From 943b20f21e8accc3475e0467db92cd0fb595b0fc Mon Sep 17 00:00:00 2001
From: Hongbo Wu <hongbo@omnivore.app>
Date: Tue, 13 Dec 2022 19:00:49 +0800
Subject: [PATCH 1/2] Only recommend page if the user is allowed to post

---
 .../api/src/resolvers/recommendations/index.ts   | 16 ++++++++--------
 packages/api/src/services/groups.ts              | 16 ++++++++++++++++
 2 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/packages/api/src/resolvers/recommendations/index.ts b/packages/api/src/resolvers/recommendations/index.ts
index d2fed1092..44242f534 100644
--- a/packages/api/src/resolvers/recommendations/index.ts
+++ b/packages/api/src/resolvers/recommendations/index.ts
@@ -26,6 +26,7 @@ import {
 import {
   createGroup,
   createLabelAndRuleForGroup,
+  getGroupsWhereUserCanPost,
   getInviteUrl,
   getRecommendationGroups,
   joinGroup,
@@ -187,18 +188,16 @@ export const recommendResolver = authorized<
       }
     }
 
-    const groups = await getRepository(Group).find({
-      where: { id: In(input.groupIds) },
-      relations: ['members', 'members.user'],
-    })
-    if (groups.length === 0) {
+    const page = await getPageByParam({ _id: input.pageId, userId: uid })
+    if (!page) {
       return {
         errorCodes: [RecommendErrorCode.NotFound],
       }
     }
 
-    const page = await getPageByParam({ _id: input.pageId, userId: uid })
-    if (!page) {
+    // find groups where id is in the groupIds and the user is a member of the group and the user is allowed to post
+    const groups = await getGroupsWhereUserCanPost(uid, input.groupIds)
+    if (groups.length === 0) {
       return {
         errorCodes: [RecommendErrorCode.NotFound],
       }
@@ -211,7 +210,7 @@ export const recommendResolver = authorized<
 
     const exp = Math.floor(Date.now() / 1000) + 60 * 60 * 24 // 1 day
     const auth = (await signToken({ uid, exp }, env.server.jwtSecret)) as string
-    await Promise.all(
+    const taskNames = await Promise.all(
       groups
         .map((group) =>
           group.members.map((member) =>
@@ -237,6 +236,7 @@ export const recommendResolver = authorized<
         )
         .flat()
     )
+    console.log('taskNames', taskNames)
 
     return {
       success: true,
diff --git a/packages/api/src/services/groups.ts b/packages/api/src/services/groups.ts
index 3725b3215..0c8d4826b 100644
--- a/packages/api/src/services/groups.ts
+++ b/packages/api/src/services/groups.ts
@@ -269,3 +269,19 @@ export const createLabelAndRuleForGroup = async (
 
   await Promise.all([addLabelPromise, sendNotificationPromise])
 }
+
+// find groups where id is in the groupIds and the user is a member of the group and the user is allowed to post
+export const getGroupsWhereUserCanPost = async (
+  userId: string,
+  groupIds: string[]
+): Promise<Group[]> => {
+  return getRepository(Group)
+    .createQueryBuilder('group')
+    .innerJoin('group.members', 'members1')
+    .whereInIds(groupIds)
+    .andWhere('members1.user_id = :userId', { userId })
+    .andWhere('(members1.is_admin = true OR group.only_admin_can_post = false)')
+    .innerJoinAndSelect('group.members', 'members')
+    .innerJoinAndSelect('members.user', 'user')
+    .getMany()
+}

From 83aa2093eb3181f318a56aa48c97695caf5d5eff Mon Sep 17 00:00:00 2001
From: Hongbo Wu <hongbo@omnivore.app>
Date: Tue, 13 Dec 2022 19:05:07 +0800
Subject: [PATCH 2/2] Still return admins if not allowed to see members

---
 packages/api/src/services/groups.ts | 41 +++++++++++++----------------
 1 file changed, 19 insertions(+), 22 deletions(-)

diff --git a/packages/api/src/services/groups.ts b/packages/api/src/services/groups.ts
index 0c8d4826b..dd0fb8002 100644
--- a/packages/api/src/services/groups.ts
+++ b/packages/api/src/services/groups.ts
@@ -79,17 +79,16 @@ export const getRecommendationGroups = async (
   return groupMembers.map((gm) => {
     const admins: GraphqlUser[] = []
     const members: GraphqlUser[] = []
+    // Return all members
+    gm.group.members.forEach((m) => {
+      const user = userDataToUser(m.user)
+      if (m.isAdmin) {
+        admins.push(user)
+      }
+      members.push(user)
+    })
+
     const canSeeMembers = gm.group.onlyAdminCanSeeMembers ? gm.isAdmin : true
-    if (canSeeMembers) {
-      // Return all members
-      gm.group.members.forEach((m) => {
-        const user = userDataToUser(m.user)
-        if (m.isAdmin) {
-          admins.push(user)
-        }
-        members.push(user)
-      })
-    }
 
     return {
       id: gm.group.id,
@@ -98,7 +97,7 @@ export const getRecommendationGroups = async (
       updatedAt: gm.group.updatedAt,
       inviteUrl: getInviteUrl(gm.invite),
       admins,
-      members,
+      members: canSeeMembers ? members : [],
       topics: gm.group.topics?.split(','),
       description: gm.group.description,
       canPost: gm.group.onlyAdminCanPost ? gm.isAdmin : true,
@@ -151,22 +150,20 @@ having count(*) < $4`,
   })
   const admins: GraphqlUser[] = []
   const members: GraphqlUser[] = []
-  if (!group.onlyAdminCanSeeMembers) {
-    // Return all members
-    group.members.forEach((m) => {
-      const user = userDataToUser(m.user)
-      if (m.isAdmin) {
-        admins.push(user)
-      }
-      members.push(user)
-    })
-  }
+  // Return all members
+  group.members.forEach((m) => {
+    const user = userDataToUser(m.user)
+    if (m.isAdmin) {
+      admins.push(user)
+    }
+    members.push(user)
+  })
 
   return {
     ...group,
     inviteUrl: getInviteUrl(invite),
     admins,
-    members,
+    members: group.onlyAdminCanSeeMembers ? [] : members,
     topics: group.topics?.split(','),
     description: group.description,
     canPost: !group.onlyAdminCanPost,