Expose organization details and email updates

src/controllers/locations.js

@@ -33,6 +33,7 @@ const locationAssociations = {
   include: [
     {
       model: models.Organization,
+      attributes: models.Organization.getPublicAttributes(),
       include: [models.Phone],
     },
     models.Phone,

src/controllers/organizations.js

@@ -4,6 +4,15 @@ import models from '../models';
 import { updateInstance, createInstance } from '../services/data-changes';
 import { NotFoundError } from '../utils/errors';
 
+const normalizeEmail = (email) => {
+  if (email == null) {
+    return email;
+  }
+
+  const trimmedEmail = email.trim();
+  return trimmedEmail || null;
+};
+
 export default {
   find: async (req, res, next) => {
     try {
@@ -12,7 +21,9 @@ export default {
       const { searchString } = req.query;
       const filterParameters = searchString ? { searchString: searchString.trim() } : {};
 
-      const organizations = await models.Organization.findMatching(filterParameters);
+      const organizations = await models.Organization.findMatching(filterParameters, 10, {
+        attributes: models.Organization.getPublicAttributes(),
+      });
       res.send(organizations);
     } catch (err) {
       next(err);
@@ -26,14 +37,17 @@ export default {
       const {
         name,
         description,
+        email: rawEmail,
         url,
         metadata,
       } = req.body;
+      const email = normalizeEmail(rawEmail);
 
       const modelCreateFunction = models.Organization.create.bind(models.Organization);
       const createdOrganization = await createInstance(req.user, modelCreateFunction, {
         name,
         description,
+        email,
         url,
       }, { metadata });
 
@@ -54,12 +68,16 @@ export default {
         throw new NotFoundError('Organization not found');
       }
 
-      const editableFields = ['name', 'description', 'url'];
-      const { metadata, ...updateParams } = req.body;
+      const editableFields = ['name', 'description', 'email', 'url'];
+      const { metadata, email, ...updateParams } = req.body;
+      const normalizedUpdateParams = email === undefined ? updateParams : {
+        ...updateParams,
+        email: normalizeEmail(email),
+      };
       await updateInstance(
         req.user,
         organization,
-        updateParams,
+        normalizedUpdateParams,
         { fields: editableFields, metadata },
       );
 
@@ -104,4 +122,20 @@ export default {
       next(err);
     }
   },
+
+  get: async (req, res, next) => {
+    try {
+      await Joi.validate(req, organizationSchemas.get, { allowUnknown: true });
+
+      const { organizationId } = req.params;
+      const organization = await models.Organization.findByPk(organizationId);
+      if (!organization) {
+        throw new NotFoundError('Organization not found');
+      }
+
+      res.send(organization);
+    } catch (err) {
+      next(err);
+    }
+  },
 };

src/controllers/validation/organizations.js

@@ -4,6 +4,7 @@ const updateMetadataSchema = Joi.object().keys({
   source: Joi.string(),
   lastUpdated: Joi.date().iso(),
 });
+const emailSchema = Joi.string().trim().email().allow('', null);
 
 export default {
   find: {
@@ -16,6 +17,7 @@ export default {
     body: Joi.object().keys({
       name: Joi.string().required(),
       description: Joi.string(),
+      email: emailSchema,
       url: Joi.string(),
       metadata: updateMetadataSchema,
     }).required(),
@@ -28,11 +30,18 @@ export default {
     body: Joi.object().keys({
       name: Joi.string(),
       description: Joi.string().allow(''),
+      email: emailSchema,
       url: Joi.string().allow(''),
       metadata: updateMetadataSchema,
     }).required(),
   },
 
+  get: {
+    params: Joi.object().keys({
+      organizationId: Joi.string().guid().required(),
+    }).required(),
+  },
+
   getLocations: {
     params: Joi.object().keys({
       organizationId: Joi.string().guid().required(),

src/models/location.js

@@ -594,7 +594,10 @@ module.exports = (sequelize, DataTypes, Op) => {
         ],
       },
     ] : [
-      sequelize.models.Organization,
+      {
+        model: sequelize.models.Organization,
+        attributes: sequelize.models.Organization.getPublicAttributes(),
+      },
       sequelize.models.EventRelatedInfo,
       {
         model: sequelize.models.Service,

src/models/organization.js

@@ -31,16 +31,20 @@ module.exports = (sequelize, DataTypes, Op) => {
     Organization.hasMany(models.Phone, { foreignKey: 'organization_id' });
   };
 
-  Organization.findMatching = (filterParameters, limit = 10) => {
+  Organization.findMatching = (filterParameters, limit = 10, queryOptions = {}) => {
     const { searchString } = filterParameters;
 
     const where = {};
     if (searchString) {
       where.name = { [Op.iLike]: `%${searchString}%` };
     }
 
-    return Organization.findAll({ limit, where });
+    return Organization.findAll({ limit, where, ...queryOptions });
   };
 
+  Organization.getPublicAttributes = () => ({
+    exclude: ['email'],
+  });
+
   return Organization;
 };

src/routes.js

@@ -18,6 +18,7 @@ import {
 
 export default (app) => {
   app.get('/organizations', organizations.find);
+  app.get('/organizations/:organizationId', getUser, organizations.get);
   app.post('/organizations', getUser, dataEntryAuth, organizations.create);
   app.patch('/organizations/:organizationId', getUser, dataEntryAuth, organizations.update);
   app.get('/organizations/:organizationId/locations', organizations.getLocations);

test/integration/__snapshots__/get-location-info.test.js.snap

@@ -7,7 +7,6 @@ Object {
   "Organization": Object {
     "Phones": Object {},
     "description": "An organization meant for testing purposes.",
-    "email": null,
     "name": "The Test Org",
     "url": "www.streetlives.com",
   },

test/integration/create-organization.test.js

@@ -29,6 +29,22 @@ describe('create organization', () => {
     expect(dbOrg).toHaveProperty('url', orgParams.url);
   });
 
+  it('should trim and persist a valid email address', async () => {
+    await request(app)
+      .post('/organizations')
+      .send({ ...orgParams, name: 'Org With Email', email: '  intake@streetlives.org  ' })
+      .expect(201);
+
+    const dbOrg = await models.Organization.findOne({ where: { name: 'Org With Email' } });
+    expect(dbOrg).toHaveProperty('email', 'intake@streetlives.org');
+  });
+
+  it('should reject an invalid email address', () =>
+    request(app)
+      .post('/organizations')
+      .send({ ...orgParams, name: 'Org With Invalid Email', email: 'not-an-email' })
+      .expect(400));
+
   describe('when no custom metadata is specified', () => {
     it('should create metadata with current time as the last action date', async () => {
       const startTime = Date.now();

test/integration/find-locations.test.js

@@ -53,6 +53,7 @@ describe('find locations', () => {
       {
         name: 'The Test Org',
         description: 'An organization meant for testing purposes.',
+        email: 'contact@streetlives.org',
         Services: [
           {
             name: 'A specific offering',
@@ -209,6 +210,21 @@ describe('find locations', () => {
       .expect(200)
       .then(expectMatchNearbyLocations));
 
+  it('should not expose organization email in public location results', () =>
+    request(app)
+      .get('/locations')
+      .query({
+        latitude: originLatitude,
+        longitude: originLongitude,
+        radius,
+      })
+      .expect(200)
+      .then((res) => {
+        res.body.forEach((returnedLocation) => {
+          expect(returnedLocation.Organization).not.toHaveProperty('email');
+        });
+      }));
+
   it('should not return locations marked "hidden from search" (meant for comments only)', () =>
     request(app)
       .get('/locations')

test/integration/get-location-info.test.js

@@ -13,6 +13,7 @@ describe('get location info', () => {
     {
       name: 'The Test Org',
       description: 'An organization meant for testing purposes.',
+      email: 'contact@streetlives.org',
       url: 'www.streetlives.com',
       Services: [{
         name: 'A specific offering',
@@ -86,6 +87,7 @@ describe('get location info', () => {
       .get(`/locations/${location.id}`)
       .expect(200)
       .then((res) => {
+        expect(res.body.Organization).not.toHaveProperty('email');
         const strippedFields = stripTimestampsAndIds(res.body);
         expect(strippedFields).toMatchSnapshot();
       }));

test/integration/get-organizations.test.js

@@ -0,0 +1,40 @@
+/**
+ * @jest-environment node
+ */
+
+import request from 'supertest';
+import app from '../../src/app';
+import models from '../../src/models';
+
+describe('get organizations', () => {
+  let organization;
+
+  beforeEach(async () => {
+    organization = await models.Organization.create({
+      name: 'Organization With Email',
+      description: 'An organization used to test public/private payloads.',
+      email: 'contact@streetlives.org',
+      url: 'www.streetlives.com',
+    });
+  });
+
+  afterEach(() => models.Organization.destroy({ where: {} }));
+
+  it('should not expose email in the public organizations list', async () => {
+    const res = await request(app)
+      .get('/organizations')
+      .expect(200);
+
+    const returnedOrganization = res.body.find(org => org.id === organization.id);
+    expect(returnedOrganization).toBeDefined();
+    expect(returnedOrganization).not.toHaveProperty('email');
+  });
+
+  it('should return email when fetching a specific organization', async () => {
+    const res = await request(app)
+      .get(`/organizations/${organization.id}`)
+      .expect(200);
+
+    expect(res.body).toHaveProperty('email', organization.email);
+  });
+});

test/integration/update-organization.test.js

@@ -0,0 +1,51 @@
+/**
+ * @jest-environment node
+ */
+
+import request from 'supertest';
+import app from '../../src/app';
+import models from '../../src/models';
+
+describe('update organization', () => {
+  let organization;
+
+  beforeEach(async () => {
+    organization = await models.Organization.create({
+      name: 'Existing Org',
+      description: 'An organization for update tests.',
+      email: 'existing@streetlives.org',
+      url: 'www.streetlives.com',
+    });
+  });
+
+  afterEach(() => Promise.all([
+    models.Organization.destroy({ where: {} }),
+    models.Metadata.destroy({ where: {} }),
+  ]));
+
+  it('should trim and persist a valid email address', async () => {
+    await request(app)
+      .patch(`/organizations/${organization.id}`)
+      .send({ email: '  updated@streetlives.org  ' })
+      .expect(204);
+
+    const updatedOrganization = await models.Organization.findByPk(organization.id);
+    expect(updatedOrganization).toHaveProperty('email', 'updated@streetlives.org');
+  });
+
+  it('should clear email when updated with a blank string', async () => {
+    await request(app)
+      .patch(`/organizations/${organization.id}`)
+      .send({ email: '   ' })
+      .expect(204);
+
+    const updatedOrganization = await models.Organization.findByPk(organization.id);
+    expect(updatedOrganization).toHaveProperty('email', null);
+  });
+
+  it('should reject an invalid email address', () =>
+    request(app)
+      .patch(`/organizations/${organization.id}`)
+      .send({ email: 'invalid-email' })
+      .expect(400));
+});