fix: notify all email send after peer authentication, not before

src/controllers/organization.ts

@@ -24,7 +24,6 @@ import {
   getOrganizationSuggestions,
   joinOrganization,
 } from '../managers/organization/join';
-import { authenticateByPeers } from '../managers/organization/authentication-by-peers';
 
 export const getJoinOrganizationController = async (
   req: Request,
@@ -108,8 +107,6 @@ export const postJoinOrganizationMiddleware = async (
       user_id: req.session.user!.id,
     });
 
-    await authenticateByPeers(userOrganizationLink);
-
     if (req.session.mustReturnOneOrganizationInPayload) {
       await selectOrganization({
         user_id: req.session.user!.id,

src/managers/organization/authentication-by-peers.ts

@@ -9,7 +9,6 @@ import {
   NotFoundError,
   UserAlreadyAskedForSponsorshipError,
 } from '../../errors';
-import { isEligibleToSponsorship } from '../../services/organization';
 import { sendMail } from '../../connectors/sendinblue';
 import { updateUserOrganizationLink } from '../../repositories/organization/setters';
 import { getOrganizationsByUserId } from './main';
@@ -19,27 +18,6 @@ import {
 } from '../../repositories/moderation';
 import { SUPPORT_EMAIL_ADDRESS } from '../../env';
 
-export const authenticateByPeers = async (
-  link: UserOrganizationLink
-): Promise<{ hasBeenAuthenticated: boolean }> => {
-  const { organization_id, user_id, is_external } = link;
-  const organizationUsers = await getUsers(organization_id);
-  const user = organizationUsers.find(({ id }) => id === user_id);
-  const organization = await findOrganizationById(organization_id);
-
-  // The user should be in the organization already
-  if (isEmpty(user) || isEmpty(organization)) {
-    throw new NotFoundError();
-  }
-
-  if (isEligibleToSponsorship(organization)) {
-    return { hasBeenAuthenticated: false };
-  }
-
-  await notifyAllMembers(link);
-
-  return { hasBeenAuthenticated: true };
-};
 export const notifyAllMembers = async ({
   organization_id,
   user_id,

src/middlewares/user.ts

@@ -3,10 +3,13 @@ import { isEmpty } from 'lodash';
 import { isUrlTrusted } from '../services/security';
 import { updateEmailAddressVerificationStatus } from '../managers/user';
 import { isEligibleToSponsorship } from '../services/organization';
-import { NotImplemented } from 'http-errors';
 import { getOrganizationsByUserId } from '../managers/organization/main';
-import { greetForJoiningOrganization } from '../managers/organization/authentication-by-peers';
+import {
+  greetForJoiningOrganization,
+  notifyAllMembers,
+} from '../managers/organization/authentication-by-peers';
 import { getSelectedOrganizationId } from '../repositories/redis/selected-organization';
+import { getUserOrganizationLink } from '../repositories/organization/getters';
 
 // redirect user to start sign in page if no email is available in session
 export const checkEmailInSessionMiddleware = async (
@@ -227,15 +230,20 @@ export const checkUserHasBeenAuthenticatedByPeersMiddleware = (
 
         if (!isEmpty(organizationThatNeedsAuthenticationByPeers)) {
           if (
-            !isEligibleToSponsorship(organizationThatNeedsAuthenticationByPeers)
+            isEligibleToSponsorship(organizationThatNeedsAuthenticationByPeers)
           ) {
-            // this should never happen as all members are notified by default
-            return next(new NotImplemented());
+            return res.redirect(
+              `/users/choose-sponsor/${organizationThatNeedsAuthenticationByPeers.id}`
+            );
           }
 
-          return res.redirect(
-            `/users/choose-sponsor/${organizationThatNeedsAuthenticationByPeers.id}`
+          const link = await getUserOrganizationLink(
+            organizationThatNeedsAuthenticationByPeers.id,
+            req.session.user!.id
           );
+
+          // link exists because we get the organization id from getOrganizationsByUserId above
+          await notifyAllMembers(link!);
         }
 
         return next();