diff --git a/test/api/v3/integration/groups/POST-groups_groupId_reject.test.js b/test/api/v3/integration/groups/POST-groups_groupId_reject.test.js new file mode 100644 index 0000000000..27018c24fe --- /dev/null +++ b/test/api/v3/integration/groups/POST-groups_groupId_reject.test.js @@ -0,0 +1,124 @@ +import { + generateUser, + createAndPopulateGroup, + translate as t, +} from '../../../../helpers/api-v3-integration.helper'; +import { v4 as generateUUID } from 'uuid'; + +describe('POST /group/:groupId/reject-invite', () => { + it('returns error when groupId is not for a valid group', async () => { + let userToRejectInvite = await generateUser(); + + await expect(userToRejectInvite.post(`/groups/${generateUUID()}/reject-invite`)).to.eventually.be.rejected.and.eql({ + code: 404, + error: 'NotFound', + message: t('groupNotFound'), + }); + }); + + context('Rejecting a public guild invite', () => { + let publicGuild, invitedUser; + + beforeEach(async () => { + let {group, invitees} = await createAndPopulateGroup({ + groupDetails: { + name: 'Test Guild', + type: 'guild', + privacy: 'public', + }, + invites: 1, + }); + + publicGuild = group; + invitedUser = invitees[0]; + }); + + it('returns error when user is not invited', async () => { + let userWithoutInvite = await generateUser(); + + await expect(userWithoutInvite.post(`/groups/${publicGuild._id}/reject-invite`)).to.eventually.be.rejected.and.eql({ + code: 401, + error: 'NotAuthorized', + message: t('messageGroupRequiresInvite'), + }); + }); + + it('clears invitation from user', async () => { + await invitedUser.post(`/groups/${publicGuild._id}/reject-invite`); + + await expect(invitedUser.get('/user')) + .to.eventually.have.deep.property('invitations.guilds') + .to.not.include({id: publicGuild._id}); + }); + }); + + context('Rejecting a private guild invite', () => { + let invitedUser, guild; + + beforeEach(async () => { + let { group, invitees } = await createAndPopulateGroup({ + groupDetails: { + name: 'Test Guild', + type: 'guild', + privacy: 'private', + }, + invites: 1, + }); + + guild = group; + invitedUser = invitees[0]; + }); + + it('returns error when user is not invited', async () => { + let userWithoutInvite = await generateUser(); + + await expect(userWithoutInvite.post(`/groups/${guild._id}/reject-invite`)).to.eventually.be.rejected.and.eql({ + code: 401, + error: 'NotAuthorized', + message: t('messageGroupRequiresInvite'), + }); + }); + + it('clears invitation from user', async () => { + await invitedUser.post(`/groups/${guild._id}/reject-invite`); + + await expect(invitedUser.get('/user')) + .to.eventually.have.deep.property('invitations.guilds') + .to.not.include({id: guild._id}); + }); + }); + + context('Rejecting a party invite', () => { + let invitedUser, party; + + beforeEach(async () => { + let { group, invitees } = await createAndPopulateGroup({ + groupDetails: { + name: 'Test Party', + type: 'party', + }, + members: 2, + invites: 1, + }); + + party = group; + invitedUser = invitees[0]; + }); + + it('returns error when user is not invited', async () => { + let userWithoutInvite = await generateUser(); + + await expect(userWithoutInvite.post(`/groups/${party._id}/reject-invite`)).to.eventually.be.rejected.and.eql({ + code: 401, + error: 'NotAuthorized', + message: t('messageGroupRequiresInvite'), + }); + }); + + it('clears invitation from user', async () => { + await invitedUser.post(`/groups/${party._id}/reject-invite`); + + await expect(invitedUser.get('/user')).to.eventually.not.have.deep.property('invitations.party.id'); + }); + }); +}); diff --git a/website/src/controllers/api-v3/groups.js b/website/src/controllers/api-v3/groups.js index 372e0c61fc..6be847a813 100644 --- a/website/src/controllers/api-v3/groups.js +++ b/website/src/controllers/api-v3/groups.js @@ -307,6 +307,53 @@ api.joinGroup = { }, }; +/** + * @api {post} /groups/:groupId/reject Reject a group invitation + * @apiVersion 3.0.0 + * @apiName RejectGroupInvite + * @apiGroup Group + * + * @apiParam {UUID} groupId The group _id + * + * @apiSuccess {Object} group The group + */ +api.rejectGroupInvite = { + method: 'POST', + url: '/groups/:groupId/reject-invite', + middlewares: [authWithHeaders(), cron], + async handler (req, res) { + let user = res.locals.user; + + req.checkParams('groupId', res.t('groupIdRequired')).notEmpty().isUUID(); + + let validationErrors = req.validationErrors(); + if (validationErrors) throw validationErrors; + + let group = await Group.getGroup({user, groupId: req.params.groupId, optionalMembership: true}); // Do not fetch chat and work even if the user is not yet a member of the group + if (!group) throw new NotFound(res.t('groupNotFound')); + + let isUserInvited = false; + + if (group.type === 'party' && group._id === user.invitations.party.id) { + user.invitations.party = {}; + user.markModified('invitations.party'); + isUserInvited = true; + } else if (group.type === 'guild') { + let hasInvitation = removeFromArray(user.invitations.guilds, { id: group._id }); + + if (hasInvitation) { + isUserInvited = true; + } + } + + if (!isUserInvited) throw new NotAuthorized(res.t('messageGroupRequiresInvite')); + + await user.save(); + + res.respond(200, {}); + }, +}; + /** * @api {post} /groups/:groupId/leave Leave a group * @apiVersion 3.0.0