From 943b20f21e8accc3475e0467db92cd0fb595b0fc Mon Sep 17 00:00:00 2001
From: Hongbo Wu <hongbo@omnivore.app>
Date: Tue, 13 Dec 2022 19:00:49 +0800
Subject: [PATCH] Only recommend page if the user is allowed to post

---
 .../api/src/resolvers/recommendations/index.ts   | 16 ++++++++--------
 packages/api/src/services/groups.ts              | 16 ++++++++++++++++
 2 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/packages/api/src/resolvers/recommendations/index.ts b/packages/api/src/resolvers/recommendations/index.ts
index d2fed1092..44242f534 100644
--- a/packages/api/src/resolvers/recommendations/index.ts
+++ b/packages/api/src/resolvers/recommendations/index.ts
@@ -26,6 +26,7 @@ import {
 import {
   createGroup,
   createLabelAndRuleForGroup,
+  getGroupsWhereUserCanPost,
   getInviteUrl,
   getRecommendationGroups,
   joinGroup,
@@ -187,18 +188,16 @@ export const recommendResolver = authorized<
       }
     }
 
-    const groups = await getRepository(Group).find({
-      where: { id: In(input.groupIds) },
-      relations: ['members', 'members.user'],
-    })
-    if (groups.length === 0) {
+    const page = await getPageByParam({ _id: input.pageId, userId: uid })
+    if (!page) {
       return {
         errorCodes: [RecommendErrorCode.NotFound],
       }
     }
 
-    const page = await getPageByParam({ _id: input.pageId, userId: uid })
-    if (!page) {
+    // find groups where id is in the groupIds and the user is a member of the group and the user is allowed to post
+    const groups = await getGroupsWhereUserCanPost(uid, input.groupIds)
+    if (groups.length === 0) {
       return {
         errorCodes: [RecommendErrorCode.NotFound],
       }
@@ -211,7 +210,7 @@ export const recommendResolver = authorized<
 
     const exp = Math.floor(Date.now() / 1000) + 60 * 60 * 24 // 1 day
     const auth = (await signToken({ uid, exp }, env.server.jwtSecret)) as string
-    await Promise.all(
+    const taskNames = await Promise.all(
       groups
         .map((group) =>
           group.members.map((member) =>
@@ -237,6 +236,7 @@ export const recommendResolver = authorized<
         )
         .flat()
     )
+    console.log('taskNames', taskNames)
 
     return {
       success: true,
diff --git a/packages/api/src/services/groups.ts b/packages/api/src/services/groups.ts
index 3725b3215..0c8d4826b 100644
--- a/packages/api/src/services/groups.ts
+++ b/packages/api/src/services/groups.ts
@@ -269,3 +269,19 @@ export const createLabelAndRuleForGroup = async (
 
   await Promise.all([addLabelPromise, sendNotificationPromise])
 }
+
+// find groups where id is in the groupIds and the user is a member of the group and the user is allowed to post
+export const getGroupsWhereUserCanPost = async (
+  userId: string,
+  groupIds: string[]
+): Promise<Group[]> => {
+  return getRepository(Group)
+    .createQueryBuilder('group')
+    .innerJoin('group.members', 'members1')
+    .whereInIds(groupIds)
+    .andWhere('members1.user_id = :userId', { userId })
+    .andWhere('(members1.is_admin = true OR group.only_admin_can_post = false)')
+    .innerJoinAndSelect('group.members', 'members')
+    .innerJoinAndSelect('members.user', 'user')
+    .getMany()
+}