merged development into branch

Author: jupiter007

CHANGELOG.md

@@ -108,6 +108,7 @@
 ### Updated
 - Updated `plans` resolver to have pagination for a specified `userId` with optional `search term`, and added a chained resolver for `PlanSearchResult` for `templateOwnerAffiliationName` [#281]
 - Updated `PlanSearchResult` model to include `createdById` and `templateOwnerAffiliationName` for the Admin Users page [#281]
+- Update local migration to add RO question to default template
 - Updated `users` resolver to include `role` and `affiliationId` [#240]
 - Added `findByAffiliationId` and `search` to pass in `role` as optional [#240]
 - Added `findByUserId` to `Plan` model to find all plans for a given user [#240]
@@ -245,6 +246,7 @@
 - Fixed issue with templates not cloning with sections and questions by updating the `addTemplate` mutation to clone from non-versioned template, section and question [#1006]
 
 ### Chore
+- Addressed security vulnerability in `nodemailer` and `undici` packages, and added debugging to troubleshoot request feedback failure [#285]
 - Updated `nodemailer` to `v9.0.1` and `undici` to `v7.28.0` [#240]
 - Updated `fast-xml-parser` to `v1.2.0` and `uuid` to `11.1.1` to address vulnerabilities.
 - Added `@types/nodemailer` [#189]

data-migrations/local-only/2026-06-22-0923-add-research-output-to-default-tmplt.sql

@@ -22,17 +22,40 @@ VALUES (@default_template_id, @section_id, 1, 'Please list all research outputs
 SET @question_id := LAST_INSERT_ID();
 
 -- Then generate/publish the new version
+SET @prior_versioned_template_id := (SELECT id FROM versionedTemplates WHERE templateId = @default_template_id AND active = 1);
 UPDATE versionedTemplates SET active = 0 WHERE templateId = @default_template_id AND active = 1;
 INSERT INTO versionedTemplates (templateId, active, version, versionType, versionedById, comment, name, description, ownerId, visibility, bestPractice, isDefault, languageId, created, createdById, modified, modifiedById)
   (SELECT id, 1, 'v3', 'PUBLISHED', createdById, 'Added a research output table question', name, description, ownerId, 'PUBLIC', bestPractice, isDefault, languageId, CURDATE(), createdById, CURDATE(), modifiedById
    FROM templates WHERE id = @default_template_id);
 SET @versioned_template_id := LAST_INSERT_ID();
 
+-- Make sure the new version has all the existing sections
+INSERT INTO versionedSections (versionedTemplateId, sectionId, name, introduction, requirements, guidance, displayOrder, bestPractice, created, createdById, modified, modifiedById)
+  (SELECT @versioned_template_id, sectionId, name, introduction, requirements, guidance, displayOrder, bestPractice, CURDATE(), createdById, CURDATE(), modifiedById
+   FROM versionedSections WHERE versionedTemplateId = @prior_versioned_template_id);
+
+-- Then add the new research output section
 INSERT INTO versionedSections (versionedTemplateId, sectionId, name, introduction, requirements, guidance, displayOrder, bestPractice, created, createdById, modified, modifiedById)
   (SELECT @versioned_template_id, id, name, introduction, requirements, guidance, displayOrder, bestPractice, CURDATE(), createdById, CURDATE(), modifiedById
    FROM sections WHERE id = @section_id);
 SET @versioned_section_id := LAST_INSERT_ID();
 
+-- Then make sure all the existing section tags and questions are copied across to the new version
+INSERT INTO versionedSectionTags (versionedSectionId, tagId, created, createdById, modified, modifiedById)
+  (SELECT newVSS.id, st.tagId, CURDATE(), st.createdById, CURDATE(), st.modifiedById
+   FROM versionedSections AS vss
+    INNER JOIN versionedSectionTags AS st ON vss.id = st.versionedSectionId
+    INNER JOIN versionedSections AS newVSS on newVSS.sectionId = vss.sectionId AND newVSS.versionedTemplateId = @versioned_template_id
+   WHERE vss.versionedTemplateId = @prior_versioned_template_id);
+
+INSERT INTO versionedQuestions (versionedTemplateId, versionedSectionId, questionId, questionText, json, requirementText, guidanceText, sampleText, required, displayOrder, created, createdById, modified, modifiedById)
+  (SELECT @versioned_template_id, newVSS.id, vsq.questionId, vsq.questionText, vsq.json, vsq.requirementText, vsq.guidanceText, vsq.sampleText, vsq.required, vsq.displayOrder, CURDATE(), vsq.createdById, CURDATE(), vsq.modifiedById
+   FROM versionedSections AS vss
+     INNER JOIN versionedQuestions vsq ON vss.id = vsq.versionedSectionId
+     INNER JOIN versionedSections AS newVSS on newVSS.sectionId = vss.sectionId AND newVSS.versionedTemplateId = @versioned_template_id
+   WHERE vss.versionedTemplateId = @prior_versioned_template_id);
+
+-- Finally add the new section tags and question to the research output question
 INSERT INTO versionedSectionTags (versionedSectionId, tagId, created, createdById, modified, modifiedById)
   (SELECT @versioned_section_id, tagId, CURDATE(), createdById, CURDATE(), modifiedById
    FROM sectionTags WHERE sectionId = @section_id);

src/resolvers/feedback.ts

@@ -153,61 +153,66 @@ export const resolvers: Resolvers = {
 
       try {
         if (isAuthorized(context.token)) {
+          context.logger.info({ planId, userId: context.token.id, affiliationId: context.token.affiliationId }, `${reference}: authorized, starting`);
+
           const plan = await Plan.findById(reference, context, planId);
           if (!plan) {
             throw NotFoundError(`Plan with ID ${planId} not found`);
           }
+          context.logger.info({ planId, projectId: plan.projectId, versionedTemplateId: plan.versionedTemplateId }, `${reference}: plan found`);
+
           const project = await Project.findById(reference, context, plan.projectId);
           if (!project) {
             throw NotFoundError(`Project with ID ${plan.projectId} not found`);
           }
+          context.logger.info({ projectId: project.id }, `${reference}: project found`);
 
-          // Get existing feedback for the given planId
-          const existingFeedback = await PlanFeedback.findByPlanId(
-            reference,
-            context,
-            planId,
-          );
-
-          // If there is already an active feedback round, then do not allow creation of a new one
-          const hasOpenFeedback = existingFeedback.some(
-            (fb) => fb.completed === null
-          );
+          const existingFeedback = await PlanFeedback.findByPlanId(reference, context, planId);
+          context.logger.info({ existingFeedbackCount: existingFeedback.length }, `${reference}: existing feedback fetched`);
 
+          const hasOpenFeedback = existingFeedback.some((fb) => fb.completed === null);
           if (hasOpenFeedback) {
             throw ForbiddenError(`There is already feedback in progress for plan ${planId}`);
           }
 
-          //Feedback request can only be made by ADMINs and SUPERADMINs or a collaborator with PRIMARY access
-          if (await hasPermissionOnProject(context, project, ProjectCollaboratorAccessLevel.PRIMARY)) {
-            const feedbackComment = new PlanFeedback({
-              planId,
-              messageToOrg: messageToOrg ?? '',
-              requestedById: context.token.id,
-              requested: getCurrentDate()
-            });
+          const hasPrimaryPermission = await hasPermissionOnProject(context, project, ProjectCollaboratorAccessLevel.PRIMARY);
+          context.logger.info({ hasPrimaryPermission }, `${reference}: permission check`);
 
+          if (hasPrimaryPermission) {
             const affiliationId = context.token.affiliationId;
             if (!affiliationId) {
               throw NotFoundError(`Affiliation for user not found`);
             }
+            context.logger.info({ affiliationId }, `${reference}: looking up affiliation`);
 
             const affiliation = await Affiliation.findByURI(reference, context, affiliationId);
+            context.logger.info(
+              { affiliationUri: affiliation?.uri, feedbackEmailCount: affiliation?.feedbackEmails?.length ?? 0 },
+              `${reference}: affiliation found`
+            );
 
             if (affiliation.feedbackEmails.length === 0) {
-              context.logger.warn(prepareObjectForLogs({ affiliationId }), `Affiliation with ID ${affiliationId} has no feedback emails configured, so no notifications will be sent when requesting feedback`);
+              context.logger.warn({ affiliationId }, `${reference}: no feedback emails configured`);
             }
 
             const planURL = `/projects/${project.id}/dmp/${planId}`;
             const planOwnerName = [context.token.givenName, context.token.surname].filter(Boolean).join(' ');
             const planTitle = plan.title || 'Untitled Plan';
+            context.logger.info({ planURL, planOwnerName, planTitle }, `${reference}: sending feedback request email`);
 
-            // Send emails to the feedback recipients
             await sendFeedbackRequestEmail(context, planOwnerName, planURL, planTitle, affiliation.feedbackEmails, messageToOrg ?? '');
+            context.logger.info(`${reference}: feedback request email sent`);
+
+            const feedbackComment = new PlanFeedback({
+              planId,
+              messageToOrg: messageToOrg ?? '',
+              requestedById: context.token.id,
+              requested: getCurrentDate()
+            });
 
             const createdFeedback = await feedbackComment.create(context);
+            context.logger.info({ createdFeedbackId: createdFeedback?.id ?? null }, `${reference}: feedback record created`);
 
-            // Notify all org admins of the feedback request
             if (createdFeedback?.id) {
               await AdminNotification.addNotificationForAffiliation(
                 reference,
@@ -216,11 +221,16 @@ export const resolvers: Resolvers = {
                 'FEEDBACK_REQUESTED',
                 { planId },
               );
+              context.logger.info({ affiliationUri: affiliation.uri }, `${reference}: admin notification sent`);
             }
 
             return createdFeedback;
           }
         }
+        context.logger.warn(
+          { hasToken: !!context?.token, userId: context?.token?.id },
+          `${reference}: reached auth fallthrough — user did not pass permission checks`
+        );
         throw context?.token ? ForbiddenError() : AuthenticationError();
       } catch (err) {
         if (err instanceof GraphQLError) throw err;

src/services/__tests__/emailService.spec.ts

@@ -334,7 +334,7 @@ describe('sendEmail', () => {
       .replace('%{helpUrl}', `${domain}/help`);
 
     expect(sent).toBe(true);
-    expect(logger.info).toHaveBeenCalledTimes(emails.length);
+    expect(logger.info).toHaveBeenCalledTimes(emails.length + 2); // accounting for additional info logs for sending and finishing
     expect(mockSendEmail).toHaveBeenCalledTimes(emails.length);
     for (const email of emails) {
       const expectedHtml = baseHtml.replace('%{adminEmail}', email);

src/services/emailService.ts

@@ -298,9 +298,13 @@ export const sendFeedbackRequestEmail = async (
     .replace('%{helpDeskEmail}', emailConfig.helpDeskAddress)
     .replace('%{helpUrl}', `${domain}/help`);
 
+  context.logger.info(`Sending feedback request email to ${collaboratorEmails.length} collaborators for plan "${planTitle}" at URL ${domain}${planURL}`);
+  context.logger.debug(prepareObjectForLogs({ collaboratorEmails, planOwnerName, planURL, planTitle, feedbackRequestMessage }), `Feedback request email details`);
+
   // Send each feedback email recipient their own email
   for (const email of collaboratorEmails) {
     const message = baseMessage.replace('%{adminEmail}', email);
+    context.logger.debug(prepareObjectForLogs({ email, message }), `Sending feedback request email to ${email}`);
     await sendEmail(
       context,
       'FeedbackRequest',
@@ -311,5 +315,6 @@ export const sendFeedbackRequestEmail = async (
       message
     );
   }
+  context.logger.info(`Finished sending feedback request emails for plan "${planTitle}"`);
   return true;
 }