26527336612

Committed 27 May 2026 05:24PM UTC coverage: 87.102% (+0.3%) from 86.841%

Build # 26527336612

Build Type

Pull #1609

github

Committed by

ClemRz

Commit Message

feat(auth): harden admin account security with TOTP MFA and brute-force protection

- Reduce admin token TTL to 10 days (non-admin remains 90 days)
- Add mandatory TOTP-based MFA with enrollment, verification, and reset endpoints
- Apply stricter rate limiting for admin login (5 req / 15 min / IP)
- Ban admin accounts after 5 consecutive failed logins or TOTP attempts
- Send email notifications on suspicious login activity and account ban
- Revoke all admin tokens on password change
- Update Swagger documentation with new MFA endpoints and login statuses

Pull Request Pull Request #1609: feat(auth): harden admin account security with TOTP MFA and brute-force protection

Coverage Stats

3397 of 4057 branches covered (83.73%)

Branch coverage included in aggregate %.

218 of 236 new or added lines in 10 files covered. (92.37%)

15 existing lines in 1 file now uncovered.

6807 of 7658 relevant lines covered (88.89%)

56.98 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

91.07

/api/services/NotificationService.js

const NameService = require('./NameService');
const CommonService = require('./CommonService');
const LanguageService = require('./LanguageService');

const NOTIFICATION_ENTITIES = {
  CAVE: 'cave',
  COMMENT: 'comment',
  DESCRIPTION: 'description',
  DOCUMENT: 'document',
  ENTRANCE: 'entrance',
  HISTORY: 'history',
  LOCATION: 'location',
  MASSIF: 'massif',
  ORGANIZATION: 'organization',
  RIGGING: 'rigging',
};

const NOTIFICATION_TYPES = {
  CREATE: 'CREATE',
  DELETE: 'DELETE',
  PERMANENT_DELETE: 'PERMANENT_DELETE',
  UPDATE: 'UPDATE',
  VALIDATE: 'VALIDATE',
  RESTORE: 'RESTORE',
  REJECT: 'REJECT',
};

async function removeOlderNotifications() {
  const query = `DELETE
                 FROM t_notification
                 WHERE date_inscription < current_timestamp - interval '2 month';`;
  await CommonService.query(query);
}

const safeGetPropId = (prop, data) => {
  if (data && data[prop]) {
    if (data[prop] instanceof Object) {
      return data[prop].id;
    }
    return data[prop];
  }
  return undefined;
};

const sendNotificationEmail = async (
  entity,
  notificationType,
  notificationEntity,
  user
) => {
  // Resolve the recipient's preferred locale
  const locale = await LanguageService.getLocale(user.language);

  // Get entity name (handle all cases)
  const getEntityName = (entityData) => {
    if (entityData.name) return entityData.name;
    if (entityData.names) return entityData.names[0]?.name;
    if (entityData.title) return entityData.title;
    if (entityData.titles) return entityData.titles[0]?.text;
    if (entityData.body) return `${entityData.body.slice(0, 50)}...`;
    if (entityData.descriptions) return entityData.descriptions[0].title;
    return '';
  };

  const entityName = getEntityName(entity);

  // Format action verb
  const actionVerbMap = {
    [NOTIFICATION_TYPES.CREATE]: 'created',
    [NOTIFICATION_TYPES.DELETE]: 'deleted',
    [NOTIFICATION_TYPES.PERMANENT_DELETE]: 'permanently deleted',
    [NOTIFICATION_TYPES.UPDATE]: 'updated',
    [NOTIFICATION_TYPES.VALIDATE]: 'validated',
    [NOTIFICATION_TYPES.RESTORE]: 'restored',
    [NOTIFICATION_TYPES.REJECT]: 'rejected',
  };

  const actionVerb = actionVerbMap[notificationType];
  if (!actionVerb) {
    throw Error(`Unknown notification type: ${notificationType}`);
  }

  // Format entity Link
  const baseUrl = `${sails.config.custom.baseUrl}/ui/`;
  const relatedCaveId = safeGetPropId('cave', entity);
  const relatedEntranceId = safeGetPropId('entrance', entity);
  const relatedMassifId = safeGetPropId('massif', entity);

  const getRelatedEntityLink = () => {
    if (relatedCaveId) return `caves/${relatedCaveId}`;
    if (relatedEntranceId) return `entrances/${relatedEntranceId}`;
    if (relatedMassifId) return `massifs/${relatedMassifId}`;
    return null;
  };

  const directLinkEntities = {
    [NOTIFICATION_ENTITIES.CAVE]: `caves/${entity.id}`,
    [NOTIFICATION_ENTITIES.DOCUMENT]: `documents/${entity.id}`,
    [NOTIFICATION_ENTITIES.ENTRANCE]: `entrances/${entity.id}`,
    [NOTIFICATION_ENTITIES.MASSIF]: `massifs/${entity.id}`,
    [NOTIFICATION_ENTITIES.ORGANIZATION]: `organizations/${entity.id}`,
  };

  let entityLink;
  if (directLinkEntities[notificationEntity]) {
    entityLink = baseUrl + directLinkEntities[notificationEntity];
  } else {
    const relatedLink = getRelatedEntityLink();
    if (!relatedLink) {
      const entityTypeName = notificationEntity.toLowerCase();
      let requiredEntities;
      if (notificationEntity === NOTIFICATION_ENTITIES.DESCRIPTION) {
        requiredEntities = 'cave, entrance or massif';
      } else if (notificationEntity === NOTIFICATION_ENTITIES.LOCATION) {
        requiredEntities = 'entrance';
      } else {
        requiredEntities = 'cave or entrance';
      }
      throw Error(
        `Can't find related entity (${requiredEntities}) of the ${entityTypeName} with id ${entity.id}`
      );
    }
    entityLink = baseUrl + relatedLink;
  }

  await sails.helpers.sendEmail
    .with({
      allowResponse: false,
      emailSubject: 'Notification',
      locale,
      recipientEmail: user.mail,
      viewName: 'notification',
      viewValues: {
        actionVerb,
        entityLink,
        entityName,
        entityType: notificationEntity,
        recipientName: user.nickname,
        subscriptionName: user.subscriptionName,
        subscriptionType: user.subscriptionType,
        isAuthorNotification: user.isAuthorNotification || false,
        validationComment: user.validationComment || null,
      },
    })
    .intercept('sendSESEmailError', () => {
      sails.log.error(
        `The email service has encountered an error while trying to notify user ${user.nickname} (id=${user.id}).`
      );
      return false;
    });
};

const getCountryMassifAndRegionSubscribers = async (
  entityCountryId,
  entityMassifIds,
  entityRegionId
) => {
  const countrySubscribers = [];
  const massifsSubscribers = [];
  const regionSubscribers = [];
  if (entityCountryId) {
    const country =
      await TCountry.findOne(entityCountryId).populate('subscribedCavers');
    if (country) {
      countrySubscribers.push(
        ...country.subscribedCavers.map((caver) => ({
          ...caver,
          subscriptionName: country.nativeName,
          subscriptionType: 'country',
        }))
      );
    }
  }
  if (entityMassifIds) {
    await Promise.all(
      entityMassifIds.map(async (massifId) => {
        const massif =
          await TMassif.findOne(massifId).populate('subscribedCavers');
        if (massif) {
          await NameService.setNames([massif], 'massif');
          massifsSubscribers.push(
            ...massif.subscribedCavers.map((caver) => ({
              ...caver,
              subscriptionType: 'massif',
              subscriptionName: massif.names[0]?.name,
            }))
          );
        }
      })
    );
  }
  if (entityRegionId) {
    const region =
      await TISO31662.findOne(entityRegionId).populate('subscribedCavers');
    if (region) {
      regionSubscribers.push(
        ...region.subscribedCavers.map((caver) => ({
          ...caver,
          subscriptionName: region.name,
          subscriptionType: 'region',
        }))
      );
    }
  }
  return { countrySubscribers, massifsSubscribers, regionSubscribers };
};

module.exports = {
  NOTIFICATION_ENTITIES,
  NOTIFICATION_TYPES,
  ...(process.env.NODE_ENV === 'test' ? { sendNotificationEmail } : undefined),

  /**
   *
   * @param {*} entity
   * @param {Number} notifierId
   * @param {NOTIFICATION_TYPES} notificationType
   * @param {NOTIFICATION_ENTITIES} notificationEntity
   * @return {Boolean} true if everything went well, else false
   */
  notifySubscribers: async (
    entity,
    notifierId,
    notificationType,
    notificationEntity
  ) => {
    // Had to require in the function to avoid a circular dependency with notifySubscribers() in CaveService.createCave()
    // eslint-disable-next-line global-require
    const CaveService = require('./CaveService');

    // Check params and silently fail to avoid sending an error to the client
    if (!Object.values(NOTIFICATION_ENTITIES).includes(notificationEntity)) {
      throw new Error(`Invalid notification entity: ${notificationEntity}`);
    }
    if (!Object.values(NOTIFICATION_TYPES).includes(notificationType)) {
      throw new Error(`Invalid notification type: ${notificationType}`);
    }
    if (!notifierId) {
      throw new Error(`Missing notifier id`);
    }

    try {
      // For the populateEntities() method, must use "grotto" instead of "organization"
      const entityKey =
        notificationEntity === NOTIFICATION_ENTITIES.ORGANIZATION
          ? 'grotto'
          : notificationEntity;

      // Format notification and populate entity
      const notification = await module.exports.populateEntities({
        dateInscription: new Date(),
        notificationType: (
          await TNotificationType.findOne({
            name: notificationType,
          })
        ).id,
        notifier: notifierId,
        [entityKey]: entity,
      });

      const populatedEntity = notification[entityKey];

      const caveId = safeGetPropId('cave', populatedEntity);
      const entranceId = safeGetPropId('entrance', populatedEntity);
      const massifId = safeGetPropId('massif', populatedEntity);

      const getMassifIdsFromCave = async (id) =>
        (await CaveService.getMassifs(id)).map((m) => m.id);
      const getCountryId = (id) => safeGetPropId('country', id);
      const getRegionId = (entityData) => entityData?.iso_3166_2;

      const getCountryFromCaveEntrances = (cave) => {
        if (cave?.entrances?.length > 0) {
          return getCountryId(cave.entrances[0]);
        }
        return null;
      };

      const resolveLocationFromCaveOrEntrance = async (
        relatedCaveId,
        relatedEntranceId,
        entityData
      ) => {
        if (relatedCaveId) {
          return {
            countryId: getCountryFromCaveEntrances(entityData.cave),
            massifIds: await getMassifIdsFromCave(relatedCaveId),
            regionId: entityData.cave?.entrances?.[0]
              ? getRegionId(entityData.cave.entrances[0])
              : null,
          };
        }
        if (relatedEntranceId) {
          return {
            countryId: getCountryId(entityData.entrance),
            massifIds: await getMassifIdsFromCave(
              safeGetPropId('cave', entityData.entrance)
            ),
            regionId: getRegionId(entityData.entrance),
          };
        }
        return { countryId: null, massifIds: [], regionId: null };
      };

      // Entity-specific location resolution
      const entityResolvers = {
        [NOTIFICATION_ENTITIES.CAVE]: async () => ({
          countryId: getCountryFromCaveEntrances(populatedEntity),
          massifIds: await getMassifIdsFromCave(populatedEntity.id),
          regionId: populatedEntity?.entrances?.[0]
            ? getRegionId(populatedEntity.entrances[0])
            : null,
        }),

        [NOTIFICATION_ENTITIES.ENTRANCE]: async () => ({
          countryId: getCountryId(populatedEntity),
          massifIds: populatedEntity?.cave
            ? await getMassifIdsFromCave(safeGetPropId('cave', populatedEntity))
            : [],
          regionId: getRegionId(populatedEntity),
        }),

        [NOTIFICATION_ENTITIES.MASSIF]: async () => ({
          countryId: null,
          massifIds: [populatedEntity.id],
          regionId: null,
        }),

        [NOTIFICATION_ENTITIES.ORGANIZATION]: async () => ({
          countryId: getCountryId(populatedEntity),
          massifIds: [],
          regionId: getRegionId(populatedEntity),
        }),

        [NOTIFICATION_ENTITIES.LOCATION]: async () => {
          if (!entranceId)
            throw new Error(`Can't retrieve related entrance id.`);
          return {
            countryId: getCountryId(populatedEntity.entrance),
            massifIds: await getMassifIdsFromCave(
              safeGetPropId('cave', populatedEntity.entrance)
            ),
            regionId: getRegionId(populatedEntity.entrance),
          };
        },
      };

      // Entities that can relate to cave, entrance, or massif
      const multiRelationEntities = [
        NOTIFICATION_ENTITIES.COMMENT,
        NOTIFICATION_ENTITIES.DESCRIPTION,
        NOTIFICATION_ENTITIES.HISTORY,
        NOTIFICATION_ENTITIES.RIGGING,
      ];

      // Find massifs and country concerned about the notification
      let result;
      if (entityResolvers[notificationEntity]) {
        result = await entityResolvers[notificationEntity]();
      } else if (multiRelationEntities.includes(notificationEntity)) {
        result = await resolveLocationFromCaveOrEntrance(
          caveId,
          entranceId,
          populatedEntity
        );

        // Handle massif-only case for description and document
        if (!result.countryId && !result.massifIds.length && massifId) {
          result.massifIds = [safeGetPropId('massif', populatedEntity)];
        }

        // Require cave or entrance for most entities
        if (
          !caveId &&
          !entranceId &&
          ![
            NOTIFICATION_ENTITIES.DESCRIPTION,
            NOTIFICATION_ENTITIES.DOCUMENT,
          ].includes(notificationEntity)
        ) {
          throw new Error(`Can't retrieve related cave or entrance id.`);
        }
      } else if (notificationEntity === NOTIFICATION_ENTITIES.DOCUMENT) {
        result = await resolveLocationFromCaveOrEntrance(
          caveId,
          entranceId,
          populatedEntity
        );
        if (!result.countryId && !result.massifIds.length && massifId) {
          result.massifIds = [safeGetPropId('massif', populatedEntity)];
        }
      } else {
        throw new Error(
          `Can't find what to do with the following notification entity value: ${notificationEntity}`
        );
      }

      const entityCountryId = result.countryId;
      const entityMassifIds = result.massifIds;
      const entityRegionId = result.regionId;

      // Find subscribers to the entity.
      const { countrySubscribers, massifsSubscribers, regionSubscribers } =
        await getCountryMassifAndRegionSubscribers(
          entityCountryId,
          entityMassifIds,
          entityRegionId
        );
      // Consolidate subscribers by user ID and combine subscription types
      const subscriberMap = new Map();

      const addSubscribers = (subscribers) => {
        subscribers
          .filter((u) => u.id !== notifierId)
          .forEach((user) => {
            if (subscriberMap.has(user.id)) {
              const existing = subscriberMap.get(user.id);
              existing.subscriptionNames.push(user.subscriptionName);
              existing.subscriptionTypes.push(user.subscriptionType);
            } else {
              subscriberMap.set(user.id, {
                ...user,
                subscriptionNames: [user.subscriptionName],
                subscriptionTypes: [user.subscriptionType],
              });
            }
          });
      };

      addSubscribers(countrySubscribers);
      addSubscribers(massifsSubscribers);
      addSubscribers(regionSubscribers);

      const uniqueUsers = Array.from(subscriberMap.values()).map((user) => ({
        ...user,
        subscriptionName: user.subscriptionNames.join(' and '),
        subscriptionType: user.subscriptionTypes.join(', '),
      }));

      // Create notifications & optionally send email
      const res = await Promise.all(
        uniqueUsers.map(async (user) => {
          try {
            await TNotification.create({
              ...notification,
              notified: user.id,
              [entityKey]: notification[entityKey].id, // id only for the DB storage
            });
          } catch (e) {
            sails.log.error(
              `An error occured when trying to create a notification: ${e.message}`
            );
            return false;
          }

          if (user.sendNotificationByEmail) {
            await sendNotificationEmail(
              populatedEntity,
              notificationType,
              notificationEntity,
              user
            );
          }
          return true;
        })
      );

      // 5% chance to also remove older notifications
      if (process.env.NODE_ENV !== 'test' && Math.random() < 0.05) {
        try {
          await removeOlderNotifications();
        } catch (cleanupError) {
          sails.log.error(
            `Error during notification cleanup: ${cleanupError.message}`
          );
        }
      }

      return res;
    } catch (error) {
      // Fail silently to avoid sending an error to the user
      sails.log.error(
        `An error occurred when trying to notify subscribers: ${error.message} ${error.stack}`
      );
      return false;
    }
  },

  /**
   * Create an in-app notification for the document author and optionally send an email.
   *
   * @param {Object}  document         - Populated TDocument (must have .author)
   * @param {Number}  moderatorId      - ID of the moderator who made the decision
   * @param {String}  notificationType - NOTIFICATION_TYPES.VALIDATE or NOTIFICATION_TYPES.REJECT
   * @param {String|null} validationComment - Moderator's comment (required for REJECT)
   * @returns {Boolean} true on success, false on silent failure
   */
  notifyAuthor: async (
    document,
    moderatorId,
    notificationType,
    validationComment
  ) => {
    const authorId = safeGetPropId('author', document);
    if (!authorId) {
      sails.log.debug(
        `notifyAuthor: document ${document.id} has no author, skipping notification`
      );
      return true;
    }
    if (authorId === moderatorId) {
      return true;
    }

    if (!Object.values(NOTIFICATION_TYPES).includes(notificationType)) {
      throw new Error(`Invalid notification type: ${notificationType}`);
    }

    try {
      const notificationTypeRecord = await TNotificationType.findOne({
        name: notificationType,
      });

      if (!notificationTypeRecord) {
        throw new Error(
          `Notification type '${notificationType}' not found in DB — migration may not have run`
        );
      }

      await TNotification.create({
        dateInscription: new Date(),
        notificationType: notificationTypeRecord.id,
        notifier: moderatorId,
        notified: authorId,
        document: document.id,
      });

      const author = await TCaver.findOne(authorId);

      if (author && author.sendNotificationByEmail) {
        await sendNotificationEmail(
          document,
          notificationType,
          NOTIFICATION_ENTITIES.DOCUMENT,
          {
            ...author,
            isAuthorNotification: true,
            validationComment,
          }
        );
      }

      return true;
    } catch (error) {
      sails.log.error(
        `An error occurred when trying to notify the document author: ${error.message} ${error.stack}`
      );
      return false;
    }
  },

  populateEntities: async (notification) => {
    const populatedNotification = notification;
    if (populatedNotification.cave) {
      await NameService.setNames([populatedNotification.cave], 'cave');
    }
    if (populatedNotification.comment) {
      populatedNotification.comment = await TComment.findOne(
        safeGetPropId('comment', notification)
      )
        .populate('cave')
        .populate('entrance');
    }
    if (populatedNotification.description) {
      populatedNotification.description = await TDescription.findOne(
        safeGetPropId('description', notification)
      )
        .populate('cave')
        .populate('document')
        .populate('entrance')
        .populate('massif');
    }
    if (populatedNotification.document) {
      // Had to require in the function to avoid a circular dependency with notifySubscribers() in DocumentService.createDocument()
      // eslint-disable-next-line global-require
      const DocumentService = require('./DocumentService');
      const populatedDocuments = await DocumentService.getDocuments([
        safeGetPropId('document', notification),
      ]);
      populatedNotification.document = populatedDocuments[0];
    }
    if (populatedNotification.entrance) {
      await NameService.setNames([populatedNotification.entrance], 'entrance');
    }
    if (populatedNotification.grotto) {
      await NameService.setNames([populatedNotification.grotto], 'grotto');
    }
    if (populatedNotification.history) {
      populatedNotification.history = await THistory.findOne(
        safeGetPropId('history', notification)
      )
        .populate('cave')
        .populate('entrance');
    }
    if (populatedNotification.location) {
      populatedNotification.location = await TLocation.findOne(
        safeGetPropId('location', notification)
      ).populate('entrance');
    }
    if (populatedNotification.massif) {
      await NameService.setNames([populatedNotification.massif], 'massif');
    }
    if (populatedNotification.rigging) {
      populatedNotification.rigging = await TRigging.findOne(
        safeGetPropId('rigging', notification)
      )
        .populate('entrance')
        .populate('cave');
    }
    return populatedNotification;
  },
};

1	const NameService = require('./NameService');	8✔
2	const CommonService = require('./CommonService');	8✔
3	const LanguageService = require('./LanguageService');	8✔
4
5	const NOTIFICATION_ENTITIES = {	8✔
6	CAVE: 'cave',
7	COMMENT: 'comment',
8	DESCRIPTION: 'description',
9	DOCUMENT: 'document',
10	ENTRANCE: 'entrance',
11	HISTORY: 'history',
12	LOCATION: 'location',
13	MASSIF: 'massif',
14	ORGANIZATION: 'organization',
15	RIGGING: 'rigging',
16	};
17
18	const NOTIFICATION_TYPES = {	8✔
19	CREATE: 'CREATE',
20	DELETE: 'DELETE',
21	PERMANENT_DELETE: 'PERMANENT_DELETE',
22	UPDATE: 'UPDATE',
23	VALIDATE: 'VALIDATE',
24	RESTORE: 'RESTORE',
25	REJECT: 'REJECT',
26	};
27
28	async function removeOlderNotifications() {
29	const query = `DELETE	×
30	FROM t_notification
31	WHERE date_inscription < current_timestamp - interval '2 month';`;
32	await CommonService.query(query);	×
33	}
34
35	const safeGetPropId = (prop, data) => {	8✔
36	if (data && data[prop]) {	1,909✔
37	if (data[prop] instanceof Object) {	558✔
38	return data[prop].id;	189✔
39	}
40	return data[prop];	369✔
41	}
42	return undefined;	1,351✔
43	};
44
45	const sendNotificationEmail = async (	8✔
46	entity,
47	notificationType,
48	notificationEntity,
49	user
50	) => {
51	// Resolve the recipient's preferred locale
52	const locale = await LanguageService.getLocale(user.language);	294✔
53
54	// Get entity name (handle all cases)
55	const getEntityName = (entityData) => {	294✔
56	if (entityData.name) return entityData.name;	294✔
57	if (entityData.names) return entityData.names[0]?.name;	31✔
58	if (entityData.title) return entityData.title;	30✔
59	if (entityData.titles) return entityData.titles[0]?.text;	16✔
60	if (entityData.body) return `${entityData.body.slice(0, 50)}...`;	15✔
61	if (entityData.descriptions) return entityData.descriptions[0].title;	14✔
62	return '';	13✔
63	};
64
65	const entityName = getEntityName(entity);	294✔
66
67	// Format action verb
68	const actionVerbMap = {	294✔
69	[NOTIFICATION_TYPES.CREATE]: 'created',
70	[NOTIFICATION_TYPES.DELETE]: 'deleted',
71	[NOTIFICATION_TYPES.PERMANENT_DELETE]: 'permanently deleted',
72	[NOTIFICATION_TYPES.UPDATE]: 'updated',
73	[NOTIFICATION_TYPES.VALIDATE]: 'validated',
74	[NOTIFICATION_TYPES.RESTORE]: 'restored',
75	[NOTIFICATION_TYPES.REJECT]: 'rejected',
76	};
77
78	const actionVerb = actionVerbMap[notificationType];	294✔
79	if (!actionVerb) {	294✔
80	throw Error(`Unknown notification type: ${notificationType}`);	1✔
81	}
82
83	// Format entity Link
84	const baseUrl = `${sails.config.custom.baseUrl}/ui/`;	293✔
85	const relatedCaveId = safeGetPropId('cave', entity);	293✔
86	const relatedEntranceId = safeGetPropId('entrance', entity);	293✔
87	const relatedMassifId = safeGetPropId('massif', entity);	293✔
88
89	const getRelatedEntityLink = () => {	293✔
90	if (relatedCaveId) return `caves/${relatedCaveId}`;	22✔
91	if (relatedEntranceId) return `entrances/${relatedEntranceId}`;	20✔
92	if (relatedMassifId) return `massifs/${relatedMassifId}`;	5✔
93	return null;	4✔
94	};
95
96	const directLinkEntities = {	293✔
97	[NOTIFICATION_ENTITIES.CAVE]: `caves/${entity.id}`,
98	[NOTIFICATION_ENTITIES.DOCUMENT]: `documents/${entity.id}`,
99	[NOTIFICATION_ENTITIES.ENTRANCE]: `entrances/${entity.id}`,
100	[NOTIFICATION_ENTITIES.MASSIF]: `massifs/${entity.id}`,
101	[NOTIFICATION_ENTITIES.ORGANIZATION]: `organizations/${entity.id}`,
102	};
103
104	let entityLink;
105	if (directLinkEntities[notificationEntity]) {	293✔
106	entityLink = baseUrl + directLinkEntities[notificationEntity];	271✔
107	} else {
108	const relatedLink = getRelatedEntityLink();	22✔
109	if (!relatedLink) {	22✔
110	const entityTypeName = notificationEntity.toLowerCase();	4✔
111	let requiredEntities;
112	if (notificationEntity === NOTIFICATION_ENTITIES.DESCRIPTION) {	4✔
113	requiredEntities = 'cave, entrance or massif';	1✔
114	} else if (notificationEntity === NOTIFICATION_ENTITIES.LOCATION) {	3✔
115	requiredEntities = 'entrance';	1✔
116	} else {
117	requiredEntities = 'cave or entrance';	2✔
118	}
119	throw Error(	4✔
120	`Can't find related entity (${requiredEntities}) of the ${entityTypeName} with id ${entity.id}`
121	);
122	}
123	entityLink = baseUrl + relatedLink;	18✔
124	}
125
126	await sails.helpers.sendEmail	289✔
127	.with({
128	allowResponse: false,
129	emailSubject: 'Notification',
130	locale,
131	recipientEmail: user.mail,
132	viewName: 'notification',
133	viewValues: {
134	actionVerb,
135	entityLink,
136	entityName,
137	entityType: notificationEntity,
138	recipientName: user.nickname,
139	subscriptionName: user.subscriptionName,
140	subscriptionType: user.subscriptionType,
141	isAuthorNotification: user.isAuthorNotification \|\| false,	368✔
142	validationComment: user.validationComment \|\| null,	394✔
143	},
144	})
145	.intercept('sendSESEmailError', () => {
UNCOV 146	sails.log.error(	×
147	`The email service has encountered an error while trying to notify user ${user.nickname} (id=${user.id}).`
148	);
UNCOV 149	return false;	×
150	});
151	};
152
153	const getCountryMassifAndRegionSubscribers = async (	8✔
154	entityCountryId,
155	entityMassifIds,
156	entityRegionId
157	) => {
158	const countrySubscribers = [];	148✔
159	const massifsSubscribers = [];	148✔
160	const regionSubscribers = [];	148✔
161	if (entityCountryId) {	148✔
162	const country =
163	await TCountry.findOne(entityCountryId).populate('subscribedCavers');	3✔
164	if (country) {	3!
165	countrySubscribers.push(	3✔
166	...country.subscribedCavers.map((caver) => ({	3✔
167	...caver,
168	subscriptionName: country.nativeName,
169	subscriptionType: 'country',
170	}))
171	);
172	}
173	}
174	if (entityMassifIds) {	148!
175	await Promise.all(	148✔
176	entityMassifIds.map(async (massifId) => {
177	const massif =
178	await TMassif.findOne(massifId).populate('subscribedCavers');	77✔
179	if (massif) {	77✔
180	await NameService.setNames([massif], 'massif');	73✔
181	massifsSubscribers.push(	73✔
182	...massif.subscribedCavers.map((caver) => ({	63✔
183	...caver,
184	subscriptionType: 'massif',
185	subscriptionName: massif.names[0]?.name,
186	}))
187	);
188	}
189	})
190	);
191	}
192	if (entityRegionId) {	148✔
193	const region =
194	await TISO31662.findOne(entityRegionId).populate('subscribedCavers');	3✔
195	if (region) {	3!
196	regionSubscribers.push(	3✔
197	...region.subscribedCavers.map((caver) => ({	3✔
198	...caver,
199	subscriptionName: region.name,
200	subscriptionType: 'region',
201	}))
202	);
203	}
204	}
205	return { countrySubscribers, massifsSubscribers, regionSubscribers };	148✔
206	};
207
208	module.exports = {	8✔
209	NOTIFICATION_ENTITIES,
210	NOTIFICATION_TYPES,
211	...(process.env.NODE_ENV === 'test' ? { sendNotificationEmail } : undefined),	8!
212
213	/**
214	*
215	* @param {*} entity
216	* @param {Number} notifierId
217	* @param {NOTIFICATION_TYPES} notificationType
218	* @param {NOTIFICATION_ENTITIES} notificationEntity
219	* @return {Boolean} true if everything went well, else false
220	*/
221	notifySubscribers: async (
222	entity,
223	notifierId,
224	notificationType,
225	notificationEntity
226	) => {
227	// Had to require in the function to avoid a circular dependency with notifySubscribers() in CaveService.createCave()
228	// eslint-disable-next-line global-require
229	const CaveService = require('./CaveService');	159✔
230
231	// Check params and silently fail to avoid sending an error to the client
232	if (!Object.values(NOTIFICATION_ENTITIES).includes(notificationEntity)) {	159✔
233	throw new Error(`Invalid notification entity: ${notificationEntity}`);	1✔
234	}
235	if (!Object.values(NOTIFICATION_TYPES).includes(notificationType)) {	158✔
236	throw new Error(`Invalid notification type: ${notificationType}`);	1✔
237	}
238	if (!notifierId) {	157✔
239	throw new Error(`Missing notifier id`);	1✔
240	}
241
242	try {	156✔
243	// For the populateEntities() method, must use "grotto" instead of "organization"
244	const entityKey =
245	notificationEntity === NOTIFICATION_ENTITIES.ORGANIZATION	156✔
246	? 'grotto'
247	: notificationEntity;
248
249	// Format notification and populate entity
250	const notification = await module.exports.populateEntities({	156✔
251	dateInscription: new Date(),
252	notificationType: (
253	await TNotificationType.findOne({
254	name: notificationType,
255	})
256	).id,
257	notifier: notifierId,
258	[entityKey]: entity,
259	});
260
261	const populatedEntity = notification[entityKey];	156✔
262
263	const caveId = safeGetPropId('cave', populatedEntity);	156✔
264	const entranceId = safeGetPropId('entrance', populatedEntity);	156✔
265	const massifId = safeGetPropId('massif', populatedEntity);	156✔
266
267	const getMassifIdsFromCave = async (id) =>	156✔
268	(await CaveService.getMassifs(id)).map((m) => m.id);	76✔
269	const getCountryId = (id) => safeGetPropId('country', id);	156✔
270	const getRegionId = (entityData) => entityData?.iso_3166_2;	156✔
271
272	const getCountryFromCaveEntrances = (cave) => {	156✔
273	if (cave?.entrances?.length > 0) {	16✔
274	return getCountryId(cave.entrances[0]);	5✔
275	}
276	return null;	11✔
277	};
278
279	const resolveLocationFromCaveOrEntrance = async (	156✔
280	relatedCaveId,
281	relatedEntranceId,
282	entityData
283	) => {
284	if (relatedCaveId) {	67✔
285	return {	3✔
286	countryId: getCountryFromCaveEntrances(entityData.cave),
287	massifIds: await getMassifIdsFromCave(relatedCaveId),
288	regionId: entityData.cave?.entrances?.[0]	3!
289	? getRegionId(entityData.cave.entrances[0])
290	: null,
291	};
292	}
293	if (relatedEntranceId) {	64✔
294	return {	19✔
295	countryId: getCountryId(entityData.entrance),
296	massifIds: await getMassifIdsFromCave(
297	safeGetPropId('cave', entityData.entrance)
298	),
299	regionId: getRegionId(entityData.entrance),
300	};
301	}
302	return { countryId: null, massifIds: [], regionId: null };	45✔
303	};
304
305	// Entity-specific location resolution
306	const entityResolvers = {	156✔
307	[NOTIFICATION_ENTITIES.CAVE]: async () => ({	13✔
308	countryId: getCountryFromCaveEntrances(populatedEntity),
309	massifIds: await getMassifIdsFromCave(populatedEntity.id),
310	regionId: populatedEntity?.entrances?.[0]	13✔
311	? getRegionId(populatedEntity.entrances[0])
312	: null,
313	}),
314
315	[NOTIFICATION_ENTITIES.ENTRANCE]: async () => ({	38✔
316	countryId: getCountryId(populatedEntity),
317	massifIds: populatedEntity?.cave	38✔
318	? await getMassifIdsFromCave(safeGetPropId('cave', populatedEntity))
319	: [],
320	regionId: getRegionId(populatedEntity),
321	}),
322
323	[NOTIFICATION_ENTITIES.MASSIF]: async () => ({	11✔
324	countryId: null,
325	massifIds: [populatedEntity.id],
326	regionId: null,
327	}),
328
329	[NOTIFICATION_ENTITIES.ORGANIZATION]: async () => ({	16✔
330	countryId: getCountryId(populatedEntity),
331	massifIds: [],
332	regionId: getRegionId(populatedEntity),
333	}),
334
335	[NOTIFICATION_ENTITIES.LOCATION]: async () => {
336	if (!entranceId)	11✔
337	throw new Error(`Can't retrieve related entrance id.`);	2✔
338	return {	9✔
339	countryId: getCountryId(populatedEntity.entrance),
340	massifIds: await getMassifIdsFromCave(
341	safeGetPropId('cave', populatedEntity.entrance)
342	),
343	regionId: getRegionId(populatedEntity.entrance),
344	};
345	},
346	};
347
348	// Entities that can relate to cave, entrance, or massif
349	const multiRelationEntities = [	156✔
350	NOTIFICATION_ENTITIES.COMMENT,
351	NOTIFICATION_ENTITIES.DESCRIPTION,
352	NOTIFICATION_ENTITIES.HISTORY,
353	NOTIFICATION_ENTITIES.RIGGING,
354	];
355
356	// Find massifs and country concerned about the notification
357	let result;
358	if (entityResolvers[notificationEntity]) {	156✔
359	result = await entityResolvers[notificationEntity]();	89✔
360	} else if (multiRelationEntities.includes(notificationEntity)) {	67✔
361	result = await resolveLocationFromCaveOrEntrance(	30✔
362	caveId,
363	entranceId,
364	populatedEntity
365	);
366
367	// Handle massif-only case for description and document
368	if (!result.countryId && !result.massifIds.length && massifId) {	30!
UNCOV 369	result.massifIds = [safeGetPropId('massif', populatedEntity)];	×
370	}
371
372	// Require cave or entrance for most entities
373	if (	30✔
374	!caveId &&	65✔
375	!entranceId &&
376	![
377	NOTIFICATION_ENTITIES.DESCRIPTION,
378	NOTIFICATION_ENTITIES.DOCUMENT,
379	].includes(notificationEntity)
380	) {
381	throw new Error(`Can't retrieve related cave or entrance id.`);	6✔
382	}
383	} else if (notificationEntity === NOTIFICATION_ENTITIES.DOCUMENT) {	37!
384	result = await resolveLocationFromCaveOrEntrance(	37✔
385	caveId,
386	entranceId,
387	populatedEntity
388	);
389	if (!result.countryId && !result.massifIds.length && massifId) {	37!
UNCOV 390	result.massifIds = [safeGetPropId('massif', populatedEntity)];	×
391	}
392	} else {
UNCOV 393	throw new Error(	×
394	`Can't find what to do with the following notification entity value: ${notificationEntity}`
395	);
396	}
397
398	const entityCountryId = result.countryId;	148✔
399	const entityMassifIds = result.massifIds;	148✔
400	const entityRegionId = result.regionId;	148✔
401
402	// Find subscribers to the entity.
403	const { countrySubscribers, massifsSubscribers, regionSubscribers } =
404	await getCountryMassifAndRegionSubscribers(	148✔
405	entityCountryId,
406	entityMassifIds,
407	entityRegionId
408	);
409	// Consolidate subscribers by user ID and combine subscription types
410	const subscriberMap = new Map();	148✔
411
412	const addSubscribers = (subscribers) => {	148✔
413	subscribers	444✔
414	.filter((u) => u.id !== notifierId)	69✔
415	.forEach((user) => {
416	if (subscriberMap.has(user.id)) {	69✔
417	const existing = subscriberMap.get(user.id);	2✔
418	existing.subscriptionNames.push(user.subscriptionName);	2✔
419	existing.subscriptionTypes.push(user.subscriptionType);	2✔
420	} else {
421	subscriberMap.set(user.id, {	67✔
422	...user,
423	subscriptionNames: [user.subscriptionName],
424	subscriptionTypes: [user.subscriptionType],
425	});
426	}
427	});
428	};
429
430	addSubscribers(countrySubscribers);	148✔
431	addSubscribers(massifsSubscribers);	148✔
432	addSubscribers(regionSubscribers);	148✔
433
434	const uniqueUsers = Array.from(subscriberMap.values()).map((user) => ({	148✔
435	...user,
436	subscriptionName: user.subscriptionNames.join(' and '),
437	subscriptionType: user.subscriptionTypes.join(', '),
438	}));
439
440	// Create notifications & optionally send email
441	const res = await Promise.all(	148✔
442	uniqueUsers.map(async (user) => {
443	try {	67✔
444	await TNotification.create({	67✔
445	...notification,
446	notified: user.id,
447	[entityKey]: notification[entityKey].id, // id only for the DB storage
448	});
449	} catch (e) {
UNCOV 450	sails.log.error(	×
451	`An error occured when trying to create a notification: ${e.message}`
452	);
UNCOV 453	return false;	×
454	}
455
456	if (user.sendNotificationByEmail) {	67!
UNCOV 457	await sendNotificationEmail(	×
458	populatedEntity,
459	notificationType,
460	notificationEntity,
461	user
462	);
463	}
464	return true;	67✔
465	})
466	);
467
468	// 5% chance to also remove older notifications
469	if (process.env.NODE_ENV !== 'test' && Math.random() < 0.05) {	148!
UNCOV 470	try {	×
UNCOV 471	await removeOlderNotifications();	×
472	} catch (cleanupError) {
UNCOV 473	sails.log.error(	×
474	`Error during notification cleanup: ${cleanupError.message}`
475	);
476	}
477	}
478
479	return res;	148✔
480	} catch (error) {
481	// Fail silently to avoid sending an error to the user
482	sails.log.error(	8✔
483	`An error occurred when trying to notify subscribers: ${error.message} ${error.stack}`
484	);
485	return false;	8✔
486	}
487	},
488
489	/**
490	* Create an in-app notification for the document author and optionally send an email.
491	*
492	* @param {Object} document - Populated TDocument (must have .author)
493	* @param {Number} moderatorId - ID of the moderator who made the decision
494	* @param {String} notificationType - NOTIFICATION_TYPES.VALIDATE or NOTIFICATION_TYPES.REJECT
495	* @param {String\|null} validationComment - Moderator's comment (required for REJECT)
496	* @returns {Boolean} true on success, false on silent failure
497	*/
498	notifyAuthor: async (
499	document,
500	moderatorId,
501	notificationType,
502	validationComment
503	) => {
504	const authorId = safeGetPropId('author', document);	324✔
505	if (!authorId) {	324✔
506	sails.log.debug(	1✔
507	`notifyAuthor: document ${document.id} has no author, skipping notification`
508	);
509	return true;	1✔
510	}
511	if (authorId === moderatorId) {	323✔
512	return true;	103✔
513	}
514
515	if (!Object.values(NOTIFICATION_TYPES).includes(notificationType)) {	220!
UNCOV 516	throw new Error(`Invalid notification type: ${notificationType}`);	×
517	}
518
519	try {	220✔
520	const notificationTypeRecord = await TNotificationType.findOne({	220✔
521	name: notificationType,
522	});
523
524	if (!notificationTypeRecord) {	220!
UNCOV 525	throw new Error(	×
526	`Notification type '${notificationType}' not found in DB — migration may not have run`
527	);
528	}
529
530	await TNotification.create({	220✔
531	dateInscription: new Date(),
532	notificationType: notificationTypeRecord.id,
533	notifier: moderatorId,
534	notified: authorId,
535	document: document.id,
536	});
537
538	const author = await TCaver.findOne(authorId);	220✔
539
540	if (author && author.sendNotificationByEmail) {	220✔
541	await sendNotificationEmail(	50✔
542	document,
543	notificationType,
544	NOTIFICATION_ENTITIES.DOCUMENT,
545	{
546	...author,
547	isAuthorNotification: true,
548	validationComment,
549	}
550	);
551	}
552
553	return true;	220✔
554	} catch (error) {
UNCOV 555	sails.log.error(	×
556	`An error occurred when trying to notify the document author: ${error.message} ${error.stack}`
557	);
UNCOV 558	return false;	×
559	}
560	},
561
562	populateEntities: async (notification) => {
563	const populatedNotification = notification;	206✔
564	if (populatedNotification.cave) {	206✔
565	await NameService.setNames([populatedNotification.cave], 'cave');	14✔
566	}
567	if (populatedNotification.comment) {	206✔
568	populatedNotification.comment = await TComment.findOne(	11✔
569	safeGetPropId('comment', notification)
570	)
571	.populate('cave')
572	.populate('entrance');
573	}
574	if (populatedNotification.description) {	206✔
575	populatedNotification.description = await TDescription.findOne(	10✔
576	safeGetPropId('description', notification)
577	)
578	.populate('cave')
579	.populate('document')
580	.populate('entrance')
581	.populate('massif');
582	}
583	if (populatedNotification.document) {	206✔
584	// Had to require in the function to avoid a circular dependency with notifySubscribers() in DocumentService.createDocument()
585	// eslint-disable-next-line global-require
586	const DocumentService = require('./DocumentService');	45✔
587	const populatedDocuments = await DocumentService.getDocuments([	45✔
588	safeGetPropId('document', notification),
589	]);
590	populatedNotification.document = populatedDocuments[0];	45✔
591	}
592	if (populatedNotification.entrance) {	206✔
593	await NameService.setNames([populatedNotification.entrance], 'entrance');	53✔
594	}
595	if (populatedNotification.grotto) {	206✔
596	await NameService.setNames([populatedNotification.grotto], 'grotto');	16✔
597	}
598	if (populatedNotification.history) {	206✔
599	populatedNotification.history = await THistory.findOne(	7✔
600	safeGetPropId('history', notification)
601	)
602	.populate('cave')
603	.populate('entrance');
604	}
605	if (populatedNotification.location) {	206✔
606	populatedNotification.location = await TLocation.findOne(	12✔
607	safeGetPropId('location', notification)
608	).populate('entrance');
609	}
610	if (populatedNotification.massif) {	206✔
611	await NameService.setNames([populatedNotification.massif], 'massif');	11✔
612	}
613	if (populatedNotification.rigging) {	206✔
614	populatedNotification.rigging = await TRigging.findOne(	6✔
615	safeGetPropId('rigging', notification)
616	)
617	.populate('entrance')
618	.populate('cave');
619	}
620	return populatedNotification;	206✔
621	},
622	};

GrottoCenter / grottocenter-api / 26527336612

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous