Merge branch 'lebihae/warn-canbook-bypasses' into 'main'

warning admins/managers when they're bypassing checks when booking a ticket

See merge request churros/churros!588

.changeset/fair-days-yell.md

···
+---
+'@churros/api': minor
+'@churros/app': minor
+---
+
+warn managers or admins when they're bypassing checks when booking a ticket

CHANGELOG.md

···
 
 ## [Unreleased]
 
+### Nouveautés
+
+- Les managers d'évènements et admins sont maintenant avertis quand iels s'apprêtent à prendre une place qu'iels ne pourrait pas prendre sans leur statut de manager/admin
+
 ## [4.7.0] - 2025-02-08
 
 ## [4.6.1] - 2025-02-07

packages/api/src/modules/ticketing/types/ticket.ts

···
         themself: t.arg.boolean({
           description: 'On souhaite réserver pour soi-même',
         }),
+        asRegularPerson: t.arg.boolean({
+          defaultValue: false,
+          description:
+            "Ignorer le fait qu'on puisse voir toutes les places (managers, admins, admins AE, etc)",
+        }),
       },
-      async resolve({ id }, { themself }, { user }) {
+      async resolve({ id }, { themself, asRegularPerson }, { user }) {
         const ticket = await prisma.ticket.findUniqueOrThrow({
           where: { id },
           include: canBookTicket.prismaIncludes,
···
             : null,
           beneficiary: themself ? null : 'someone else',
           pointOfContact: ticket.event.managers.at(0)?.user,
+          ignoreCanSeeAllBookings: asRegularPerson,
         });
         return can ? null : whynot;
       },

packages/api/src/modules/ticketing/utils/permissions.ts

···
-import { canEditEvent, canEditEventPrismaIncludes } from '#modules/events';
 import { fullName, log, type Capacity, type Context } from '#lib';
+import { canEditEvent, canEditEventPrismaIncludes } from '#modules/events';
 import { actualPrice } from '#modules/payments';
 import { userIsAdminOf } from '#permissions';
 import type { Prisma, User } from '@churros/db/prisma';
···
 /**
  * @returns [canBook, why]
  * @param beneficiary - can be a string if it's a beneficiary (free form) or a User if it's a churrosBeneficiary
+ * @param ignoreCanSeeAllBookings - if true, will ignore the canSeeAllBookings check. useful to determine if someone can book a ticket only because they're managers/admins/etc
  */
 export function canBookTicket({
   user,
···
   ticket,
   debug,
   pointOfContact,
+  ignoreCanSeeAllBookings = false,
 }: {
   user: Context['user'];
   userAdditionalData: null | Prisma.UserGetPayload<{
···
   beneficiary: string | User | null | undefined;
   ticket: Prisma.TicketGetPayload<{ include: typeof canBookTicket.prismaIncludes }>;
   debug?: boolean;
+  ignoreCanSeeAllBookings?: boolean;
 }): [boolean, string] {
   const dret = <T extends [boolean, string]>(ret: T, data: unknown) => {
     if (debug) void log('ticketing', 'debug/can-book-ticket', { ret, data }, ticket.id, user);
···
     if (debug) void log('ticketing', 'debug/can-book-ticket', { data }, ticket.id, user);
   };
 
-  if (canSeeAllBookings(ticket.event, user)) return dret([true, ''], { why: 'canSeeAllBookings' });
+  if (!ignoreCanSeeAllBookings && canSeeAllBookings(ticket.event, user))
+    return dret([true, ''], { why: 'canSeeAllBookings' });
 
   d({ canSeeAllBookings: false });
 
···
 
   d({ shotgunPastClosed: true });
 
-  if (ticket.onlyManagersCanProvide && !canSeeAllBookings(ticket.event, user))
+  if (ticket.onlyManagersCanProvide)
     return dret([false, 'Seul un·e manager peut faire une réservation pour ce billet'], {});
 
   d({ managersOnlyCheck: true });
 
-  if (!canSeeAllBookings(ticket.event, user) && user) {
+  if (user) {
     const bookingsByUser = ticket.registrations.filter((r) => r.authorId === user.id);
     if (ticket.godsonLimit > 0 && bookingsByUser.length > ticket.godsonLimit)
       return dret([false, 'Vous avez atteint la limite de parrainages pour ce billet'], {});
···
 
   d({ placesLeftCheck: true });
 
-  if (!canSeeAllBookings(ticket.event, user) && ticket.godsonLimit <= 0 && beneficiary)
+  if (ticket.godsonLimit <= 0 && beneficiary)
     return dret([false, "Ce billet n'accepte pas de parrainages"], {});
 
   d({ godsonEnabledCheck: true });

packages/app/schema.graphql

···
   """
   cannotBookReason(
     """
+    Ignorer le fait qu'on puisse voir toutes les places (managers, admins, admins AE, etc)
+    """
+    asRegularPerson: Boolean! = false
+    """
     On souhaite réserver pour soi-même
     """
     themself: Boolean!

packages/app/src/routes/(app)/events/[id]/ModalBookTicket.svelte

···
   import LoadingText from '$lib/components/LoadingText.svelte';
   import MaybeError from '$lib/components/MaybeError.svelte';
   import ModalOrDrawer from '$lib/components/ModalOrDrawer.svelte';
-  import { loaded, onceLoaded } from '$lib/loading';
+  import { countThing } from '$lib/i18n';
+  import { allLoaded, loaded } from '$lib/loading';
   import { mutate } from '$lib/mutations';
   import { refroute } from '$lib/navigation';
   import { route } from '$lib/ROUTES';
···
         price: minimumPrice(applyPromotions: true)
         cannotBookForMe: cannotBookReason(themself: true)
         cannotBookForSomeoneElse: cannotBookReason(themself: false)
+        cannotBookAsRegularUser: cannotBookReason(themself: true, asRegularPerson: true)
         godsonLimit
         remainingGodsons
         event {
···
     </h2>
   </header>
   <div class="contents">
-    {#if !$data}
+    {#if !$data || !allLoaded( [$data.cannotBookAsRegularUser, $data.cannotBookForMe, $data.cannotBookForSomeoneElse], )}
       <LoadingChurros />
       <p>Chargement...</p>
       <nav>
···
         <LoadingText tag="p" value={$data.cannotBookForMe} />
       </Alert>
     {:else if step === 'start'}
-      {#if !$data.cannotBookForSomeoneElse && $data.godsonLimit > 0}
-        <Alert theme="warning">
-          <LoadingText tag="p" value={$data.cannotBookForSomeoneElse} />
-        </Alert>
-      {:else if $data?.godsonLimit > 0}
-        <p class="godsons-remaining">
-          Il te reste <LoadingText value={$data.remainingGodsons} /> parrainage{onceLoaded(
-            $data.remainingGodsons,
-            (count) => (count > 1 ? 's' : ''),
-            '(s)',
-          )}
-        </p>
-      {/if}
+      <section class="notices">
+        {#if !$data.cannotBookForMe && $data.cannotBookAsRegularUser}
+          <Alert theme="warning">
+            <p>Si tu n'étais pas admin ou manager, tu ne pourrais pas réserver cette place:</p>
+            <LoadingText tag="p" value={$data.cannotBookAsRegularUser} />
+          </Alert>
+        {/if}
+        {#if !$data.cannotBookForSomeoneElse && $data.godsonLimit > 0}
+          <Alert theme="warning">
+            <LoadingText tag="p" value={$data.cannotBookForSomeoneElse} />
+          </Alert>
+        {:else if $data?.godsonLimit > 0}
+          <p class="godsons-remaining">
+            Il te reste {countThing('parrainage', $data.remainingGodsons)}
+          </p>
+        {/if}
+      </section>
       <div class="actions">
         <ButtonSecondary
           disabled={Boolean($data.cannotBookForMe)}
···
     gap: 0.5rem;
     align-items: center;
     justify-content: center;
+  }
+
+  .notices {
+    margin-bottom: 1.2em;
   }
 </style>