Merge pull request #1623 from gradido/user-entity-in-context

fix: Query for Only Creations Transaction List

admin/src/components/CreationTransactionListFormular.spec.js

@@ -6,8 +6,7 @@ const localVue = global.localVue
 
 const apolloQueryMock = jest.fn().mockResolvedValue({
   data: {
-    transactionList: {
+    creationTransactionList: [
-      transactions: [
       {
         id: 1,
         amount: 100,
@@ -32,7 +31,6 @@ const apolloQueryMock = jest.fn().mockResolvedValue({
       },
     ],
   },
-  },
 })
 
 const mocks = {
@@ -67,7 +65,6 @@ describe('CreationTransactionListFormular', () => {
             currentPage: 1,
             pageSize: 25,
             order: 'DESC',
-            onlyCreations: true,
             userId: 1,
           },
         }),

admin/src/components/CreationTransactionListFormular.vue

@@ -5,7 +5,7 @@
   </div>
 </template>
 <script>
-import { transactionList } from '../graphql/transactionList'
+import { creationTransactionList } from '../graphql/creationTransactionList'
 export default {
   name: 'CreationTransactionList',
   props: {
@@ -51,17 +51,16 @@ export default {
     getTransactions() {
       this.$apollo
         .query({
-          query: transactionList,
+          query: creationTransactionList,
           variables: {
             currentPage: 1,
             pageSize: 25,
             order: 'DESC',
-            onlyCreations: true,
             userId: parseInt(this.userId),
           },
         })
         .then((result) => {
-          this.items = result.data.transactionList.transactions
+          this.items = result.data.creationTransactionList
         })
         .catch((error) => {
           this.toastError(error.message)

admin/src/graphql/creationTransactionList.js

@@ -0,0 +1,22 @@
+import gql from 'graphql-tag'
+
+export const creationTransactionList = gql`
+  query ($currentPage: Int = 1, $pageSize: Int = 25, $order: Order = DESC, $userId: Int!) {
+    creationTransactionList(
+      currentPage: $currentPage
+      pageSize: $pageSize
+      order: $order
+      userId: $userId
+    ) {
+      id
+      amount
+      balanceDate
+      creationDate
+      memo
+      linkedUser {
+        firstName
+        lastName
+      }
+    }
+  }
+`

admin/src/graphql/transactionList.js

@@ -1,31 +0,0 @@
-import gql from 'graphql-tag'
-
-export const transactionList = gql`
-  query (
-    $currentPage: Int = 1
-    $pageSize: Int = 25
-    $order: Order = DESC
-    $onlyCreations: Boolean = false
-    $userId: Int = null
-  ) {
-    transactionList(
-      currentPage: $currentPage
-      pageSize: $pageSize
-      order: $order
-      onlyCreations: $onlyCreations
-      userId: $userId
-    ) {
-      transactions {
-        id
-        amount
-        balanceDate
-        creationDate
-        memo
-        linkedUser {
-          firstName
-          lastName
-        }
-      }
-    }
-  }
-`

backend/src/auth/RIGHTS.ts

@@ -33,4 +33,5 @@ export enum RIGHTS {
   SEND_ACTIVATION_EMAIL = 'SEND_ACTIVATION_EMAIL',
   DELETE_USER = 'DELETE_USER',
   UNDELETE_USER = 'UNDELETE_USER',
+  CREATION_TRANSACTION_LIST = 'CREATION_TRANSACTION_LIST',
 }

backend/src/graphql/arg/Paginated.ts

@@ -11,10 +11,4 @@ export default class Paginated {
 
   @Field(() => Order, { nullable: true })
   order?: Order
-
-  @Field(() => Boolean, { nullable: true })
-  onlyCreations?: boolean
-
-  @Field(() => Int, { nullable: true })
-  userId?: number
 }

backend/src/graphql/directive/isAuthorized.ts

@@ -35,6 +35,7 @@ const isAuthorized: AuthChecker<any> = async ({ context }, rights) => {
   const userRepository = await getCustomRepository(UserRepository)
   try {
     const user = await userRepository.findByPubkeyHex(context.pubKey)
+    context.user = user
     const countServerUsers = await ServerUser.count({ email: user.email })
     context.role = countServerUsers > 0 ? ROLE_ADMIN : ROLE_USER
   } catch {

backend/src/graphql/resolver/AdminResolver.ts

@@ -1,7 +1,7 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 /* eslint-disable @typescript-eslint/explicit-module-boundary-types */
 
-import { Resolver, Query, Arg, Args, Authorized, Mutation, Ctx } from 'type-graphql'
+import { Resolver, Query, Arg, Args, Authorized, Mutation, Ctx, Int } from 'type-graphql'
 import {
   getCustomRepository,
   IsNull,
@@ -19,16 +19,21 @@ import { UserRepository } from '@repository/User'
 import CreatePendingCreationArgs from '@arg/CreatePendingCreationArgs'
 import UpdatePendingCreationArgs from '@arg/UpdatePendingCreationArgs'
 import SearchUsersArgs from '@arg/SearchUsersArgs'
-import { Transaction } from '@entity/Transaction'
+import { Transaction as DbTransaction } from '@entity/Transaction'
+import { Transaction } from '@model/Transaction'
 import { TransactionRepository } from '@repository/Transaction'
 import { calculateDecay } from '@/util/decay'
 import { AdminPendingCreation } from '@entity/AdminPendingCreation'
 import { hasElopageBuys } from '@/util/hasElopageBuys'
 import { LoginEmailOptIn } from '@entity/LoginEmailOptIn'
-import { User } from '@entity/User'
+import { User as dbUser } from '@entity/User'
+import { User } from '@model/User'
 import { TransactionTypeId } from '@enum/TransactionTypeId'
 import Decimal from 'decimal.js-light'
 import { Decay } from '@model/Decay'
+import Paginated from '@arg/Paginated'
+import { Order } from '@enum/Order'
+import { communityUser } from '@/util/communityUser'
 
 // const EMAIL_OPT_IN_REGISTER = 1
 // const EMAIL_OPT_UNKNOWN = 3 // elopage?
@@ -123,27 +128,26 @@ export class AdminResolver {
   @Authorized([RIGHTS.DELETE_USER])
   @Mutation(() => Date, { nullable: true })
   async deleteUser(@Arg('userId') userId: number, @Ctx() context: any): Promise<Date | null> {
-    const user = await User.findOne({ id: userId })
+    const user = await dbUser.findOne({ id: userId })
     // user exists ?
     if (!user) {
       throw new Error(`Could not find user with userId: ${userId}`)
     }
     // moderator user disabled own account?
-    const userRepository = getCustomRepository(UserRepository)
+    const moderatorUser = context.user
-    const moderatorUser = await userRepository.findByPubkeyHex(context.pubKey)
     if (moderatorUser.id === userId) {
       throw new Error('Moderator can not delete his own account!')
     }
     // soft-delete user
     await user.softRemove()
-    const newUser = await User.findOne({ id: userId }, { withDeleted: true })
+    const newUser = await dbUser.findOne({ id: userId }, { withDeleted: true })
     return newUser ? newUser.deletedAt : null
   }
 
   @Authorized([RIGHTS.UNDELETE_USER])
   @Mutation(() => Date, { nullable: true })
   async unDeleteUser(@Arg('userId') userId: number): Promise<Date | null> {
-    const user = await User.findOne({ id: userId }, { withDeleted: true })
+    const user = await dbUser.findOne({ id: userId }, { withDeleted: true })
     // user exists ?
     if (!user) {
       throw new Error(`Could not find user with userId: ${userId}`)
@@ -158,7 +162,7 @@ export class AdminResolver {
   async createPendingCreation(
     @Args() { email, amount, memo, creationDate, moderator }: CreatePendingCreationArgs,
   ): Promise<number[]> {
-    const user = await User.findOne({ email }, { withDeleted: true })
+    const user = await dbUser.findOne({ email }, { withDeleted: true })
     if (!user) {
       throw new Error(`Could not find user with email: ${email}`)
     }
@@ -215,7 +219,7 @@ export class AdminResolver {
   async updatePendingCreation(
     @Args() { id, email, amount, memo, creationDate, moderator }: UpdatePendingCreationArgs,
   ): Promise<UpdatePendingCreation> {
-    const user = await User.findOne({ email }, { withDeleted: true })
+    const user = await dbUser.findOne({ email }, { withDeleted: true })
     if (!user) {
       throw new Error(`Could not find user with email: ${email}`)
     }
@@ -265,7 +269,7 @@ export class AdminResolver {
 
     const userIds = pendingCreations.map((p) => p.userId)
     const userCreations = await getUserCreations(userIds)
-    const users = await User.find({ where: { id: In(userIds) }, withDeleted: true })
+    const users = await dbUser.find({ where: { id: In(userIds) }, withDeleted: true })
 
     return pendingCreations.map((pendingCreation) => {
       const user = users.find((u) => u.id === pendingCreation.userId)
@@ -294,12 +298,11 @@ export class AdminResolver {
   @Mutation(() => Boolean)
   async confirmPendingCreation(@Arg('id') id: number, @Ctx() context: any): Promise<boolean> {
     const pendingCreation = await AdminPendingCreation.findOneOrFail(id)
-    const userRepository = getCustomRepository(UserRepository)
+    const moderatorUser = context.user
-    const moderatorUser = await userRepository.findByPubkeyHex(context.pubKey)
     if (moderatorUser.id === pendingCreation.userId)
       throw new Error('Moderator can not confirm own pending creation')
 
-    const user = await User.findOneOrFail({ id: pendingCreation.userId }, { withDeleted: true })
+    const user = await dbUser.findOneOrFail({ id: pendingCreation.userId }, { withDeleted: true })
     if (user.deletedAt) throw new Error('This user was deleted. Cannot confirm a creation.')
 
     const creations = await getUserCreation(pendingCreation.userId, false)
@@ -321,7 +324,7 @@ export class AdminResolver {
     // TODO pending creations decimal
     newBalance = newBalance.add(new Decimal(Number(pendingCreation.amount)).toString())
 
-    const transaction = new Transaction()
+    const transaction = new DbTransaction()
     transaction.typeId = TransactionTypeId.CREATION
     transaction.memo = pendingCreation.memo
     transaction.userId = pendingCreation.userId
@@ -339,6 +342,27 @@ export class AdminResolver {
 
     return true
   }
+
+  @Authorized([RIGHTS.CREATION_TRANSACTION_LIST])
+  @Query(() => [Transaction])
+  async creationTransactionList(
+    @Args()
+    { currentPage = 1, pageSize = 25, order = Order.DESC }: Paginated,
+    @Arg('userId', () => Int) userId: number,
+  ): Promise<Transaction[]> {
+    const offset = (currentPage - 1) * pageSize
+    const transactionRepository = getCustomRepository(TransactionRepository)
+    const [userTransactions] = await transactionRepository.findByUserPaged(
+      userId,
+      pageSize,
+      offset,
+      order,
+      true,
+    )
+
+    const user = await dbUser.findOneOrFail({ id: userId })
+    return userTransactions.map((t) => new Transaction(t, new User(user), communityUser))
+  }
 }
 
 interface CreationMap {

backend/src/graphql/resolver/BalanceResolver.ts

@@ -2,9 +2,7 @@
 /* eslint-disable @typescript-eslint/explicit-module-boundary-types */
 
 import { Resolver, Query, Ctx, Authorized } from 'type-graphql'
-import { getCustomRepository } from '@dbTools/typeorm'
 import { Balance } from '@model/Balance'
-import { UserRepository } from '@repository/User'
 import { calculateDecay } from '@/util/decay'
 import { RIGHTS } from '@/auth/RIGHTS'
 import { Transaction } from '@entity/Transaction'
@@ -16,9 +14,7 @@ export class BalanceResolver {
   @Query(() => Balance)
   async balance(@Ctx() context: any): Promise<Balance> {
     // load user and balance
-    const userRepository = getCustomRepository(UserRepository)
+    const { user } = context
-
-    const user = await userRepository.findByPubkeyHex(context.pubKey)
     const now = new Date()
 
     const lastTransaction = await Transaction.findOne(

backend/src/graphql/resolver/GdtResolver.ts

@@ -2,12 +2,10 @@
 /* eslint-disable @typescript-eslint/explicit-module-boundary-types */
 
 import { Resolver, Query, Args, Ctx, Authorized, Arg } from 'type-graphql'
-import { getCustomRepository } from '@dbTools/typeorm'
 import CONFIG from '@/config'
 import { GdtEntryList } from '@model/GdtEntryList'
 import Paginated from '@arg/Paginated'
 import { apiGet } from '@/apis/HttpRequest'
-import { UserRepository } from '@repository/User'
 import { Order } from '@enum/Order'
 import { RIGHTS } from '@/auth/RIGHTS'
 
@@ -22,8 +20,7 @@ export class GdtResolver {
     @Ctx() context: any,
   ): Promise<GdtEntryList> {
     // load user
-    const userRepository = getCustomRepository(UserRepository)
+    const userEntity = context.user
-    const userEntity = await userRepository.findByPubkeyHex(context.pubKey)
 
     try {
       const resultGDT = await apiGet(

backend/src/graphql/resolver/TransactionLinkResolver.ts

@@ -2,11 +2,9 @@
 /* eslint-disable @typescript-eslint/explicit-module-boundary-types */
 
 import { Resolver, Args, Arg, Authorized, Ctx, Mutation, Query } from 'type-graphql'
-import { getCustomRepository } from '@dbTools/typeorm'
 import { TransactionLink } from '@model/TransactionLink'
 import { TransactionLink as dbTransactionLink } from '@entity/TransactionLink'
 import { User as dbUser } from '@entity/User'
-import { UserRepository } from '@repository/User'
 import TransactionLinkArgs from '@arg/TransactionLinkArgs'
 import Paginated from '@arg/Paginated'
 import { calculateBalance } from '@/util/validate'
@@ -42,8 +40,7 @@ export class TransactionLinkResolver {
     @Args() { amount, memo }: TransactionLinkArgs,
     @Ctx() context: any,
   ): Promise<TransactionLink> {
-    const userRepository = getCustomRepository(UserRepository)
+    const { user } = context
-    const user = await userRepository.findByPubkeyHex(context.pubKey)
 
     const createdDate = new Date()
     const validUntil = transactionLinkExpireDate(createdDate)
@@ -74,8 +71,7 @@ export class TransactionLinkResolver {
   @Authorized([RIGHTS.DELETE_TRANSACTION_LINK])
   @Mutation(() => Boolean)
   async deleteTransactionLink(@Arg('id') id: number, @Ctx() context: any): Promise<boolean> {
-    const userRepository = getCustomRepository(UserRepository)
+    const { user } = context
-    const user = await userRepository.findByPubkeyHex(context.pubKey)
 
     const transactionLink = await dbTransactionLink.findOne({ id })
     if (!transactionLink) {
@@ -116,8 +112,7 @@ export class TransactionLinkResolver {
     { currentPage = 1, pageSize = 5, order = Order.DESC }: Paginated,
     @Ctx() context: any,
   ): Promise<TransactionLink[]> {
-    const userRepository = getCustomRepository(UserRepository)
+    const { user } = context
-    const user = await userRepository.findByPubkeyHex(context.pubKey)
     // const now = new Date()
     const transactionLinks = await dbTransactionLink.find({
       where: {
@@ -137,8 +132,7 @@ export class TransactionLinkResolver {
   @Authorized([RIGHTS.REDEEM_TRANSACTION_LINK])
   @Mutation(() => Boolean)
   async redeemTransactionLink(@Arg('id') id: number, @Ctx() context: any): Promise<boolean> {
-    const userRepository = getCustomRepository(UserRepository)
+    const { user } = context
-    const user = await userRepository.findByPubkeyHex(context.pubKey)
     const transactionLink = await dbTransactionLink.findOneOrFail({ id })
     const linkedUser = await dbUser.findOneOrFail({ id: transactionLink.userId })
 

backend/src/graphql/resolver/TransactionResolver.ts

@@ -17,7 +17,6 @@ import Paginated from '@arg/Paginated'
 
 import { Order } from '@enum/Order'
 
-import { UserRepository } from '@repository/User'
 import { TransactionRepository } from '@repository/Transaction'
 import { TransactionLinkRepository } from '@repository/TransactionLink'
 
@@ -131,22 +130,11 @@ export class TransactionResolver {
   @Query(() => TransactionList)
   async transactionList(
     @Args()
-    {
+    { currentPage = 1, pageSize = 25, order = Order.DESC }: Paginated,
-      currentPage = 1,
-      pageSize = 25,
-      order = Order.DESC,
-      onlyCreations = false,
-      userId,
-    }: Paginated,
     @Ctx() context: any,
   ): Promise<TransactionList> {
     const now = new Date()
-    // find user
+    const user = context.user
-    const userRepository = getCustomRepository(UserRepository)
-    // TODO: separate those usecases - this is a security issue
-    const user = userId
-      ? await userRepository.findOneOrFail({ id: userId }, { withDeleted: true })
-      : await userRepository.findByPubkeyHex(context.pubKey)
 
     // find current balance
     const lastTransaction = await dbTransaction.findOne(
@@ -182,7 +170,6 @@ export class TransactionResolver {
       pageSize,
       offset,
       order,
-      onlyCreations,
     )
 
     // find involved users; I am involved
@@ -208,7 +195,7 @@ export class TransactionResolver {
       await transactionLinkRepository.summary(user.id, now)
 
     // decay & link transactions
-    if (!onlyCreations && currentPage === 1 && order === Order.DESC) {
+    if (currentPage === 1 && order === Order.DESC) {
       transactions.push(
         virtualDecayTransaction(lastTransaction.balance, lastTransaction.balanceDate, now, self),
       )
@@ -256,8 +243,7 @@ export class TransactionResolver {
     @Ctx() context: any,
   ): Promise<boolean> {
     // TODO this is subject to replay attacks
-    const userRepository = getCustomRepository(UserRepository)
+    const senderUser = context.user
-    const senderUser = await userRepository.findByPubkeyHex(context.pubKey)
     if (senderUser.pubKey.length !== 32) {
       throw new Error('invalid sender public key')
     }

backend/src/graphql/resolver/UserResolver.ts

@@ -14,7 +14,6 @@ import UpdateUserInfosArgs from '@arg/UpdateUserInfosArgs'
 import { klicktippNewsletterStateMiddleware } from '@/middleware/klicktippMiddleware'
 import { UserSettingRepository } from '@repository/UserSettingRepository'
 import { Setting } from '@enum/Setting'
-import { UserRepository } from '@repository/User'
 import { LoginEmailOptIn } from '@entity/LoginEmailOptIn'
 import { sendResetPasswordEmail } from '@/mailer/sendResetPasswordEmail'
 import { sendAccountActivationEmail } from '@/mailer/sendAccountActivationEmail'
@@ -214,8 +213,7 @@ export class UserResolver {
   @UseMiddleware(klicktippNewsletterStateMiddleware)
   async verifyLogin(@Ctx() context: any): Promise<User> {
     // TODO refactor and do not have duplicate code with login(see below)
-    const userRepository = getCustomRepository(UserRepository)
+    const userEntity = context.user
-    const userEntity = await userRepository.findByPubkeyHex(context.pubKey)
     const user = new User(userEntity)
     // user.pubkey = userEntity.pubKey.toString('hex')
     // Elopage Status & Stored PublisherId
@@ -585,8 +583,7 @@ export class UserResolver {
     }: UpdateUserInfosArgs,
     @Ctx() context: any,
   ): Promise<boolean> {
-    const userRepository = getCustomRepository(UserRepository)
+    const userEntity = context.user
-    const userEntity = await userRepository.findByPubkeyHex(context.pubKey)
 
     if (firstName) {
       userEntity.firstName = firstName
@@ -664,8 +661,7 @@ export class UserResolver {
   @Authorized([RIGHTS.HAS_ELOPAGE])
   @Query(() => Boolean)
   async hasElopage(@Ctx() context: any): Promise<boolean> {
-    const userRepository = getCustomRepository(UserRepository)
+    const userEntity = context.user
-    const userEntity = await userRepository.findByPubkeyHex(context.pubKey).catch()
     if (!userEntity) {
       return false
     }

frontend/src/graphql/queries.js

@@ -43,18 +43,8 @@ export const logout = gql`
 `
 
 export const transactionsQuery = gql`
-  query(
+  query($currentPage: Int = 1, $pageSize: Int = 25, $order: Order = DESC) {
-    $currentPage: Int = 1
+    transactionList(currentPage: $currentPage, pageSize: $pageSize, order: $order) {
-    $pageSize: Int = 25
-    $order: Order = DESC
-    $onlyCreations: Boolean = false
-  ) {
-    transactionList(
-      currentPage: $currentPage
-      pageSize: $pageSize
-      order: $order
-      onlyCreations: $onlyCreations
-    ) {
       balanceGDT
       count
       linkCount