nodebb-plugin-calendar-onekite 10.0.11 → 10.0.13

package/library.js

@@ -12,6 +12,25 @@ const privileges = require.main.require('./src/privileges');
 
 const plugin = {};
 
+function ensureLoggedIn(req, res, next) {
+  if (!req.uid) {
+    return res.status(401).json({ error: 'not-authenticated' });
+  }
+  next();
+}
+
+async function adminsOnly(req, res, next) {
+  try {
+    if (!req.uid) return res.status(401).json({ error: 'not-authenticated' });
+    const isAdmin = await user.isAdministrator(req.uid);
+    if (!isAdmin) return res.status(403).json({ error: 'not-allowed' });
+    next();
+  } catch (e) {
+    res.status(500).json({ error: e.message });
+  }
+}
+
+
 const PLUGIN_NS = 'calendar-onekite';
 const RES_PREFIX = `calendar-onekite:reservation`;
 const RES_ZSET_BY_START = `calendar-onekite:reservations:byStart`;
@@ -344,7 +363,7 @@ plugin.init = async function (params) {
   });
 
   // API: create reservation (pending)
-  router.post('/api/calendar-onekite/reservations', middleware.authenticate, async (req, res) => {
+  router.post('/api/calendar-onekite/reservations', ensureLoggedIn, async (req, res) => {
     try {
       const s = await getSettings();
       await assertRequesterPrivileges(req, s);
@@ -424,7 +443,7 @@ plugin.init = async function (params) {
   });
 
   // API: approve reservation (creates checkout intent, sends payer link)
-  router.post('/api/calendar-onekite/reservations/:id/approve', middleware.authenticate, async (req, res) => {
+  router.post('/api/calendar-onekite/reservations/:id/approve', ensureLoggedIn, async (req, res) => {
     try {
       const s = await getSettings();
       await assertApproverPrivileges(req, s);
@@ -483,7 +502,7 @@ plugin.init = async function (params) {
   });
 
   // API: reject reservation
-  router.post('/api/calendar-onekite/reservations/:id/reject', middleware.authenticate, async (req, res) => {
+  router.post('/api/calendar-onekite/reservations/:id/reject', ensureLoggedIn, async (req, res) => {
     try {
       const s = await getSettings();
       await assertApproverPrivileges(req, s);
@@ -521,12 +540,12 @@ plugin.init = async function (params) {
   });
 
   // Admin API: get/save settings
-  router.get('/api/admin/plugins/calendar-onekite', middleware.authenticate, middleware.adminsOnly, async (req, res) => {
+  router.get('/api/admin/plugins/calendar-onekite', ensureLoggedIn, adminsOnly, async (req, res) => {
     const settings = await meta.settings.get(PLUGIN_NS);
     res.json(settings);
   });
 
-  router.post('/api/admin/plugins/calendar-onekite', middleware.authenticate, middleware.adminsOnly, async (req, res) => {
+  router.post('/api/admin/plugins/calendar-onekite', ensureLoggedIn, adminsOnly, async (req, res) => {
     await meta.settings.set(PLUGIN_NS, req.body);
     // invalidate caches when settings change
     helloassoTokenCache = { token: null, expiresAt: 0 };
@@ -535,7 +554,7 @@ plugin.init = async function (params) {
   });
 
   // Admin API: purge by year
-  router.post('/api/admin/plugins/calendar-onekite/purge', middleware.authenticate, middleware.adminsOnly, async (req, res) => {
+  router.post('/api/admin/plugins/calendar-onekite/purge', ensureLoggedIn, adminsOnly, async (req, res) => {
     const year = parseInt((req.body && req.body.year) || '0', 10);
     if (!year || year < 1970 || year > 3000) return res.status(400).json({ error: 'invalid-year' });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-calendar-onekite",
-  "version": "10.0.11",
+  "version": "10.0.13",
   "description": "NodeBB calendar booking plugin using FullCalendar and HelloAsso checkout intents",
   "main": "library.js",
   "license": "MIT",

package/plugin.json

@@ -20,7 +20,7 @@
   ],
   "templates": "templates",
   "staticDirs": {
-    "public": "./public"
+    "calendar-onekite": "./public"
   },
   "acpScripts": [
     "public/js/admin/calendar-onekite-admin.js"