feat: add optional admin capability to manage all wishlist items

README.md

@@ -125,6 +125,8 @@ LISTS_PUBLIC=false
 TABLE=true
 # Allow Markdown in item notes. Does not work with TABLE=false. Defaults to false.
 MARKDOWN=false
+# Auto archive pledges
+AUTO_ARCHIVE_PLEDGES=false
 
 ## Custom HTML Snippets
 # These are inserted into specific locations in the relevant page
@@ -147,16 +149,26 @@ MARKDOWN=false
 ## OIDC Provider Details
 # You can configure single sign-on to your Christmas Community instance using any OIDC provider.
 # Once you've created a client ID and secret in your authentication provider use the below environment variables to enable single sign on.
+# The values specified below are the defaults
 # OIDC_CLIENT_ID=
 # OIDC_CLIENT_SECRET=
 # OIDC_AUTHORIZATION_URL=https://accounts.google.com/o/oauth2/auth
 # OIDC_TOKEN_URL=https://oauth2.googleapis.com/token
 # OIDC_ISSUER=https://accounts.google.com
 # OIDC_PROVIDER_NAME=Google
-
+# OIDC_AUTO_CREATE_USER=false
 
 # Profile picture upload max size in MB
 UPLOAD_PFP_MAX_SIZE=5
+
+# Set to false to disable pledge only users from being able to suggest items to another user's list
+PLEDGE_SUGGEST=true
+
+# Set to false to disable all users from being able to suggest items to another users's list
+SUGGESTIONS_ENABLED=true
+
+## Admin users can optionally edit, archive, remove, and reorder any item on any wishlist when set to true (default: false).
+# ADMIN_CAN_EDIT_ALL_WISHLISTS=false
 ```
 
 ## Default Profile Pictures
@@ -406,4 +418,4 @@ Hi, I'm Wingy. I made this app. My website is [samwing.dev](https://samwing.dev)
 		</tr>
 	<tbody>
 </table>
-<!-- readme: contributors -end -->
+<!-- readme: contributors -end --> 

package.json

@@ -7,10 +7,11 @@
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1",
     "start": "node built/manager.js",
-    "dev": "nodemon --watch src -e ts,js --exec 'npm run build && node built/index.js'",
+    "dev": "nodemon --watch src -e ts,js,pug --exec 'npm run build && node built/index.js'",
     "postinstall": "node postinstall.cjs",
     "build": "tsc",
-    "release": "docker buildx build . --platform linux/amd64,linux/arm64 -t wingysam/christmas-community -t wingysam/christmas-community:$(./node_modules/node-jq/bin/jq -r .version < package.json) --push"
+    "release": "docker buildx build . --platform linux/amd64,linux/arm64 -t wingysam/christmas-community -t wingysam/christmas-community:$(./node_modules/node-jq/bin/jq -r .version < package.json) --push",
+    "lint": "eslint src && prettier . --write"
   },
   "author": "Wingysam <wingysam+git@gmail.com>",
   "license": "AGPL-3.0",

src/config/index.ts

@@ -39,7 +39,12 @@ const config = {
   oidcEnabled: false,
   pfpUploadMaxSize: process.env.UPLOAD_PFP_MAX_SIZE || 5,
   rootUrl: appendSlash(process.env.ROOT_URL ?? process.env.ROOT_PATH ?? '/'),
+  autoArchivePledges: process.env.AUTO_ARCHIVE_PLEDGES === 'true',
   base: '', // automatically set below
+  pledgeSuggest: (process.env.PLEDGE_SUGGEST === 'true'),
+  suggestionsEnabled: (process.env.SUGGESTIONS_ENABLED === 'true'),
+  oidcAutoCreateUser: process.env.OIDC_AUTO_CREATE_USER || false,
+  adminCanEditAllWishlists: process.env.ADMIN_CAN_EDIT_ALL_WISHLISTS|| false,
 }
 
 if (config.guestPassword) config.wishlist.public = false

src/index.ts

@@ -20,6 +20,7 @@ import config from './config/index.js'
 import PouchDB from './PouchDB.js'
 import logger from './logger.js'
 import { doDbMigrations } from './dbMigration.js'
+import ensurePfp from './utils/ensurePfp.js'
 
 // from https://github.com/ai/nanoid/blob/main/url-alphabet/index.js
 const nanoidWithoutUnderscores = customAlphabet(
@@ -98,6 +99,31 @@ if (config.oidcEnabled) {
           })
           if (docs.docs.length === 1) {
             return done(null, docs.docs[0])
+          } else if (config.oidcAutoCreateUser) {
+            // Auto-create user if enabled
+            const username =
+              profile.username ||
+              profile.displayName ||
+              profile.emails?.[0]?.value ||
+              oidcId
+            const newUser = {
+              _id: username,
+              username,
+              displayName: profile.displayName || username,
+              emails: profile.emails || [],
+              oauthConnections: { oidc: oidcId },
+              createdAt: new Date().toISOString(),
+              wishlist: [],
+              // Add any other required fields here
+            }
+            try {
+              await db.put(newUser)
+              await ensurePfp(db, config, username)
+              const createdUser = await db.get(username)
+              return done(null, createdUser)
+            } catch (err) {
+              return done(err)
+            }
           } else {
             // Handle other errors, including missing user
             return done(null, false, {

src/languages/en-us.ts

@@ -18,6 +18,7 @@ export const strings = {
   ADMIN_SETTINGS_USERS_ADD_HEADER: 'Add user',
   ADMIN_SETTINGS_USERS_ADD_PLACEHOLDER: 'john',
   ADMIN_SETTINGS_USERS_ADD_USERNAME: 'Username',
+  ADMIN_SETTINGS_USERS_ADD_PLEDGE_ONLY: 'Pledge only user?',
   ADMIN_SETTINGS_USERS_ADD_ERROR_USERNAME_EMPTY: 'Username cannot be empty.',
   ADMIN_SETTINGS_USERS_EDIT_DELETE_FAIL_ADMIN:
     'Failed to remove: user is admin.',
@@ -36,11 +37,14 @@ export const strings = {
     `${name} is now an admin.`,
   ADMIN_SETTINGS_USERS_EDIT_RENAMED_USER: 'Renamed user!',
   ADMIN_SETTINGS_USERS_EDIT_SAME_NAME: 'Username is same as new username.',
+  ADMIN_USER_EDIT_PLEDGE_ONLY: 'Pledge only',
+  ADMIN_USER_EDIT_PLEDGE_ONLY_BUTTON: 'Change pledge only',
   ADMIN_SETTINGS_USERS_EDIT: 'Edit',
   ADMIN_SETTINGS_USERS_HEADER: 'Users',
   ADMIN_SETTINGS_VERSION_INFO: 'Version Info',
   ADMIN_SETTINGS_TABLE_USERNAME: 'Username',
   ADMIN_SETTINGS_TABLE_ADMIN_USER: 'Admin',
+  ADMIN_SETTINGS_TABLE_PLEDGE_ONLY: 'Pledge only',
   ADMIN_SETTINGS_TABLE_WISHLIST_COUNT: 'Wishlist items',
   ADMIN_SETTINGS_TABLE_EDIT: 'Edit',
   ADMIN_USER_EDIT_ACCOUNT_UNCONFIRMED: "This account hasn't been confirmed.",
@@ -102,6 +106,8 @@ export const strings = {
   LOGIN_SSO_UNLINK_FAILURE: 'Failed to unlink account',
   LOGIN_SSO_LINK_FAILURE_ACCOUNT_EXISTS:
     'The external account is already linked to another account on this site!',
+  LOGIN_SSO_CREATED_USER: (username) =>
+    `Congratulations, ${username}! You've been added and automatically logged in!`,
   LOGOUT_BUTTON: 'Log Out',
   NAVBAR_ADMIN: 'Admin Settings',
   NAVBAR_LOGIN: 'Log In',
@@ -239,9 +245,19 @@ export const strings = {
   WISHLIST_URL_LABEL: `Item URL or Name (<a href="${_CC.config.base}supported-sites">Supported Sites</a>)`,
   WISHLIST_URL_PLACEHOLDER: 'https://www.amazon.com/dp/B00ZV9RDKK',
   WISHLIST_URL_REQUIRED: 'Item URL or Name is required',
+  WISHLIST_SUGGESTIONS_DISABLED : 'Suggestions are disabled.',
+  WISHLIST_ARCHIVE: 'Archive',
+  WISHLIST_RESTORE: 'Restore',
+  WISHLIST_ARCHIVED_ITEMS: 'Archived Items',
+  WISHLIST_ARCHIVE_SUCCESS: 'Successfully archived item.',
+  WISHLIST_RESTORE_SUCCESS: 'Successfully restored item.',
+  WISHLIST_ARCHIVE_GUARD: 'You are not allowed to archive this item',
+  WISHLIST_RESTORE_GUARD: 'You are not allowed to restore this item',
+  WISHLIST_DELETE_CONFIRM: 'Are you sure you want to delete this item?',
+  WISHLIST_ITEM_OPTIONS: 'Options',
   WISHLISTS_COUNTS_SELF: (name) => `${name}: ???/???`,
   WISHLISTS_COUNTS: (name, pledged, total) => `${name}: ${pledged}/${total}`,
   WISHLISTS_TITLE: `${_CC.config.siteTitle} - Wishlists`,
   YES: 'Yes',
   NO: 'No',
-} as const
+} as const

src/languages/fr-fr.ts

@@ -18,24 +18,30 @@ export const strings = {
   ADMIN_SETTINGS_USERS_ADD_HEADER: 'Ajouter un utilisateur',
   ADMIN_SETTINGS_USERS_ADD_PLACEHOLDER: 'jean',
   ADMIN_SETTINGS_USERS_ADD_USERNAME: "Nom d'utilisateur",
-  ADMIN_SETTINGS_USERS_ADD_ERROR_USERNAME_EMPTY: "Le nom d'utilisateur ne peut pas être vide.",
+  ADMIN_SETTINGS_USERS_ADD_ERROR_USERNAME_EMPTY:
+    "Le nom d'utilisateur ne peut pas être vide.",
   ADMIN_SETTINGS_USERS_EDIT_DELETE_FAIL_ADMIN:
     "Échec de la suppression : l'utilisateur est un administrateur.",
   ADMIN_SETTINGS_USERS_EDIT_DELETE_SUCCESS: (name) =>
     `Utilisateur supprimé avec succès ${name}`,
-  ADMIN_SETTINGS_USERS_EDIT_DEMOTE_NOT_ADMIN: "l'utilisateur n'est pas un administrateur",
-  ADMIN_SETTINGS_USERS_EDIT_DEMOTE_SELF: 'Vous ne pouvez pas vous supprimer vous même.',
+  ADMIN_SETTINGS_USERS_EDIT_DEMOTE_NOT_ADMIN:
+    "l'utilisateur n'est pas un administrateur",
+  ADMIN_SETTINGS_USERS_EDIT_DEMOTE_SELF:
+    'Vous ne pouvez pas vous supprimer vous même.',
   ADMIN_SETTINGS_USERS_EDIT_DEMOTE_SUCCESS: (name) =>
     `${name} n'est plus un administrateur.`,
   ADMIN_SETTINGS_USERS_EDIT_IMPERSONATE_SUCCESS: (name) =>
     `Vous êtes maintenant ${name}.`,
-  ADMIN_SETTINGS_USERS_EDIT_NO_USERNAME_PROVIDED: "Aucun nom d'utilisateur fourni",
-  ADMIN_SETTINGS_USERS_EDIT_PROMOTE_ALREADY_ADMIN: 'cet utilisateur est déjà administrateur',
+  ADMIN_SETTINGS_USERS_EDIT_NO_USERNAME_PROVIDED:
+    "Aucun nom d'utilisateur fourni",
+  ADMIN_SETTINGS_USERS_EDIT_PROMOTE_ALREADY_ADMIN:
+    'cet utilisateur est déjà administrateur',
   ADMIN_SETTINGS_USERS_EDIT_PROMOTE_DEMOTE_NOT_FOUND: 'Utilisateur non trouvé.',
   ADMIN_SETTINGS_USERS_EDIT_PROMOTE_SUCCESS: (name) =>
     `${name} est maintenant un administrateur.`,
   ADMIN_SETTINGS_USERS_EDIT_RENAMED_USER: 'Utilisateur renommé!',
-  ADMIN_SETTINGS_USERS_EDIT_SAME_NAME: "L'ancien nom d'utilisateur est le même que le nouveau nom d'utilisateur.",
+  ADMIN_SETTINGS_USERS_EDIT_SAME_NAME:
+    "L'ancien nom d'utilisateur est le même que le nouveau nom d'utilisateur.",
   ADMIN_SETTINGS_USERS_EDIT: 'Modifier',
   ADMIN_SETTINGS_USERS_HEADER: 'Utilisateurs',
   ADMIN_SETTINGS_VERSION_INFO: 'Informations sur la version',
@@ -45,7 +51,8 @@ export const strings = {
   ADMIN_SETTINGS_TABLE_EDIT: 'Modifier',
   ADMIN_USER_EDIT_ACCOUNT_UNCONFIRMED: "Ce compte n'a pas été confirmé.",
   ADMIN_USER_EDIT_ADMIN_ISADMIN: (name) => `${name} est un administrateur.`,
-  ADMIN_USER_EDIT_ADMIN_NOTADMIN: (name) => `${name} n'est pas un administrateur.`,
+  ADMIN_USER_EDIT_ADMIN_NOTADMIN: (name) =>
+    `${name} n'est pas un administrateur.`,
   ADMIN_USER_EDIT_ADMIN: 'Admin',
   ADMIN_USER_EDIT_CHANGE_NAME: 'Changer de nom',
   ADMIN_USER_EDIT_CHANGE_USERNAME: "Changer de nom d'utilisateur",
@@ -55,9 +62,11 @@ export const strings = {
   ADMIN_USER_EDIT_DELETE_USER: (name) => `Supprimer l'utilisateur ${name}`,
   ADMIN_USER_EDIT_DEMOTE_SELF: 'Vous ne pouvez pas vous rétrograder',
   ADMIN_USER_EDIT_DEMOTE: (name) => `Rétrograder ${name}`,
-  ADMIN_USER_EDIT_EDITING_USER: (name) => `Modification de l'utilisateur "${name}"`,
+  ADMIN_USER_EDIT_EDITING_USER: (name) =>
+    `Modification de l'utilisateur "${name}"`,
   ADMIN_USER_EDIT_GENERATE_NEW_LINK: 'Générer un nouveau lien',
-  ADMIN_USER_EDIT_IMPERSONATE_BUTTON: (name) => `Se connecter en tant que ${name}`,
+  ADMIN_USER_EDIT_IMPERSONATE_BUTTON: (name) =>
+    `Se connecter en tant que ${name}`,
   ADMIN_USER_EDIT_IMPERSONATE_HEADER: 'se faire passer pour',
   ADMIN_USER_EDIT_LINK_EXPIRY_FUTURE: (fromNow) =>
     `Le lien suivant expire le ${fromNow}`, // fromNow is localized by moment
@@ -71,9 +80,12 @@ export const strings = {
   ADMIN_USER_EDIT_RESET_PASSWORD_HASLINK:
     'Il y a un lien de réinitialisation de mot de passe pour cet utilisateur.',
   ADMIN_USER_EDIT_RESET_PASSWORD_HEADER: 'Réinitialiser le mot de passe',
-  ADMIN_USER_EDIT_RESET_PASSWORD_LINK_CANCEL: 'Supprimer le lien de réinitialisation du mot de passe',
-  ADMIN_USER_EDIT_RESET_PASSWORD_LINK_CREATE: 'Créer un lien de réinitialisation de mot de passe',
-  ADMIN_USER_EDIT_RESET_PASSWORD_LINK_REFRESH: 'Actualiser le lien de réinitialisation du mot de passe',
+  ADMIN_USER_EDIT_RESET_PASSWORD_LINK_CANCEL:
+    'Supprimer le lien de réinitialisation du mot de passe',
+  ADMIN_USER_EDIT_RESET_PASSWORD_LINK_CREATE:
+    'Créer un lien de réinitialisation de mot de passe',
+  ADMIN_USER_EDIT_RESET_PASSWORD_LINK_REFRESH:
+    'Actualiser le lien de réinitialisation du mot de passe',
   ADMIN_USER_EDIT_USERNAME: "Nom d'utilisateur",
   BACK_BUTTON: 'Retour',
   CONFIRM_ACCOUNT_EXPIRED:
@@ -136,7 +148,8 @@ export const strings = {
   PROFILE_PASSWORD_REQUIRED_NEW: 'Un nouveau mot de passe est requis',
   PROFILE_PASSWORD_REQUIRED_OLD: "L'ancien mot de passe est requis",
   PROFILE_PASSWORD_SUCCESS: 'Les modifications on été enregistré avec succès!',
-  PROFILE_PASSWORD_TITLE: (name) => `Paramètres de profil - Mot de passe - ${name}`,
+  PROFILE_PASSWORD_TITLE: (name) =>
+    `Paramètres de profil - Mot de passe - ${name}`,
   PROFILE_PHONE_MODEL: 'Modèle de téléphone',
   PROFILE_RING_SIZE: 'Taille de bague',
   PROFILE_SAVE_PFP_DISABLED: 'Les photos de profil sont désactivées.',
@@ -197,10 +210,12 @@ export const strings = {
   WISHLIST_ADDED_BY_GUEST: 'Utilisateur Invité',
   WISHLIST_ADDED_BY: 'Ajouté par',
   WISHLIST_ADDED_ITEM_TO_OWN_WISHLIST: "Article ajouté à la listes d'envies.",
-  WISHLIST_CONFLICT: 'Les éléments ont été ajoutés trop rapidement. Veuillez réessayer.',
+  WISHLIST_CONFLICT:
+    'Les éléments ont été ajoutés trop rapidement. Veuillez réessayer.',
   WISHLIST_DELETE: 'Supprimer',
   WISHLIST_EDIT_ITEM: "Modifier l'article",
-  WISHLIST_FETCH_FAIL: "Échec de la récupération de la liste de souhaits : l'utilisateur existe-t-il ?",
+  WISHLIST_FETCH_FAIL:
+    "Échec de la récupération de la liste de souhaits : l'utilisateur existe-t-il ?",
   WISHLIST_IMAGE: 'Image',
   WISHLIST_ITEM_MISSING: "Impossible de trouver l'article",
   WISHLIST_MOVE_DOWN: 'Descendre',

src/routes/adminSettings/index.js

@@ -38,24 +38,28 @@ export default function ({ db, ensurePfp }) {
         .then((docs) => {
           res.render('adminSettings', {
             add_user_error: _CC.lang(
-              'ADMIN_SETTINGS_USERS_ADD_ERROR_USERNAME_EMPTY',
+              'ADMIN_SETTINGS_USERS_ADD_ERROR_USERNAME_EMPTY'
             ),
             title: _CC.lang('ADMIN_SETTINGS_HEADER'),
-            users: docs.rows,
+            users: docs.rows
           })
         })
         .catch((err) => {
           throw err
         })
     }
 
+    const pledgeOnlyValue = req.body.newPledgeOnlyUser
+    const pledgeOnly =  pledgeOnlyValue === 'on'
+
     await db.put({
       _id: username,
       admin: false,
       wishlist: [],
+      pledgeOnly: pledgeOnly,
 
       signupToken: nanoid(SECRET_TOKEN_LENGTH),
-      expiry: new Date().getTime() + SECRET_TOKEN_LIFETIME,
+      expiry: new Date().getTime() + SECRET_TOKEN_LIFETIME
     })
 
     await ensurePfp(username)
@@ -156,6 +160,23 @@ export default function ({ db, ensurePfp }) {
     }
   })
 
+  router.post('/edit/pledgeOnly/:userToChange', verifyAuth(), async (req, res) => {
+
+    const newPledgeValue = req.body.editPledgeOnlyUser
+    const newPledge = newPledgeValue === 'on'
+
+    const userDoc = await db.get(req.params.userToChange)
+    userDoc.pledgeOnly = newPledge
+    try {
+      await db.put(userDoc)
+      await _CC.wishlistManager.clearCache()
+      return res.redirect(`/admin-settings/edit/${req.params.userToChange}`)
+    } catch (error) {
+      req.flash('error', error.message)
+      return res.redirect(`/admin-settings/edit/${req.params.userToChange}`)
+    }
+  })
+
   router.post(
     '/edit/impersonate/:userToEdit',
     verifyAuth(),
@@ -304,4 +325,4 @@ export default function ({ db, ensurePfp }) {
   })
 
   return router
-}
+}

src/routes/index.js

@@ -2,6 +2,7 @@ import publicRoute from '../middlewares/publicRoute.js'
 import express from 'express'
 import path from 'path'
 import fs from 'fs/promises'
+import ensurePfp from '../utils/ensurePfp.js'
 
 import Api from './api/index.js'
 import Setup from './setup/index.js'
@@ -17,27 +18,10 @@ import ManifestJson from './manifest.json/index.js'
 import OIDC from './oidc/index.js'
 
 export default ({ db, config }) => {
-  async function ensurePfp(username) {
-    if (!config.pfp) return
-    const user = await db.get(username)
-    if (user.pfp) return
-
-    const { rows } = await db.allDocs({ include_docs: true })
-
-    const unfilteredPool = await fs.readdir('src/static/img/default-pfps')
-    const filteredPool = unfilteredPool.filter(
-      (file) => !rows.find((row) => row.doc.pfp?.default === file),
-    )
-    const pool = filteredPool.length ? filteredPool : unfilteredPool
-
-    user.pfp = { default: _CC._.sample(pool) }
-    await db.put(user)
-  }
-
   ;(async () => {
     const { rows } = await db.allDocs({ include_docs: true })
     for (const row of rows) {
-      await ensurePfp(row.id)
+      await ensurePfp(db, config, row.id)
     }
   })()
 
@@ -63,7 +47,7 @@ export default ({ db, config }) => {
 
   router.use('/api', Api())
 
-  router.use('/setup', Setup({ db, ensurePfp }))
+  router.use('/setup', Setup({ db, ensurePfp: (username) => ensurePfp(db, config, username) }))
 
   router.use('/login', Login({ config }))
   router.use('/logout', Logout())
@@ -73,9 +57,9 @@ export default ({ db, config }) => {
   router.use('/wishlist', Wishlist(db))
   router.use('/supported-sites', SupportedSites())
 
-  router.use('/profile', Profile({ db, config, ensurePfp }))
+  router.use('/profile', Profile({ db, config, ensurePfp: (username) => ensurePfp(db, config, username) }))
 
-  router.use('/admin-settings', AdminSettings({ db, ensurePfp }))
+  router.use('/admin-settings', AdminSettings({ db, ensurePfp: (username) => ensurePfp(db, config, username) }))
 
   router.use('/manifest.json', ManifestJson({ config }))
 

src/routes/setup/index.js

@@ -30,6 +30,7 @@ export default function ({ db, ensurePfp }) {
               admin: true,
               wishlist: [],
               oauthConnections: {},
+              pledgeOnly: false
             })
             resolve()
           },