Users can request invites to organizations

api/src/affiliation/mutations/index.js

@@ -1,5 +1,6 @@
 export * from './invite-user-to-org'
 export * from './leave-organization'
 export * from './remove-user-from-org'
+export * from './request-org-affiliation'
 export * from './transfer-org-ownership'
 export * from './update-user-role'

api/src/affiliation/mutations/remove-user-from-org.js

@@ -1,14 +1,13 @@
-import {GraphQLNonNull, GraphQLID} from 'graphql'
-import {mutationWithClientMutationId, fromGlobalId} from 'graphql-relay'
-import {t} from '@lingui/macro'
+import { GraphQLNonNull, GraphQLID } from 'graphql'
+import { mutationWithClientMutationId, fromGlobalId } from 'graphql-relay'
+import { t } from '@lingui/macro'
 
-import {removeUserFromOrgUnion} from '../unions'
+import { removeUserFromOrgUnion } from '../unions'
 import { logActivity } from '../../audit-logs/mutations/log-activity'
 
 export const removeUserFromOrg = new mutationWithClientMutationId({
   name: 'RemoveUserFromOrg',
-  description:
-    'This mutation allows admins or higher to remove users from any organizations they belong to.',
+  description: 'This mutation allows admins or higher to remove users from any organizations they belong to.',
   inputFields: () => ({
     userId: {
       type: GraphQLNonNull(GraphQLID),
@@ -35,20 +34,20 @@ export const removeUserFromOrg = new mutationWithClientMutationId({
       collections,
       transaction,
       userKey,
-      auth: {checkPermission, userRequired, verifiedRequired, tfaRequired},
-      loaders: {loadOrgByKey, loadUserByKey},
-      validators: {cleanseInput},
+      auth: { checkPermission, userRequired, verifiedRequired, tfaRequired },
+      loaders: { loadOrgByKey, loadUserByKey },
+      validators: { cleanseInput },
     },
   ) => {
     // Cleanse Input
-    const {id: requestedUserKey} = fromGlobalId(cleanseInput(args.userId))
-    const {id: requestedOrgKey} = fromGlobalId(cleanseInput(args.orgId))
+    const { id: requestedUserKey } = fromGlobalId(cleanseInput(args.userId))
+    const { id: requestedOrgKey } = fromGlobalId(cleanseInput(args.orgId))
 
     // Get requesting user
     const user = await userRequired()
 
-    verifiedRequired({user})
-    tfaRequired({user})
+    verifiedRequired({ user })
+    tfaRequired({ user })
 
     // Get requested org
     const requestedOrg = await loadOrgByKey.load(requestedOrgKey)
@@ -59,14 +58,12 @@ export const removeUserFromOrg = new mutationWithClientMutationId({
       return {
         _type: 'error',
         code: 400,
-        description: i18n._(
-          t`Unable to remove user from unknown organization.`,
-        ),
+        description: i18n._(t`Unable to remove user from unknown organization.`),
       }
     }
 
     // Check requesting users permission
-    const permission = await checkPermission({orgId: requestedOrg._id})
+    const permission = await checkPermission({ orgId: requestedOrg._id })
     if (permission === 'user' || typeof permission === 'undefined') {
       console.warn(
         `User: ${userKey} attempted to remove user: ${requestedUserKey} from org: ${requestedOrg._key}, however they do not have the permission to remove users.`,
@@ -87,9 +84,7 @@ export const removeUserFromOrg = new mutationWithClientMutationId({
       return {
         _type: 'error',
         code: 400,
-        description: i18n._(
-          t`Unable to remove unknown user from organization.`,
-        ),
+        description: i18n._(t`Unable to remove unknown user from organization.`),
       }
     }
 
@@ -106,11 +101,7 @@ export const removeUserFromOrg = new mutationWithClientMutationId({
       console.error(
         `Database error occurred when user: ${userKey} attempted to check the current permission of user: ${requestedUser._key} to see if they could be removed: ${err}`,
       )
-      throw new Error(
-        i18n._(
-          t`Unable to remove user from this organization. Please try again.`,
-        ),
-      )
+      throw new Error(i18n._(t`Unable to remove user from this organization. Please try again.`))
     }
 
     if (affiliationCursor.count < 1) {
@@ -120,9 +111,7 @@ export const removeUserFromOrg = new mutationWithClientMutationId({
       return {
         _type: 'error',
         code: 400,
-        description: i18n._(
-          t`Unable to remove a user that already does not belong to this organization.`,
-        ),
+        description: i18n._(t`Unable to remove a user that already does not belong to this organization.`),
       }
     }
 
@@ -133,20 +122,13 @@ export const removeUserFromOrg = new mutationWithClientMutationId({
       console.error(
         `Cursor error occurred when user: ${userKey} attempted to check the current permission of user: ${requestedUser._key} to see if they could be removed: ${err}`,
       )
-      throw new Error(
-        i18n._(
-          t`Unable to remove user from this organization. Please try again.`,
-        ),
-      )
+      throw new Error(i18n._(t`Unable to remove user from this organization. Please try again.`))
     }
 
     let canRemove
-    if (
-      permission === 'super_admin' &&
-      (affiliation.permission === 'admin' || affiliation.permission === 'user')
-    ) {
+    if (permission === 'super_admin' && ['pending', 'user', 'admin'].includes(affiliation.permission)) {
       canRemove = true
-    } else if (permission === 'admin' && affiliation.permission === 'user') {
+    } else if (permission === 'admin' && ['pending', 'user'].includes(affiliation.permission)) {
       canRemove = true
     } else {
       canRemove = false
@@ -171,11 +153,7 @@ export const removeUserFromOrg = new mutationWithClientMutationId({
         console.error(
           `Trx step error occurred when user: ${userKey} attempted to remove user: ${requestedUser._key} from org: ${requestedOrg._key}, error: ${err}`,
         )
-        throw new Error(
-          i18n._(
-            t`Unable to remove user from this organization. Please try again.`,
-          ),
-        )
+        throw new Error(i18n._(t`Unable to remove user from this organization. Please try again.`))
       }
 
       try {
@@ -184,16 +162,10 @@ export const removeUserFromOrg = new mutationWithClientMutationId({
         console.error(
           `Trx commit error occurred when user: ${userKey} attempted to remove user: ${requestedUser._key} from org: ${requestedOrg._key}, error: ${err}`,
         )
-        throw new Error(
-          i18n._(
-            t`Unable to remove user from this organization. Please try again.`,
-          ),
-        )
+        throw new Error(i18n._(t`Unable to remove user from this organization. Please try again.`))
       }
 
-      console.info(
-        `User: ${userKey} successfully removed user: ${requestedUser._key} from org: ${requestedOrg._key}.`,
-      )
+      console.info(`User: ${userKey} successfully removed user: ${requestedUser._key} from org: ${requestedOrg._key}.`)
       await logActivity({
         transaction,
         collections,
@@ -229,9 +201,7 @@ export const removeUserFromOrg = new mutationWithClientMutationId({
       return {
         _type: 'error',
         code: 400,
-        description: i18n._(
-          t`Permission Denied: Please contact organization admin for help with removing users.`,
-        ),
+        description: i18n._(t`Permission Denied: Please contact organization admin for help with removing users.`),
       }
     }
   },

api/src/affiliation/mutations/request-org-affiliation.js

@@ -0,0 +1,201 @@
+import { GraphQLNonNull, GraphQLID } from 'graphql'
+import { mutationWithClientMutationId, fromGlobalId } from 'graphql-relay'
+import { t } from '@lingui/macro'
+
+import { inviteUserToOrgUnion } from '../unions'
+import { logActivity } from '../../audit-logs/mutations/log-activity'
+
+export const requestOrgAffiliation = new mutationWithClientMutationId({
+  name: 'RequestOrgAffiliation',
+  description: `This mutation allows users to request to join an organization.`,
+  inputFields: () => ({
+    orgId: {
+      type: GraphQLNonNull(GraphQLID),
+      description: 'The organization you wish to invite the user to.',
+    },
+  }),
+  outputFields: () => ({
+    result: {
+      type: inviteUserToOrgUnion,
+      description:
+        '`InviteUserToOrgUnion` returning either a `InviteUserToOrgResult`, or `InviteUserToOrgError` object.',
+      resolve: (payload) => payload,
+    },
+  }),
+  mutateAndGetPayload: async (
+    args,
+    {
+      i18n,
+      query,
+      request,
+      collections,
+      transaction,
+      userKey,
+      auth: { userRequired, verifiedRequired },
+      loaders: { loadOrgByKey, loadUserByKey },
+      notify: { sendInviteRequestEmail },
+      validators: { cleanseInput },
+    },
+  ) => {
+    const { id: orgId } = fromGlobalId(cleanseInput(args.orgId))
+
+    // Get requesting user
+    const user = await userRequired()
+    verifiedRequired({ user })
+
+    // Check to see if requested org exists
+    const org = await loadOrgByKey.load(orgId)
+
+    if (typeof org === 'undefined') {
+      console.warn(
+        `User: ${userKey} attempted to request invite to org: ${orgId} however there is no org associated with that id.`,
+      )
+      return {
+        _type: 'error',
+        code: 400,
+        description: i18n._(t`Unable to request invite to unknown organization.`),
+      }
+    }
+
+    // Check to see if user is already a member of the org
+    let affiliationCursor
+    try {
+      affiliationCursor = await query`
+        FOR v, e IN 1..1 OUTBOUND ${org._id} affiliations
+          FILTER e._to == ${user._id}
+          RETURN e
+      `
+    } catch (err) {
+      console.error(
+        `Database error occurred when user: ${userKey} attempted to request invite to ${orgId}, error: ${err}`,
+      )
+      throw new Error(i18n._(t`Unable to request invite. Please try again.`))
+    }
+
+    if (affiliationCursor.count > 0) {
+      const requestedAffiliation = await affiliationCursor.next()
+      if (requestedAffiliation.permission === 'pending') {
+        console.warn(
+          `User: ${userKey} attempted to request invite to org: ${orgId} however they have already requested to join that org.`,
+        )
+        return {
+          _type: 'error',
+          code: 400,
+          description: i18n._(
+            t`Unable to request invite to organization with which you have already requested to join.`,
+          ),
+        }
+      } else {
+        console.warn(
+          `User: ${userKey} attempted to request invite to org: ${orgId} however they are already affiliated with that org.`,
+        )
+        return {
+          _type: 'error',
+          code: 400,
+          description: i18n._(t`Unable to request invite to organization with which you are already affiliated.`),
+        }
+      }
+    }
+
+    // Setup Transaction
+    const trx = await transaction(collections)
+
+    // Create pending affiliation
+    try {
+      await trx.step(
+        () =>
+          query`
+            WITH affiliations, organizations, users
+            INSERT {
+              _from: ${org._id},
+              _to: ${user._id},
+              permission: "pending",
+              owner: false
+            } INTO affiliations
+          `,
+      )
+    } catch (err) {
+      console.error(
+        `Transaction step error occurred while user: ${userKey} attempted to request invite to org: ${org.slug}, error: ${err}`,
+      )
+      throw new Error(i18n._(t`Unable to request invite. Please try again.`))
+    }
+
+    // get all org admins
+    let orgAdminsCursor
+    try {
+      orgAdminsCursor = await query`
+        WITH affiliations, organizations, users
+        FOR v, e IN 1..1 OUTBOUND ${org._id} affiliations
+          FILTER e.permission == "admin"
+          RETURN v._key
+      `
+    } catch (err) {
+      console.error(
+        `Database error occurred when user: ${userKey} attempted to request invite to ${orgId}, error: ${err}`,
+      )
+      throw new Error(i18n._(t`Unable to request invite. Please try again.`))
+    }
+
+    let orgAdmins
+    try {
+      orgAdmins = await orgAdminsCursor.all()
+    } catch (err) {
+      console.error(
+        `Cursor error occurred when user: ${userKey} attempted to request invite to ${orgId}, error: ${err}`,
+      )
+      throw new Error(i18n._(t`Unable to request invite. Please try again.`))
+    }
+
+    if (orgAdmins.length > 0) {
+      const adminLink = `https://${request.get('host')}/admin/organizations`
+      // send notification to org admins
+      for (const userKey of orgAdmins) {
+        const adminUser = await loadUserByKey.load(userKey)
+        await sendInviteRequestEmail({ user: adminUser, orgName: org.name, adminLink })
+      }
+    }
+
+    // Commit Transaction
+    try {
+      await trx.commit()
+    } catch (err) {
+      console.error(
+        `Transaction commit error occurred while user: ${userKey} attempted to request invite to org: ${org.slug}, error: ${err}`,
+      )
+      throw new Error(i18n._(t`Unable to request invite. Please try again.`))
+    }
+
+    console.info(`User: ${userKey} successfully requested invite to the org: ${org.slug}.`)
+    await logActivity({
+      transaction,
+      collections,
+      query,
+      initiatedBy: {
+        id: user._key,
+        userName: user.userName,
+      },
+      action: 'add',
+      target: {
+        resource: user.userName,
+        organization: {
+          id: org._key,
+          name: org.name,
+        }, // name of resource being acted upon
+        updatedProperties: [
+          {
+            name: 'permission',
+            oldValue: null,
+            newValue: 'pending',
+          },
+        ],
+        resourceType: 'user', // user, org, domain
+      },
+    })
+
+    return {
+      _type: 'regular',
+      status: i18n._(t`Successfully requested invite to organization, and sent notification email.`),
+    }
+  },
+})