✨ Expose user attributes to notification templates

Author: edulix

packages/Cargo.lock

@@ -81,6 +81,7 @@ phf = { version = "0.11", features = ["macros"], default-features = false }
 handlebars = { version = "6.1", optional = true }
 handlebars-chrono = { version = "0.2", features = [ "locale", "timezone" ], optional = true }
 num-format = { version = "0.4", optional = true }
+urlencoding = { version = "2.1", optional = true }
 headless_chrome = { version = "1.0", optional = true }
 reqwest = { version="0.12", features = ["blocking", "json", "rustls-tls"], optional = true, default-features = false }
 reqwest-retry = { version = "0.7", optional = true }
@@ -138,7 +139,7 @@ wasm = ["dep:wasm-bindgen", "areas", "dep:serde-wasm-bindgen"]
 signatures=["dep:tracing"]
 default = []
 areas = []
-reports = ["dep:handlebars", "dep:handlebars-chrono", "dep:headless_chrome", "dep:reqwest", "dep:tracing", "dep:tokio", "dep:num-format", "dep:aws-config", "dep:aws-sdk-sesv2", "dep:aws-sdk-sns", "dep:aws-sdk-s3", "dep:aws-smithy-types", "dep:sha256", "dep:ammonia"]
+reports = ["dep:handlebars", "dep:handlebars-chrono", "dep:headless_chrome", "dep:reqwest", "dep:tracing", "dep:tokio", "dep:num-format", "dep:urlencoding", "dep:aws-config", "dep:aws-sdk-sesv2", "dep:aws-sdk-sns", "dep:aws-sdk-s3", "dep:aws-smithy-types", "dep:sha256", "dep:ammonia"]
 reports_sync = []
 s3 = ["dep:reqwest", "dep:aws-config", "dep:aws-sdk-sesv2", "dep:aws-sdk-sns", "dep:aws-sdk-s3", "dep:aws-smithy-types"]
 keycloak = ["jwt", "dep:openid", "dep:reqwest", "dep:reqwest-retry", "dep:reqwest-middleware", "dep:serde_urlencoded", "dep:rocket", "dep:keycloak", "dep:tracing", "dep:uuid", "dep:regex", "dep:jsonwebtoken", "dep:tokio-postgres", "dep:time"]

packages/sequent-core/Cargo.toml

@@ -62,6 +62,7 @@ fn get_registry<'reg>() -> Handlebars<'reg> {
         helper_wrapper_or(Box::new(inc2), String::from("-")),
     );
     reg.register_helper("to_json", helper_wrapper(Box::new(to_json)));
+    reg.register_helper("url_encode", helper_wrapper(Box::new(url_encode)));
     reg.register_helper(
         "parse_i64",
         helper_wrapper_or(Box::new(parse_i64), String::from("-")),
@@ -283,6 +284,31 @@ pub fn sanitize_html(
     Ok(())
 }
 
+/// Percent-encodes a string for use as one dynamic URL query value.
+pub fn url_encode(
+    helper: &Helper,
+    _: &Handlebars,
+    _: &Context,
+    _: &mut RenderContext,
+    out: &mut dyn Output,
+) -> HelperResult {
+    let value = helper
+        .param(0)
+        .ok_or(RenderErrorReason::ParamNotFoundForIndex("url_encode", 0))?
+        .value()
+        .as_str()
+        .ok_or_else(|| {
+            RenderErrorReason::ParamTypeMismatchForName(
+                "url_encode",
+                "0".to_string(),
+                "string".to_string(),
+            )
+        })?;
+
+    out.write(urlencoding::encode(value).as_ref())?;
+    Ok(())
+}
+
 fn parse_u64_value(value: &JsonValue) -> Result<u64, RenderError> {
     match value {
         JsonValue::Number(n) => n.as_u64().ok_or_else(|| {
@@ -802,3 +828,27 @@ impl HelperDef for is_some {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::render_template_text;
+    use serde_json::{json, Map};
+
+    #[test]
+    fn url_encode_keeps_dynamic_data_in_one_query_value() {
+        let mut variables = Map::new();
+        variables
+            .insert("value".to_string(), json!("a&admin=true 50% \"Málaga\""));
+
+        let rendered = render_template_text(
+            "https://vote.example/login?login_hint__reference={{url_encode value}}",
+            variables,
+        )
+        .expect("template should render");
+
+        assert_eq!(
+            rendered,
+            "https://vote.example/login?login_hint__reference=a%26admin%3Dtrue%2050%25%20%22M%C3%A1laga%22"
+        );
+    }
+}

packages/sequent-core/src/services/reports.rs

@@ -50,16 +50,22 @@ fn get_variables(
     auth_action: AuthAction,
 ) -> Result<Map<String, Value>> {
     let mut variables: Map<String, Value> = Default::default();
-    variables.insert(
-        "user".to_string(),
-        json!({
-            "first_name": user.first_name.clone(),
-            "last_name": user.last_name.clone(),
-            "username": user.username.clone(),
-            "first_name": user.first_name.clone(),
-            "email": user.email.clone(),
-        }),
-    );
+    let mut user_variables = Map::new();
+    user_variables.insert("first_name".to_string(), json!(user.first_name));
+    user_variables.insert("last_name".to_string(), json!(user.last_name));
+    user_variables.insert("username".to_string(), json!(user.username));
+    user_variables.insert("email".to_string(), json!(user.email));
+
+    let attributes = user.attributes.clone().unwrap_or_default();
+    for (attribute_name, values) in &attributes {
+        if let Some(first_value) = values.first() {
+            user_variables
+                .entry(attribute_name.clone())
+                .or_insert_with(|| json!(first_value));
+        }
+    }
+    user_variables.insert("attributes".to_string(), json!(attributes));
+    variables.insert("user".to_string(), Value::Object(user_variables));
     variables.insert("tenant_id".to_string(), json!(tenant_id.clone()));
     if let Some(ref election_event) = election_event {
         let default_language = election_event.get_default_language();
@@ -644,3 +650,47 @@ pub async fn send_template_email_or_sms(
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::get_variables;
+    use sequent_core::services::generate_urls::AuthAction;
+    use sequent_core::types::keycloak::User;
+    use serde_json::json;
+    use std::collections::HashMap;
+
+    #[test]
+    fn get_variables_exposes_dynamic_and_multivalued_user_attributes() {
+        let user = User {
+            username: Some("canonical-user".to_string()),
+            attributes: Some(HashMap::from([
+                (
+                    "dateOfBirth".to_string(),
+                    vec!["2000-01-01".to_string(), "ignored-first-value".to_string()],
+                ),
+                (
+                    "username".to_string(),
+                    vec!["untrusted-collision".to_string()],
+                ),
+                ("empty".to_string(), Vec::new()),
+            ])),
+            ..User::default()
+        };
+
+        let variables = get_variables(&user, None, "tenant-id".to_string(), AuthAction::Login)
+            .expect("variables should be generated");
+
+        assert_eq!(variables["user"]["username"], json!("canonical-user"));
+        assert_eq!(variables["user"]["dateOfBirth"], json!("2000-01-01"));
+        assert!(variables["user"].get("empty").is_none());
+        assert_eq!(
+            variables["user"]["attributes"]["dateOfBirth"],
+            json!(["2000-01-01", "ignored-first-value"])
+        );
+        assert_eq!(
+            variables["user"]["attributes"]["username"],
+            json!(["untrusted-collision"])
+        );
+        assert_eq!(variables["user"]["attributes"]["empty"], json!([]));
+    }
+}