nodebb-plugin-onekite-calendar 2.0.48 → 2.0.49

package/lib/api.js

@@ -924,7 +924,9 @@ api.getCapabilities = async function (req, res) {
     canModerate: canMod,
     canCreateSpecial: uid ? await canCreateSpecial(uid, settings) : false,
     canDeleteSpecial: uid ? await canDeleteSpecial(uid, settings) : false,
+    // Outings share the same rights as reservations/locations.
     canCreateOuting: uid ? await canRequest(uid, settings, Date.now()) : false,
+    canCreateReservation: uid ? await canRequest(uid, settings, Date.now()) : false,
   });
 };
 
@@ -1055,7 +1057,13 @@ api.createOuting = async function (req, res) {
   // not on the outing date, so members can plan future outings without
   // requiring next-year group membership.
   const ok = await canRequest(req.uid, settings, Date.now());
-  if (!ok) return res.status(403).json({ error: 'not-allowed' });
+  if (!ok) {
+    return res.status(403).json({
+      error: 'not-allowed',
+      code: 'NOT_MEMBER',
+      message: 'Vous devez être adhérent Onekite',
+    });
+  }
 
   const title = String((req.body && req.body.title) || '').trim() || 'Sortie';
   const endTs = toTs(req.body && req.body.end);
@@ -1186,7 +1194,13 @@ api.createReservation = async function (req, res) {
   const settings = await meta.settings.get('calendar-onekite');
   const startPreview = toTs(req.body.start);
   const ok = await canRequest(uid, settings, startPreview);
-  if (!ok) return res.status(403).json({ error: 'not-allowed' });
+  if (!ok) {
+    return res.status(403).json({
+      error: 'not-allowed',
+      code: 'NOT_MEMBER',
+      message: 'Vous devez être adhérent Onekite',
+    });
+  }
 
   const isValidator = await canValidate(uid, settings);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-onekite-calendar",
-  "version": "2.0.48",
+  "version": "2.0.49",
   "description": "FullCalendar-based equipment reservation workflow with admin approval & HelloAsso payment for NodeBB",
   "main": "library.js",
   "license": "MIT",

package/plugin.json

@@ -39,5 +39,5 @@
   "acpScripts": [
     "public/admin.js"
   ],
-  "version": "2.0.48"
+  "version": "2.0.49"
 }

package/public/client.js

@@ -1203,6 +1203,8 @@ function toDatetimeLocalValue(date) {
     const caps = await loadCapabilities().catch(() => ({}));
     const canCreateSpecial = !!caps.canCreateSpecial;
     const canDeleteSpecial = !!caps.canDeleteSpecial;
+    const canCreateOuting = !!caps.canCreateOuting;
+    const canCreateReservation = !!caps.canCreateReservation;
 
     // Creation chooser: Location / Prévision de sortie / Évènement (si autorisé).
 
@@ -1281,6 +1283,17 @@ function toDatetimeLocalValue(date) {
       if (isDialogOpen) return;
       if (!lockAction('create', 900)) return;
 
+      // If the user is not an Onekite member (or not logged in), do not open
+      // the creation chooser at all. This avoids a confusing "not-allowed"
+      // error after the user fills the form.
+      try {
+        if (!canCreateReservation && !canCreateOuting && !canCreateSpecial) {
+          showAlert('error', 'Vous devez être adhérent Onekite');
+          try { calendar.unselect(); } catch (e) {}
+          return;
+        }
+      } catch (e) {}
+
       // Business rule: nothing can be created in the past.
       try {
         const startDateCheck = toLocalYmd(info.start);
@@ -1325,7 +1338,7 @@ function toDatetimeLocalValue(date) {
       // Buttons order matters for UX: put "Annuler" at bottom-right (last).
       const buttons = {};
 
-      buttons.location = {
+      if (canCreateReservation) buttons.location = {
         label: 'Location',
         className: 'btn-onekite-location',
         callback: async () => {
@@ -1364,7 +1377,7 @@ function toDatetimeLocalValue(date) {
         },
       };
 
-      buttons.outing = {
+      if (canCreateOuting) buttons.outing = {
         label: 'Prévision de sortie',
         className: 'btn-onekite-outing',
         callback: async () => {