Compare commits

...
2 Commits
Author SHA1 Message Date
joshua 0414854dec Merge branch 'fix/update-request-newer' 2026-10-28 12:16:56 +02:00
joshuaandClaude Opus 5.5 dd537a1a16 Fix: update request for an older version than the latest (1.47.4)
After asking for an update, a newer version coming out made the Licence
page claim the newer version was requested, with no way to ask for it.
Now it shows the version asked for, that a newer one is out, and "Ask
for X instead"; the banner shows again. Hub 1.5.0 moves the open request
on (`changed`); with an older Hub the site withdraws and asks again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-28 12:16:56 +02:00
18 changed files with 189 additions and 41 deletions
+14
View File
@@ -7,6 +7,20 @@ and this project follows [Semantic Versioning](https://semver.org/).
## [Unreleased]
## [1.47.4] - 2026-10-28
### Fixed
- **Update requested, then a newer version came out** — the Licence page said the newer version
was requested ("Version 1.47.3 is available. Update requested …") when the request was for an
older one, and there was no way to ask for the newer version; the update banner stayed hidden.
Now it shows the request ("You asked for version 1.47.0 on …") and, below it, that a newer
version has come out with **Ask for 1.47.3 instead** (Withdraw request stays). The banner shows
again and says to change the request. Changing it is audited as `hub_update_requested` with
`changedFrom`.
- With Cross Events Hub 1.5.0 the Hub moves the open request on to the new version and emails the
provider once; with an older Hub the site withdraws the request and makes it again.
## [1.47.3] - 2026-10-28
### Added
+2 -1
View File
@@ -814,7 +814,8 @@ can't start, the same jobs run on in-process timers.
created or edited; no new registrations or payments; tickets still scan, data can be exported).
The site checks in 30 seconds after starting and after a licence key is connected. Admins see when an update is available, with
**what's new** in each version, and press **Request update**, which tells the provider through the Hub (the site never updates
itself). A request can be **withdrawn**. **Not now** hides the update banner until the next version; urgent updates (security or
itself). A request can be **withdrawn**; when a newer version comes out after asking, the page shows
the version asked for and **Ask for … instead** moves the request on to the newer one. **Not now** hides the update banner until the next version; urgent updates (security or
serious bug fixes) can't be put off and show a red banner.
- **Notices from the provider** — maintenance and other messages the provider posts in the Hub show as a banner on the dashboard
for site admins and supervisors, in their time window; each can be closed (per browser) and stays listed on Site settings →
+6
View File
@@ -12,6 +12,12 @@ Write for church admins, not developers: no environment variables, endpoints or
developer log is CHANGELOG.md. A tagged version without a section here shows "No details given".
-->
## 1.47.4
- **Asked for an update, and a newer one came out?** The Licence page now shows which version you
asked for, tells you when a newer one is out, and lets you ask for that one instead with one
button.
## 1.47.3
- **Season passes.** Sell a ticket for several events in a series at one price — say all of next
+2 -2
View File
@@ -1,12 +1,12 @@
{
"name": "event-management-backend",
"version": "1.47.3",
"version": "1.47.4",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "event-management-backend",
"version": "1.47.3",
"version": "1.47.4",
"hasInstallScript": true,
"dependencies": {
"@prisma/adapter-pg": "^7.10.1",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "event-management-backend",
"version": "1.47.3",
"version": "1.47.4",
"description": "Event Management System Backend",
"main": "src/index.js",
"scripts": {
+12 -6
View File
@@ -13,10 +13,13 @@ function compareVersions(a, b) {
return 0;
}
/** An update request still waiting: until this site runs the version that was asked for. */
function pendingUpdateRequest(version, requestedAt, requestedVersion) {
/**
* An update request still waiting: until this site runs the version that was asked for.
* `outdated`: a newer version than the one asked for is out, so the request can be changed to it.
*/
function pendingUpdateRequest(version, requestedAt, requestedVersion, latestVersion = null) {
if (!requestedAt || !requestedVersion || compareVersions(version, requestedVersion) >= 0) return null;
return { requestedAt, version: requestedVersion };
return { requestedAt, version: requestedVersion, outdated: !!latestVersion && compareVersions(latestVersion, requestedVersion) > 0 };
}
const str = (v, max) => String(v ?? '').slice(0, max);
@@ -87,7 +90,7 @@ async function statusPayload({ fresh = false } = {}) {
urgentUpdate,
updateSnoozed: updateAvailable && updateSnoozed({ latestVersion: s.latestVersion, snoozedVersion: s.updateSnoozedVersion, urgent: urgentUpdate }),
releases,
updateRequest: pendingUpdateRequest(APP_VERSION, s.updateRequestedAt, s.updateRequestedVersion),
updateRequest: pendingUpdateRequest(APP_VERSION, s.updateRequestedAt, s.updateRequestedVersion, s.latestVersion),
notices: activeNotices(s.notices),
};
}
@@ -139,8 +142,11 @@ const heartbeatNow = async (req, res) => {
const requestUpdate = async (req, res) => {
try {
const result = await hub.requestUpdate();
if (!result.alreadyRequested) {
logAdminAction({ actorId: req.user.id, actorRole: req.user.role, action: 'hub_update_requested', targetType: 'hub', metadata: { from: APP_VERSION, to: result.version }, ip: getClientIp(req) });
if (!result.alreadyRequested || result.changed) {
logAdminAction({
actorId: req.user.id, actorRole: req.user.role, action: 'hub_update_requested', targetType: 'hub',
metadata: { from: APP_VERSION, to: result.version, ...(result.changed ? { changedFrom: result.previousVersion || null } : {}) }, ip: getClientIp(req),
});
}
res.json(await statusPayload({ fresh: true }));
} catch (e) {
+26 -7
View File
@@ -145,17 +145,36 @@ async function heartbeat() {
}
}
/** a < b as x.y.z versions. */
function olderThan(a, b) {
const pa = String(a || '').split('.').map(n => parseInt(n, 10) || 0);
const pb = String(b || '').split('.').map(n => parseInt(n, 10) || 0);
for (let i = 0; i < 3; i++) if (pa[i] !== pb[i]) return pa[i] < pb[i];
return false;
}
/**
* Ask the Hub for this site to be updated (§3a). Joshua is told; the site never updates itself.
* Returns { requestedAt, version, alreadyRequested }.
* Asking again after a newer version came out moves the request on to it (`changed`). A Hub before
* 1.5.0 can't do that (it doesn't send `changed`), so the old request is withdrawn and made again.
* Returns { requestedAt, version, alreadyRequested, changed, previousVersion }.
*/
async function requestUpdate() {
let data;
try {
data = await signedPost('/api/installs/update-request', { protocolVersion: PROTOCOL_VERSION, version: report.APP_VERSION });
} catch (e) {
if (e.code === 'NOT_FOUND') throw new HubError('The Hub doesn\'t take update requests yet. Please contact your provider.', 'NOT_SUPPORTED', 502);
throw e;
const ask = async () => {
try {
return await signedPost('/api/installs/update-request', { protocolVersion: PROTOCOL_VERSION, version: report.APP_VERSION });
} catch (e) {
if (e.code === 'NOT_FOUND') throw new HubError('The Hub doesn\'t take update requests yet. Please contact your provider.', 'NOT_SUPPORTED', 502);
throw e;
}
};
let data = await ask();
if (data.alreadyRequested && data.changed === undefined) {
const asked = (await read(['hub_update_requested_version'])).hub_update_requested_version || null;
if (!asked || olderThan(asked, data.version)) {
await cancelUpdateRequest();
data = { ...(await ask()), changed: true, previousVersion: asked };
}
}
await save({ hub_update_requested_at: data.requestedAt, hub_update_requested_version: data.version || null });
return data;
+7 -1
View File
@@ -148,12 +148,18 @@ test('version comparison for "update available"', () => {
test('an update request shows until the site runs the version asked for', () => {
const at = '2026-10-27T09:00:00.000Z';
expect(pendingUpdateRequest('1.41.2', at, '1.42.0')).toEqual({ requestedAt: at, version: '1.42.0' });
expect(pendingUpdateRequest('1.41.2', at, '1.42.0')).toEqual({ requestedAt: at, version: '1.42.0', outdated: false });
expect(pendingUpdateRequest('1.42.0', at, '1.42.0')).toBeNull();
expect(pendingUpdateRequest('1.43.0', at, '1.42.0')).toBeNull();
expect(pendingUpdateRequest('1.41.2', null, null)).toBeNull();
});
test('a request for a version that has since been overtaken can be changed', () => {
const at = '2026-10-27T09:00:00.000Z';
expect(pendingUpdateRequest('1.46.2', at, '1.47.0', '1.47.3')).toEqual({ requestedAt: at, version: '1.47.0', outdated: true });
expect(pendingUpdateRequest('1.46.2', at, '1.47.3', '1.47.3')).toEqual({ requestedAt: at, version: '1.47.3', outdated: false });
});
describe("what's new", () => {
const releases = [
{ version: '1.46.0', notes: 'Older', urgent: false, releasedAt: '2026-10-20T10:00:00.000Z' },
+67
View File
@@ -0,0 +1,67 @@
// Asking for an update again after a newer version came out: the request moves on to it — on the
// Hub itself (1.5.0, `changed`), or by withdrawing and asking again with an older Hub.
const mockSettings = new Map();
jest.mock('../src/config/db', () => ({
appSetting: {
findMany: jest.fn(async ({ where }) => [...mockSettings].filter(([key]) => where.key.in.includes(key)).map(([key, value]) => ({ key, value }))),
upsert: jest.fn(async ({ where, create }) => { mockSettings.set(where.key, create.value); }),
deleteMany: jest.fn(async ({ where }) => { mockSettings.delete(where.key); }),
},
}));
jest.mock('../src/hub/report', () => ({ APP_VERSION: '1.46.2' }));
const { encrypt } = require('../src/utils/encryption');
const hub = require('../src/hub/client');
const reply = (status, body) => ({ ok: status < 400, status, json: async () => body });
describe('changing an update request', () => {
let calls;
beforeEach(() => {
mockSettings.clear();
mockSettings.set('hub_install_id', 'install-1');
mockSettings.set('hub_install_secret', encrypt('secret'));
mockSettings.set('hub_update_requested_at', '2026-10-20T09:00:00.000Z');
mockSettings.set('hub_update_requested_version', '1.47.0');
calls = [];
});
afterEach(() => { delete global.fetch; });
test('Hub 1.5.0 moves the open request on to the latest version', async () => {
global.fetch = jest.fn(async url => {
calls.push(new URL(url).pathname);
return reply(200, { requestedAt: '2026-10-28T09:00:00.000Z', version: '1.47.3', alreadyRequested: true, changed: true, previousVersion: '1.47.0' });
});
const out = await hub.requestUpdate();
expect(calls).toEqual(['/api/installs/update-request']);
expect(out).toMatchObject({ version: '1.47.3', changed: true, previousVersion: '1.47.0' });
expect(mockSettings.get('hub_update_requested_version')).toBe('1.47.3');
expect(mockSettings.get('hub_update_requested_at')).toBe('2026-10-28T09:00:00.000Z');
});
test('an older Hub (no `changed`): the old request is withdrawn and made again', async () => {
let open = true;
global.fetch = jest.fn(async url => {
const path = new URL(url).pathname;
calls.push(path);
if (path.endsWith('/cancel')) { open = false; return reply(200, { cancelled: true }); }
return open
? reply(200, { requestedAt: '2026-10-20T09:00:00.000Z', version: '1.47.3', alreadyRequested: true })
: reply(201, { requestedAt: '2026-10-28T09:00:00.000Z', version: '1.47.3', alreadyRequested: false });
});
const out = await hub.requestUpdate();
expect(calls).toEqual(['/api/installs/update-request', '/api/installs/update-request/cancel', '/api/installs/update-request']);
expect(out).toMatchObject({ version: '1.47.3', changed: true, previousVersion: '1.47.0' });
expect(mockSettings.get('hub_update_requested_version')).toBe('1.47.3');
});
test('asking again for the version already asked for changes nothing', async () => {
mockSettings.set('hub_update_requested_version', '1.47.3');
global.fetch = jest.fn(async url => {
calls.push(new URL(url).pathname);
return reply(200, { requestedAt: '2026-10-20T09:00:00.000Z', version: '1.47.3', alreadyRequested: true });
});
await hub.requestUpdate();
expect(calls).toEqual(['/api/installs/update-request']);
});
});
+2 -1
View File
@@ -1,6 +1,6 @@
# Handover — where things stand and how to carry on
Last updated: 2026-10-28, after **1.47.3** (and Hub 1.4.0). The plan itself is in
Last updated: 2026-10-28, after **1.47.4** (and Hub 1.5.0). The plan itself is in
[ROADMAP-v2.md](./ROADMAP-v2.md) (decisions table at the end); the previous round of
features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
@@ -14,6 +14,7 @@ encrypted settings unreadable or break existing installs.
| Version | What |
|---------|------|
| 1.47.4 | Fix: an update request for a version that has since been overtaken shows as such, with **Ask for … instead** (and the banner again). Hub 1.5.0 moves the open request on (`changed`); with an older Hub `requestUpdate` withdraws and asks again |
| 1.47.3 | **Season passes** (§6 part 4): passes on the Event series page, buy on the series page (a registration per event, one checkout), price split by normal prices, one Payment per event from the webhook. Migration `20261028150000_season_pass` |
| 1.47.2 | **Series: year on year** report (§6 part 3): `GET /api/series/:id/compare` (`compareSeries` in `utils/series.js`), report `seriesComparison` in `ReportsV2`, "Compare" on the Event series page |
| 1.47.1 | **Event series** (§6 part 2): Event series page, Series box on events, public `/series/<slug>`, "Next in this series", follow (News & announcements email from the `series` job when a new event goes live). Migration `20261028140000_event_series` |
+9 -2
View File
@@ -144,12 +144,19 @@ Signed exactly like the heartbeat.
POST /api/installs/update-request
X-Hub-Install / X-Hub-Timestamp / X-Hub-Signature (as in §3)
{ "protocolVersion": 1, "version": "1.41.2" }
→ 201 { "requestedAt": "2026-10-27T09:00:00.000Z", "version": "1.42.0", "alreadyRequested": false }
→ 200 { …, "alreadyRequested": true } // a request is already open: not emailed again
→ 201 { "requestedAt": "2026-10-27T09:00:00.000Z", "version": "1.42.0", "alreadyRequested": false, "changed": false }
→ 200 { …, "alreadyRequested": true, "changed": false } // a request for the latest is already open: not emailed again
→ 200 { …, "alreadyRequested": true, "changed": true, "previousVersion": "1.42.0" }
// the open request was for an older version: it now asks for the latest
```
- The Hub opens an `update_requested` alert on the install (shown under Alerts) and emails the
alert address once. It is resolved when a heartbeat reports a newer version than before.
- **Changing a request (Hub 1.5.0):** when a request is open for a version that has since been
overtaken, asking again moves it on to the latest version — the alert says "latest is 1.47.3
(changed from 1.47.0)" and the alert address is emailed once about the change. `version` is
always the version now asked for. A Hub before 1.5.0 doesn't send `changed`; installs then
withdraw the request and ask again (two emails, same result).
- `409 UP_TO_DATE` — the install already runs the Hub's latest version (or none is set).
- Errors as in §3 (`INSTALL_NOT_FOUND`, `STALE_REQUEST`, `BAD_SIGNATURE`). Rate-limited (10 an
hour per IP). A Hub older than this section answers `404 NOT_FOUND`.
+2 -2
View File
@@ -1,12 +1,12 @@
{
"name": "hope-events-frontend",
"version": "1.47.3",
"version": "1.47.4",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "hope-events-frontend",
"version": "1.47.3",
"version": "1.47.4",
"dependencies": {
"@dnd-kit/core": "^6.3.1",
"@hookform/resolvers": "^5.2.1",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "hope-events-frontend",
"version": "1.47.3",
"version": "1.47.4",
"private": true,
"scripts": {
"dev": "next dev --turbopack",
+24 -7
View File
@@ -24,7 +24,8 @@ export type HubStatus = {
urgentUpdate: boolean;
updateSnoozed: boolean;
releases: HubRelease[];
updateRequest: { requestedAt: string; version: string } | null;
// `outdated`: a newer version than the one asked for is out (the request can be changed to it).
updateRequest: { requestedAt: string; version: string; outdated?: boolean } | null;
notices: HubNotice[];
};
@@ -138,6 +139,8 @@ export function LicenceTab({ active }: { active: boolean }) {
}
};
const requestUpdate = () => updateAction("/api/hub/update-request", undefined, "Update requested. Your provider has been told and will update the site.");
// Same request again: the Hub moves the open request on to the latest version.
const changeRequest = () => updateAction("/api/hub/update-request", undefined, `Request changed to version ${status?.latestVersion}. Your provider has been told.`);
const withdrawRequest = () => {
if (!confirm("Withdraw the update request? Your provider is told not to update the site for now.")) return;
updateAction("/api/hub/update-request/cancel", undefined, "Update request withdrawn. Your provider has been told.");
@@ -208,12 +211,26 @@ export function LicenceTab({ active }: { active: boolean }) {
</p>
)}
{status.updateRequest ? (
<div className="flex flex-wrap items-center gap-3">
<p className="text-gray-600">Version {status.latestVersion} is available. Update requested on {fmt(status.updateRequest.requestedAt)} — your provider will install it.</p>
{status.connected && (
<button onClick={withdrawRequest} disabled={busy} className="inline-flex items-center gap-1.5 px-3 py-1.5 rounded-lg border text-sm hover:bg-gray-50 disabled:opacity-50">
<Undo2 className="w-4 h-4" /> Withdraw request
</button>
<div className="space-y-2" data-testid="update-request">
<div className="flex flex-wrap items-center gap-3">
<p className="text-gray-600">
You asked for version <strong>{status.updateRequest.version}</strong> on {fmt(status.updateRequest.requestedAt)} — your provider will install it.
</p>
{status.connected && (
<button onClick={withdrawRequest} disabled={busy} className="inline-flex items-center gap-1.5 px-3 py-1.5 rounded-lg border text-sm hover:bg-gray-50 disabled:opacity-50">
<Undo2 className="w-4 h-4" /> Withdraw request
</button>
)}
</div>
{status.updateRequest.outdated && (
<div className="flex flex-wrap items-center gap-3 rounded-lg border border-brand-200 bg-brand-50 p-3">
<p className="text-brand-800">Version <strong>{status.latestVersion}</strong> has come out since. Ask for it instead, and your provider installs that one.</p>
{status.connected && (
<button onClick={changeRequest} disabled={busy} className="inline-flex items-center gap-1.5 px-3 py-1.5 rounded-lg bg-brand-600 text-white text-sm font-medium hover:bg-brand-700 disabled:opacity-50">
<ArrowUpCircle className="w-4 h-4" /> {busy ? "Working…" : `Ask for ${status.latestVersion} instead`}
</button>
)}
</div>
)}
</div>
) : (
@@ -52,17 +52,21 @@ export function LicenceBanner() {
</div>
);
}
// Once an update has been requested there's nothing more for the admin to do. "Not now" hides it
// until the next version, except for urgent (security or serious bug) updates.
if (status.urgentUpdate && !status.updateRequest) {
// Once the latest version has been requested there's nothing more for the admin to do. A request
// for a version that has since been overtaken shows again, to change it. "Not now" hides it until
// the next version, except for urgent (security or serious bug) updates.
const request = status.updateRequest;
const awaiting = !!request && !request.outdated;
const ask = request?.outdated ? <>You asked for {request.version}; change your request in {link}</> : <>Please request the update in {link}</>;
if (status.urgentUpdate && !awaiting) {
return (
<div role="alert" className="bg-red-50 border-b border-red-200 text-red-800 text-sm px-4 py-2 flex items-center gap-2">
<ShieldAlert className="w-4 h-4 shrink-0" />
<span>Cross Events {status.latestVersion} fixes a security problem or a serious bug (this site runs {status.version}). Please request the update in {link}</span>
<span>Cross Events {status.latestVersion} fixes a security problem or a serious bug (this site runs {status.version}). {ask}</span>
</div>
);
}
if (status.updateAvailable && !status.updateRequest && !status.updateSnoozed) {
if (status.updateAvailable && !awaiting && !status.updateSnoozed) {
const notNow = async () => {
setBusy(true);
try { setStatus(await apiFetch<HubStatus>("/api/hub/update-snooze", { method: "POST", authToken: token, body: { snooze: true } })); } catch { /* the Licence page shows why */ }
@@ -72,7 +76,7 @@ export function LicenceBanner() {
<div role="status" className="bg-brand-50 border-b border-brand-100 text-brand-800 text-sm px-4 py-2 flex flex-wrap items-center gap-x-3 gap-y-1">
<span className="flex items-center gap-2">
<ArrowUpCircle className="w-4 h-4 shrink-0" />
<span>Cross Events {status.latestVersion} is available (this site runs {status.version}). See what&apos;s new and request it in {link}</span>
<span>Cross Events {status.latestVersion} is available (this site runs {status.version}). {request?.outdated ? <>You asked for {request.version}; see what&apos;s new and change your request in {link}</> : <>See what&apos;s new and request it in {link}</>}</span>
</span>
<button onClick={notNow} disabled={busy} className="ml-auto inline-flex items-center gap-1 rounded-md px-2 py-0.5 text-brand-700 hover:bg-brand-100 disabled:opacity-50" title="Hide this until the next version comes out">
<BellOff className="w-3.5 h-3.5" /> Not now
+1 -1
View File
@@ -184,7 +184,7 @@ export const siteSettingsHelpContent: HelpContent = {
When a licence is suspended, revoked or past its grace period, nothing new can be added — no events, registrations or payments. Tickets for events people already paid for still scan, and all data can still be viewed and exported.
</GuideItem>
<GuideItem icon={ArrowUpCircle} title="Updates" tone="brand">
When a new version is out, the Version box shows what&apos;s new in it, so you can decide whether you want it. Press Request update and your provider updates the site for you — there&apos;s nothing to run yourself. Changed your mind? Withdraw request tells your provider not to.
When a new version is out, the Version box shows what&apos;s new in it, so you can decide whether you want it. Press Request update and your provider updates the site for you — there&apos;s nothing to run yourself. Changed your mind? Withdraw request tells your provider not to. If a newer version comes out before your provider has updated the site, the page shows which version you asked for and offers &quot;Ask for … instead&quot;.
</GuideItem>
<GuideItem icon={BellOff} title="Not now" tone="gray">
Not now (on the Licence page or the update banner) hides the reminder until the next version comes out. Updates that fix a security problem or a serious bug can&apos;t be put off.
+2 -2
View File
@@ -1,12 +1,12 @@
{
"name": "hope-events",
"version": "1.47.3",
"version": "1.47.4",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "hope-events",
"version": "1.47.3",
"version": "1.47.4",
"license": "ISC",
"devDependencies": {
"@playwright/test": "^1.64.0",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "hope-events",
"version": "1.47.3",
"version": "1.47.4",
"main": "index.js",
"scripts": {
"dev:backend": "cd backend && npm run dev",