From 0c93ae95b4c143d0bad6cd246b68060bad878b12 Mon Sep 17 00:00:00 2001
From: Pierre HUBERT <pierre.git@communiquons.org>
Date: Sat, 25 Apr 2020 19:03:55 +0200
Subject: [PATCH] Allow non-moderator of conversation to add members

---
 src/controllers/ConversationsController.ts | 33 +++++++++++--------
 src/helpers/ConversationsHelper.ts         | 37 ++++++++++++++++++----
 2 files changed, 49 insertions(+), 21 deletions(-)

diff --git a/src/controllers/ConversationsController.ts b/src/controllers/ConversationsController.ts
index 5bed968..9f32e1e 100644
--- a/src/controllers/ConversationsController.ts
+++ b/src/controllers/ConversationsController.ts
@@ -84,6 +84,7 @@ export class ConversationsController {
 	 */
 	public static async UpdateSettings(h: RequestHandler) : Promise<void> {
 		const convID = await h.postConversationId("conversationID");
+		const isUserModerator = await ConversationsHelper.IsUserModerator(h.getUserId(), convID);
 
 		// Update following state, if required
 		if(h.hasPostParameter("following")) {
@@ -94,31 +95,35 @@ export class ConversationsController {
 			);
 		}
 	
+		// Update members list
+		if(h.hasPostParameter("members")) {
+
+			const members = h.postNumbersSet("members");
+			const canEveryoneAddMembers = await ConversationsHelper.CanEveryoneAddMembers(convID);
+
+			if(!isUserModerator && !canEveryoneAddMembers)
+				h.error(401, "You can not update the list of members of this conversation!");
+
+			// Make sure current user is on the list
+			if(!members.has(h.getUserId()))
+				members.add(h.getUserId());
+			
+			await ConversationsHelper.SetMembers(convID, members, isUserModerator);
+		}
+
 		// Change moderator settings
-		if(h.hasPostParameter("members") || h.hasPostParameter("name") || h.hasPostParameter("canEveryoneAddMembers")) {
+		if(h.hasPostParameter("name") || h.hasPostParameter("canEveryoneAddMembers")) {
 			
 			// Check if user is the moderator of the conversation
-			if(!await ConversationsHelper.IsUserModerator(h.getUserId(), convID))
+			if(!isUserModerator)
 				h.error(401, "You are not allowed to perform changes on this conversation !");
 			
-			
 			// Update conversation name (if required)
 			if(h.hasPostParameter("name")) {
 				const name = h.postString("name");
 				await ConversationsHelper.SetName(convID, name == "false" ? "" : removeHTMLNodes(name));
 			}
 
-			// Update the list of members of the conversation (if required)
-			if(h.hasPostParameter("members")) {
-				const members = h.postNumbersSet("members");
-
-				// Make sure current user is on the list
-				if(!members.has(h.getUserId()))
-					members.add(h.getUserId());
-				
-				await ConversationsHelper.SetMembers(convID, members);
-			}
-
 			// Update "canEveryoneAddMembers" parameter
 			if(h.hasPostParameter("canEveryoneAddMembers")) {
 				await ConversationsHelper.SetCanEveryoneAddMembers(convID, h.postBool("canEveryoneAddMembers"));
diff --git a/src/helpers/ConversationsHelper.ts b/src/helpers/ConversationsHelper.ts
index 2e511b7..7fce7d5 100644
--- a/src/helpers/ConversationsHelper.ts
+++ b/src/helpers/ConversationsHelper.ts
@@ -187,8 +187,9 @@ export class ConversationsHelper {
 	 * 
 	 * @param convID Target conversation ID
 	 * @param members The new list of members for the conversation
+	 * @param canDelete Set to true to perform memberships deletion
 	 */
-	public static async SetMembers(convID: number, newList: Set<number>) {
+	public static async SetMembers(convID: number, newList: Set<number>, canDelete: boolean) {
 		const currentList = await this.GetConversationMembers(convID);
 
 		// Add new members
@@ -200,12 +201,13 @@ export class ConversationsHelper {
 		}
 
 		// Remove old members
-		for(const member of currentList) {
-			if(newList.has(member))
-				continue;
-			
-			await this.RemoveMember(convID, member);
-		}
+		if(canDelete)
+			for(const member of currentList) {
+				if(newList.has(member))
+					continue;
+				
+				await this.RemoveMember(convID, member);
+			}
 	}
 
 	/**
@@ -281,6 +283,27 @@ export class ConversationsHelper {
 		})) > 0;
 	}
 
+	/**
+	 * Check out whether all the members of the conversation can
+	 * add members to it or not
+	 * 
+	 * @param convID Target conversation ID
+	 */
+	public static async	CanEveryoneAddMembers(convID: number) : Promise<boolean> {
+		const info = await DatabaseHelper.QueryRow({
+			table: LIST_TABLE,
+			where: {
+				id: convID
+			},
+			fields: ["can_everyone_add_members"]
+		});
+
+		if(info == null)
+			throw new Error("Could not find conversation!");
+		
+		return info["can_everyone_add_members"] == 1;
+	}
+
 	/**
 	 * Get the last messages of a conversation
 	 *