nodebb-plugin-calendar-onekite 12.0.8 → 12.0.9

package/lib/api.js

@@ -17,6 +17,35 @@ async function userInAnyGroup(uid, allowed) {
   return allowed.some(g => slugs.includes(g));
 }
 
+
+function normalizeAllowedGroups(raw) {
+  if (!raw) return [];
+  if (Array.isArray(raw)) return raw.map(v => String(v).trim()).filter(Boolean);
+  const s = String(raw).trim();
+  if (!s) return [];
+  // Some admin UIs store JSON arrays as strings
+  if ((s.startsWith('[') && s.endsWith(']')) || (s.startsWith('"[') && s.endsWith(']"'))) {
+    try {
+      const parsed = JSON.parse(s.startsWith('"') ? JSON.parse(s) : s);
+      if (Array.isArray(parsed)) return parsed.map(v => String(v).trim()).filter(Boolean);
+    } catch (e) {}
+  }
+  return s.split(',').map(v => String(v).trim().replace(/^"+|"+$/g, '')).filter(Boolean);
+}
+
+async function isMemberOfAnyGroup(uid, allowed) {
+  if (!uid || !allowed || !allowed.length) return false;
+  for (const g of allowed) {
+    try {
+      if (await groups.isMember(uid, g)) return true;
+    } catch (e) {
+      // ignore
+    }
+  }
+  return false;
+}
+
+
 const helloasso = require('./helloasso');
 
 // Email helper: NodeBB's Emailer signature differs across versions.
@@ -124,17 +153,25 @@ function autoFormSlugForYear(year) {
 }
 
 async function canRequest(uid, settings, startTs) {
+  if (!uid) return false;
+
+  // Always allow administrators to create.
+  try {
+    if (await groups.isMember(uid, 'administrators')) return true;
+  } catch (e) {}
+
   const year = yearFromTs(startTs);
   const defaultGroup = autoCreatorGroupForYear(year);
-  const extras = (settings.creatorGroups || settings.allowedGroups || '').split(',').map(s => s.trim()).filter(Boolean);
-  const allowed = [defaultGroup, ...extras].filter(Boolean);
-  // If only the default group exists, enforce membership (do not open access to all).
-  if (!allowed.length) return true;
-  for (const g of allowed) {
-    const isMember = await groups.isMember(uid, g);
-    if (isMember) return true;
-  }
-  return false;
+
+  // ACP may store group slugs as CSV string or array depending on NodeBB/admin UI.
+  const raw = settings.creatorGroups ?? settings.allowedGroups ?? [];
+  const extraGroups = normalizeAllowedGroups(raw);
+
+  const allowed = [defaultGroup, ...extraGroups].filter(Boolean);
+
+  // Enforce membership in at least one allowed group.
+  // Use groups.isMember so hidden groups still work.
+  return await isMemberOfAnyGroup(uid, allowed);
 }
 
 async function canValidate(uid, settings) {
@@ -142,12 +179,9 @@ async function canValidate(uid, settings) {
   // even if validatorGroups is empty.
   try {
     const isAdmin = await groups.isMember(uid, 'administrators');
-    if (isAdmin) return true;
-    const isGlobalMod = await groups.isMember(uid, 'Global Moderators');
-    if (isGlobalMod) return true;
-  } catch (e) {}
+    if (isAdmin) return true;} catch (e) {}
 
-  const allowed = (settings.validatorGroups || '').split(',').map(s => s.trim()).filter(Boolean);
+  const allowed = normalizeAllowedGroups(settings.validatorGroups || '');
   if (!allowed.length) return false;
   if (await userInAnyGroup(uid, allowed)) return true;
 
@@ -158,11 +192,8 @@ async function canCreateSpecial(uid, settings) {
   if (!uid) return false;
   try {
     const isAdmin = await groups.isMember(uid, 'administrators');
-    if (isAdmin) return true;
-    const isGlobalMod = await groups.isMember(uid, 'Global Moderators');
-    if (isGlobalMod) return true;
-  } catch (e) {}
-  const allowed = (settings.specialCreatorGroups || '').split(',').map(s => s.trim()).filter(Boolean);
+    if (isAdmin) return true;} catch (e) {}
+  const allowed = normalizeAllowedGroups(settings.specialCreatorGroups || '');
   if (!allowed.length) return false;
   if (await userInAnyGroup(uid, allowed)) return true;
 
@@ -173,10 +204,7 @@ async function canDeleteSpecial(uid, settings) {
   if (!uid) return false;
   try {
     const isAdmin = await groups.isMember(uid, 'administrators');
-    if (isAdmin) return true;
-    const isGlobalMod = await groups.isMember(uid, 'Global Moderators');
-    if (isGlobalMod) return true;
-  } catch (e) {}
+    if (isAdmin) return true;} catch (e) {}
   const allowed = (settings.specialDeleterGroups || settings.specialCreatorGroups || '').split(',').map(s => s.trim()).filter(Boolean);
   if (!allowed.length) return false;
   if (await userInAnyGroup(uid, allowed)) return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-calendar-onekite",
-  "version": "12.0.8",
+  "version": "12.0.9",
   "description": "FullCalendar-based equipment reservation workflow with admin approval & HelloAsso payment for NodeBB",
   "main": "library.js",
   "license": "MIT",