10656551217

Committed 01 Sep 2024 06:54PM UTC coverage: 82.678% (+0.007%) from 82.671%

Build # 10656551217

Build Type

Pull #348

github

Committed by

web-flow

Commit Message

Merge 353c9a27c into e7cfda55c

Pull Request Pull Request #348: Refactoring code in `src/api/groups.js` to reduce Cognitive Complexity

Run Details

9966 of 13474 branches covered (73.96%)

Branch coverage included in aggregate %.

9 of 9 new or added lines in 1 file covered. (100.0%)

8 existing lines in 1 file now uncovered.

22328 of 25586 relevant lines covered (87.27%)

1632.55 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

92.56

/src/api/groups.js

'use strict';

const validator = require('validator');

const privileges = require('../privileges');
const events = require('../events');
const groups = require('../groups');
const user = require('../user');
const meta = require('../meta');
const notifications = require('../notifications');
const slugify = require('../slugify');

const groupsAPI = module.exports;

groupsAPI.list = async (caller, data) => {
        const groupsPerPage = 10;
        const start = parseInt(data.after || 0, 10);
        const stop = start + groupsPerPage - 1;
        const groupData = await groups.getGroupsBySort(data.sort, start, stop);

        return { groups: groupData, nextStart: stop + 1 };
};

groupsAPI.create = async function (caller, data) {
        if (!caller.uid) {
                throw new Error('[[error:no-privileges]]');
        } else if (!data) {
                throw new Error('[[error:invalid-data]]');
        } else if (typeof data.name !== 'string' || groups.isPrivilegeGroup(data.name)) {
                throw new Error('[[error:invalid-group-name]]');
        }

        const canCreate = await privileges.global.can('group:create', caller.uid);
        if (!canCreate) {
                throw new Error('[[error:no-privileges]]');
        }
        data.ownerUid = caller.uid;
        data.system = false;
        const groupData = await groups.create(data);
        logGroupEvent(caller, 'group-create', {
                groupName: data.name,
        });

        return groupData;
};

groupsAPI.update = async function (caller, data) {
        if (!data) {
                throw new Error('[[error:invalid-data]]');
        }
        const groupName = await groups.getGroupNameByGroupSlug(data.slug);
        await isOwner(caller, groupName);

        delete data.slug;
        await groups.update(groupName, data);

        return await groups.getGroupData(data.name || groupName);
};

groupsAPI.delete = async function (caller, data) {
        const groupName = await groups.getGroupNameByGroupSlug(data.slug);
        await isOwner(caller, groupName);
        if (
                groups.systemGroups.includes(groupName) ||
                groups.ephemeralGroups.includes(groupName)
        ) {
                throw new Error('[[error:not-allowed]]');
        }

        await groups.destroy(groupName);
        logGroupEvent(caller, 'group-delete', {
                groupName: groupName,
        });
};

groupsAPI.listMembers = async (caller, data) => {
        // v4 wishlist — search should paginate (with lru caching I guess) to match index listing behaviour
        const groupName = await groups.getGroupNameByGroupSlug(data.slug);

        await canSearchMembers(caller.uid, groupName);
        if (!await privileges.global.can('search:users', caller.uid)) {
                throw new Error('[[error:no-privileges]]');
        }

        const { query } = data;
        const after = parseInt(data.after || 0, 10);
        let response;
        if (query && query.length) {
                response = await groups.searchMembers({
                        uid: caller.uid,
                        query,
                        groupName,
                });
                response.nextStart = null;
        } else {
                response = {
                        users: await groups.getOwnersAndMembers(groupName, caller.uid, after, after + 19),
                        nextStart: after + 20,
                        matchCount: null,
                        timing: null,
                };
        }

        return response;
};

async function canSearchMembers(uid, groupName) {
        const [isHidden, isMember, hasAdminPrivilege, isGlobalMod, viewGroups] = await Promise.all([
                groups.isHidden(groupName),
                groups.isMember(uid, groupName),
                privileges.admin.can('admin:groups', uid),
                user.isGlobalModerator(uid),
                privileges.global.can('view:groups', uid),
        ]);

        if (!viewGroups || (isHidden && !isMember && !hasAdminPrivilege && !isGlobalMod)) {
                throw new Error('[[error:no-privileges]]');
        }
}

function validateJoinRequest(caller, data) {
        if (!data) {
                throw new Error('[[error:invalid-data]]');
        }
        if (caller.uid <= 0 || !data.uid) {
                throw new Error('[[error:invalid-uid]]');
        }
}

async function checkPrivileges(caller, groupName) {
        const isCallerAdmin = await privileges.admin.can('admin:groups', caller.uid);
        if (!isCallerAdmin && (
                groups.systemGroups.includes(groupName) ||
                groups.isPrivilegeGroup(groupName)
        )) {
                throw new Error('[[error:not-allowed]]');
        }
        return isCallerAdmin;
}

function isGroupJoinDisabledForCaller(isCallerAdmin, isSelf, groupData) {
        return !isCallerAdmin && isSelf && groupData.private && groupData.disableJoinRequests;
}

groupsAPI.join = async function (caller, data) {
        validateJoinRequest(caller, data);

        const groupName = await groups.getGroupNameByGroupSlug(data.slug);
        if (!groupName) {
                throw new Error('[[error:no-group]]');
        }

        const isCallerAdmin = await checkPrivileges(caller, groupName);

        const [groupData, userExists] = await Promise.all([
                groups.getGroupData(groupName),
                user.exists(data.uid),
        ]);

        if (!userExists) {
                throw new Error('[[error:invalid-uid]]');
        }

        const isSelf = parseInt(caller.uid, 10) === parseInt(data.uid, 10);
        if (!meta.config.allowPrivateGroups && isSelf) {
                // all groups are public!
                await groups.join(groupName, data.uid);
                logGroupEvent(caller, 'group-join', {
                        groupName: groupName,
                        targetUid: data.uid,
                });
                return;
        }

        if (isGroupJoinDisabledForCaller(isCallerAdmin, isSelf, groupData)) {
                throw new Error('[[error:group-join-disabled]]');
        }

        if ((!groupData.private && isSelf) || isCallerAdmin) {
                await groups.join(groupName, data.uid);
                logGroupEvent(caller, `group-${isSelf ? 'join' : 'add-member'}`, {
                        groupName: groupName,
                        targetUid: data.uid,
                });
        } else if (isSelf) {
                await groups.requestMembership(groupName, caller.uid);
                logGroupEvent(caller, 'group-request-membership', {
                        groupName: groupName,
                        targetUid: data.uid,
                });
        } else {
                throw new Error('[[error:not-allowed]]');
        }
};

groupsAPI.leave = async function (caller, data) {
        if (!data) {
                throw new Error('[[error:invalid-data]]');
        }
        if (caller.uid <= 0) {
                throw new Error('[[error:invalid-uid]]');
        }
        const isSelf = parseInt(caller.uid, 10) === parseInt(data.uid, 10);
        const groupName = await groups.getGroupNameByGroupSlug(data.slug);
        if (!groupName) {
                throw new Error('[[error:no-group]]');
        }

        if (typeof groupName !== 'string') {
                throw new Error('[[error:invalid-group-name]]');
        }

        if (groupName === 'administrators' && isSelf) {
                throw new Error('[[error:cant-remove-self-as-admin]]');
        }

        const [groupData, isCallerOwner, userExists, isMember] = await Promise.all([
                groups.getGroupData(groupName),
                isOwner(caller, groupName, false),
                user.exists(data.uid),
                groups.isMember(data.uid, groupName),
        ]);

        if (!isMember) {
                throw new Error('[[error:group-not-member]]');
        }

        if (!userExists) {
                throw new Error('[[error:invalid-uid]]');
        }

        if (groupData.disableLeave && isSelf) {
                throw new Error('[[error:group-leave-disabled]]');
        }

        if (isSelf || isCallerOwner) {
                await groups.leave(groupName, data.uid);
        } else {
                throw new Error('[[error:no-privileges]]');
        }

        const { displayname } = await user.getUserFields(data.uid, ['username']);

        const notification = await notifications.create({
                type: 'group-leave',
                bodyShort: `[[groups:membership.leave.notification-title, ${displayname}, ${groupName}]]`,
                nid: `group:${validator.escape(groupName)}:uid:${data.uid}:group-leave`,
                path: `/groups/${slugify(groupName)}`,
                from: data.uid,
        });
        const uids = await groups.getOwners(groupName);
        await notifications.push(notification, uids);

        logGroupEvent(caller, `group-${isSelf ? 'leave' : 'kick'}`, {
                groupName: groupName,
                targetUid: data.uid,
        });
};

groupsAPI.grant = async (caller, data) => {
        const groupName = await groups.getGroupNameByGroupSlug(data.slug);
        await isOwner(caller, groupName);

        await groups.ownership.grant(data.uid, groupName);
        logGroupEvent(caller, 'group-owner-grant', {
                groupName: groupName,
                targetUid: data.uid,
        });
};

groupsAPI.rescind = async (caller, data) => {
        const groupName = await groups.getGroupNameByGroupSlug(data.slug);
        await isOwner(caller, groupName);

        await groups.ownership.rescind(data.uid, groupName);
        logGroupEvent(caller, 'group-owner-rescind', {
                groupName,
                targetUid: data.uid,
        });
};

groupsAPI.getPending = async (caller, { slug }) => {
        const groupName = await groups.getGroupNameByGroupSlug(slug);
        await isOwner(caller, groupName);

        return await groups.getPending(groupName);
};

groupsAPI.accept = async (caller, { slug, uid }) => {
        const groupName = await groups.getGroupNameByGroupSlug(slug);

        await isOwner(caller, groupName);
        const isPending = await groups.isPending(uid, groupName);
        if (!isPending) {
                throw new Error('[[error:group-user-not-pending]]');
        }

        await groups.acceptMembership(groupName, uid);
        logGroupEvent(caller, 'group-accept-membership', {
                groupName,
                targetUid: uid,
        });
};

groupsAPI.reject = async (caller, { slug, uid }) => {
        const groupName = await groups.getGroupNameByGroupSlug(slug);

        await isOwner(caller, groupName);
        const isPending = await groups.isPending(uid, groupName);
        if (!isPending) {
                throw new Error('[[error:group-user-not-pending]]');
        }

        await groups.rejectMembership(groupName, uid);
        logGroupEvent(caller, 'group-reject-membership', {
                groupName,
                targetUid: uid,
        });
};

groupsAPI.getInvites = async (caller, { slug }) => {
        const groupName = await groups.getGroupNameByGroupSlug(slug);
        await isOwner(caller, groupName);

        return await groups.getInvites(groupName);
};

groupsAPI.issueInvite = async (caller, { slug, uid }) => {
        const groupName = await groups.getGroupNameByGroupSlug(slug);
        await isOwner(caller, groupName);

        await groups.invite(groupName, uid);
        logGroupEvent(caller, 'group-invite', {
                groupName,
                targetUid: uid,
        });
};

groupsAPI.acceptInvite = async (caller, { slug, uid }) => {
        const groupName = await groups.getGroupNameByGroupSlug(slug);

        // Can only be called by the invited user
        const invited = await groups.isInvited(uid, groupName);
        if (caller.uid !== parseInt(uid, 10)) {
                throw new Error('[[error:not-allowed]]');
        }
        if (!invited) {
                throw new Error('[[error:not-invited]]');
        }

        await groups.acceptMembership(groupName, uid);
        logGroupEvent(caller, 'group-invite-accept', { groupName });
};

groupsAPI.rejectInvite = async (caller, { slug, uid }) => {
        const groupName = await groups.getGroupNameByGroupSlug(slug);

        // Can be called either by invited user, or group owner
        const owner = await isOwner(caller, groupName, false);
        const invited = await groups.isInvited(uid, groupName);

        if (!owner && caller.uid !== parseInt(uid, 10)) {
                throw new Error('[[error:not-allowed]]');
        }
        if (!invited) {
                throw new Error('[[error:not-invited]]');
        }

        await groups.rejectMembership(groupName, uid);
        if (!owner) {
                logGroupEvent(caller, 'group-invite-reject', { groupName });
        }
};

async function isOwner(caller, groupName, throwOnFalse = true) {
        if (typeof groupName !== 'string') {
                throw new Error('[[error:invalid-group-name]]');
        }
        const [hasAdminPrivilege, isGlobalModerator, isOwner, group] = await Promise.all([
                privileges.admin.can('admin:groups', caller.uid),
                user.isGlobalModerator(caller.uid),
                groups.ownership.isOwner(caller.uid, groupName),
                groups.getGroupData(groupName),
        ]);

        const check = isOwner || hasAdminPrivilege || (isGlobalModerator && !group.system);
        if (!check && throwOnFalse) {
                throw new Error('[[error:no-privileges]]');
        }

        return check;
}

function logGroupEvent(caller, event, additional) {
        events.log({
                type: event,
                uid: caller.uid,
                ip: caller.ip,
                ...additional,
        });
}

1	'use strict';
2
3	const validator = require('validator');	1✔
4
5	const privileges = require('../privileges');	1✔
6	const events = require('../events');	1✔
7	const groups = require('../groups');	1✔
8	const user = require('../user');	1✔
9	const meta = require('../meta');	1✔
10	const notifications = require('../notifications');	1✔
11	const slugify = require('../slugify');	1✔
12
13	const groupsAPI = module.exports;	1✔
14
15	groupsAPI.list = async (caller, data) => {	1✔
16	const groupsPerPage = 10;	3✔
17	const start = parseInt(data.after \|\| 0, 10);	3✔
18	const stop = start + groupsPerPage - 1;	3✔
19	const groupData = await groups.getGroupsBySort(data.sort, start, stop);	3✔
20
21	return { groups: groupData, nextStart: stop + 1 };	3✔
22	};
23
24	groupsAPI.create = async function (caller, data) {	1✔
25	if (!caller.uid) {	11✔
26	throw new Error('[[error:no-privileges]]');	1✔
27	} else if (!data) {	10✔
28	throw new Error('[[error:invalid-data]]');	1✔
29	} else if (typeof data.name !== 'string' \|\| groups.isPrivilegeGroup(data.name)) {	9✔
30	throw new Error('[[error:invalid-group-name]]');	3✔
31	}
32
33	const canCreate = await privileges.global.can('group:create', caller.uid);	6✔
34	if (!canCreate) {	6✔
35	throw new Error('[[error:no-privileges]]');	1✔
36	}
37	data.ownerUid = caller.uid;	5✔
38	data.system = false;	5✔
39	const groupData = await groups.create(data);	5✔
40	logGroupEvent(caller, 'group-create', {	4✔
41	groupName: data.name,
42	});
43
44	return groupData;	4✔
45	};
46
47	groupsAPI.update = async function (caller, data) {	1✔
48	if (!data) {	13✔
49	throw new Error('[[error:invalid-data]]');	1✔
50	}
51	const groupName = await groups.getGroupNameByGroupSlug(data.slug);	12✔
52	await isOwner(caller, groupName);	12✔
53
54	delete data.slug;	10✔
55	await groups.update(groupName, data);	10✔
56
57	return await groups.getGroupData(data.name \|\| groupName);	3✔
58	};
59
60	groupsAPI.delete = async function (caller, data) {	1✔
61	const groupName = await groups.getGroupNameByGroupSlug(data.slug);	8✔
62	await isOwner(caller, groupName);	8✔
63	if (	7✔
64	groups.systemGroups.includes(groupName) \|\|	9✔
65	groups.ephemeralGroups.includes(groupName)
66	) {
67	throw new Error('[[error:not-allowed]]');	5✔
68	}
69
70	await groups.destroy(groupName);	2✔
71	logGroupEvent(caller, 'group-delete', {	2✔
72	groupName: groupName,
73	});
74	};
75
76	groupsAPI.listMembers = async (caller, data) => {	1✔
77	// v4 wishlist — search should paginate (with lru caching I guess) to match index listing behaviour
78	const groupName = await groups.getGroupNameByGroupSlug(data.slug);	5✔
79
80	await canSearchMembers(caller.uid, groupName);	5✔
81	if (!await privileges.global.can('search:users', caller.uid)) {	5!
82	throw new Error('[[error:no-privileges]]');	×
83	}
84
85	const { query } = data;	5✔
86	const after = parseInt(data.after \|\| 0, 10);	5✔
87	let response;
88	if (query && query.length) {	5✔
89	response = await groups.searchMembers({	2✔
90	uid: caller.uid,
91	query,
92	groupName,
93	});
94	response.nextStart = null;	2✔
95	} else {
96	response = {	3✔
97	users: await groups.getOwnersAndMembers(groupName, caller.uid, after, after + 19),
98	nextStart: after + 20,
99	matchCount: null,
100	timing: null,
101	};
102	}
103
104	return response;	5✔
105	};
106
107	async function canSearchMembers(uid, groupName) {
108	const [isHidden, isMember, hasAdminPrivilege, isGlobalMod, viewGroups] = await Promise.all([	5✔
109	groups.isHidden(groupName),
110	groups.isMember(uid, groupName),
111	privileges.admin.can('admin:groups', uid),
112	user.isGlobalModerator(uid),
113	privileges.global.can('view:groups', uid),
114	]);
115
116	if (!viewGroups \|\| (isHidden && !isMember && !hasAdminPrivilege && !isGlobalMod)) {	5!
117	throw new Error('[[error:no-privileges]]');	×
118	}
119	}
120
121	function validateJoinRequest(caller, data) {
122	if (!data) {	21✔
123	throw new Error('[[error:invalid-data]]');	1✔
124	}
125	if (caller.uid <= 0 \|\| !data.uid) {	20✔
126	throw new Error('[[error:invalid-uid]]');	1✔
127	}
128	}
129
130	async function checkPrivileges(caller, groupName) {
131	const isCallerAdmin = await privileges.admin.can('admin:groups', caller.uid);	17✔
132	if (!isCallerAdmin && (	17✔
133	groups.systemGroups.includes(groupName) \|\|
134	groups.isPrivilegeGroup(groupName)
135	)) {
136	throw new Error('[[error:not-allowed]]');	4✔
137	}
138	return isCallerAdmin;	13✔
139	}
140
141	function isGroupJoinDisabledForCaller(isCallerAdmin, isSelf, groupData) {
142	return !isCallerAdmin && isSelf && groupData.private && groupData.disableJoinRequests;	11✔
143	}
144
145	groupsAPI.join = async function (caller, data) {	1✔
146	validateJoinRequest(caller, data);	21✔
147
148	const groupName = await groups.getGroupNameByGroupSlug(data.slug);	19✔
149	if (!groupName) {	19✔
150	throw new Error('[[error:no-group]]');	2✔
151	}
152
153	const isCallerAdmin = await checkPrivileges(caller, groupName);	17✔
154
155	const [groupData, userExists] = await Promise.all([	13✔
156	groups.getGroupData(groupName),
157	user.exists(data.uid),
158	]);
159
160	if (!userExists) {	13✔
161	throw new Error('[[error:invalid-uid]]');	1✔
162	}
163
164	const isSelf = parseInt(caller.uid, 10) === parseInt(data.uid, 10);	12✔
165	if (!meta.config.allowPrivateGroups && isSelf) {	12✔
166	// all groups are public!
167	await groups.join(groupName, data.uid);	1✔
168	logGroupEvent(caller, 'group-join', {	1✔
169	groupName: groupName,
170	targetUid: data.uid,
171	});
172	return;	1✔
173	}
174
175	if (isGroupJoinDisabledForCaller(isCallerAdmin, isSelf, groupData)) {	11✔
176	throw new Error('[[error:group-join-disabled]]');	1✔
177	}
178
179	if ((!groupData.private && isSelf) \|\| isCallerAdmin) {	10!
180	await groups.join(groupName, data.uid);	7✔
181	logGroupEvent(caller, `group-${isSelf ? 'join' : 'add-member'}`, {	7✔
182	groupName: groupName,
183	targetUid: data.uid,
184	});
185	} else if (isSelf) {	3✔
186	await groups.requestMembership(groupName, caller.uid);	2✔
187	logGroupEvent(caller, 'group-request-membership', {	2✔
188	groupName: groupName,
189	targetUid: data.uid,
190	});
191	} else {
192	throw new Error('[[error:not-allowed]]');	1✔
193	}
194	};
195
196	groupsAPI.leave = async function (caller, data) {	1✔
197	if (!data) {	13✔
198	throw new Error('[[error:invalid-data]]');	1✔
199	}
200	if (caller.uid <= 0) {	12✔
201	throw new Error('[[error:invalid-uid]]');	1✔
202	}
203	const isSelf = parseInt(caller.uid, 10) === parseInt(data.uid, 10);	11✔
204	const groupName = await groups.getGroupNameByGroupSlug(data.slug);	11✔
205	if (!groupName) {	11!
UNCOV 206	throw new Error('[[error:no-group]]');	×
207	}
208
209	if (typeof groupName !== 'string') {	11!
UNCOV 210	throw new Error('[[error:invalid-group-name]]');	×
211	}
212
213	if (groupName === 'administrators' && isSelf) {	11✔
214	throw new Error('[[error:cant-remove-self-as-admin]]');	2✔
215	}
216
217	const [groupData, isCallerOwner, userExists, isMember] = await Promise.all([	9✔
218	groups.getGroupData(groupName),
219	isOwner(caller, groupName, false),
220	user.exists(data.uid),
221	groups.isMember(data.uid, groupName),
222	]);
223
224	if (!isMember) {	9✔
225	throw new Error('[[error:group-not-member]]');	2✔
226	}
227
228	if (!userExists) {	7!
UNCOV 229	throw new Error('[[error:invalid-uid]]');	×
230	}
231
232	if (groupData.disableLeave && isSelf) {	7✔
233	throw new Error('[[error:group-leave-disabled]]');	1✔
234	}
235
236	if (isSelf \|\| isCallerOwner) {	6✔
237	await groups.leave(groupName, data.uid);	5✔
238	} else {
239	throw new Error('[[error:no-privileges]]');	1✔
240	}
241
242	const { displayname } = await user.getUserFields(data.uid, ['username']);	5✔
243
244	const notification = await notifications.create({	5✔
245	type: 'group-leave',
246	bodyShort: `[[groups:membership.leave.notification-title, ${displayname}, ${groupName}]]`,
247	nid: `group:${validator.escape(groupName)}:uid:${data.uid}:group-leave`,
248	path: `/groups/${slugify(groupName)}`,
249	from: data.uid,
250	});
251	const uids = await groups.getOwners(groupName);	5✔
252	await notifications.push(notification, uids);	5✔
253
254	logGroupEvent(caller, `group-${isSelf ? 'leave' : 'kick'}`, {	5✔
255	groupName: groupName,
256	targetUid: data.uid,
257	});
258	};
259
260	groupsAPI.grant = async (caller, data) => {	1✔
261	const groupName = await groups.getGroupNameByGroupSlug(data.slug);	2✔
262	await isOwner(caller, groupName);	2✔
263
264	await groups.ownership.grant(data.uid, groupName);	2✔
265	logGroupEvent(caller, 'group-owner-grant', {	2✔
266	groupName: groupName,
267	targetUid: data.uid,
268	});
269	};
270
271	groupsAPI.rescind = async (caller, data) => {	1✔
272	const groupName = await groups.getGroupNameByGroupSlug(data.slug);	3✔
273	await isOwner(caller, groupName);	3✔
274
275	await groups.ownership.rescind(data.uid, groupName);	3✔
276	logGroupEvent(caller, 'group-owner-rescind', {	2✔
277	groupName,
278	targetUid: data.uid,
279	});
280	};
281
282	groupsAPI.getPending = async (caller, { slug }) => {	1✔
283	const groupName = await groups.getGroupNameByGroupSlug(slug);	1✔
284	await isOwner(caller, groupName);	1✔
285
286	return await groups.getPending(groupName);	1✔
287	};
288
289	groupsAPI.accept = async (caller, { slug, uid }) => {	1✔
290	const groupName = await groups.getGroupNameByGroupSlug(slug);	3✔
291
292	await isOwner(caller, groupName);	3✔
293	const isPending = await groups.isPending(uid, groupName);	2✔
294	if (!isPending) {	2!
UNCOV 295	throw new Error('[[error:group-user-not-pending]]');	×
296	}
297
298	await groups.acceptMembership(groupName, uid);	2✔
299	logGroupEvent(caller, 'group-accept-membership', {	2✔
300	groupName,
301	targetUid: uid,
302	});
303	};
304
305	groupsAPI.reject = async (caller, { slug, uid }) => {	1✔
306	const groupName = await groups.getGroupNameByGroupSlug(slug);	2✔
307
308	await isOwner(caller, groupName);	2✔
309	const isPending = await groups.isPending(uid, groupName);	2✔
310	if (!isPending) {	2!
UNCOV 311	throw new Error('[[error:group-user-not-pending]]');	×
312	}
313
314	await groups.rejectMembership(groupName, uid);	2✔
315	logGroupEvent(caller, 'group-reject-membership', {	2✔
316	groupName,
317	targetUid: uid,
318	});
319	};
320
321	groupsAPI.getInvites = async (caller, { slug }) => {	1✔
322	const groupName = await groups.getGroupNameByGroupSlug(slug);	1✔
323	await isOwner(caller, groupName);	1✔
324
325	return await groups.getInvites(groupName);	1✔
326	};
327
328	groupsAPI.issueInvite = async (caller, { slug, uid }) => {	1✔
329	const groupName = await groups.getGroupNameByGroupSlug(slug);	5✔
330	await isOwner(caller, groupName);	5✔
331
332	await groups.invite(groupName, uid);	5✔
333	logGroupEvent(caller, 'group-invite', {	5✔
334	groupName,
335	targetUid: uid,
336	});
337	};
338
339	groupsAPI.acceptInvite = async (caller, { slug, uid }) => {	1✔
340	const groupName = await groups.getGroupNameByGroupSlug(slug);	3✔
341
342	// Can only be called by the invited user
343	const invited = await groups.isInvited(uid, groupName);	3✔
344	if (caller.uid !== parseInt(uid, 10)) {	3!
UNCOV 345	throw new Error('[[error:not-allowed]]');	×
346	}
347	if (!invited) {	3✔
348	throw new Error('[[error:not-invited]]');	1✔
349	}
350
351	await groups.acceptMembership(groupName, uid);	2✔
352	logGroupEvent(caller, 'group-invite-accept', { groupName });	2✔
353	};
354
355	groupsAPI.rejectInvite = async (caller, { slug, uid }) => {	1✔
356	const groupName = await groups.getGroupNameByGroupSlug(slug);	3✔
357
358	// Can be called either by invited user, or group owner
359	const owner = await isOwner(caller, groupName, false);	3✔
360	const invited = await groups.isInvited(uid, groupName);	3✔
361
362	if (!owner && caller.uid !== parseInt(uid, 10)) {	3!
UNCOV 363	throw new Error('[[error:not-allowed]]');	×
364	}
365	if (!invited) {	3!
UNCOV 366	throw new Error('[[error:not-invited]]');	×
367	}
368
369	await groups.rejectMembership(groupName, uid);	3✔
370	if (!owner) {	3✔
371	logGroupEvent(caller, 'group-invite-reject', { groupName });	1✔
372	}
373	};
374
375	async function isOwner(caller, groupName, throwOnFalse = true) {	37✔
376	if (typeof groupName !== 'string') {	49✔
377	throw new Error('[[error:invalid-group-name]]');	3✔
378	}
379	const [hasAdminPrivilege, isGlobalModerator, isOwner, group] = await Promise.all([	46✔
380	privileges.admin.can('admin:groups', caller.uid),
381	user.isGlobalModerator(caller.uid),
382	groups.ownership.isOwner(caller.uid, groupName),
383	groups.getGroupData(groupName),
384	]);
385
386	const check = isOwner \|\| hasAdminPrivilege \|\| (isGlobalModerator && !group.system);	46✔
387	if (!check && throwOnFalse) {	46✔
388	throw new Error('[[error:no-privileges]]');	1✔
389	}
390
391	return check;	45✔
392	}
393
394	function logGroupEvent(caller, event, additional) {
395	events.log({	37✔
396	type: event,
397	uid: caller.uid,
398	ip: caller.ip,
399	...additional,
400	});
401	}

CMU-313 / NodeBB / 10656551217

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous