Merge branch 'gwenn/fixcancreategroup' into 'main'

fix(groups/permissions): fix canCreateGroup

See merge request churros/churros!652

.changeset/early-lamps-rescue.md

···
+---
+'@churros/api': major
+---
+
+Remove deprecated Mutation.upsertGroup

.changeset/pink-spies-cough.md

···
+---
+'@churros/api': patch
+---
+
+canCreateGroup would always return false

CHANGELOG.md

···
 
 ## [Unreleased]
 
+### Corrections
+
+- Un bug empêchait les respos clubs ou admins d'AE de créer des groupes
+
 ## [4.8.2] - 2025-02-15
 
 ## [4.8.1] - 2025-02-11

packages/api/src/modules/groups/resolvers/mutation.create-group.ts

···
         defaultValue: 'Group',
       }),
     },
-    async authScopes(_, { studentAssociation, type }, { user }) {
+    async authScopes(_, { studentAssociation: studentAssociationUid, type }, { user }) {
+      const studentAssociation = await prisma.studentAssociation.findUniqueOrThrow({
+        where: { uid: studentAssociationUid },
+      });
       return canCreateGroup(user, {
-        studentAssociationUid: studentAssociation,
+        studentAssociationId: studentAssociation.id,
         type,
       });
     },

packages/api/src/modules/groups/resolvers/mutation.upsert-group.ts

···
-import { builder, freeUidValidator, graphinx, log, prisma, purgeSessionsUser } from '#lib';
-import { UIDScalar } from '#modules/global';
-import { getDescendants, hasCycle } from 'arborist';
-import { GraphQLError } from 'graphql';
-import { ZodError } from 'zod';
-import { GroupEnumType, GroupType } from '../index.js';
-import { canCreateGroup, canEditGroup } from '../utils/index.js';
-
-/*
- TODO split into:
-  - upsertGroup
-  - changeGroupStudentAssociation (can also remove)
-  - changeParentGroup (can also remove)
-
-  This would prevent confusion around null (ie removing) vs undefined (ie not changing), the distinction does not exist in GraphQL
-
-  And would also make the code for canEditGroup more manageable
-
-  This would also allow us to (maybe?) change the contact email automatically when the student association changes (unless it is already set to sth different than the old student association's email)
- */
-
-const UpsertGroupInput = builder.inputType('UpsertGroupInput', {
-  ...graphinx('groups'),
-  fields: (t) => ({
-    uid: t.field({
-      required: false,
-      type: UIDScalar,
-      validate: freeUidValidator,
-      description:
-        "Ne sert qu'à la création du groupe. Il est impossible de modifier un uid existant",
-    }),
-    type: t.field({ type: GroupEnumType }),
-    parent: t.field({ type: UIDScalar, required: false }),
-    school: t.field({
-      type: UIDScalar,
-      required: false,
-      deprecationReason:
-        "N'a aucun effet, les groupes ne peuvent plus être reliés à des écoles directement",
-    }),
-    studentAssociation: t.field({ type: UIDScalar, required: false }),
-    name: t.string({ validate: { maxLength: 255 } }),
-    color: t.string({ required: false, validate: { regex: /#[\dA-Fa-f]{6}/ } }),
-    address: t.string({ validate: { maxLength: 255 } }),
-    description: t.string({ validate: { maxLength: 255 } }),
-    website: t.string({ validate: { maxLength: 255 } }),
-    email: t.string({ validate: { email: true }, required: false }),
-    mailingList: t.string({ validate: { email: true }, required: false }),
-    longDescription: t.string(),
-    selfJoinable: t.boolean(),
-    related: t.field({ type: ['String'] }),
-  }),
-});
-
-/** Upserts a group. */
-builder.mutationField('upsertGroup', (t) =>
-  t.prismaField({
-    deprecationReason:
-      'Mutation séparée en plusieurs mutations plus spécifiques. Voir la documentation du module groups',
-    type: GroupType,
-    errors: { types: [ZodError, Error] },
-    args: {
-      uid: t.arg({ type: UIDScalar, required: false }),
-      input: t.arg({ type: UpsertGroupInput }),
-    },
-    validate: [
-      [
-        ({ uid, input }) => !(uid && input.uid),
-        { message: "Impossible de modifier l'@ d'un groupe existant" },
-      ],
-      [
-        ({ uid, input }) => !(!uid && !input.uid),
-        {
-          message:
-            'Use uid to choose which group to update or input.uid to create a new group with that uid',
-        },
-      ],
-    ],
-    async authScopes(_, { uid, input }, { user }) {
-      if (!user) return false;
-      const creating = !uid;
-      if (creating) return canCreateGroup(user, input);
-
-      const group = await prisma.group.findUniqueOrThrow({
-        where: { uid },
-        include: canEditGroup.prismaIncludes,
-      });
-      return canEditGroup(user, group);
-    },
-    // eslint-disable-next-line complexity
-    async resolve(
-      query,
-      _,
-      {
-        uid: oldUid,
-        input: {
-          selfJoinable,
-          uid: newUid,
-          type,
-          parent: parentUid,
-          name,
-          color,
-          address,
-          description,
-          website,
-          studentAssociation: studentAssociationUid,
-          email,
-          mailingList,
-          longDescription,
-          related,
-        },
-      },
-      { user },
-    ) {
-      if (!user) throw new GraphQLError("Vous n'êtes pas connecté·e");
-      if (!studentAssociationUid) throw new GraphQLError("Il faut préciser l'AE de rattachement");
-
-      // --- First, we update the group's children's familyId according to the new parent of this group. ---
-      // We have 2 possible cases for updating the parent: either it is:
-      // - null (or set to ''): the group does not have a parent anymore;
-      //   In that case, the root (set by familyId) is the group itself.
-      //   We don't need to change the root's children
-      // - an id: the group's parent is changed to the group with that ID.
-      //   In that case, the root is changed to the root of the new parent.
-      //   - if we are creating the group, we don't need to change its children since it has none
-      //
-      let familyId;
-      const oldGroup = await prisma.group.findUnique({ where: { uid: oldUid ?? '' } });
-      if (parentUid === null || parentUid === undefined || parentUid === '') {
-        // First case (null): the group does not have a parent anymore.
-        // Set both the parent and the root to the group itself.
-        // eslint-disable-next-line unicorn/no-null
-        parentUid = null;
-        // eslint-disable-next-line unicorn/no-null
-        familyId = oldGroup?.id ?? null;
-      } else {
-        // Third case (number): the group's parent is changed to the group with that ID.
-        const newParent = await prisma.group.findUnique({ where: { uid: parentUid } });
-        if (!newParent) throw new GraphQLError('uid de groupe parent invalide');
-        familyId = newParent.familyId ?? newParent.id;
-        // Update all descendants' familyId to the new parent's familyId
-        // Or when creating (i.e. oldGroup is undefined), just check for cycles
-        const allGroups = await prisma.group.findMany({});
-        if (oldGroup) {
-          if (
-            hasCycle(
-              allGroups.map((g) =>
-                g.id === oldGroup.id ? { ...oldGroup, parentId: newParent.id } : g,
-              ),
-            )
-          )
-            throw new GraphQLError('La modification créerait un cycle dans les groupes');
-
-          const descendants = getDescendants(allGroups, oldGroup.id);
-          await prisma.group.updateMany({
-            where: { id: { in: descendants.map((g) => g.id) } },
-            data: {
-              familyId,
-            },
-          });
-        } else if (newParent.id && hasCycle([{ parentId: newParent.id, id: '' }, ...allGroups])) {
-          throw new GraphQLError("Can't create a cycle");
-        }
-      }
-
-      if (parentUid === oldGroup?.uid) throw new GraphQLError('Group cannot be its own parent');
-
-      if (oldGroup) {
-        const oldStudentAssociation = await prisma.studentAssociation.findUnique({
-          where: { id: oldGroup.studentAssociationId ?? '' },
-        });
-
-        if (
-          !(user.canEditGroups || user.admin) &&
-          (oldGroup?.type != type ||
-            (oldStudentAssociation && oldStudentAssociation.uid != studentAssociationUid))
-        )
-          // Non admin users aren't allowed to change attached ae and group type
-          throw new GraphQLError("Vous n'êtes pas autorisé à modifer ces paramètres.");
-      }
-
-      const data = {
-        type,
-        selfJoinable,
-        name,
-        color: color ?? undefined,
-        familyRoot: familyId ? { connect: { id: familyId } } : undefined,
-        address,
-        description,
-        website,
-        email: email ?? undefined,
-        mailingList: mailingList ?? undefined,
-        longDescription,
-      };
-
-      const group = await prisma.group.upsert({
-        ...query,
-        where: { uid: oldUid ?? '' },
-        create: {
-          ...data,
-          color: color ?? '',
-          uid: newUid ?? '',
-          related: { connect: related.map((uid) => ({ uid })) },
-          parent:
-            parentUid === null || parentUid === undefined ? {} : { connect: { uid: parentUid } },
-          studentAssociation: studentAssociationUid
-            ? { connect: { uid: studentAssociationUid } }
-            : {},
-        },
-        update: {
-          ...data,
-          related: {
-            set: related.map((uid) => ({ uid })),
-          },
-          parent:
-            parentUid === null || parentUid === undefined
-              ? { disconnect: true }
-              : { connect: { uid: parentUid } },
-          studentAssociation: studentAssociationUid
-            ? { connect: { uid: studentAssociationUid } }
-            : {},
-        },
-      });
-      if ((await prisma.groupMember.count({ where: { groupId: group.id } })) === 0) {
-        await prisma.group.update({
-          where: { id: group.id },
-          data: {
-            members: {
-              create: {
-                president: true,
-                title: 'Prez',
-                member: {
-                  connect: {
-                    uid: user.uid,
-                  },
-                },
-              },
-            },
-          },
-        });
-        purgeSessionsUser(user.uid);
-      }
-
-      await log('groups', oldUid ? 'update' : 'create', group, group.uid, user);
-      return group;
-    },
-  }),
-);

packages/api/src/modules/groups/utils/permissions.ts

···
 export function canCreateGroup(
   user: Context['user'],
   {
-    studentAssociationUid,
+    studentAssociationId,
     parentUid,
     type,
   }: {
-    studentAssociationUid?: string | null | undefined;
+    studentAssociationId?: string | null | undefined;
     /** @deprecated setting parent group is done in another mutation now  */
     parentUid?: string | null | undefined;
     type: GroupType;
   },
 ): boolean {
   if (!user) return false;
-  if (userIsAdminOf(user, studentAssociationUid ?? null)) return true;
-  if (userIsGroupEditorOf(user, studentAssociationUid ?? null)) return true;
+  if (userIsAdminOf(user, studentAssociationId ?? null)) return true;
+  if (userIsGroupEditorOf(user, studentAssociationId ?? null)) return true;
 
   if (
     parentUid &&

packages/api/src/modules/student-associations/types/student-association.ts

···
   canEditDetails,
   userContributesTo,
 } from '#modules/student-associations/utils';
-import type { Prisma } from '@churros/db/prisma';
+import { type Prisma, GroupType as GroupTypeEnum } from '@churros/db/prisma';
 
 export const StudentAssociationPrismaIncludes = {
   contributionOptions: true,
···
             "Quel type de groupe l'on souhaiterait créer. Si non spécifié, renvoie vrai si l'on peut créer au moins un type de groupe",
         }),
       },
-      resolve: async ({ uid }, { type }, { user }) => {
+      resolve: async ({ id }, { type }, { user }) => {
         if (type) {
           return canCreateGroup(user, {
-            studentAssociationUid: uid,
+            studentAssociationId: id,
             type,
           });
         }
 
-        return Object.values(GroupEnumType).some((type) =>
+        return Object.values(GroupTypeEnum).some((type) =>
           canCreateGroup(user, {
-            studentAssociationUid: uid,
+            studentAssociationId: id,
             type,
           }),
         );

packages/app/schema.graphql

···
     godparentUid: String!
     id: ID
   ): MutationUpsertGodparentRequestResult!
-  upsertGroup(input: UpsertGroupInput!, uid: UID): MutationUpsertGroupResult!
-    @deprecated(
-      reason: "Mutation séparée en plusieurs mutations plus spécifiques. Voir la documentation du module groups"
-    )
   upsertGroupMember(
     canEditArticles: Boolean!
     canEditMembers: Boolean!
···
 
 type MutationUpsertGodparentRequestSuccess {
   data: GodparentRequest!
-}
-
-union MutationUpsertGroupResult = Error | MutationUpsertGroupSuccess | ZodError
-
-type MutationUpsertGroupSuccess {
-  data: Group!
 }
 
 union MutationUpsertLydiaAccountResult = Error | MutationUpsertLydiaAccountSuccess | ZodError
···
 Une adresse internet (URL). Les protocoles autorisés sont: http:, https:, mailto:, tel:
 """
 scalar URL
-
-input UpsertGroupInput @graphinx(module: "groups") {
-  address: String!
-  color: String
-  description: String!
-  email: String
-  longDescription: String!
-  mailingList: String
-  name: String!
-  parent: UID
-  related: [String!]!
-  school: UID
-    @deprecated(
-      reason: "N'a aucun effet, les groupes ne peuvent plus être reliés à des écoles directement"
-    )
-  selfJoinable: Boolean!
-  studentAssociation: UID
-  type: GroupType!
-  """
-  Ne sert qu'à la création du groupe. Il est impossible de modifier un uid existant
-  """
-  uid: UID
-  website: String!
-}
 
 """
 Users are the people who use the app

packages/app/src/lib/components/FormGroup.svelte

···
-<script lang="ts">
-  import { goto } from '$app/navigation';
-  import { fragment, graphql, type FormGroup } from '$houdini';
-  import Alert from '$lib/components/Alert.svelte';
-  import { DISPLAY_GROUP_TYPES } from '$lib/display';
-  import { mutationErrorMessages, mutationSucceeded } from '$lib/errors';
-  import { toasts } from '$lib/toasts';
-  import ButtonPrimary from './ButtonPrimary.svelte';
-  import InputCheckbox from './InputCheckbox.svelte';
-  import InputGroups from './InputGroups.svelte';
-  import InputLongText from './InputLongText.svelte';
-  import InputSelectOne from './InputSelectOne.svelte';
-  import InputSocialLinks from './InputSocialLinks.svelte';
-  import InputStudentAssociations from './InputStudentAssociations.svelte';
-  import InputText from './InputText.svelte';
-
-  // export let data: PageData;
-  export let creatingSubgroup = false;
-
-  export let group: FormGroup;
-  $: data = fragment(
-    group,
-    graphql(`
-      fragment FormGroup on Group {
-        uid
-        address
-        color
-        description
-        email
-        mailingList
-        longDescription
-        website
-        canEditDetails
-        name
-        selfJoinable
-        type
-        parent {
-          uid
-          name
-          id
-          pictureFile
-          pictureFileDark
-        }
-        related {
-          uid
-          name
-          id
-          pictureFile
-          pictureFileDark
-        }
-        studentAssociation {
-          uid
-          id
-          name
-        }
-        links {
-          name
-          value
-        }
-      }
-    `),
-  );
-
-  let serverError = '';
-
-  $: ({
-    address,
-    description,
-    color,
-    email,
-    mailingList,
-    longDescription,
-    website,
-    name,
-    selfJoinable,
-    type,
-    parent,
-    related,
-    studentAssociation,
-  } = $data);
-
-  const socialMediaNames = [
-    'facebook',
-    'instagram',
-    'discord',
-    'twitter',
-    'linkedin',
-    'github',
-    'hackernews',
-    'anilist',
-  ] as const;
-
-  let links = socialMediaNames.map((name) => ({
-    name,
-    value: $data?.links.find((link) => link.name === name)?.value ?? '',
-  }));
-
-  let loading = false;
-  const submit = async () => {
-    if (loading) return;
-    try {
-      loading = true;
-      // const { upsertGroup } = await $zeus.mutate({
-      //   upsertGroup: [
-      //     {
-      //       uid: data.group.uid,
-      //       input: {
-      //         address,
-      //         color,
-      //         description,
-      //         email: email || undefined,
-      //         mailingList: mailingList || undefined,
-      //         longDescription,
-      //         website,
-      //         name,
-      //         selfJoinable,
-      //         parent: parent?.uid,
-      //         type,
-      //         related: related.map(({ uid }) => uid),
-      //         studentAssociation: studentAssociation?.uid,
-      //       },
-      //     },
-      //     {
-      //       '__typename': true,
-      //       '...on Error': { message: true },
-      //       '...on ZodError': { message: true },
-      //       '...on MutationUpsertGroupSuccess': { data: clubQuery },
-      //     },
-      //   ],
-      // });
-
-      const result = await graphql(`
-        mutation UpsertGroup($uid: UID!, $input: UpsertGroupInput!) {
-          upsertGroup(uid: $uid, input: $input) {
-            __typename
-            ... on MutationUpsertGroupSuccess {
-              data {
-                ...FormGroup
-              }
-            }
-            ...MutationErrors
-          }
-        }
-      `).mutate({
-        uid: $data.uid,
-        input: {
-          address,
-          color,
-          description,
-          email: email || undefined,
-          mailingList: mailingList || undefined,
-          longDescription,
-          website,
-          name,
-          selfJoinable,
-          parent: parent?.uid,
-          type,
-          related: related.map(({ uid }) => uid),
-          studentAssociation: studentAssociation?.uid,
-        },
-      });
-
-      if (mutationSucceeded('upsertGroup', result)) {
-        serverError = '';
-        toasts.success(`${$data.name} mis à jour`);
-        if ($data.uid) await goto(`/groups/${$data.uid}/edit`);
-      } else {
-        serverError = mutationErrorMessages('upsertGroup', result).join(', ');
-        return;
-      }
-    } finally {
-      loading = false;
-    }
-  };
-
-  const AllGroups = graphql(`
-    query AllGroups {
-      groups {
-        uid
-        name
-        id
-        pictureFile
-        pictureFileDark
-      }
-    }
-  `);
-</script>
-
-{#await AllGroups.fetch().then((d) => d.data ?? { groups: [] })}
-  <p class="loading muted">Chargement...</p>
-{:then { groups: allGroups }}
-  <form on:submit|preventDefault={submit}>
-    {#if $data.canEditDetails}
-      <InputSelectOne
-        label="Type de groupe"
-        required
-        options={DISPLAY_GROUP_TYPES}
-        bind:value={type}
-      />
-
-      <div class="side-by-side">
-        <InputStudentAssociations
-          clearable
-          label="AE de rattachement"
-          bind:association={studentAssociation}
-          required={['Club', 'List'].includes(type)}
-        ></InputStudentAssociations>
-      </div>
-    {/if}
-
-    <InputCheckbox
-      label="Inscription libre"
-      help="N'importe qui peut rejoindre le groupe"
-      bind:value={selfJoinable}
-    />
-
-    <InputText required label="Nom" maxlength={255} bind:value={name} />
-    <InputText label="Description courte" maxlength={255} bind:value={description} />
-    <InputLongText rich label="Description" bind:value={longDescription} />
-    <!-- TODO colors ? -->
-    <InputText label="Salle" maxlength={255} bind:value={address} />
-    <InputText
-      label="Email"
-      type="email"
-      maxlength={255}
-      value={email ?? ''}
-      on:input={({ detail }) => {
-        email = detail.currentTarget.value || null;
-      }}
-    />
-    <InputText label="Mailing list" type="email" maxlength={255} bind:value={mailingList} />
-    <InputText label="Site web" type="url" maxlength={255} bind:value={website} />
-    <InputSocialLinks label="Réseaux sociaux" bind:value={links} />
-    {#if !creatingSubgroup}
-      <InputGroups clearable label="Groupe parent" bind:group={parent} options={allGroups}
-      ></InputGroups>
-    {/if}
-    <InputGroups multiple label="Groupes à voir" bind:groups={related} options={allGroups} />
-
-    {#if serverError}
-      <Alert theme="danger"
-        >Impossible de sauvegarder les modifications : <br /><strong>{serverError}</strong></Alert
-      >
-    {/if}
-    <section class="submit">
-      <ButtonPrimary submits {loading}>Sauvegarder</ButtonPrimary>
-    </section>
-  </form>
-{/await}
-
-<style>
-  form {
-    display: flex;
-    flex-flow: column wrap;
-    gap: 2rem;
-  }
-
-  section.submit {
-    display: flex;
-    justify-content: center;
-  }
-
-  .side-by-side {
-    display: flex;
-    flex-wrap: wrap;
-    column-gap: 1rem;
-    align-items: center;
-  }
-</style>