nodebb-plugin-calendar-onekite 12.0.12 → 12.0.14

package/lib/api.js

@@ -8,6 +8,7 @@ const nconf = require.main.require('nconf');
 const user = require.main.require('./src/user');
 const groups = require.main.require('./src/groups');
 const db = require.main.require('./src/database');
+const logger = require.main.require('./src/logger');
 
 const dbLayer = require('./db');
 
@@ -173,16 +174,42 @@ async function resolveAllowedGroups(list) {
 }
 
 
+async function expandGroupCandidates(rawList) {
+  const out = [];
+  for (const raw of (rawList || [])) {
+    const g = String(raw || '').trim();
+    if (!g) continue;
+    out.push(g);
+    const mapped = await resolveGroupName(g);
+    if (mapped && mapped !== g) out.push(mapped);
+  }
+  return [...new Set(out)];
+}
+
+async function checkAnyMembership(uid, rawList, fnLabel) {
+  const candidates = await expandGroupCandidates(rawList);
+  for (const g of candidates) {
+    try {
+      const ok = await groups.isMember(uid, g);
+      if (ok) return { ok: true, matched: g, candidates };
+    } catch (e) {
+      logger.warn('[calendar-onekite] auth check error', { uid, group: g, fn: fnLabel, err: String(e && e.message || e) });
+    }
+  }
+  return { ok: false, matched: '', candidates };
+}
+
+
 function autoFormSlugForYear(year) {
   return `locations-materiel-${year}`;
 }
 
 async function canRequest(uid, settings, startTs) {
-  if (!uid) return false;
+  if (!uid) return { ok: false, allowed: [], candidates: [], startTs };
 
   // Always allow administrators to create.
   try {
-    if (await groups.isMember(uid, 'administrators')) return true;
+    if (await groups.isMember(uid, 'administrators')) return { ok: true, allowed: [], candidates: [], startTs };
   } catch (e) {}
 
   const year = yearFromTs(startTs);
@@ -194,9 +221,11 @@ async function canRequest(uid, settings, startTs) {
 
   const allowed = [defaultGroup, ...extraGroups].filter(Boolean);
 
-  // Enforce membership in at least one allowed group.
-  // Use groups.isMember so hidden groups still work.
-  return await isMemberOfAnyGroup(uid, allowed);
+  const chk = await checkAnyMembership(uid, allowed, 'canRequest');
+  if (chk.ok) return { ok: true, allowed, candidates: chk.candidates, startTs };
+
+  logger.warn('[calendar-onekite] not-allowed in canRequest', { uid, startTs, allowed, candidates: chk.candidates, raw });
+  return { ok: false, allowed, candidates: chk.candidates, startTs };
 }
 
 async function canValidate(uid, settings) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-calendar-onekite",
-  "version": "12.0.12",
+  "version": "12.0.14",
   "description": "FullCalendar-based equipment reservation workflow with admin approval & HelloAsso payment for NodeBB",
   "main": "library.js",
   "license": "MIT",