                     throw new SimpleError({
-                        code: "missing_unsubscribe_button",
-                        message: "Missing unsubscribe button",
+                        code: 'missing_unsubscribe_button',
+                        message: 'Missing unsubscribe button',
                         human: $t(`dd55e04b-e5d9-4d9a-befc-443eef4175a8`),
-                        field: "html"
-                    })
+                        field: 'html',
+                    });
                 }
             }
@@ -122,15 +176,16 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 // Check email contains an unsubscribe button
                 if (!model.text.includes(replacement)) {
                     throw new SimpleError({
-                        code: "missing_unsubscribe_button",
-                        message: "Missing unsubscribe button",
+                        code: 'missing_unsubscribe_button',
+                        message: 'Missing unsubscribe button',
                         human: $t(`dd55e04b-e5d9-4d9a-befc-443eef4175a8`),
-                        field: "text"
-                    })
+                        field: 'text',
+                    });
                 }
             }
-            model.send().catch(console.error);
+            // Preview the sending status
+            await model.queueForSending();
         }
         return new Response(await model.getPreviewStructure());

package/src/endpoints/global/email-recipients/GetEmailRecipientsCountEndpoint.ts ADDED Viewed

@@ -0,0 +1,47 @@
+import { Decoder } from '@simonbackx/simple-encoding';
+import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
+import { CountFilteredRequest, CountResponse } from '@stamhoofd/structures';
+import { Context } from '../../../helpers/Context';
+import { GetEmailRecipientsEndpoint } from './GetEmailRecipientsEndpoint';
+type Params = Record<string, never>;
+type Query = CountFilteredRequest;
+type Body = undefined;
+type ResponseBody = CountResponse;
+export class GetEmailRecipientsCountEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    queryDecoder = CountFilteredRequest as Decoder<CountFilteredRequest>;
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'GET') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/email-recipients/count', {});
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        const organization = await Context.setOptionalOrganizationScope();
+        await Context.authenticate();
+        if (!await Context.auth.canReadEmails(organization)) {
+            throw Context.auth.error();
+        }
+        const query = await GetEmailRecipientsEndpoint.buildQuery(request.query);
+        const count = await query
+            .count();
+        return new Response(
+            CountResponse.create({
+                count,
+            }),
+        );
+    }
+}