fix: require calendar owner or admin for booking confirm/decline. Fixes EventHub/EventHubBack#53

test/unit/booking_integration_tests.erl

@@ -2,7 +2,7 @@
 -include_lib("eunit/include/eunit.hrl").
 -include("records.hrl").
 
--define(TABLES, [user, calendar, event, booking]).
+-define(TABLES, [user, calendar, event, booking, admin]).
 
 setup() ->
   eh_test_support:start_mnesia(),

test/unit/logic_booking_tests.erl

@@ -25,6 +25,11 @@ logic_booking_test_() ->
       {"Create booking when event is full", fun test_booking_event_full/0},
       {"Pending bookings do not fill capacity", fun test_pending_does_not_fill/0},
       {"Confirm booking", fun test_confirm_booking/0},
+      {"Confirm booking as booker denied", fun test_confirm_booker_denied/0},
+      {"Confirm booking as stranger denied", fun test_confirm_stranger_denied/0},
+      {"Confirm booking as admin", fun test_confirm_booking_admin/0},
+      {"Decline booking by owner", fun test_decline_booking/0},
+      {"Decline booking as booker denied", fun test_decline_booker_denied/0},
       {"Confirm non-pending booking denied", fun test_confirm_non_pending/0},
       {"Cancel booking by participant", fun test_cancel_booking/0},
       {"Cancel booking access denied", fun test_cancel_access_denied/0},
@@ -49,6 +54,11 @@ create_test_user(Role) ->
   mnesia:dirty_write(User),
   UserId.
 
+create_test_admin() ->
+  AdminId = base64:encode(crypto:strong_rand_bytes(16), #{mode => urlsafe, padding => false}),
+  Admin = eh_test_support:seed_admin(#{id => AdminId, email => <<AdminId/binary, "@admin.test">>}),
+  Admin#admin.id.
+
 create_test_calendar(OwnerId, Confirmation) ->
   {ok, Calendar} = core_calendar:create(OwnerId, <<"Test Calendar">>, <<"">>, Confirmation),
   Calendar#calendar.id.
@@ -98,7 +108,7 @@ test_booking_event_full() ->
   EventId = create_test_event_with_capacity(CalendarId, 1),
 
   {ok, B1} = logic_booking:create_booking(Participant1Id, EventId),
-  {ok, _} = logic_booking:confirm_booking(Participant1Id, B1#booking.id, confirm),
+  {ok, _} = logic_booking:confirm_booking(OwnerId, B1#booking.id, confirm),
   {error, full} = logic_booking:create_booking(Participant2Id, EventId).
 
 test_pending_does_not_fill() ->
@@ -122,6 +132,55 @@ test_confirm_booking() ->
   {ok, Confirmed} = logic_booking:confirm_booking(OwnerId, Booking#booking.id, confirm),
   ?assertEqual(confirmed, Confirmed#booking.status).
 
+test_confirm_booker_denied() ->
+  OwnerId = create_test_user(user),
+  ParticipantId = create_test_user(user),
+  CalendarId = create_test_calendar(OwnerId, manual),
+  EventId = create_test_event(CalendarId),
+
+  {ok, Booking} = logic_booking:create_booking(ParticipantId, EventId),
+  {error, access_denied} = logic_booking:confirm_booking(ParticipantId, Booking#booking.id, confirm).
+
+test_confirm_stranger_denied() ->
+  OwnerId = create_test_user(user),
+  ParticipantId = create_test_user(user),
+  StrangerId = create_test_user(user),
+  CalendarId = create_test_calendar(OwnerId, manual),
+  EventId = create_test_event(CalendarId),
+
+  {ok, Booking} = logic_booking:create_booking(ParticipantId, EventId),
+  {error, access_denied} = logic_booking:confirm_booking(StrangerId, Booking#booking.id, confirm).
+
+test_confirm_booking_admin() ->
+  OwnerId = create_test_user(user),
+  ParticipantId = create_test_user(user),
+  AdminId = create_test_admin(),
+  CalendarId = create_test_calendar(OwnerId, manual),
+  EventId = create_test_event(CalendarId),
+
+  {ok, Booking} = logic_booking:create_booking(ParticipantId, EventId),
+  {ok, Confirmed} = logic_booking:confirm_booking(AdminId, Booking#booking.id, confirm),
+  ?assertEqual(confirmed, Confirmed#booking.status).
+
+test_decline_booking() ->
+  OwnerId = create_test_user(user),
+  ParticipantId = create_test_user(user),
+  CalendarId = create_test_calendar(OwnerId, manual),
+  EventId = create_test_event(CalendarId),
+
+  {ok, Booking} = logic_booking:create_booking(ParticipantId, EventId),
+  {ok, Declined} = logic_booking:confirm_booking(OwnerId, Booking#booking.id, decline),
+  ?assertEqual(cancelled, Declined#booking.status).
+
+test_decline_booker_denied() ->
+  OwnerId = create_test_user(user),
+  ParticipantId = create_test_user(user),
+  CalendarId = create_test_calendar(OwnerId, manual),
+  EventId = create_test_event(CalendarId),
+
+  {ok, Booking} = logic_booking:create_booking(ParticipantId, EventId),
+  {error, access_denied} = logic_booking:confirm_booking(ParticipantId, Booking#booking.id, decline).
+
 test_confirm_non_pending() ->
   OwnerId = create_test_user(user),
   ParticipantId = create_test_user(user),