nodebb-plugin-onekite-calendar 2.0.74 → 2.0.75

package/lib/api.js

@@ -778,7 +778,7 @@ api.getCapabilities = async function (req, res) {
     isValidator: canMod,
     canCreateSpecial: canSpecialC,
     canDeleteSpecial: canSpecialD,
-    canCreateOuting: canReq,
+    canCreateOuting: canMod || canReq,
     canCreateReservation: canReq,
     specialEventCategoryCid: parseInt(settings && settings.specialEventCategoryId, 10) || 0,
   });
@@ -938,7 +938,7 @@ api.getOutingDetails = async function (req, res) {
   });
 
   const participants = normalizeUidList(o.participants);
-  const canEditOuting = uid ? await canRequest(uid, settings, Date.now()) : false;
+  const canEditOuting = uid ? (canMod || await canRequest(uid, settings, Date.now())) : false;
   const out = {
     oid: o.oid,
     title: o.title || '',
@@ -967,8 +967,7 @@ api.joinOuting = async function (req, res) {
   const settings = await getSettings();
   const uid = req.uid;
   if (!uid) return res.status(401).json({ error: 'not-logged-in' });
-  // Outings share the same rights as reservations/locations.
-  const ok = await canRequest(uid, settings, Date.now());
+  const ok = (await canValidate(uid, settings)) || (await canRequest(uid, settings, Date.now()));
   if (!ok) return res.status(403).json({ error: 'not-allowed' });
 
   const oid = String(req.params.oid || '').replace(/^outing:/, '').trim();
@@ -999,8 +998,7 @@ api.leaveOuting = async function (req, res) {
   const settings = await getSettings();
   const uid = req.uid;
   if (!uid) return res.status(401).json({ error: 'not-logged-in' });
-  // Outings share the same rights as reservations/locations.
-  const ok = await canRequest(uid, settings, Date.now());
+  const ok = (await canValidate(uid, settings)) || (await canRequest(uid, settings, Date.now()));
   if (!ok) return res.status(403).json({ error: 'not-allowed' });
 
   const oid = String(req.params.oid || '').replace(/^outing:/, '').trim();
@@ -1032,12 +1030,9 @@ api.createOuting = async function (req, res) {
   if (!req.uid) return res.status(401).json({ error: 'not-logged-in' });
 
   const startTs = toTs(req.body && req.body.start);
-  // Permissions for outings must match reservations/locations rights.
-  // We intentionally base the "auto" yearly group on the *current* year,
-  // not on the outing date, so members can plan future outings without
-  // requiring next-year group membership.
-  const ok = await canRequest(req.uid, settings, Date.now());
-  if (!ok) {
+  const isValidatorForOuting = await canValidate(req.uid, settings);
+  const canMakeOuting = isValidatorForOuting || (await canRequest(req.uid, settings, Date.now()));
+  if (!canMakeOuting) {
     return res.status(403).json({
       error: 'not-allowed',
       code: 'NOT_MEMBER',
@@ -1051,18 +1046,20 @@ api.createOuting = async function (req, res) {
     return res.status(400).json({ error: 'bad-dates' });
   }
 
-  // Business rule: nothing can be created in the past.
-  try {
-    const today0 = new Date();
-    today0.setHours(0, 0, 0, 0);
-    const today0ts = today0.getTime();
-    if (startTs < today0ts) {
-      return res.status(400).json({
-        error: 'date-too-soon',
-        message: "Impossible de créer pour une date passée.",
-      });
-    }
-  } catch (e) {}
+  // Validators can create outings in the past (regularization); others cannot.
+  if (!isValidatorForOuting) {
+    try {
+      const today0 = new Date();
+      today0.setHours(0, 0, 0, 0);
+      const today0ts = today0.getTime();
+      if (startTs < today0ts) {
+        return res.status(400).json({
+          error: 'date-too-soon',
+          message: "Impossible de créer pour une date passée.",
+        });
+      }
+    } catch (e) {}
+  }
 
   const address = String((req.body && req.body.address) || '').trim();
   const notes = String((req.body && req.body.notes) || '').trim();
@@ -1122,7 +1119,7 @@ api.deleteOuting = async function (req, res) {
 api.updateOuting = async function (req, res) {
   const settings = await getSettings();
   if (!req.uid) return res.status(401).json({ error: 'not-logged-in' });
-  const ok = await canRequest(req.uid, settings, Date.now());
+  const ok = (await canValidate(req.uid, settings)) || (await canRequest(req.uid, settings, Date.now()));
   if (!ok) return res.status(403).json({ error: 'not-allowed' });
 
   const oid = String(req.params.oid || '').replace(/^outing:/, '').trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-onekite-calendar",
-  "version": "2.0.74",
+  "version": "2.0.75",
   "description": "FullCalendar-based equipment reservation workflow with admin approval & HelloAsso payment for NodeBB",
   "main": "library.js",
   "license": "MIT",