nodebb-plugin-onekite-calendar 2.0.65 → 2.0.66

package/lib/api.js

@@ -765,13 +765,27 @@ api.getReservationDetails = async function (req, res) {
   return res.json(out);
 };
 
+/**
+ * Get detailed information about a special event.
+ * 
+ * This endpoint is publicly accessible (no authentication required).
+ * Guests can view all event details including participants, but cannot join (canJoin will be false).
+ * 
+ * @route GET /api/v3/plugins/calendar-onekite/special-events/:eid
+ * @param {Object} req - Express request object with req.params.eid and optionally req.uid
+ * @param {Object} res - Express response object
+ * @returns {Object} Event details including participants list, calendar export links, and permission flags
+ * 
+ * @since 1.0.0 Modified to allow unauthenticated access (guests can view)
+ */
 api.getSpecialEventDetails = async function (req, res) {
   const uid = req.uid;
-  if (!uid) return res.status(401).json({ error: 'not-logged-in' });
+  // Guests (uid = null/undefined/0) can view event details but cannot join.
+  // Authenticated users get canJoin=true if they meet participation requirements.
 
   const settings = await getSettings();
-  const canMod = await canValidate(uid, settings);
-  const canSpecialDelete = await canDeleteSpecial(uid, settings);
+  const canMod = uid ? await canValidate(uid, settings) : false;
+  const canSpecialDelete = uid ? await canDeleteSpecial(uid, settings) : false;
 
   const eid = String(req.params.eid || '').trim();
   if (!eid) return res.status(400).json({ error: 'missing-eid' });
@@ -977,12 +991,26 @@ api.deleteSpecialEvent = async function (req, res) {
   res.json({ ok: true });
 };
 
+/**
+ * Get detailed information about an outing (prévision de sortie).
+ * 
+ * This endpoint is publicly accessible (no authentication required).
+ * Guests can view all outing details including participants, but cannot join (canJoin will be false).
+ * 
+ * @route GET /api/v3/plugins/calendar-onekite/outings/:oid
+ * @param {Object} req - Express request object with req.params.oid and optionally req.uid
+ * @param {Object} res - Express response object
+ * @returns {Object} Outing details including participants list, calendar export links, and permission flags
+ * 
+ * @since 1.0.0 Modified to allow unauthenticated access (guests can view)
+ */
 api.getOutingDetails = async function (req, res) {
   const uid = req.uid;
-  if (!uid) return res.status(401).json({ error: 'not-logged-in' });
+  // Guests (uid = null/undefined/0) can view outing details but cannot join.
+  // Only authenticated users in authorized groups can join outings (canRequest).
 
   const settings = await getSettings();
-  const canMod = await canValidate(uid, settings);
+  const canMod = uid ? await canValidate(uid, settings) : false;
 
   const oid = String(req.params.oid || '').trim();
   if (!oid) return res.status(400).json({ error: 'missing-oid' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-onekite-calendar",
-  "version": "2.0.65",
+  "version": "2.0.66",
   "description": "FullCalendar-based equipment reservation workflow with admin approval & HelloAsso payment for NodeBB",
   "main": "library.js",
   "license": "MIT",

package/plugin.json

@@ -39,5 +39,5 @@
   "acpScripts": [
     "public/admin.js"
   ],
-  "version": "2.0.65"
+  "version": "2.0.66"
 }