csv only for dev/admin, mail change notice

src/routes/sample.spec.ts

@@ -7,8 +7,6 @@ import TestHelper from "../test/helper";
 import mongoose from 'mongoose';
 
 
-// TODO: allowed types: tension rod, part, granulate, other
-// TODO: filter by conditions and material properties
 
 describe('/sample', () => {
   let server;
@@ -451,12 +449,12 @@ describe('/sample', () => {
         res: {status: 'Invalid body format', details: 'Measurement key not found'}
       });
     });
-    it('returns a correct csv file if specified', done => {
+    it('returns a correct csv file for admins if specified', done => {
       TestHelper.request(server, done, {
         method: 'get',
         url: '/samples?status[]=new&status[]=validated&page-size=2&csv=true',
         contentType: /text\/csv/,
-        auth: {basic: 'janedoe'},
+        auth: {basic: 'admin'},
         httpStatus: 200
       }).end((err, res) => {
         if (err) return done(err);
@@ -466,6 +464,14 @@ describe('/sample', () => {
         done();
       });
     });
+    it('rejects returning a csv file for a write user', done => {
+      TestHelper.request(server, done, {
+        method: 'get',
+        url: '/samples?status[]=new&status[]=validated&page-size=2&csv=true',
+        auth: {basic: 'janedoe'},
+        httpStatus: 403
+      });
+    });
     it('returns only the fields specified', done => {
       TestHelper.request(server, done, {
         method: 'get',

src/routes/sample.ts

@@ -34,8 +34,8 @@ router.get('/samples', async (req, res, next) => {
   const {error, value: filters} = SampleValidate.query(req.query, ['dev', 'admin'].indexOf(req.authDetails.level) >= 0);
   if (error) return res400(error, res);
 
-  // spectral data not allowed for read/write users
-  if (filters.fields.find(e => /\.dpt$/.test(e)) && !req.auth(res, ['dev', 'admin'], 'all')) return;
+  // spectral data and csv not allowed for read/write users
+  if ((filters.fields.find(e => /\.dpt$/.test(e)) || filters.csv) && !req.auth(res, ['dev', 'admin'], 'all')) return;
 
   // TODO: find a better place for these
   const sampleKeys = ['_id', 'color', 'number', 'type', 'batch', 'added', 'condition', 'material_id', 'note_id',
@@ -195,7 +195,8 @@ router.get('/samples', async (req, res, next) => {
         {$addFields: {'material.group': { $arrayElemAt: ['$material.group.name', 0]}}}
       );
     }
-    // if (sortFilterKeys.find(e => e === 'material.number')) {  // add material number if needed  // TODO: adapt code to new numbers format
+    // TODO: adapt code to new numbers format
+    // if (sortFilterKeys.find(e => e === 'material.number')) {  // add material number if needed
     //   materialQuery.push(
     //     {$addFields: {'material.number': { $arrayElemAt: [
     //       '$material.numbers.number', {$indexOfArray: ['$material.numbers.color', '$color']}
@@ -478,9 +479,6 @@ router.put('/sample/' + IdValidate.parameter(), (req, res, next) => {
     if (sample.hasOwnProperty('material_id')) {
       if (!await materialCheck(sample, res, next)) return;
     }
-    else if (sample.hasOwnProperty('color')) {
-      if (!await materialCheck(sample, res, next, sampleData.material_id)) return;
-    }
     // do not execute check if condition is and was empty
     if (sample.hasOwnProperty('condition') && !(_.isEmpty(sample.condition) && _.isEmpty(sampleData.condition))) {
       if (!await conditionCheck(sample.condition, 'change', res, next,
@@ -706,8 +704,8 @@ async function numberCheck(sample, res, next) {
 }
 
 // validate material_id and color, returns false if invalid
-async function materialCheck (sample, res, next, id = sample.material_id) {
-  const materialData = await MaterialModel.findById(id).lean().exec().catch(err => next(err)) as any;
+async function materialCheck (sample, res, next) {
+  const materialData = await MaterialModel.findById(sample.material_id).lean().exec().catch(err => next(err)) as any;
   if (materialData instanceof Error) return false;
   if (!materialData) {  // could not find material_id
     res.status(400).json({status: 'Material not available'});

src/routes/user.ts

@@ -59,9 +59,20 @@ router.put('/user:username([/](?!key|new).?*|/?)', async (req, res, next) => {
     if (!await usernameCheck(user.name, res, next)) return;
   }
 
+  // get current mail address to compare to given address
+  const {email: oldMail} = await UserModel.findOne({name: username}).lean().exec().catch(err => next(err));
+
   await UserModel.findOneAndUpdate({name: username}, user, {new: true}).log(req).lean().exec(  (err, data:any) => {
     if (err) return next(err);
     if (data) {
+      if (data.mail !== oldMail) {  // mail address was changed, send notice to old address
+        Mail.send(oldMail, 'Email change in your DeFinMa database account',
+          'Hi, <br><br> Your email address of your DeFinMa account was changed to ' + data.mail +
+          '<br><br>If you actually did this, just delete this email.' +
+          '<br><br>If you did not change your email, someone might be messing around with your account, ' +
+          'so talk to the sysadmin quickly!<br><br>Have a nice day.' +
+          '<br><br>The DeFinMa team');
+      }
       res.json(UserValidate.output(data));
     }
     else {