nodebb-plugin-calendar-onekite 11.1.19 → 11.1.20

package/library.js

@@ -1,72 +1,85 @@
 'use strict';
 
+// We use NodeBB's route helpers for page routes so the rendered page includes
+// the normal client bundle (ajaxify/requirejs). The helper signatures differ
+// across NodeBB versions, but for NodeBB v4.x the order is:
+//   setupPageRoute(router, path, middlewaresArray, handler)
+//   setupAdminPageRoute(router, path, middlewaresArray, handler)
+const routeHelpers = require.main.require('./src/routes/helpers');
+
 const controllers = require('./lib/controllers');
 const api = require('./lib/api');
 const admin = require('./lib/admin');
 const scheduler = require('./lib/scheduler');
 
-const Groups = require.main.require('./src/groups');
-
 const Plugin = {};
 
-function isFn(fn) { return typeof fn === 'function'; }
-function mw(...fns) { return fns.filter(isFn); }
+const isFn = (fn) => typeof fn === 'function';
+const mw = (...fns) => fns.filter(isFn);
 
-// Simple admin guard that does not rely on middleware.admin.checkPrivileges (signature differs across versions)
-async function adminGuard(req, res, next) {
-  try {
-    if (!req.uid) {
-      return res.status(403).json({ status: { code: 'forbidden', message: 'Admin only' } });
-    }
-    const isAdmin = await Groups.isMember(req.uid, 'administrators');
-    if (!isAdmin) {
-      return res.status(403).json({ status: { code: 'forbidden', message: 'Admin only' } });
+Plugin.init = async function (params) {
+  const { router, middleware } = params;
+
+  // Build middleware arrays safely and always spread them into Express route methods.
+  // Express will throw if any callback is undefined, so we filter strictly.
+  const publicExpose = mw(middleware && middleware.exposeUid);
+  const publicAuth = mw(middleware && middleware.exposeUid, middleware && middleware.ensureLoggedIn);
+
+  // Robust admin guard: avoid middleware.admin.checkPrivileges() signature differences
+  // across NodeBB versions. We treat membership in the 'administrators' group as admin.
+  const Groups = require.main.require('./src/groups');
+  async function adminOnly(req, res, next) {
+    try {
+      const uid = req.uid;
+      if (!uid) {
+        return res.status(401).json({ status: { code: 'not-authorized', message: 'Not logged in' } });
+      }
+      const isAdmin = await Groups.isMember(uid, 'administrators');
+      if (!isAdmin) {
+        return res.status(403).json({ status: { code: 'not-authorized', message: 'Not allowed' } });
+      }
+      return next();
+    } catch (err) {
+      return next(err);
     }
-    return next();
-  } catch (err) {
-    return next(err);
   }
-}
-
-Plugin.init = async function (params) {
-  const router = params.router;
-  const middleware = params.middleware;
+  const adminMws = mw(middleware && middleware.exposeUid, middleware && middleware.ensureLoggedIn, adminOnly);
 
-  // ---------- Pages ----------
-  // Public calendar page
-  router.get('/calendar', ...mw(middleware.exposeUid, middleware.buildHeader), controllers.renderCalendar);
+  // Page routes (HTML)
+  // IMPORTANT: pass an ARRAY for middlewares (even if empty), otherwise
+  // setupPageRoute will throw "middlewares is not iterable".
+  routeHelpers.setupPageRoute(router, '/calendar', mw(), controllers.renderCalendar);
+  routeHelpers.setupAdminPageRoute(router, '/admin/plugins/calendar-onekite', mw(), admin.renderAdmin);
 
-  // ACP page
-  router.get('/admin/plugins/calendar-onekite', ...mw(middleware.exposeUid, middleware.admin?.buildHeader), controllers.renderAdmin);
+  // Public API (JSON)
+  // We register both v3 and legacy (/api/...) endpoints as a compatibility fallback.
 
-  // ---------- Public API (v3 + legacy fallback) ----------
-  const expose = mw(middleware.exposeUid);
+  ['/api/v3/plugins/calendar-onekite/events', '/api/plugins/calendar-onekite/events'].forEach((p) => {
+    router.get(p, ...publicExpose, api.getEvents);
+  });
 
-  router.get('/api/v3/plugins/calendar-onekite/events', ...expose, api.getEvents);
-  router.get('/api/v3/plugins/calendar-onekite/items', ...expose, api.getItems);
-  router.post('/api/v3/plugins/calendar-onekite/reservations', ...mw(middleware.exposeUid, middleware.ensureLoggedIn), api.createReservation);
+  ['/api/v3/plugins/calendar-onekite/items', '/api/plugins/calendar-onekite/items'].forEach((p) => {
+    router.get(p, ...publicExpose, api.getItems);
+  });
 
-  router.get('/api/plugins/calendar-onekite/events', ...expose, api.getEvents);
-  router.get('/api/plugins/calendar-onekite/items', ...expose, api.getItems);
-  router.post('/api/plugins/calendar-onekite/reservations', ...mw(middleware.exposeUid, middleware.ensureLoggedIn), api.createReservation);
+  ['/api/v3/plugins/calendar-onekite/reservations', '/api/plugins/calendar-onekite/reservations'].forEach((p) => {
+    router.post(p, ...publicAuth, api.createReservation);
+  });
 
-  // ---------- Admin API (v3 + legacy fallback) ----------
-  const adminMws = mw(middleware.exposeUid, adminGuard);
+  // Admin API (JSON)
+  const adminBases = ['/api/v3/admin/plugins/calendar-onekite', '/api/admin/plugins/calendar-onekite'];
 
-  const adminRoutes = (prefix) => {
-    router.get(`${prefix}/settings`, ...adminMws, admin.getSettings);
-    router.put(`${prefix}/settings`, ...adminMws, admin.saveSettings);
-    router.get(`${prefix}/pending`, ...adminMws, admin.listPending);
-    router.post(`${prefix}/approve`, ...adminMws, admin.approveReservation);
-    router.post(`${prefix}/refuse`, ...adminMws, admin.refuseReservation);
-    router.post(`${prefix}/purge`, ...adminMws, admin.purgeYear);
-    router.get(`${prefix}/debug`, ...adminMws, admin.debugHelloAsso);
-  };
+  adminBases.forEach((base) => {
+    router.get(`${base}/settings`, ...adminMws, admin.getSettings);
+    router.put(`${base}/settings`, ...adminMws, admin.saveSettings);
 
-  adminRoutes('/api/v3/admin/plugins/calendar-onekite');
-  adminRoutes('/api/admin/plugins/calendar-onekite');
+    router.get(`${base}/pending`, ...adminMws, admin.listPending);
+    router.put(`${base}/reservations/:rid/approve`, ...adminMws, admin.approveReservation);
+    router.put(`${base}/reservations/:rid/refuse`, ...adminMws, admin.refuseReservation);
 
-  // Start periodic cleanup of expired pending reservations
+    router.post(`${base}/purge`, ...adminMws, admin.purgeByYear);
+    router.get(`${base}/debug`, ...adminMws, admin.debugHelloAsso);
+  });
   scheduler.start();
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-calendar-onekite",
-  "version": "11.1.19",
+  "version": "11.1.20",
   "description": "FullCalendar-based equipment reservation workflow with admin approval & HelloAsso payment for NodeBB",
   "main": "library.js",
   "license": "MIT",
@@ -8,4 +8,4 @@
     "node": ">=18"
   },
   "dependencies": {}
-}
+}