@stamhoofd/backend 2.93.0 → 2.95.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.93.0",
+    "version": "2.95.0",
     "main": "./dist/index.js",
     "exports": {
         ".": {
@@ -45,14 +45,14 @@
         "@simonbackx/simple-encoding": "2.22.0",
         "@simonbackx/simple-endpoints": "1.20.1",
         "@simonbackx/simple-logging": "^1.0.1",
-        "@stamhoofd/backend-i18n": "2.93.0",
-        "@stamhoofd/backend-middleware": "2.93.0",
-        "@stamhoofd/email": "2.93.0",
-        "@stamhoofd/models": "2.93.0",
-        "@stamhoofd/queues": "2.93.0",
-        "@stamhoofd/sql": "2.93.0",
-        "@stamhoofd/structures": "2.93.0",
-        "@stamhoofd/utility": "2.93.0",
+        "@stamhoofd/backend-i18n": "2.95.0",
+        "@stamhoofd/backend-middleware": "2.95.0",
+        "@stamhoofd/email": "2.95.0",
+        "@stamhoofd/models": "2.95.0",
+        "@stamhoofd/queues": "2.95.0",
+        "@stamhoofd/sql": "2.95.0",
+        "@stamhoofd/structures": "2.95.0",
+        "@stamhoofd/utility": "2.95.0",
         "archiver": "^7.0.1",
         "axios": "^1.8.2",
         "cookie": "^0.7.0",
@@ -70,5 +70,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "05b8228a7fc3871aa767609a95a2c1511132e548"
+    "gitHead": "baed3abb7d0814204ae52004bfec7287e397d28e"
 }

package/src/endpoints/global/email/CreateEmailEndpoint.ts

@@ -130,6 +130,24 @@ export class CreateEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
             await model.queueForSending();
         }
 
+        // Delete open drafts with the same content, from the same user
+        const duplicates = await Email.select()
+            .where('userId', user.id)
+            .where('organizationId', model.organizationId)
+            .where('status', EmailStatus.Draft)
+            .where('subject', model.subject)
+            .where('html', model.html)
+            .where('text', model.text)
+            .where('deletedAt', null)
+            .whereNot('id', model.id)
+            .limit(100)
+            .fetch();
+
+        for (const duplicate of duplicates) {
+            duplicate.deletedAt = new Date();
+            await duplicate.save();
+        }
+
         return new Response(await model.getPreviewStructure());
     }
 }

package/src/endpoints/global/email/GetAdminEmailsEndpoint.ts

@@ -1,5 +1,5 @@
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
-import { assertSort, CountFilteredRequest, EmailPreview, EmailStatus, getSortFilter, LimitedFilteredRequest, PaginatedResponse, StamhoofdFilter } from '@stamhoofd/structures';
+import { assertSort, CountFilteredRequest, EmailPreview, EmailStatus, getSortFilter, LimitedFilteredRequest, mergeFilters, PaginatedResponse, PermissionLevel, StamhoofdFilter } from '@stamhoofd/structures';
 
 import { Decoder } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
@@ -40,12 +40,15 @@ export class GetAdminEmailsEndpoint extends Endpoint<Params, Query, Body, Respon
             throw new Error('Not authenticated');
         }
 
-        let scopeFilter: StamhoofdFilter | undefined = undefined;
+        let scopeFilter: StamhoofdFilter = null;
 
         const canReadAllEmails = await Context.auth.canReadAllEmails(organization ?? null);
-        scopeFilter = {
-            organizationId: organization?.id ?? null,
-        };
+
+        if (organization || Context.auth.getPlatformAccessibleOrganizationTags(PermissionLevel.Full) !== 'all') {
+            scopeFilter = {
+                organizationId: organization?.id ?? null,
+            };
+        }
 
         if (!canReadAllEmails) {
             const senders = organization ? organization.privateMeta.emails : (await Platform.getShared()).privateConfig.emails;
@@ -59,52 +62,39 @@ export class GetAdminEmailsEndpoint extends Endpoint<Params, Query, Body, Respon
                 throw Context.auth.error();
             }
 
-            scopeFilter = {
-                $and: [
+            scopeFilter = mergeFilters([scopeFilter, {
+                $or: [
                     {
-                        organizationId: organization?.id ?? null,
+                        senderId: {
+                            $in: ids,
+                        },
+                        status: {
+                            $neq: EmailStatus.Draft,
+                        },
                     },
                     {
-                        $or: [
-                            {
-                                senderId: {
-                                    $in: ids,
-                                },
-                                status: {
-                                    $neq: EmailStatus.Draft,
-                                },
-                            },
-                            {
-                                userId: user.id,
-                            },
-                        ],
+                        userId: user.id,
                     },
                 ],
-            };
+            }]);
         }
         else {
-            scopeFilter = {
-                $and: [
+            scopeFilter = mergeFilters([scopeFilter, {
+                $or: [
                     {
-                        organizationId: organization?.id ?? null,
+                        status: {
+                            $neq: EmailStatus.Draft,
+                        },
                     },
                     {
-                        $or: [
-                            {
-                                status: {
-                                    $neq: EmailStatus.Draft,
-                                },
-                            },
-                            {
-                                userId: user.id,
-                            },
-                        ],
+                        userId: user.id,
                     },
                 ],
-            };
+            }]);
         }
 
-        const query = Email.select();
+        const query = Email.select()
+            .where('deletedAt', null);
 
         if (scopeFilter) {
             query.where(await compileToSQLFilter(scopeFilter, filterCompilers));

package/src/endpoints/global/email/GetEmailEndpoint.ts

@@ -30,14 +30,14 @@ export class GetEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBody
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOptionalOrganizationScope();
-        const { user } = await Context.authenticate();
+        await Context.authenticate();
 
         if (!await Context.auth.canReadEmails(organization)) {
             throw Context.auth.error();
         }
 
         const model = await Email.getByID(request.params.id);
-        if (!model || model.userId !== user.id || (model.organizationId !== (organization?.id ?? null))) {
+        if (!model || (model.organizationId !== (organization?.id ?? null))) {
             throw new SimpleError({
                 code: 'not_found',
                 human: 'Email not found',

package/src/endpoints/global/email/GetUserEmailsEndpoint.ts

@@ -0,0 +1,163 @@
+import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
+import { assertSort, CountFilteredRequest, EmailWithRecipients, EmailStatus, getSortFilter, LimitedFilteredRequest, mergeFilters, PaginatedResponse, StamhoofdFilter } from '@stamhoofd/structures';
+
+import { Decoder } from '@simonbackx/simple-encoding';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { Email, Member } from '@stamhoofd/models';
+import { applySQLSorter, compileToSQLFilter, SQLFilterDefinitions, SQLSortDefinitions } from '@stamhoofd/sql';
+import { Context } from '../../../helpers/Context';
+import { emailFilterCompilers, userEmailFilterCompilers } from '../../../sql-filters/emails';
+import { emailSorters } from '../../../sql-sorters/emails';
+
+type Params = Record<string, never>;
+type Query = LimitedFilteredRequest;
+type Body = undefined;
+type ResponseBody = PaginatedResponse<EmailWithRecipients[], LimitedFilteredRequest>;
+
+const filterCompilers: SQLFilterDefinitions = emailFilterCompilers;
+const sorters: SQLSortDefinitions<Email> = emailSorters;
+
+export class GetUserEmailsEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    queryDecoder = LimitedFilteredRequest as Decoder<LimitedFilteredRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'GET') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/user/email', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    static async buildQuery(memberIds: string[], q: CountFilteredRequest | LimitedFilteredRequest) {
+        const organization = Context.organization;
+        const user = Context.user;
+        if (!user) {
+            throw new Error('Not authenticated');
+        }
+
+        let scopeFilter: StamhoofdFilter | null = null;
+
+        if (organization) {
+            scopeFilter = mergeFilters([scopeFilter, {
+                organizationId: organization.id,
+            }]);
+        }
+
+        scopeFilter = mergeFilters([scopeFilter, {
+            recipients: {
+                $elemMatch: {
+                    memberId: {
+                        $in: memberIds,
+                    },
+                },
+            },
+        }]);
+
+        const query = Email.select()
+            .where('deletedAt', null)
+            .where('status', EmailStatus.Sent);
+
+        if (scopeFilter) {
+            query.where(await compileToSQLFilter(scopeFilter, filterCompilers));
+        }
+
+        if (q.filter) {
+            // This one is more strict
+            query.where(await compileToSQLFilter(q.filter, userEmailFilterCompilers));
+        }
+
+        if (q.search) {
+            let searchFilter: StamhoofdFilter | null = null;
+
+            searchFilter = {
+                subject: {
+                    $contains: q.search,
+                },
+            };
+
+            if (searchFilter) {
+                query.where(await compileToSQLFilter(searchFilter, filterCompilers));
+            }
+        }
+
+        if (q instanceof LimitedFilteredRequest) {
+            if (q.pageFilter) {
+                // More strict as well, since this comes from the frontend
+                query.where(await compileToSQLFilter(q.pageFilter, userEmailFilterCompilers));
+            }
+
+            q.sort = assertSort(q.sort, [{ key: 'id' }]);
+            applySQLSorter(query, q.sort, sorters);
+            query.limit(q.limit);
+        }
+
+        return query;
+    }
+
+    static async buildData(requestQuery: LimitedFilteredRequest) {
+        const user = Context.user;
+        if (!user) {
+            throw new Error('Not authenticated');
+        }
+        const memberIds = await Member.getMemberIdsForUser(user);
+        const query = await GetUserEmailsEndpoint.buildQuery(memberIds, requestQuery);
+        const emails = await query.fetch();
+
+        let next: LimitedFilteredRequest | undefined;
+
+        if (emails.length >= requestQuery.limit) {
+            const lastObject = emails[emails.length - 1];
+            const nextFilter = getSortFilter(lastObject, sorters, requestQuery.sort);
+
+            next = new LimitedFilteredRequest({
+                filter: requestQuery.filter,
+                pageFilter: nextFilter,
+                sort: requestQuery.sort,
+                limit: requestQuery.limit,
+                search: requestQuery.search,
+            });
+
+            if (JSON.stringify(nextFilter) === JSON.stringify(requestQuery.pageFilter)) {
+                console.error('Found infinite loading loop for', requestQuery);
+                next = undefined;
+            }
+        }
+
+        return new PaginatedResponse<EmailWithRecipients[], LimitedFilteredRequest>({
+            results: await Promise.all(emails.map(email => email.getStructureForUser(user, memberIds))),
+            next,
+        });
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope();
+        await Context.authenticate();
+
+        const maxLimit = Context.auth.hasSomePlatformAccess() ? 1000 : 100;
+
+        if (request.query.limit > maxLimit) {
+            throw new SimpleError({
+                code: 'invalid_field',
+                field: 'limit',
+                message: 'Limit can not be more than ' + maxLimit,
+            });
+        }
+
+        if (request.query.limit < 1) {
+            throw new SimpleError({
+                code: 'invalid_field',
+                field: 'limit',
+                message: 'Limit can not be less than 1',
+            });
+        }
+
+        return new Response(
+            await GetUserEmailsEndpoint.buildData(request.query),
+        );
+    }
+}

package/src/endpoints/global/email/PatchEmailEndpoint.ts

@@ -50,15 +50,6 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             throw Context.auth.error();
         }
 
-        if (model.status !== EmailStatus.Draft) {
-            throw new SimpleError({
-                code: 'not_draft',
-                human: 'Email is not a draft',
-                message: $t(`298b5a46-2899-4aa1-89df-9b634c20806b`),
-                statusCode: 400,
-            });
-        }
-
         let rebuild = false;
 
         if (request.body.subject !== undefined) {
@@ -78,6 +69,11 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 model.senderId = sender.id;
                 model.fromAddress = sender.email;
                 model.fromName = sender.name;
+
+                // Check if we still have write access to the email
+                if (!await Context.auth.canAccessEmail(model, PermissionLevel.Write)) {
+                    throw Context.auth.error();
+                }
             }
             else {
                 throw new SimpleError({
@@ -138,6 +134,13 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             model.validateAttachments();
         }
 
+        if (request.body.deletedAt !== undefined) {
+            if (!await Context.auth.canAccessEmail(model, PermissionLevel.Full)) {
+                throw Context.auth.error();
+            }
+            model.deletedAt = request.body.deletedAt;
+        }
+
         await model.save();
 
         if (rebuild) {

package/src/endpoints/global/email-recipients/GetEmailRecipientsEndpoint.ts

@@ -3,7 +3,7 @@ import { assertSort, CountFilteredRequest, EmailRecipient as EmailRecipientStruc
 
 import { Decoder } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { EmailRecipient } from '@stamhoofd/models';
+import { EmailRecipient, fillRecipientReplacements } from '@stamhoofd/models';
 import { applySQLSorter, compileToSQLFilter, SQLFilterDefinitions, SQLSortDefinitions } from '@stamhoofd/sql';
 import { Context } from '../../../helpers/Context';
 import { emailRecipientsFilterCompilers } from '../../../sql-filters/email-recipients';
@@ -126,7 +126,18 @@ export class GetEmailRecipientsEndpoint extends Endpoint<Params, Query, Body, Re
         }
 
         return new PaginatedResponse<EmailRecipientStruct[], LimitedFilteredRequest>({
-            results: recipients.map(r => r.getStructure()),
+            results: await Promise.all((await EmailRecipient.getStructures(recipients)).map(async (r) => {
+                const rr = r.getRecipient();
+                await fillRecipientReplacements(rr, {
+                    organization: Context.organization ?? null,
+                    from: null,
+                    replyTo: null,
+                    forPreview: true,
+                    forceRefresh: false,
+                });
+                r.replacements = rr.replacements;
+                return r;
+            })),
             next,
         });
     }

package/src/endpoints/global/registration/GetUserDetailedPayableBalanceEndpoint.ts

@@ -31,7 +31,7 @@ export class GetUserDetailedPayableBalanceEndpoint extends Endpoint<Params, Quer
         const organization = await Context.setUserOrganizationScope();
         const { user } = await Context.authenticate();
 
-        const memberIds = await Member.getMemberIdsWithRegistrationForUser(user);
+        const memberIds = await Member.getMemberIdsForUser(user);
 
         const balanceItemModels = await BalanceItem.balanceItemsForUsersAndMembers(organization?.id ?? null, [user.id], memberIds);
 

package/src/endpoints/global/registration-periods/PatchRegistrationPeriodsEndpoint.ts

@@ -92,9 +92,8 @@ export class PatchRegistrationPeriodsEndpoint extends Endpoint<Params, Query, Bo
                 }
             }
 
-            await period.setPreviousPeriodId();
-
             await period.save();
+            await period.updatePreviousNextPeriods();
             periods.push(period);
         }
 
@@ -138,7 +137,7 @@ export class PatchRegistrationPeriodsEndpoint extends Endpoint<Params, Query, Bo
                 model.settings = patchObject(model.settings, patch.settings);
             }
 
-            await model.setPreviousPeriodId();
+            await model.updatePreviousNextPeriods();
             await model.save();
 
             // Schedule patch of all groups in this period
@@ -156,23 +155,13 @@ export class PatchRegistrationPeriodsEndpoint extends Endpoint<Params, Query, Bo
                 });
             }
 
-            // Get before deleting the model
-            const updateWhere = await RegistrationPeriod.where({ previousPeriodId: model.id });
-
             // Now delete the model
             await model.delete();
-
-            // Update all previous period ids
-            await AuditLogService.setContext({ source: AuditLogSource.System }, async () => {
-                for (const period of updateWhere) {
-                    await period.setPreviousPeriodId();
-                    await period.save();
-                }
-            });
+            await RegistrationPeriod.updatePreviousNextPeriods(model.organizationId);
         }
 
         // Clear platform cache
-        Platform.clearCache();
+        await Platform.clearCache();
 
         return new Response(
             periods.map(p => p.getStructure()),

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -1,5 +1,5 @@
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
-import { GroupPrivateSettings, Group as GroupStruct, GroupType, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, PermissionLevel, PermissionsResourceType, ResourcePermissions, SetupStepType, Version } from '@stamhoofd/structures';
+import { GroupPrivateSettings, Group as GroupStruct, GroupType, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, PermissionLevel, PermissionsResourceType, ResourcePermissions, Version } from '@stamhoofd/structures';
 
 import { AutoEncoderPatchType, Decoder, PatchableArrayAutoEncoder, PatchableArrayDecoder, StringDecoder } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
@@ -407,12 +407,18 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             model.settings.period = period.getBaseStructure();
 
             if (model.type !== GroupType.EventRegistration) {
-                // Note: start date is curomizable, as long as it stays between period start and end
-                if (model.settings.startDate < period.startDate || model.settings.startDate > period.endDate) {
-                    model.settings.startDate = period.startDate;
+                if (!model.settings.hasCustomDates) {
+                    model.settings.endDate = period.endDate;
+
+                    // Note: start date is customizable, as long as it stays between period start and end
+                    if (model.settings.startDate < period.startDate || model.settings.startDate > period.endDate) {
+                        model.settings.startDate = period.startDate;
+                    }
                 }
 
-                model.settings.endDate = period.endDate;
+                if (model.settings.startDate > model.settings.endDate) {
+                    model.settings.startDate = model.settings.endDate;
+                }
             }
         }
 
@@ -530,13 +536,23 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
         model.status = struct.status;
         model.type = struct.type;
         model.settings.period = period.getBaseStructure();
-        model.settings.endDate = period.endDate;
 
-        // Note: start date is curomizable, as long as it stays between period start and end
-        if (model.settings.startDate < period.startDate || model.settings.startDate > period.endDate) {
-            model.settings.startDate = period.startDate;
+        if (!model.settings.hasCustomDates) {
+            model.settings.endDate = period.endDate;
+
+            // Note: start date is customizable, as long as it stays between period start and end
+            if (model.settings.startDate < period.startDate || model.settings.startDate > period.endDate) {
+                model.settings.startDate = period.startDate;
+            }
+        }
+
+        if (model.settings.startDate > model.settings.endDate) {
+            model.settings.startDate = model.settings.endDate;
         }
 
+        model.settings.registeredMembers = 0;
+        model.settings.reservedMembers = 0;
+
         if (!await Context.auth.canAccessGroup(model, PermissionLevel.Full)) {
             // Create a temporary permission role for this user
             const organizationPermissions = user.permissions?.organizationPermissions?.get(organizationId);

package/src/helpers/AdminPermissionChecker.ts

@@ -883,6 +883,10 @@ export class AdminPermissionChecker {
             return false;
         }
 
+        if (email.deletedAt) {
+            return false;
+        }
+
         if (email.userId === this.user.id) {
             // User can always read their own emails
             // Note; for sending we'll always need to use 'canSendEmailsFrom' externally

package/src/helpers/AuthenticatedStructures.ts

@@ -604,7 +604,7 @@ export class AuthenticatedStructures {
 
             const registration = memberBlob.registrations.find(r => r.id === id);
             if (!registration) {
-                throw new Error('Registration not found');
+                throw new Error('Registration not found: ' + id);
             }
 
             return RegistrationWithMemberBlob.create({