Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if (cart.billing && typeof cart.billing[0].address === "object" &&
cart.billing[0].address._id === addressId) {
update.$unset["billing.0.address"] = "";
needToUpdate = true;
}
if (cart.shipping && typeof cart.shipping[0].address === "object" && cart.shipping[0].address._id === addressId) {
removeShippingAddresses(cart);
isShippingDeleting = true;
}
}
if (needToUpdate) {
try {
Cart.update({ _id: cartId }, update);
} catch (error) {
Logger.error(error);
throw new ReactionError("server-error", "Error updating cart");
}
}
if (needToUpdate || isShippingDeleting) {
if (isShippingDeleting) {
// if we remove shipping address from cart, we need to revert
// `cartWorkflow` to the `checkoutAddressBook` step.
Meteor.call("workflow/revertCartWorkflow", "checkoutAddressBook", cartId);
}
const updatedCart = Cart.findOne({ _id: cartId });
Promise.await(appEvents.emit("afterCartUpdate", {
cart: updatedCart,
updatedBy: Reaction.getUserId()
}));
if (!cart) {
throw new Error("afterCartUpdate hook run with no cart argument");
}
// refresh shipping quotes
try {
Meteor.call("shipping/updateShipmentQuotes", cartId);
} catch (error) {
Logger.error(`Error calling shipping/updateShipmentQuotes method in afterCartUpdate for cart with ID ${cartId}`, error);
}
// revert workflow to checkout shipping step.
try {
Meteor.call("workflow/revertCartWorkflow", "coreCheckoutShipping", cartId);
} catch (error) {
Logger.error("Error calling workflow/revertCartWorkflow method in afterCartUpdate", error);
}
// reset selected shipment method
if (cart.shipping && cart.shipping[0] && cart.shipping[0].shipmentMethod) {
Cart.update({ _id: cartId }, {
$unset: { "shipping.0.shipmentMethod": "" }
});
const updatedCart = Cart.findOne({ _id: cartId });
Promise.await(appEvents.emit("afterCartUpdate", cartId, updatedCart));
}
});
).toArray();
if (products.length !== productIds.length) {
throw new ReactionError("not-found", "Some products not found");
}
if (!isInternalCall) {
const uniqueShopIds = _.uniq(products.map((product) => product.shopId));
for (const shopId of uniqueShopIds) {
await checkPermissions(["createProduct", "product/admin", "product/publish"], shopId); // eslint-disable-line no-await-in-loop
}
}
const success = await publishProductsToCatalog(productIds, context);
if (!success) {
Logger.error("Some Products could not be published to the Catalog.");
throw new ReactionError(
"server-error",
"Some Products could not be published to the Catalog. Make sure the parent product and its variants and options are visible."
);
}
return Catalog.find({ "product.productId": { $in: productIds } }).toArray();
}
// given that we `export` this function, there is an expectation that it can
// be imported and used elsewhere in the code. the use of `this` in this
// method requires that the context be Meteor, and further, `this.unblock()`
// assumes that this is being run as a Meteor method. Consider using a small
// function in the Meteor.method section below to call unblock, and pass any
// Meteor-defined data (e.g., userId) as a parameter to allow for this method
// to be reused.
this.unblock();
const shop = Shops.findOne(shopId);
const primaryShop = Reaction.getPrimaryShop();
if (!shop) {
const msg = `accounts/inviteShopMember - Shop ${shopId} not found`;
Logger.error(msg);
throw new Meteor.Error("not-found", msg);
}
if (!Reaction.hasPermission("reaction-accounts", this.userId, shopId)) {
Logger.error(`User ${this.userId} does not have reaction-accounts permissions`);
throw new ReactionError("access-denied", "Access denied");
}
const group = Groups.findOne({ _id: groupId }) || {};
// check to ensure that user has roles required to perform the invitation
if (!Reaction.canInviteToGroup({ group, user: Meteor.user() })) {
throw new ReactionError("access-denied", "Cannot invite to group");
}
if (group.slug === "owner") {
if (!user) {
Logger.error("sendResetPasswordEmail - User not found");
throw new ReactionError("not-found", "User not found");
}
let email = optionalEmail;
// pick the first email if we weren't passed an email.
if (!optionalEmail && user.emails && user.emails[0]) {
email = user.emails[0].address;
}
// make sure we have a valid email
if (!email || !user.emails || !user.emails.map((mailInfo) => mailInfo.address).includes(email)) {
Logger.error("sendResetPasswordEmail - Email not found");
throw new ReactionError("not-found", "Email not found");
}
// Create token for password reset
const token = Random.secret();
const when = new Date();
const tokenObj = { token, email, when };
Meteor.users.update(userId, {
$set: {
"services.password.reset": tokenObj
}
});
Meteor._ensure(user, "services", "password").reset = tokenObj;
async function sendResetEmail(context, account, email) {
const { collections } = context;
const { Shops, users } = collections;
// Make sure the user exists, and email is one of their addresses.
const user = await users.findOne({ _id: account.userId });
if (!user) {
Logger.error("sendResetAccountPasswordEmail - User not found");
throw new ReactionError("not-found", "User not found");
}
// make sure we have a valid email
if (!email || !user.emails || !user.emails.map((mailInfo) => mailInfo.address).includes(email)) {
Logger.error("sendResetPasswordEmail - Email not found");
throw new ReactionError("not-found", "Email not found");
}
// Create token for password reset
const tokenObj = generateVerificationTokenObject({ email });
const { value: updatedAccount } = await users.findOneAndUpdate({ _id: account.userId }, {
$set: {
"services.password.reset": tokenObj
}
"orders/shipmentShipped"(order, shipment) {
check(order, Object);
check(shipment, Object);
// TODO: Who should have access to ship shipments in a marketplace setting
// Should be anyone who has product in an order.
if (!Reaction.hasPermission("orders")) {
Logger.error("User does not have 'orders' permissions");
throw new Meteor.Error("access-denied", "Access Denied");
}
this.unblock();
let completedItemsResult;
let completedOrderResult;
const itemIds = shipment.items.map((item) => item._id);
// TODO: In the future, this could be handled by shipping delivery status
// REVIEW: This hook seems to run before the shipment has been marked as shipped
Hooks.Events.run("onOrderShipmentShipped", order, itemIds);
const workflowResult = Meteor.call("workflow/pushItemWorkflow", "coreOrderItemWorkflow/shipped", order, itemIds);
if (workflowResult === 1) {
.catch((error) => {
Logger.error("Encountered error when exporting to shopify", error);
if (error.response && error.response.body) {
Logger.error(error.response.body);
}
markExportFailed(order);
});
job.done(`Finished exporting order ${orderId}`);
const refundResult = await stripe.refunds.create({ charge: paymentMethod.transactionId, amount: formatForStripe(amount), reason });
Logger.debug(refundResult);
if (refundResult && refundResult.object === "refund") {
result = {
saved: true,
response: refundResult
};
} else {
result = {
saved: false,
response: refundResult
};
Logger.warn("Stripe call succeeded but refund not issued");
}
} catch (error) {
Logger.error(error);
result = {
saved: false,
error: `Cannot issue refund: ${error.message}`
};
Logger.fatal("Stripe call failed, refund was not issued", error.message);
}
return result;
}
const userId = Reaction.getUserId();
let account = null;
const selector = { shopId };
if (cartId) {
selector._id = cartId;
}
if (cartToken) {
selector.anonymousAccessToken = hashLoginToken(cartToken);
} else {
account = (userId && Accounts.findOne({ userId })) || null;
if (!account) {
if (throwIfNotFound) {
Logger.error(`Cart not found for user with ID ${userId}`);
throw new ReactionError("not-found", "Cart not found");
}
return { account, cart: null };
}
selector.accountId = account._id;
}
const cart = Cart.findOne(selector) || null;
if (!cart && throwIfNotFound) {
Logger.error(`Cart not found for user with ID ${userId}`);
throw new ReactionError("not-found", "Cart not found");
}