Jennie Robinson Faber
b7279f57d1
- Add centralized Zod schemas (server/utils/schemas.js) and validateBody utility for all API endpoints - Fix critical mass assignment in member creation: raw body no longer passed to new Member(), only validated fields (email, name, circle, contributionTier) are accepted - Apply Zod validation to login, profile patch, event registration, updates, verify-payment, and admin event creation endpoints - Fix logout cookie flags to match login (httpOnly: true, secure conditional on NODE_ENV) - Delete unauthenticated test/debug endpoints (test-connection, test-subscription, test-bot) - Remove sensitive console.log statements from Helcim and member endpoints - Remove unused bcryptjs dependency - Add 10MB file size limit on image uploads - Use runtime config for JWT secret across all endpoints - Add 38 validation tests (117 total, all passing)
113 lines
No EOL
3.4 KiB
JavaScript
113 lines
No EOL
3.4 KiB
JavaScript
// server/api/members/create.post.js
|
|
import Member from '../../models/member.js'
|
|
import { connectDB } from '../../utils/mongoose.js'
|
|
import { getSlackService } from '../../utils/slack.ts'
|
|
import { validateBody } from '../../utils/validateBody.js'
|
|
import { memberCreateSchema } from '../../utils/schemas.js'
|
|
// Simple payment check function to avoid import issues
|
|
const requiresPayment = (contributionValue) => contributionValue !== '0'
|
|
|
|
// Function to invite member to Slack
|
|
async function inviteToSlack(member) {
|
|
try {
|
|
const slackService = getSlackService()
|
|
if (!slackService) {
|
|
console.warn('Slack service not configured, skipping invitation')
|
|
return
|
|
}
|
|
|
|
console.warn(`Processing Slack invitation for member`)
|
|
|
|
const inviteResult = await slackService.inviteUserToSlack(
|
|
member.email,
|
|
member.name
|
|
)
|
|
|
|
if (inviteResult.success) {
|
|
// Update member record based on the actual result
|
|
if (inviteResult.status === 'existing_user_added_to_channel' ||
|
|
inviteResult.status === 'user_already_in_channel' ||
|
|
inviteResult.status === 'new_user_invited_to_workspace') {
|
|
member.slackInviteStatus = 'sent'
|
|
member.slackUserId = inviteResult.userId
|
|
member.slackInvited = true
|
|
} else {
|
|
// Manual invitation required
|
|
member.slackInviteStatus = 'pending'
|
|
member.slackInvited = false
|
|
}
|
|
await member.save()
|
|
|
|
// Send notification to vetting channel
|
|
await slackService.notifyNewMember(
|
|
member.name,
|
|
member.email,
|
|
member.circle,
|
|
member.contributionTier,
|
|
inviteResult.status
|
|
)
|
|
|
|
console.warn(`Slack invitation processed: ${inviteResult.status}`)
|
|
} else {
|
|
// Update member record to reflect failed invitation
|
|
member.slackInviteStatus = 'failed'
|
|
await member.save()
|
|
|
|
console.error(`Failed to process Slack invitation: ${inviteResult.error}`)
|
|
// Don't throw error - member creation should still succeed
|
|
}
|
|
} catch (error) {
|
|
console.error('Error during Slack invitation process:', error)
|
|
|
|
// Update member record to reflect failed invitation
|
|
try {
|
|
member.slackInviteStatus = 'failed'
|
|
await member.save()
|
|
} catch (saveError) {
|
|
console.error('Failed to update member Slack status:', saveError)
|
|
}
|
|
|
|
// Don't throw error - member creation should still succeed
|
|
}
|
|
}
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
// Ensure database is connected
|
|
await connectDB()
|
|
|
|
const validatedData = await validateBody(event, memberCreateSchema)
|
|
|
|
try {
|
|
// Check if member already exists
|
|
const existingMember = await Member.findOne({ email: validatedData.email })
|
|
if (existingMember) {
|
|
throw createError({
|
|
statusCode: 409,
|
|
statusMessage: 'A member with this email already exists'
|
|
})
|
|
}
|
|
|
|
const member = new Member(validatedData)
|
|
await member.save()
|
|
|
|
// Send Slack invitation for new members
|
|
await inviteToSlack(member)
|
|
|
|
// TODO: Process payment with Helcim if not free tier
|
|
if (requiresPayment(validatedData.contributionTier)) {
|
|
// Payment processing will be added here
|
|
}
|
|
|
|
// TODO: Send welcome email
|
|
|
|
return { success: true, member }
|
|
} catch (error) {
|
|
if (error.statusCode) {
|
|
throw error
|
|
}
|
|
throw createError({
|
|
statusCode: 400,
|
|
statusMessage: error.message
|
|
})
|
|
}
|
|
}) |