From 349686e1826f5f64c4377cd33821787533117964 Mon Sep 17 00:00:00 2001 From: joshua Date: Thu, 23 Jul 2026 16:51:10 +0200 Subject: [PATCH] Block self-service payment and cancellation on closed/past registrations Extends the earlier user-dashboard fix: canEditActive is renamed canModifyActive and now also gates the "Make payment" and "Cancel registration" actions, not just editing. Backend enforcement added to cancelRegistration and createYocoCheckout to block past-event self-service payment/cancellation server-side (cashup-closed events were already blocked via assertEventOpen; admins/supervisors are exempt from the past-date check, consistent with existing overrides). Co-Authored-By: Claude Sonnet 5 --- CHANGELOG.md | 2 +- backend/src/controllers/paymentController.js | 6 +++++- backend/src/controllers/registrationController.js | 9 ++++++++- frontend/src/app/dashboard/user/page.tsx | 12 +++++++----- 4 files changed, 21 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bf0e723..1d0496e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,7 +10,7 @@ and this project follows [Semantic Versioning](https://semver.org/). ### Fixed - User dashboard: registration-edit errors now show inside the edit popup instead of being hidden behind it. -- User dashboard: closed events are now hidden by default alongside past events (revealed via "Show past events"), and the Edit button no longer appears for closed or past registrations. +- User dashboard: closed events are now hidden by default alongside past events (revealed via "Show past events"), and the Edit, Make payment, and Cancel registration actions no longer appear for closed or past registrations (also enforced server-side). ## [1.0.0] - 2026-07-23 diff --git a/backend/src/controllers/paymentController.js b/backend/src/controllers/paymentController.js index 804ba0e..00cdc9e 100644 --- a/backend/src/controllers/paymentController.js +++ b/backend/src/controllers/paymentController.js @@ -788,11 +788,15 @@ const createYocoCheckout = async (req, res) => { // Branch 1: Registration payment — delegate to internal helper if (registrationId) { // Authorisation check (the internal helper skips this) - const reg = await prisma.registration.findUnique({ where: { id: registrationId }, select: { userId: true, eventId: true } }); + const reg = await prisma.registration.findUnique({ where: { id: registrationId }, select: { userId: true, eventId: true, event: { select: { endDate: true } } } }); if (!reg) { res.status(404); throw new Error('Registration not found'); } if (reg.userId !== userId && req.user.role !== 'admin' && req.user.role !== 'supervisor') { res.status(403); throw new Error('Not authorized to create checkout for this registration'); } + // If event is in the past, block self-service payment (mirrors the registration-edit block) + if (req.user.role !== 'admin' && req.user.role !== 'supervisor' && reg.event?.endDate && new Date(reg.event.endDate).getTime() < Date.now()) { + res.status(400); throw new Error('This event has already ended; payment can no longer be made for this registration'); + } await assertEventOpen(reg.eventId, res); // Refresh early-bird pricing — updates priceSnapshot if any tier has expired or sold out. diff --git a/backend/src/controllers/registrationController.js b/backend/src/controllers/registrationController.js index 64116d9..a8fc6a9 100644 --- a/backend/src/controllers/registrationController.js +++ b/backend/src/controllers/registrationController.js @@ -583,7 +583,8 @@ const updateRegistrationStatus = async (req, res) => { const cancelRegistration = async (req, res) => { try { const registration = await prisma.registration.findUnique({ - where: { id: req.params.id } + where: { id: req.params.id }, + include: { event: { select: { endDate: true } } } }); if (!registration) { @@ -597,6 +598,12 @@ const cancelRegistration = async (req, res) => { throw new Error('Not authorized to cancel this registration'); } + // If event is in the past, block self-cancellation (mirrors the edit-block above) + if (req.user.role !== 'admin' && registration.event?.endDate && new Date(registration.event.endDate).getTime() < Date.now()) { + res.status(400); + throw new Error('This event has already ended; registration can no longer be cancelled'); + } + await assertEventOpen(registration.eventId, res); // Check if registration can be cancelled diff --git a/frontend/src/app/dashboard/user/page.tsx b/frontend/src/app/dashboard/user/page.tsx index 8c54856..b97b271 100644 --- a/frontend/src/app/dashboard/user/page.tsx +++ b/frontend/src/app/dashboard/user/page.tsx @@ -447,7 +447,9 @@ export default function UserDashboardPage() { const [editMinQty, setEditMinQty] = useState>({}); const [editError, setEditError] = useState(null); - const canEditActive = useMemo(() => { + // Whether the active registration's event still permits self-service changes + // (edit items, pay, cancel) — false once the event is past or its cashup is closed. + const canModifyActive = useMemo(() => { if (!activeReg) return false; return !isEventOver(activeReg.event); }, [activeReg]); @@ -847,7 +849,7 @@ export default function UserDashboardPage() {
Registration items - {!editMode && canEditActive && ( + {!editMode && canModifyActive && ( )}
@@ -987,7 +989,7 @@ export default function UserDashboardPage() { onClick={() => router.push(`/dashboard/user/forms?registrationId=${encodeURIComponent(activeReg.id)}`)} >Attendee forms )} - {activeBill && activeBill.outstanding > 0 ? ( + {canModifyActive && activeBill && activeBill.outstanding > 0 ? (
- {/* Cancel registration — only shown when no payments have been made */} - {activeReg.status !== 'cancelled' && (activeBill?.totalPaid ?? 0) === 0 && ( + {/* Cancel registration — only shown when no payments have been made and the event still permits changes */} + {canModifyActive && activeReg.status !== 'cancelled' && (activeBill?.totalPaid ?? 0) === 0 && (
{!showCancelConfirm ? (