nodebb-plugin-calendar-onekite 11.1.52 → 11.1.54

package/lib/api.js

@@ -203,6 +203,12 @@ api.getEvents = async function (req, res) {
       ev.extendedProps.canModerate = canMod;
       ev.extendedProps.total = r.total || 0;
       ev.extendedProps.createdAt = r.createdAt || null;
+      // Expose payment URL only to the requester (or moderators) when awaiting payment
+      if (r.status === 'awaiting_payment' && r.paymentUrl && (/^https?:\/\//i).test(String(r.paymentUrl))) {
+        if ((req.uid && String(req.uid) === String(r.uid)) || canMod) {
+          ev.extendedProps.paymentUrl = String(r.paymentUrl);
+        }
+      }
       out.push(ev);
     }
   }

package/lib/helloasso.js

@@ -14,31 +14,35 @@ function requestJson(method, url, headers = {}, bodyObj = null) {
         port: u.port || 443,
         path: u.pathname + u.search,
         headers: {
-          'Accept': 'application/json',
+          Accept: 'application/json',
+          'Content-Type': 'application/json',
+          ...(body ? { 'Content-Length': Buffer.byteLength(body) } : {}),
           ...headers,
-          ...(body ? { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) } : {}),
         },
       },
-      (res) => {
+      (resp) => {
         let data = '';
-        res.setEncoding('utf8');
-        res.on('data', (chunk) => (data += chunk));
-        res.on('end', () => {
-          const status = res.statusCode || 0;
-          if (!data) {
-            return resolve({ status, json: null });
-          }
+        resp.setEncoding('utf8');
+        resp.on('data', (chunk) => { data += chunk; });
+        resp.on('end', () => {
+          const status = resp.statusCode || 0;
+
+          // Try JSON first, but never throw from here (avoid crashing NodeBB).
           try {
-            const json = JSON.parse(data);
-            resolve({ status, json });
+            const json = data ? JSON.parse(data) : null;
+            return resolve({ status, json });
           } catch (e) {
-            reject(new Error(`HelloAsso: Invalid JSON (status ${status})`));
+            // Non-JSON response (HTML/proxy error/etc.)
+            const snippet = String(data || '').slice(0, 500);
+            return resolve({ status, json: null, raw: snippet });
           }
         });
       }
     );
 
-    req.on('error', reject);
+    req.on('error', (err) => {
+      resolve({ status: 0, json: null, error: err && err.message ? err.message : String(err) });
+    });
     if (body) req.write(body);
     req.end();
   });
@@ -246,4 +250,4 @@ module.exports = {
   extractCatalogItems,
   listCatalogItems,
   createCheckoutIntent,
-};
+};

package/lib/helloassoWebhook.js

@@ -145,7 +145,7 @@ function buildBodyCandidates(req) {
 
 async function verifySignature(req) {
   const settings = await meta.settings.get(SETTINGS_KEY);
-  const secret = settings && settings.helloassoClientSecret ? String(settings.helloassoClientSecret) : '';
+  const secret = settings && (settings.helloassoSignatureKey || settings.helloassoClientSecret) ? String(settings.helloassoSignatureKey || settings.helloassoClientSecret) : '';
   const provided = req.headers['x-ha-signature'] || req.headers['X-HA-Signature'];
   if (!secret || !provided) return false;
 
@@ -254,13 +254,26 @@ function getReservationIdFromPayload(payload) {
  */
 async function handler(req, res, next) {
   try {
+    if (req.method === 'GET') {
+      return res.json({ ok: true });
+    }
     if (req.method !== 'POST') {
       return res.status(405).json({ ok: false, error: 'method-not-allowed' });
     }
 
-    const sigOk = await verifySignature(req);
-    if (!sigOk) {
-      return res.status(401).json({ ok: false, error: 'invalid-signature' });
+    // Verify signature if a signatureKey is configured; otherwise accept but log a warning.
+    const settings = await meta.settings.get(SETTINGS_KEY);
+    const hasSigKey = settings && settings.helloassoSignatureKey;
+    if (hasSigKey) {
+      const sigOk = await verifySignature(req);
+      if (!sigOk) {
+        // eslint-disable-next-line no-console
+        console.warn('[calendar-onekite] HelloAsso webhook invalid signature', { ip: req.ip, ua: req.headers['user-agent'] });
+        return res.status(401).json({ ok: false, error: 'invalid-signature' });
+      }
+    } else {
+      // eslint-disable-next-line no-console
+      console.warn('[calendar-onekite] HelloAsso webhook signatureKey not set; skipping signature verification');
     }
 
     // At this point, the payload is trusted.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-calendar-onekite",
-  "version": "11.1.52",
+  "version": "11.1.54",
   "description": "FullCalendar-based equipment reservation workflow with admin approval & HelloAsso payment for NodeBB",
   "main": "library.js",
   "license": "MIT",

package/public/client.js

@@ -287,7 +287,7 @@ define('forum/calendar-onekite', ['alerts', 'bootbox', 'hooks'], function (alert
         const rid = p.rid || ev.id;
         const status = p.status || '';
         const itemsHtml = (() => {
-        const names = Array.isArray(p.itemNames) ? p.itemNames : (p.itemName ? [p.itemName] : []);
+        const names = Array.isArray(p.itemNames) ? p.itemNames : (typeof p.itemNames === 'string' && p.itemNames.trim() ? p.itemNames.split(',').map(s=>s.trim()).filter(Boolean) : (p.itemName ? [p.itemName] : []));
         if (names.length) {
           return `<ul style="margin:0 0 0 1.1rem; padding:0;">${names.map(n => `<li>${String(n).replace(/</g,'&lt;').replace(/>/g,'&gt;')}</li>`).join('')}</ul>`;
         }
@@ -361,7 +361,7 @@ define('forum/calendar-onekite', ['alerts', 'bootbox', 'hooks'], function (alert
             callback: async () => {
               const itemNames = Array.isArray(p.itemNames) && p.itemNames.length
                 ? p.itemNames
-                : (p.itemName ? [p.itemName] : []);
+                : (typeof p.itemNames === 'string' && p.itemNames.trim() ? p.itemNames.split(',').map(s=>s.trim()).filter(Boolean) : (p.itemName ? [p.itemName] : []));
               const itemsListHtml = itemNames.length
                 ? `<div class="mb-2"><strong>Matériel</strong><ul style="margin:0.25rem 0 0 1.1rem; padding:0;">${itemNames.map(n => `<li>${String(n).replace(/</g, '&lt;').replace(/>/g, '&gt;')}</li>`).join('')}</ul></div>`
                 : '';

package/templates/admin/plugins/calendar-onekite.tpl

@@ -61,6 +61,12 @@
             <input class="form-control" name="helloassoClientSecret" type="password">
           </div>
 
+          <div class="mb-3">
+            <label class="form-label">Webhook signatureKey (x-ha-signature)</label>
+            <input class="form-control" name="helloassoSignatureKey" type="password">
+            <div class="form-text">Clé de signature HelloAsso utilisée pour vérifier le header <code>x-ha-signature</code> des webhooks. Recommandé.</div>
+          </div>
+
           <div class="mb-3">
             <label class="form-label">Organization Slug</label>
             <input class="form-control" name="helloassoOrganizationSlug">