Merge pull request 'Alpha Release 0.2.0' (#109) from dev into main

Reviewed-on: #109
Reviewed-by: Philipp Dormann <philipp@philippdormann.de>

.drone.yml

@@ -11,7 +11,7 @@ steps:
       - git checkout $DRONE_SOURCE_BRANCH
       - mv .env.ci .env
   - name: run tests
-    image: node:alpine
+    image: node:latest
     commands:
       - yarn
       - yarn test:ci
@@ -23,8 +23,15 @@ trigger:
 kind: pipeline
 type: docker
 name: build:dev
+clone:
+  disable: true
 
 steps:
+  - name: clone
+    image: alpine/git
+    commands:
+      - git clone $DRONE_REMOTE_URL .
+      - git checkout dev
   - name: build dev
     image: plugins/docker
     depends_on: [clone]
@@ -37,11 +44,41 @@ steps:
       tags:
         - dev
       registry: registry.odit.services
-    when:
-      branch:
-        - dev
-      event:
-        - push
+  - name: run changelog export
+    depends_on: ["clone"]
+    image: node:latest
+    commands:
+      - npx auto-changelog --commit-limit false -p -u --hide-credit
+  - name: push new changelog to repo
+    depends_on: ["run changelog export"]
+    image: appleboy/drone-git-push
+    settings:
+      branch: dev
+      commit: true
+      commit_message: 🧾New changelog file version [CI SKIP] [skip ci]
+      author_email: bot@odit.services
+      remote: git@git.odit.services:lfk/backend.git
+      ssh_key:
+        from_secret: GITLAB_SSHKEY
+  - name: run full license export
+    depends_on: ["clone"]
+    image: node:14.15.1-alpine3.12
+    commands:
+      - yarn
+      - yarn licenses:export
+  - name: push new licenses file to repo
+    depends_on: ["run full license export"]
+    image: appleboy/drone-git-push
+    settings:
+      branch: dev
+      commit: true
+      commit_message: 📖New license file version [CI SKIP] [skip ci]
+      author_email: bot@odit.services
+      remote: git@git.odit.services:lfk/backend.git
+      skip_verify: true
+      ssh_key:
+        from_secret: GITLAB_SSHKEY
+
 
 trigger:
   branch:
@@ -53,11 +90,20 @@ trigger:
 kind: pipeline
 type: docker
 name: build:latest
+clone:
+  disable: true
 
 steps:
+  - name: clone
+    image: alpine/git
+    commands:
+      - git clone $DRONE_REMOTE_URL .
+      - git checkout dev
+      - git merge main
+      - git checkout main
   - name: build latest
+    depends_on: ["clone"]
     image: plugins/docker
-    depends_on: [clone]
     settings:
       username:
         from_secret: DOCKER_REGISTRY_USER
@@ -67,6 +113,15 @@ steps:
       tags:
         - latest
       registry: registry.odit.services
+  - name: push merge to repo
+    depends_on: ["clone"]
+    image: appleboy/drone-git-push
+    settings:
+      branch: dev
+      commit: false
+      remote: git@git.odit.services:lfk/backend.git
+      ssh_key:
+        from_secret: GITLAB_SSHKEY
 
 trigger:
   branch:
@@ -90,22 +145,20 @@ steps:
         from_secret: DOCKER_REGISTRY_PASSWORD
       repo: registry.odit.services/lfk/backend
       tags:
-        - $DRONE_TAG
+        - '${DRONE_TAG}'
       registry: registry.odit.services
-  - name: trigger lib build
-    depends_on: [clone]
-    image: plugins/downstream
+  - name: trigger node lib build
+    image: idcooldi/drone-webhook
     settings:
-      server: https://ci.odit.services/
-      token: 
+      urls: https://ci.odit.services/api/repos/lfk/lfk-client-node/builds?SOURCE_TAG=${DRONE_TAG}
+      bearer:
+        from_secret: BOT_DRONE_KEY
+  - name: trigger js lib build
+    image: idcooldi/drone-webhook
+    settings:
+      urls: https://ci.odit.services/api/repos/lfk/lfk-client-js/builds?SOURCE_TAG=${DRONE_TAG}
+      bearer:
         from_secret: BOT_DRONE_KEY
-      fork: false
-      repositories:
-        - lfk/lib
-      params:
-      - SOURCE_TAG: $DRONE_TAG
 trigger:
-  branch:
-    - main
   event:
-    - tag
+  - tag

.env.ci

@@ -5,4 +5,5 @@ DB_PORT=unused
 DB_USER=unused
 DB_PASSWORD=bla
 DB_NAME=./test.sqlite
-NODE_ENV=dev
+NODE_ENV=dev
+POSTALCODE_COUNTRYCODE=DE

.env.example

@@ -5,4 +5,5 @@ DB_PORT=bla
 DB_USER=bla
 DB_PASSWORD=bla
 DB_NAME=bla
-NODE_ENV=production
+NODE_ENV=production
+POSTALCODE_COUNTRYCODE=DE

.gitignore

@@ -132,5 +132,7 @@ build
 
 *.sqlite
 *.sqlite-jurnal
-docs
-lib
+/docs
+lib
+/oss-attribution
+*.tmp

package.json

@@ -1,6 +1,6 @@
 {
-  "name": "@lfk/backend",
-  "version": "1.0.0",
+  "name": "@odit/lfk-backend",
+  "version": "0.2.0",
   "main": "src/app.ts",
   "repository": "https://git.odit.services/lfk/backend",
   "author": {
@@ -22,11 +22,11 @@
   ],
   "license": "CC-BY-NC-SA-4.0",
   "dependencies": {
-    "argon2": "^0.27.0",
+    "@odit/class-validator-jsonschema": "2.1.1",
+    "argon2": "^0.27.1",
     "body-parser": "^1.19.0",
-    "class-transformer": "^0.3.1",
-    "class-validator": "^0.12.2",
-    "class-validator-jsonschema": "^2.0.3",
+    "class-transformer": "0.3.1",
+    "class-validator": "^0.13.1",
     "consola": "^2.15.0",
     "cookie": "^0.4.1",
     "cookie-parser": "^1.4.5",
@@ -35,46 +35,64 @@
     "dotenv": "^8.2.0",
     "express": "^4.17.1",
     "jsonwebtoken": "^8.5.1",
+    "libphonenumber-js": "^1.9.7",
     "mysql": "^2.18.1",
     "pg": "^8.5.1",
     "reflect-metadata": "^0.1.13",
     "routing-controllers": "^0.9.0-alpha.6",
-    "routing-controllers-openapi": "^2.1.0",
-    "sqlite3": "^5.0.0",
-    "swagger-ui-express": "^4.1.5",
+    "routing-controllers-openapi": "^2.2.0",
+    "sqlite3": "5.0.0",
     "typeorm": "^0.2.29",
     "typeorm-routing-controllers-extensions": "^0.2.0",
     "typeorm-seeding": "^1.6.1",
-    "uuid": "^8.3.1"
+    "uuid": "^8.3.2",
+    "validator": "^13.5.2"
   },
   "devDependencies": {
-    "@types/cors": "^2.8.8",
+    "@odit/license-exporter": "^0.0.9",
+    "@types/cors": "^2.8.9",
     "@types/csvtojson": "^1.1.5",
     "@types/express": "^4.17.9",
     "@types/jest": "^26.0.16",
     "@types/jsonwebtoken": "^8.5.0",
-    "@types/node": "^14.14.9",
-    "@types/swagger-ui-express": "^4.1.2",
+    "@types/node": "^14.14.20",
     "@types/uuid": "^8.3.0",
-    "axios": "^0.21.0",
+    "axios": "^0.21.1",
+    "cp-cli": "^2.0.0",
     "jest": "^26.6.3",
-    "nodemon": "^2.0.6",
-    "rimraf": "^2.7.1",
-    "start-server-and-test": "^1.11.6",
+    "nodemon": "^2.0.7",
+    "release-it": "^14.2.2",
+    "rimraf": "^3.0.2",
+    "start-server-and-test": "^1.11.7",
     "ts-jest": "^26.4.4",
-    "ts-node": "^9.0.0",
-    "typedoc": "^0.19.2",
-    "typescript": "^4.1.2"
+    "ts-node": "^9.1.1",
+    "typedoc": "^0.20.14",
+    "typescript": "^4.1.3"
   },
   "scripts": {
     "dev": "nodemon src/app.ts",
-    "build": "tsc",
+    "build": "rimraf ./dist && tsc && cp-cli ./src/static ./dist/static",
     "docs": "typedoc --out docs src",
     "test": "jest",
     "test:watch": "jest --watchAll",
-    "test:ci": "start-server-and-test dev http://localhost:4010/api/openapi.json test",
+    "test:ci": "start-server-and-test dev http://localhost:4010/api/docs/openapi.json test",
     "seed": "ts-node ./node_modules/typeorm/cli.js schema:sync && ts-node ./node_modules/typeorm-seeding/dist/cli.js seed",
-    "openapi:export": "ts-node src/openapi_export.ts"
+    "openapi:export": "ts-node scripts/openapi_export.ts",
+    "licenses:export": "license-exporter --md",
+    "release": "release-it --only-version"
+  },
+  "release-it": {
+    "git": {
+      "commit": true,
+      "requireCleanWorkingDir": false,
+      "commitMessage": "🚀Bumped version to v${version}",
+      "requireBranch": "dev",
+      "push": false,
+      "tag": false
+    },
+    "npm": {
+      "publish": false
+    }
   },
   "nodemonConfig": {
     "ignore": [

scripts/openapi_export.ts

@@ -0,0 +1,34 @@
+import { validationMetadatasToSchemas } from '@odit/class-validator-jsonschema';
+import consola from "consola";
+import fs from "fs";
+import "reflect-metadata";
+import { createExpressServer, getMetadataArgsStorage } from "routing-controllers";
+import { generateSpec } from '../src/apispec';
+import { config } from '../src/config';
+import authchecker from "../src/middlewares/authchecker";
+import { ErrorHandler } from '../src/middlewares/ErrorHandler';
+
+const CONTROLLERS_FILE_EXTENSION = process.env.NODE_ENV === 'production' ? 'js' : 'ts';
+createExpressServer({
+    authorizationChecker: authchecker,
+    middlewares: [ErrorHandler],
+    development: config.development,
+    cors: true,
+    routePrefix: "/api",
+    controllers: [`${__dirname}/../src/controllers/*.${CONTROLLERS_FILE_EXTENSION}`],
+});
+
+const storage = getMetadataArgsStorage();
+const schemas = validationMetadatasToSchemas({
+    refPointerPrefix: "#/components/schemas/",
+});
+
+//Spec creation based on the previously created schemas
+const spec = generateSpec(storage, schemas);
+
+try {
+    fs.writeFileSync("./openapi.json", JSON.stringify(spec), { encoding: "utf-8" });
+    consola.success("Exported openapi spec to openapi.json");
+} catch (error) {
+    consola.error("Couldn't export the openapi spec");
+}

src/apispec.ts

@@ -0,0 +1,51 @@
+import { MetadataArgsStorage } from 'routing-controllers';
+import { routingControllersToSpec } from 'routing-controllers-openapi';
+import { config } from './config';
+
+/**
+ * This function generates a the openapi spec from route metadata and type schemas.
+ * @param storage MetadataArgsStorage object generated by routing-controllers.
+ * @param schemas MetadataArgsStorage object generated by class-validator-jsonschema.
+ */
+export function generateSpec(storage: MetadataArgsStorage, schemas) {
+    return routingControllersToSpec(
+        storage,
+        {
+            routePrefix: "/api"
+        },
+        {
+            components: {
+                schemas,
+                "securitySchemes": {
+                    "AuthToken": {
+                        "type": "http",
+                        "scheme": "bearer",
+                        "bearerFormat": "JWT",
+                        description: "A JWT based access token. Use /api/auth/login or /api/auth/refresh to get one."
+                    },
+                    "RefreshTokenCookie": {
+                        "type": "apiKey",
+                        "in": "cookie",
+                        "name": "lfk_backend__refresh_token",
+                        description: "A cookie containing a JWT based refreh token. Attention: Doesn't work in swagger-ui. Use /api/auth/login or /api/auth/refresh to get one."
+                    },
+                    "StatsApiToken": {
+                        "type": "http",
+                        "scheme": "bearer",
+                        description: "Api token that can be obtained by creating a new stats client (post to /api/statsclients). Only valid for obtaining stats."
+                    },
+                    "StationApiToken": {
+                        "type": "http",
+                        "scheme": "bearer",
+                        description: "Api token that can be obtained by creating a new scan station (post to /api/stations). Only valid for creating scans."
+                    }
+                }
+            },
+            info: {
+                description: "The the backend API for the LfK! runner system.",
+                title: "LfK! Backend API",
+                version: config.version
+            },
+        }
+    );
+}

src/app.ts

@@ -1,14 +1,16 @@
 import consola from "consola";
 import "reflect-metadata";
 import { createExpressServer } from "routing-controllers";
-import authchecker from "./authchecker";
 import { config, e as errors } from './config';
 import loaders from "./loaders/index";
+import authchecker from "./middlewares/authchecker";
 import { ErrorHandler } from './middlewares/ErrorHandler';
+import UserChecker from './middlewares/UserChecker';
 
 const CONTROLLERS_FILE_EXTENSION = process.env.NODE_ENV === 'production' ? 'js' : 'ts';
 const app = createExpressServer({
   authorizationChecker: authchecker,
+  currentUserChecker: UserChecker,
   middlewares: [ErrorHandler],
   development: config.development,
   cors: true,

src/config.ts

@@ -1,22 +1,33 @@
 import { config as configDotenv } from 'dotenv';
+import { CountryCode } from 'libphonenumber-js';
+import ValidatorJS from 'validator';
+
 configDotenv();
 export const config = {
     internal_port: parseInt(process.env.APP_PORT) || 4010,
     development: process.env.NODE_ENV === "production",
     jwt_secret: process.env.JWT_SECRET || "secretjwtsecret",
-    phone_validation_countrycode: process.env.PHONE_COUNTRYCODE || "ZZ"
+    phone_validation_countrycode: getPhoneCodeLocale(),
+    postalcode_validation_countrycode: getPostalCodeLocale(),
+    version: process.env.VERSION || require('../package.json').version
 }
 let errors = 0
 if (typeof config.internal_port !== "number") {
     errors++
 }
-if (typeof config.phone_validation_countrycode !== "string") {
-    errors++
-}
-if (config.phone_validation_countrycode.length !== 2) {
-    errors++
-}
 if (typeof config.development !== "boolean") {
     errors++
 }
+function getPhoneCodeLocale(): CountryCode {
+    return (process.env.PHONE_COUNTRYCODE as CountryCode);
+}
+function getPostalCodeLocale(): any {
+    try {
+        const stringArray: String[] = ValidatorJS.isPostalCodeLocales;
+        let index = stringArray.indexOf(process.env.POSTALCODE_COUNTRYCODE);
+        return ValidatorJS.isPostalCodeLocales[index];
+    } catch (error) {
+        return null;
+    }
+}
 export let e = errors

src/controllers/AuthController.ts

@@ -1,11 +1,13 @@
-import { Body, CookieParam, JsonController, Post, Res } from 'routing-controllers';
+import { Body, CookieParam, JsonController, Param, Post, Req, Res } from 'routing-controllers';
 import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
 import { IllegalJWTError, InvalidCredentialsError, JwtNotProvidedError, PasswordNeededError, RefreshTokenCountInvalidError, UsernameOrEmailNeededError } from '../errors/AuthError';
 import { UserNotFoundError } from '../errors/UserErrors';
-import { CreateAuth } from '../models/actions/CreateAuth';
+import { CreateAuth } from '../models/actions/create/CreateAuth';
+import { CreateResetToken } from '../models/actions/create/CreateResetToken';
 import { HandleLogout } from '../models/actions/HandleLogout';
 import { RefreshAuth } from '../models/actions/RefreshAuth';
-import { Auth } from '../models/responses/ResponseAuth';
+import { ResetPassword } from '../models/actions/ResetPassword';
+import { ResponseAuth } from '../models/responses/ResponseAuth';
 import { Logout } from '../models/responses/ResponseLogout';
 
 @JsonController('/auth')
@@ -14,13 +16,13 @@ export class AuthController {
 	}
 
 	@Post("/login")
-	@ResponseSchema(Auth)
+	@ResponseSchema(ResponseAuth)
 	@ResponseSchema(InvalidCredentialsError)
 	@ResponseSchema(UserNotFoundError)
 	@ResponseSchema(UsernameOrEmailNeededError)
 	@ResponseSchema(PasswordNeededError)
 	@ResponseSchema(InvalidCredentialsError)
-	@OpenAPI({ description: 'Create a new access token object' })
+	@OpenAPI({ description: 'Login with your username/email and password. <br> You will receive: \n * access token (use it as a bearer token) \n * refresh token (will also be sent as a cookie)' })
 	async login(@Body({ validate: true }) createAuth: CreateAuth, @Res() response: any) {
 		let auth;
 		try {
@@ -40,7 +42,7 @@ export class AuthController {
 	@ResponseSchema(UsernameOrEmailNeededError)
 	@ResponseSchema(PasswordNeededError)
 	@ResponseSchema(InvalidCredentialsError)
-	@OpenAPI({ description: 'Create a new access token object' })
+	@OpenAPI({ description: 'Logout using your refresh token. <br> This instantly invalidates all your access and refresh tokens.', security: [{ "RefreshTokenCookie": [] }] })
 	async logout(@Body({ validate: true }) handleLogout: HandleLogout, @CookieParam("lfk_backend__refresh_token") refresh_token: string, @Res() response: any) {
 		if (refresh_token && refresh_token.length != 0 && handleLogout.token == undefined) {
 			handleLogout.token = refresh_token;
@@ -58,13 +60,13 @@ export class AuthController {
 	}
 
 	@Post("/refresh")
-	@ResponseSchema(Auth)
+	@ResponseSchema(ResponseAuth)
 	@ResponseSchema(JwtNotProvidedError)
 	@ResponseSchema(IllegalJWTError)
 	@ResponseSchema(UserNotFoundError)
 	@ResponseSchema(RefreshTokenCountInvalidError)
-	@OpenAPI({ description: 'refresh a access token' })
-	async refresh(@Body({ validate: true }) refreshAuth: RefreshAuth, @CookieParam("lfk_backend__refresh_token") refresh_token: string, @Res() response: any) {
+	@OpenAPI({ description: 'Refresh your access and refresh tokens using a valid refresh token. <br> You will receive: \n * access token (use it as a bearer token) \n * refresh token (will also be sent as a cookie)', security: [{ "RefreshTokenCookie": [] }] })
+	async refresh(@Body({ validate: true }) refreshAuth: RefreshAuth, @CookieParam("lfk_backend__refresh_token") refresh_token: string, @Res() response: any, @Req() req: any) {
 		if (refresh_token && refresh_token.length != 0 && refreshAuth.token == undefined) {
 			refreshAuth.token = refresh_token;
 		}
@@ -78,4 +80,24 @@ export class AuthController {
 		}
 		return response.send(auth)
 	}
+
+	@Post("/reset")
+	@ResponseSchema(ResponseAuth)
+	@ResponseSchema(UserNotFoundError)
+	@ResponseSchema(UsernameOrEmailNeededError)
+	@OpenAPI({ description: "Request a password reset token. <br> This will provide you with a reset token that you can use by posting to /api/auth/reset/{token}." })
+	async getResetToken(@Body({ validate: true }) passwordReset: CreateResetToken) {
+		//This really shouldn't just get returned, but sent via mail or sth like that. But for dev only this is fine.
+		return { "resetToken": await passwordReset.toResetToken() };
+	}
+
+	@Post("/reset/:token")
+	@ResponseSchema(ResponseAuth)
+	@ResponseSchema(UserNotFoundError)
+	@ResponseSchema(UsernameOrEmailNeededError)
+	@OpenAPI({ description: "Reset a user's utilising a valid password reset token. <br> This will set the user's password to the one you provided in the body. <br> To get a reset token post to /api/auth/reset with your username." })
+	async resetPassword(@Param("token") token: string, @Body({ validate: true }) passwordReset: ResetPassword) {
+		passwordReset.resetToken = token;
+		return await passwordReset.resetPassword();
+	}
 }

src/controllers/DonationController.ts

@@ -0,0 +1,145 @@
+import { Authorized, Body, Delete, Get, JsonController, OnUndefined, Param, Post, Put, QueryParam } from 'routing-controllers';
+import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
+import { getConnectionManager, Repository } from 'typeorm';
+import { DonationIdsNotMatchingError, DonationNotFoundError } from '../errors/DonationErrors';
+import { DonorNotFoundError } from '../errors/DonorErrors';
+import { RunnerNotFoundError } from '../errors/RunnerErrors';
+import { CreateDistanceDonation } from '../models/actions/create/CreateDistanceDonation';
+import { CreateFixedDonation } from '../models/actions/create/CreateFixedDonation';
+import { UpdateDistanceDonation } from '../models/actions/update/UpdateDistanceDonation';
+import { UpdateFixedDonation } from '../models/actions/update/UpdateFixedDonation';
+import { DistanceDonation } from '../models/entities/DistanceDonation';
+import { Donation } from '../models/entities/Donation';
+import { FixedDonation } from '../models/entities/FixedDonation';
+import { ResponseDistanceDonation } from '../models/responses/ResponseDistanceDonation';
+import { ResponseDonation } from '../models/responses/ResponseDonation';
+import { ResponseEmpty } from '../models/responses/ResponseEmpty';
+
+@JsonController('/donations')
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+export class DonationController {
+	private donationRepository: Repository<Donation>;
+	private distanceDonationRepository: Repository<DistanceDonation>;
+	private fixedDonationRepository: Repository<FixedDonation>;
+
+	/**
+	 * Gets the repository of this controller's model/entity.
+	 */
+	constructor() {
+		this.donationRepository = getConnectionManager().get().getRepository(Donation);
+		this.distanceDonationRepository = getConnectionManager().get().getRepository(DistanceDonation);
+		this.fixedDonationRepository = getConnectionManager().get().getRepository(FixedDonation);
+	}
+
+	@Get()
+	@Authorized("DONATION:GET")
+	@ResponseSchema(ResponseDonation, { isArray: true })
+	@ResponseSchema(ResponseDistanceDonation, { isArray: true })
+	@OpenAPI({ description: 'Lists all donations (fixed or distance based) from all donors. <br> This includes the donations\'s runner\'s distance ran(if distance donation).' })
+	async getAll() {
+		let responseDonations: ResponseDonation[] = new Array<ResponseDonation>();
+		const donations = await this.donationRepository.find({ relations: ['runner', 'donor', 'runner.scans', 'runner.scans.track'] });
+		donations.forEach(donation => {
+			responseDonations.push(donation.toResponse());
+		});
+		return responseDonations;
+	}
+
+	@Get('/:id')
+	@Authorized("DONATION:GET")
+	@ResponseSchema(ResponseDonation)
+	@ResponseSchema(ResponseDistanceDonation)
+	@ResponseSchema(DonationNotFoundError, { statusCode: 404 })
+	@OnUndefined(DonationNotFoundError)
+	@OpenAPI({ description: 'Lists all information about the donation whose id got provided. This includes the donation\'s runner\'s distance ran (if distance donation).' })
+	async getOne(@Param('id') id: number) {
+		let donation = await this.donationRepository.findOne({ id: id }, { relations: ['runner', 'donor', 'runner.scans', 'runner.scans.track'] })
+		if (!donation) { throw new DonationNotFoundError(); }
+		return donation.toResponse();
+	}
+
+	@Post('/fixed')
+	@Authorized("DONATION:CREATE")
+	@ResponseSchema(ResponseDonation)
+	@ResponseSchema(DonorNotFoundError, { statusCode: 404 })
+	@OpenAPI({ description: 'Create a fixed donation (not distance donation - use /donations/distance instead). <br> Please rmemember to provide the donation\'s donors\'s id and amount.' })
+	async postFixed(@Body({ validate: true }) createDonation: CreateFixedDonation) {
+		let donation = await createDonation.toEntity();
+		donation = await this.fixedDonationRepository.save(donation);
+		return (await this.donationRepository.findOne({ id: donation.id }, { relations: ['donor'] })).toResponse();
+	}
+
+	@Post('/distance')
+	@Authorized("DONATION:CREATE")
+	@ResponseSchema(ResponseDistanceDonation)
+	@ResponseSchema(DonorNotFoundError, { statusCode: 404 })
+	@ResponseSchema(RunnerNotFoundError, { statusCode: 404 })
+	@OpenAPI({ description: 'Create a distance donation (not fixed donation - use /donations/fixed instead). <br> Please rmemember to provide the donation\'s donors\'s and runner\s ids and amount per distance (kilometer).' })
+	async postDistance(@Body({ validate: true }) createDonation: CreateDistanceDonation) {
+		let donation = await createDonation.toEntity();
+		donation = await this.distanceDonationRepository.save(donation);
+		return (await this.donationRepository.findOne({ id: donation.id }, { relations: ['runner', 'donor', 'runner.scans', 'runner.scans.track'] })).toResponse();
+	}
+
+	@Put('/fixed/:id')
+	@Authorized("DONATION:UPDATE")
+	@ResponseSchema(ResponseDonation)
+	@ResponseSchema(DonationNotFoundError, { statusCode: 404 })
+	@ResponseSchema(DonorNotFoundError, { statusCode: 404 })
+	@ResponseSchema(RunnerNotFoundError, { statusCode: 404 })
+	@ResponseSchema(DonationIdsNotMatchingError, { statusCode: 406 })
+	@OpenAPI({ description: "Update the fixed donation (not distance donation - use /donations/distance instead) whose id you provided. <br> Please remember that ids can't be changed and amounts must be positive." })
+	async putFixed(@Param('id') id: number, @Body({ validate: true }) donation: UpdateFixedDonation) {
+		let oldDonation = await this.fixedDonationRepository.findOne({ id: id });
+
+		if (!oldDonation) {
+			throw new DonationNotFoundError();
+		}
+
+		if (oldDonation.id != donation.id) {
+			throw new DonationIdsNotMatchingError();
+		}
+
+		await this.fixedDonationRepository.save(await donation.update(oldDonation));
+		return (await this.donationRepository.findOne({ id: donation.id }, { relations: ['donor'] })).toResponse();
+	}
+
+	@Put('/distance/:id')
+	@Authorized("DONATION:UPDATE")
+	@ResponseSchema(ResponseDonation)
+	@ResponseSchema(DonationNotFoundError, { statusCode: 404 })
+	@ResponseSchema(DonorNotFoundError, { statusCode: 404 })
+	@ResponseSchema(RunnerNotFoundError, { statusCode: 404 })
+	@ResponseSchema(DonationIdsNotMatchingError, { statusCode: 406 })
+	@OpenAPI({ description: "Update the distance donation (not fixed donation - use /donations/fixed instead) whose id you provided. <br> Please remember that ids can't be changed and amountPerDistance must be positive." })
+	async putDistance(@Param('id') id: number, @Body({ validate: true }) donation: UpdateDistanceDonation) {
+		let oldDonation = await this.distanceDonationRepository.findOne({ id: id });
+
+		if (!oldDonation) {
+			throw new DonationNotFoundError();
+		}
+
+		if (oldDonation.id != donation.id) {
+			throw new DonationIdsNotMatchingError();
+		}
+
+		await this.distanceDonationRepository.save(await donation.update(oldDonation));
+		return (await this.donationRepository.findOne({ id: donation.id }, { relations: ['runner', 'donor', 'runner.scans', 'runner.scans.track'] })).toResponse();
+	}
+
+	@Delete('/:id')
+	@Authorized("DONATION:DELETE")
+	@ResponseSchema(ResponseDonation)
+	@ResponseSchema(ResponseDistanceDonation)
+	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
+	@OnUndefined(204)
+	@OpenAPI({ description: 'Delete the donation whose id you provided. <br> If no donation with this id exists it will just return 204(no content).' })
+	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
+		let donation = await this.donationRepository.findOne({ id: id });
+		if (!donation) { return null; }
+		const responseScan = await this.donationRepository.findOne({ id: donation.id }, { relations: ['runner', 'donor', 'runner.scans', 'runner.scans.track'] });
+
+		await this.donationRepository.delete(donation);
+		return responseScan.toResponse();
+	}
+}

src/controllers/DonorController.ts

@@ -0,0 +1,113 @@
+import { Authorized, Body, Delete, Get, JsonController, OnUndefined, Param, Post, Put, QueryParam } from 'routing-controllers';
+import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
+import { getConnectionManager, Repository } from 'typeorm';
+import { DonorHasDonationsError, DonorIdsNotMatchingError, DonorNotFoundError } from '../errors/DonorErrors';
+import { CreateDonor } from '../models/actions/create/CreateDonor';
+import { UpdateDonor } from '../models/actions/update/UpdateDonor';
+import { Donor } from '../models/entities/Donor';
+import { ResponseDonor } from '../models/responses/ResponseDonor';
+import { ResponseEmpty } from '../models/responses/ResponseEmpty';
+import { DonationController } from './DonationController';
+
+@JsonController('/donors')
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+export class DonorController {
+	private donorRepository: Repository<Donor>;
+
+	/**
+	 * Gets the repository of this controller's model/entity.
+	 */
+	constructor() {
+		this.donorRepository = getConnectionManager().get().getRepository(Donor);
+	}
+
+	@Get()
+	@Authorized("DONOR:GET")
+	@ResponseSchema(ResponseDonor, { isArray: true })
+	@OpenAPI({ description: 'Lists all donor. <br> This includes the donor\'s current donation amount.' })
+	async getAll() {
+		let responseDonors: ResponseDonor[] = new Array<ResponseDonor>();
+		const donors = await this.donorRepository.find({ relations: ['donations', 'donations.runner', 'donations.runner.scans', 'donations.runner.scans.track'] });
+		donors.forEach(donor => {
+			responseDonors.push(new ResponseDonor(donor));
+		});
+		return responseDonors;
+	}
+
+	@Get('/:id')
+	@Authorized("DONOR:GET")
+	@ResponseSchema(ResponseDonor)
+	@ResponseSchema(DonorNotFoundError, { statusCode: 404 })
+	@OnUndefined(DonorNotFoundError)
+	@OpenAPI({ description: 'Lists all information about the donor whose id got provided. <br> This includes the donor\'s current donation amount.' })
+	async getOne(@Param('id') id: number) {
+		let donor = await this.donorRepository.findOne({ id: id }, { relations: ['donations', 'donations.runner', 'donations.runner.scans', 'donations.runner.scans.track'] })
+		if (!donor) { throw new DonorNotFoundError(); }
+		return new ResponseDonor(donor);
+	}
+
+	@Post()
+	@Authorized("DONOR:CREATE")
+	@ResponseSchema(ResponseDonor)
+	@OpenAPI({ description: 'Create a new donor.' })
+	async post(@Body({ validate: true }) createRunner: CreateDonor) {
+		let donor;
+		try {
+			donor = await createRunner.toEntity();
+		} catch (error) {
+			throw error;
+		}
+
+		donor = await this.donorRepository.save(donor)
+		return new ResponseDonor(await this.donorRepository.findOne(donor, { relations: ['donations', 'donations.runner', 'donations.runner.scans', 'donations.runner.scans.track'] }));
+	}
+
+	@Put('/:id')
+	@Authorized("DONOR:UPDATE")
+	@ResponseSchema(ResponseDonor)
+	@ResponseSchema(DonorNotFoundError, { statusCode: 404 })
+	@ResponseSchema(DonorIdsNotMatchingError, { statusCode: 406 })
+	@OpenAPI({ description: "Update the donor whose id you provided. <br> Please remember that ids can't be changed." })
+	async put(@Param('id') id: number, @Body({ validate: true }) donor: UpdateDonor) {
+		let oldDonor = await this.donorRepository.findOne({ id: id });
+
+		if (!oldDonor) {
+			throw new DonorNotFoundError();
+		}
+
+		if (oldDonor.id != donor.id) {
+			throw new DonorIdsNotMatchingError();
+		}
+
+		await this.donorRepository.save(await donor.update(oldDonor));
+		return new ResponseDonor(await this.donorRepository.findOne({ id: id }, { relations: ['donations', 'donations.runner', 'donations.runner.scans', 'donations.runner.scans.track'] }));
+	}
+
+	@Delete('/:id')
+	@Authorized("DONOR:DELETE")
+	@ResponseSchema(ResponseDonor)
+	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
+	@OnUndefined(204)
+	@OpenAPI({ description: 'Delete the donor whose id you provided. <br> If no donor with this id exists it will just return 204(no content). <br> If the donor still has donations associated this will fail, please provide the query param ?force=true to delete the donor with all associated donations.' })
+	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
+		let donor = await this.donorRepository.findOne({ id: id });
+		if (!donor) { return null; }
+		const responseDonor = await this.donorRepository.findOne(donor, { relations: ['donations', 'donations.runner', 'donations.runner.scans', 'donations.runner.scans.track'] });
+
+		if (!donor) {
+			throw new DonorNotFoundError();
+		}
+
+		const donorDonations = (await this.donorRepository.findOne({ id: donor.id }, { relations: ["donations"] })).donations;
+		if (donorDonations.length > 0 && !force) {
+			throw new DonorHasDonationsError();
+		}
+		const donationController = new DonationController();
+		for (let donation of donorDonations) {
+			await donationController.remove(donation.id, force);
+		}
+
+		await this.donorRepository.delete(donor);
+		return new ResponseDonor(responseDonor);
+	}
+}

src/controllers/GroupContactController.ts

@@ -0,0 +1,107 @@
+import { Authorized, Body, Delete, Get, JsonController, OnUndefined, Param, Post, Put, QueryParam } from 'routing-controllers';
+import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
+import { getConnection, getConnectionManager, Repository } from 'typeorm';
+import { GroupContactIdsNotMatchingError, GroupContactNotFoundError } from '../errors/GroupContactErrors';
+import { RunnerGroupNotFoundError } from '../errors/RunnerGroupErrors';
+import { CreateGroupContact } from '../models/actions/create/CreateGroupContact';
+import { UpdateGroupContact } from '../models/actions/update/UpdateGroupContact';
+import { GroupContact } from '../models/entities/GroupContact';
+import { RunnerGroup } from '../models/entities/RunnerGroup';
+import { ResponseEmpty } from '../models/responses/ResponseEmpty';
+import { ResponseGroupContact } from '../models/responses/ResponseGroupContact';
+
+@JsonController('/contacts')
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+export class GroupContactController {
+	private contactRepository: Repository<GroupContact>;
+
+	/**
+	 * Gets the repository of this controller's model/entity.
+	 */
+	constructor() {
+		this.contactRepository = getConnectionManager().get().getRepository(GroupContact);
+	}
+
+	@Get()
+	@Authorized("CONTACT:GET")
+	@ResponseSchema(ResponseGroupContact, { isArray: true })
+	@OpenAPI({ description: 'Lists all contacts. <br> This includes the contact\'s associated groups.' })
+	async getAll() {
+		let responseContacts: ResponseGroupContact[] = new Array<ResponseGroupContact>();
+		const contacts = await this.contactRepository.find({ relations: ['groups'] });
+		contacts.forEach(contact => {
+			responseContacts.push(contact.toResponse());
+		});
+		return responseContacts;
+	}
+
+	@Get('/:id')
+	@Authorized("CONTACT:GET")
+	@ResponseSchema(ResponseGroupContact)
+	@ResponseSchema(GroupContactNotFoundError, { statusCode: 404 })
+	@OnUndefined(GroupContactNotFoundError)
+	@OpenAPI({ description: 'Lists all information about the contact whose id got provided. <br> This includes the contact\'s associated groups.' })
+	async getOne(@Param('id') id: number) {
+		let contact = await this.contactRepository.findOne({ id: id }, { relations: ['groups'] })
+		if (!contact) { throw new GroupContactNotFoundError(); }
+		return contact.toResponse();
+	}
+
+	@Post()
+	@Authorized("CONTACT:CREATE")
+	@ResponseSchema(ResponseGroupContact)
+	@ResponseSchema(RunnerGroupNotFoundError, { statusCode: 404 })
+	@OpenAPI({ description: 'Create a new contact.' })
+	async post(@Body({ validate: true }) createContact: CreateGroupContact) {
+		let contact;
+		try {
+			contact = await createContact.toEntity();
+		} catch (error) {
+			throw error;
+		}
+
+		contact = await this.contactRepository.save(contact)
+		return (await this.contactRepository.findOne({ id: contact.id }, { relations: ['groups'] })).toResponse();
+	}
+
+	@Put('/:id')
+	@Authorized("CONTACT:UPDATE")
+	@ResponseSchema(ResponseGroupContact)
+	@ResponseSchema(GroupContactNotFoundError, { statusCode: 404 })
+	@ResponseSchema(GroupContactIdsNotMatchingError, { statusCode: 406 })
+	@ResponseSchema(RunnerGroupNotFoundError, { statusCode: 404 })
+	@OpenAPI({ description: "Update the contact whose id you provided. <br> Please remember that ids can't be changed." })
+	async put(@Param('id') id: number, @Body({ validate: true }) contact: UpdateGroupContact) {
+		let oldContact = await this.contactRepository.findOne({ id: id });
+
+		if (!oldContact) {
+			throw new GroupContactNotFoundError();
+		}
+
+		if (oldContact.id != contact.id) {
+			throw new GroupContactIdsNotMatchingError();
+		}
+
+		await this.contactRepository.save(await contact.update(oldContact));
+		return (await this.contactRepository.findOne({ id: contact.id }, { relations: ['groups'] })).toResponse();
+	}
+
+	@Delete('/:id')
+	@Authorized("CONTACT:DELETE")
+	@ResponseSchema(ResponseGroupContact)
+	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
+	@OnUndefined(204)
+	@OpenAPI({ description: 'Delete the contact whose id you provided. <br> If no contact with this id exists it will just return 204(no content). <br> This won\'t delete any groups associated with the contact.' })
+	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
+		let contact = await this.contactRepository.findOne({ id: id });
+		if (!contact) { return null; }
+		const responseContact = await this.contactRepository.findOne(contact, { relations: ['groups'] });
+		for (let group of responseContact.groups) {
+			group.contact = null;
+			await getConnection().getRepository(RunnerGroup).save(group);
+		}
+
+		await this.contactRepository.delete(contact);
+		return responseContact.toResponse();
+	}
+}

src/controllers/ImportController.ts

@@ -10,7 +10,7 @@ import { RunnerController } from './RunnerController';
 
 @Controller()
 @Authorized(["RUNNER:IMPORT", "TEAM:IMPORT"])
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class ImportController {
     private runnerController: RunnerController;
 
@@ -26,7 +26,7 @@ export class ImportController {
     @ResponseSchema(ResponseRunner, { isArray: true, statusCode: 200 })
     @ResponseSchema(RunnerGroupNotFoundError, { statusCode: 404 })
     @ResponseSchema(RunnerGroupNeededError, { statusCode: 406 })
-    @OpenAPI({ description: "Create new runners from json and insert them (or their teams) into the provided group" })
+    @OpenAPI({ description: "Create new runners from json and insert them into the provided group. <br> If teams/classes are provided alongside the runner's name they'll automaticly be created under the provided org and the runners will be inserted into the teams instead." })
     async postJSON(@Body({ validate: true, type: ImportRunner }) importRunners: ImportRunner[], @QueryParam("group") groupID: number) {
         if (!groupID) { throw new RunnerGroupNeededError(); }
         let responseRunners: ResponseRunner[] = new Array<ResponseRunner>();
@@ -41,7 +41,7 @@ export class ImportController {
     @ResponseSchema(ResponseRunner, { isArray: true, statusCode: 200 })
     @ResponseSchema(RunnerGroupNotFoundError, { statusCode: 404 })
     @ResponseSchema(RunnerGroupNeededError, { statusCode: 406 })
-    @OpenAPI({ description: "Create new runners from json and insert them (or their teams) into the provided org" })
+    @OpenAPI({ description: "Create new runners from json and insert them into the provided org. <br> If teams/classes are provided alongside the runner's name they'll automaticly be created under the provided org and the runners will be inserted into the teams instead." })
     async postOrgsJSON(@Body({ validate: true, type: ImportRunner }) importRunners: ImportRunner[], @Param('id') id: number) {
         return await this.postJSON(importRunners, id)
     }
@@ -62,7 +62,7 @@ export class ImportController {
     @ResponseSchema(ResponseRunner, { isArray: true, statusCode: 200 })
     @ResponseSchema(RunnerGroupNotFoundError, { statusCode: 404 })
     @ResponseSchema(RunnerGroupNeededError, { statusCode: 406 })
-    @OpenAPI({ description: "Create new runners from csv and insert them (or their teams) into the provided group" })
+    @OpenAPI({ description: "Create new runners from csv and insert them into the provided group. <br> If teams/classes are provided alongside the runner's name they'll automaticly be created under the provided org and the runners will be inserted into the teams instead." })
     async postCSV(@Req() request: any, @QueryParam("group") groupID: number) {
         let csvParse = await csv({ delimiter: [",", ";"], trim: true }).fromString(request.rawBody.toString());
         let importRunners: ImportRunner[] = new Array<ImportRunner>();
@@ -84,7 +84,7 @@ export class ImportController {
     @ResponseSchema(ResponseRunner, { isArray: true, statusCode: 200 })
     @ResponseSchema(RunnerGroupNotFoundError, { statusCode: 404 })
     @ResponseSchema(RunnerGroupNeededError, { statusCode: 406 })
-    @OpenAPI({ description: "Create new runners from csv and insert them (or their teams) into the provided org" })
+    @OpenAPI({ description: "Create new runners from csv and insert them into the provided org. <br> If teams/classes are provided alongside the runner's name they'll automaticly be created under the provided org and the runners will be inserted into the teams instead." })
     async postOrgsCSV(@Req() request: any, @Param("id") id: number) {
         return await this.postCSV(request, id);
     }

src/controllers/MeController.ts

@@ -0,0 +1,86 @@
+import { Body, CurrentUser, Delete, Get, JsonController, OnUndefined, Put, QueryParam } from 'routing-controllers';
+import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
+import { getConnectionManager, Repository } from 'typeorm';
+import { UserDeletionNotConfirmedError, UserIdsNotMatchingError, UsernameContainsIllegalCharacterError, UserNotFoundError } from '../errors/UserErrors';
+import { UpdateUser } from '../models/actions/update/UpdateUser';
+import { User } from '../models/entities/User';
+import { ResponseUser } from '../models/responses/ResponseUser';
+import { ResponseUserPermissions } from '../models/responses/ResponseUserPermissions';
+import { PermissionController } from './PermissionController';
+
+
+@JsonController('/users/me')
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+export class MeController {
+	private userRepository: Repository<User>;
+
+	/**
+	 * Gets the repository of this controller's model/entity.
+	 */
+	constructor() {
+		this.userRepository = getConnectionManager().get().getRepository(User);
+	}
+
+	@Get('/')
+	@ResponseSchema(ResponseUser)
+	@ResponseSchema(UserNotFoundError, { statusCode: 404 })
+	@OnUndefined(UserNotFoundError)
+	@OpenAPI({ description: 'Lists all information about yourself.' })
+	async get(@CurrentUser() currentUser: User) {
+		let user = await this.userRepository.findOne({ id: currentUser.id }, { relations: ['permissions', 'groups', 'groups.permissions', 'permissions.principal', 'groups.permissions.principal'] })
+		if (!user) { throw new UserNotFoundError(); }
+		return new ResponseUser(user);
+	}
+
+	@Get('/')
+	@ResponseSchema(ResponseUserPermissions)
+	@ResponseSchema(UserNotFoundError, { statusCode: 404 })
+	@OnUndefined(UserNotFoundError)
+	@OpenAPI({ description: 'Lists all permissions granted to the you sorted into directly granted and inherited as permission response objects.' })
+	async getPermissions(@CurrentUser() currentUser: User) {
+		let user = await this.userRepository.findOne({ id: currentUser.id }, { relations: ['permissions', 'groups', 'groups.permissions', 'permissions.principal', 'groups.permissions.principal'] })
+		if (!user) { throw new UserNotFoundError(); }
+		return new ResponseUserPermissions(user);
+	}
+
+	@Put('/')
+	@ResponseSchema(ResponseUser)
+	@ResponseSchema(UserNotFoundError, { statusCode: 404 })
+	@ResponseSchema(UserIdsNotMatchingError, { statusCode: 406 })
+	@ResponseSchema(UsernameContainsIllegalCharacterError, { statusCode: 406 })
+	@OpenAPI({ description: "Update the yourself. <br> You can't edit your own permissions or group memberships here - Please use the /api/users/:id enpoint instead. <br> Please remember that ids can't be changed." })
+	async put(@CurrentUser() currentUser: User, @Body({ validate: true }) updateUser: UpdateUser) {
+		let oldUser = await this.userRepository.findOne({ id: currentUser.id }, { relations: ['groups'] });
+		updateUser.groups = oldUser.groups.map(g => g.id);
+
+		if (!oldUser) {
+			throw new UserNotFoundError();
+		}
+
+		if (oldUser.id != updateUser.id) {
+			throw new UserIdsNotMatchingError();
+		}
+		await this.userRepository.save(await updateUser.update(oldUser));
+
+		return new ResponseUser(await this.userRepository.findOne({ id: currentUser.id }, { relations: ['permissions', 'groups', 'groups.permissions'] }));
+	}
+
+	@Delete('/')
+	@ResponseSchema(ResponseUser)
+	@ResponseSchema(UserNotFoundError, { statusCode: 404 })
+	@ResponseSchema(UserDeletionNotConfirmedError, { statusCode: 406 })
+	@OpenAPI({ description: 'Delete yourself. <br> You have to confirm your decision by providing the ?force=true query param. <br> If there are any permissions directly granted to you they will get deleted as well.' })
+	async remove(@CurrentUser() currentUser: User, @QueryParam("force") force: boolean) {
+		if (!force) { throw new UserDeletionNotConfirmedError; }
+		if (!currentUser) { return UserNotFoundError; }
+		const responseUser = await this.userRepository.findOne({ id: currentUser.id }, { relations: ['permissions', 'groups', 'groups.permissions'] });;
+
+		const permissionControler = new PermissionController();
+		for (let permission of responseUser.permissions) {
+			await permissionControler.remove(permission.id, true);
+		}
+
+		await this.userRepository.delete(currentUser);
+		return new ResponseUser(responseUser);
+	}
+}

src/controllers/PermissionController.ts

@@ -3,8 +3,8 @@ import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
 import { getConnectionManager, Repository } from 'typeorm';
 import { PermissionIdsNotMatchingError, PermissionNeedsPrincipalError, PermissionNotFoundError } from '../errors/PermissionErrors';
 import { PrincipalNotFoundError } from '../errors/PrincipalErrors';
-import { CreatePermission } from '../models/actions/CreatePermission';
-import { UpdatePermission } from '../models/actions/UpdatePermission';
+import { CreatePermission } from '../models/actions/create/CreatePermission';
+import { UpdatePermission } from '../models/actions/update/UpdatePermission';
 import { Permission } from '../models/entities/Permission';
 import { ResponseEmpty } from '../models/responses/ResponseEmpty';
 import { ResponsePermission } from '../models/responses/ResponsePermission';
@@ -12,7 +12,7 @@ import { ResponsePrincipal } from '../models/responses/ResponsePrincipal';
 
 
 @JsonController('/permissions')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class PermissionController {
     private permissionRepository: Repository<Permission>;
 
@@ -26,7 +26,7 @@ export class PermissionController {
     @Get()
     @Authorized("PERMISSION:GET")
     @ResponseSchema(ResponsePermission, { isArray: true })
-    @OpenAPI({ description: 'Lists all permissions.' })
+    @OpenAPI({ description: 'Lists all permissions for all users and groups.' })
     async getAll() {
         let responsePermissions: ResponsePermission[] = new Array<ResponsePermission>();
         const permissions = await this.permissionRepository.find({ relations: ['principal'] });
@@ -42,7 +42,7 @@ export class PermissionController {
     @ResponseSchema(ResponsePermission)
     @ResponseSchema(PermissionNotFoundError, { statusCode: 404 })
     @OnUndefined(PermissionNotFoundError)
-    @OpenAPI({ description: 'Returns a permissions of a specified id (if it exists)' })
+    @OpenAPI({ description: 'Lists all information about the permission whose id got provided.' })
     async getOne(@Param('id') id: number) {
         let permission = await this.permissionRepository.findOne({ id: id }, { relations: ['principal'] });
         if (!permission) { throw new PermissionNotFoundError(); }
@@ -54,11 +54,11 @@ export class PermissionController {
     @Authorized("PERMISSION:CREATE")
     @ResponseSchema(ResponsePermission)
     @ResponseSchema(PrincipalNotFoundError, { statusCode: 404 })
-    @OpenAPI({ description: 'Create a new runnerTeam object (id will be generated automagicly).' })
+    @OpenAPI({ description: 'Create a new permission for a existing principal(user/group). <br> If a permission with this target, action and prinicpal already exists that permission will be returned instead of creating a new one.' })
     async post(@Body({ validate: true }) createPermission: CreatePermission) {
         let permission;
         try {
-            permission = await createPermission.toPermission();
+            permission = await createPermission.toEntity();
         } catch (error) {
             throw error;
         }
@@ -79,7 +79,7 @@ export class PermissionController {
     @ResponseSchema(PrincipalNotFoundError, { statusCode: 404 })
     @ResponseSchema(PermissionIdsNotMatchingError, { statusCode: 406 })
     @ResponseSchema(PermissionNeedsPrincipalError, { statusCode: 406 })
-    @OpenAPI({ description: "Update a permission object (id can't be changed)." })
+    @OpenAPI({ description: "Update a permission object. <br> If updateing the permission object would result in duplicate permission (same target, action and principal) this permission will get deleted and the existing permission will be returned. <br> Please remember that ids can't be changed." })
     async put(@Param('id') id: number, @Body({ validate: true }) permission: UpdatePermission) {
         let oldPermission = await this.permissionRepository.findOne({ id: id }, { relations: ['principal'] });
 
@@ -90,13 +90,13 @@ export class PermissionController {
         if (oldPermission.id != permission.id) {
             throw new PermissionIdsNotMatchingError();
         }
-        let existingPermission = await this.permissionRepository.findOne({ target: permission.target, action: permission.action, principal: permission.principal }, { relations: ['principal'] });
+        let existingPermission = await this.permissionRepository.findOne({ target: permission.target, action: permission.action, principal: await permission.getPrincipal() }, { relations: ['principal'] });
         if (existingPermission) {
             await this.remove(permission.id, true);
             return new ResponsePermission(existingPermission);
         }
 
-        await this.permissionRepository.save(await permission.updatePermission(oldPermission));
+        await this.permissionRepository.save(await permission.update(oldPermission));
 
         return new ResponsePermission(await this.permissionRepository.findOne({ id: permission.id }, { relations: ['principal'] }));
     }
@@ -106,7 +106,7 @@ export class PermissionController {
     @ResponseSchema(ResponsePermission)
     @ResponseSchema(ResponseEmpty, { statusCode: 204 })
     @OnUndefined(204)
-    @OpenAPI({ description: 'Delete a specified permission (if it exists).' })
+    @OpenAPI({ description: 'Deletes the permission whose id you provide. <br> If no permission with this id exists it will just return 204(no content).' })
     async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
         let permission = await this.permissionRepository.findOne({ id: id }, { relations: ['principal'] });
         if (!permission) { return null; }

src/controllers/RunnerCardController.ts

@@ -0,0 +1,106 @@
+import { Authorized, Body, Delete, Get, JsonController, OnUndefined, Param, Post, Put, QueryParam } from 'routing-controllers';
+import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
+import { getConnectionManager, Repository } from 'typeorm';
+import { RunnerCardHasScansError, RunnerCardIdsNotMatchingError, RunnerCardNotFoundError } from '../errors/RunnerCardErrors';
+import { RunnerNotFoundError } from '../errors/RunnerErrors';
+import { CreateRunnerCard } from '../models/actions/create/CreateRunnerCard';
+import { UpdateRunnerCard } from '../models/actions/update/UpdateRunnerCard';
+import { RunnerCard } from '../models/entities/RunnerCard';
+import { ResponseEmpty } from '../models/responses/ResponseEmpty';
+import { ResponseRunnerCard } from '../models/responses/ResponseRunnerCard';
+import { ScanController } from './ScanController';
+
+@JsonController('/cards')
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+export class RunnerCardController {
+	private cardRepository: Repository<RunnerCard>;
+
+	/**
+	 * Gets the repository of this controller's model/entity.
+	 */
+	constructor() {
+		this.cardRepository = getConnectionManager().get().getRepository(RunnerCard);
+	}
+
+	@Get()
+	@Authorized("CARD:GET")
+	@ResponseSchema(ResponseRunnerCard, { isArray: true })
+	@OpenAPI({ description: 'Lists all card.' })
+	async getAll() {
+		let responseCards: ResponseRunnerCard[] = new Array<ResponseRunnerCard>();
+		const cards = await this.cardRepository.find({ relations: ['runner'] });
+		cards.forEach(card => {
+			responseCards.push(new ResponseRunnerCard(card));
+		});
+		return responseCards;
+	}
+
+	@Get('/:id')
+	@Authorized("CARD:GET")
+	@ResponseSchema(ResponseRunnerCard)
+	@ResponseSchema(RunnerCardNotFoundError, { statusCode: 404 })
+	@OnUndefined(RunnerCardNotFoundError)
+	@OpenAPI({ description: "Lists all information about the card whose id got provided." })
+	async getOne(@Param('id') id: number) {
+		let card = await this.cardRepository.findOne({ id: id }, { relations: ['runner'] });
+		if (!card) { throw new RunnerCardNotFoundError(); }
+		return card.toResponse();
+	}
+
+	@Post()
+	@Authorized("CARD:CREATE")
+	@ResponseSchema(ResponseRunnerCard)
+	@ResponseSchema(RunnerNotFoundError, { statusCode: 404 })
+	@OpenAPI({ description: "Create a new card. <br> You can provide a associated runner by id but you don't have to." })
+	async post(@Body({ validate: true }) createCard: CreateRunnerCard) {
+		let card = await createCard.toEntity();
+		card = await this.cardRepository.save(card);
+		return (await this.cardRepository.findOne({ id: card.id }, { relations: ['runner'] })).toResponse();
+	}
+
+	@Put('/:id')
+	@Authorized("CARD:UPDATE")
+	@ResponseSchema(ResponseRunnerCard)
+	@ResponseSchema(RunnerCardNotFoundError, { statusCode: 404 })
+	@ResponseSchema(RunnerNotFoundError, { statusCode: 404 })
+	@ResponseSchema(RunnerCardIdsNotMatchingError, { statusCode: 406 })
+	@OpenAPI({ description: "Update the card whose id you provided. <br> Scans created via this card will still be associated with the old runner. <br> Please remember that ids can't be changed." })
+	async put(@Param('id') id: number, @Body({ validate: true }) card: UpdateRunnerCard) {
+		let oldCard = await this.cardRepository.findOne({ id: id });
+
+		if (!oldCard) {
+			throw new RunnerCardNotFoundError();
+		}
+
+		if (oldCard.id != card.id) {
+			throw new RunnerCardIdsNotMatchingError();
+		}
+
+		await this.cardRepository.save(await card.update(oldCard));
+		return (await this.cardRepository.findOne({ id: id }, { relations: ['runner'] })).toResponse();
+	}
+
+	@Delete('/:id')
+	@Authorized("CARD:DELETE")
+	@ResponseSchema(ResponseRunnerCard)
+	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
+	@ResponseSchema(RunnerCardHasScansError, { statusCode: 406 })
+	@OnUndefined(204)
+	@OpenAPI({ description: "Delete the card whose id you provided. <br> If no card with this id exists it will just return 204(no content). <br> If the card still has scans associated you have to provide the force=true query param (warning: this deletes all scans associated with by this card - please disable it instead or just remove the runner association)." })
+	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
+		let card = await this.cardRepository.findOne({ id: id });
+		if (!card) { return null; }
+
+		const cardScans = (await this.cardRepository.findOne({ id: id }, { relations: ["scans"] })).scans;
+		if (cardScans.length != 0 && !force) {
+			throw new RunnerCardHasScansError();
+		}
+		const scanController = new ScanController;
+		for (let scan of cardScans) {
+			await scanController.remove(scan.id, force);
+		}
+
+		await this.cardRepository.delete(card);
+		return card.toResponse();
+	}
+}

src/controllers/RunnerController.ts

@@ -1,16 +1,19 @@
 import { Authorized, Body, Delete, Get, JsonController, OnUndefined, Param, Post, Put, QueryParam } from 'routing-controllers';
 import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
 import { getConnectionManager, Repository } from 'typeorm';
-import { RunnerGroupNeededError, RunnerIdsNotMatchingError, RunnerNotFoundError } from '../errors/RunnerErrors';
+import { RunnerGroupNeededError, RunnerHasDistanceDonationsError, RunnerIdsNotMatchingError, RunnerNotFoundError } from '../errors/RunnerErrors';
 import { RunnerGroupNotFoundError } from '../errors/RunnerGroupErrors';
-import { CreateRunner } from '../models/actions/CreateRunner';
-import { UpdateRunner } from '../models/actions/UpdateRunner';
+import { CreateRunner } from '../models/actions/create/CreateRunner';
+import { UpdateRunner } from '../models/actions/update/UpdateRunner';
 import { Runner } from '../models/entities/Runner';
 import { ResponseEmpty } from '../models/responses/ResponseEmpty';
 import { ResponseRunner } from '../models/responses/ResponseRunner';
+import { DonationController } from './DonationController';
+import { RunnerCardController } from './RunnerCardController';
+import { ScanController } from './ScanController';
 
 @JsonController('/runners')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class RunnerController {
 	private runnerRepository: Repository<Runner>;
 
@@ -24,10 +27,10 @@ export class RunnerController {
 	@Get()
 	@Authorized("RUNNER:GET")
 	@ResponseSchema(ResponseRunner, { isArray: true })
-	@OpenAPI({ description: 'Lists all runners.' })
+	@OpenAPI({ description: 'Lists all runners from all teams/orgs. <br> This includes the runner\'s group and distance ran.' })
 	async getAll() {
 		let responseRunners: ResponseRunner[] = new Array<ResponseRunner>();
-		const runners = await this.runnerRepository.find({ relations: ['scans', 'group'] });
+		const runners = await this.runnerRepository.find({ relations: ['scans', 'group', 'scans.track', 'cards'] });
 		runners.forEach(runner => {
 			responseRunners.push(new ResponseRunner(runner));
 		});
@@ -39,9 +42,9 @@ export class RunnerController {
 	@ResponseSchema(ResponseRunner)
 	@ResponseSchema(RunnerNotFoundError, { statusCode: 404 })
 	@OnUndefined(RunnerNotFoundError)
-	@OpenAPI({ description: 'Returns a runner of a specified id (if it exists)' })
+	@OpenAPI({ description: 'Lists all information about the runner whose id got provided.' })
 	async getOne(@Param('id') id: number) {
-		let runner = await this.runnerRepository.findOne({ id: id }, { relations: ['scans', 'group'] })
+		let runner = await this.runnerRepository.findOne({ id: id }, { relations: ['scans', 'group', 'scans.track', 'cards'] })
 		if (!runner) { throw new RunnerNotFoundError(); }
 		return new ResponseRunner(runner);
 	}
@@ -51,17 +54,17 @@ export class RunnerController {
 	@ResponseSchema(ResponseRunner)
 	@ResponseSchema(RunnerGroupNeededError)
 	@ResponseSchema(RunnerGroupNotFoundError)
-	@OpenAPI({ description: 'Create a new runner object (id will be generated automagicly).' })
+	@OpenAPI({ description: 'Create a new runner. <br> Please remeber to provide the runner\'s group\'s id.' })
 	async post(@Body({ validate: true }) createRunner: CreateRunner) {
 		let runner;
 		try {
-			runner = await createRunner.toRunner();
+			runner = await createRunner.toEntity();
 		} catch (error) {
 			throw error;
 		}
 
 		runner = await this.runnerRepository.save(runner)
-		return new ResponseRunner(await this.runnerRepository.findOne(runner, { relations: ['scans', 'group'] }));
+		return new ResponseRunner(await this.runnerRepository.findOne(runner, { relations: ['scans', 'group', 'scans.track', 'cards'] }));
 	}
 
 	@Put('/:id')
@@ -69,7 +72,7 @@ export class RunnerController {
 	@ResponseSchema(ResponseRunner)
 	@ResponseSchema(RunnerNotFoundError, { statusCode: 404 })
 	@ResponseSchema(RunnerIdsNotMatchingError, { statusCode: 406 })
-	@OpenAPI({ description: "Update a runner object (id can't be changed)." })
+	@OpenAPI({ description: "Update the runner whose id you provided. <br> Please remember that ids can't be changed." })
 	async put(@Param('id') id: number, @Body({ validate: true }) runner: UpdateRunner) {
 		let oldRunner = await this.runnerRepository.findOne({ id: id }, { relations: ['group'] });
 
@@ -81,25 +84,47 @@ export class RunnerController {
 			throw new RunnerIdsNotMatchingError();
 		}
 
-		await this.runnerRepository.save(await runner.updateRunner(oldRunner));
-		return new ResponseRunner(await this.runnerRepository.findOne({ id: id }, { relations: ['scans', 'group'] }));
+		await this.runnerRepository.save(await runner.update(oldRunner));
+		return new ResponseRunner(await this.runnerRepository.findOne({ id: id }, { relations: ['scans', 'group', 'scans.track', 'cards'] }));
 	}
 
 	@Delete('/:id')
 	@Authorized("RUNNER:DELETE")
 	@ResponseSchema(ResponseRunner)
 	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
+	@ResponseSchema(RunnerHasDistanceDonationsError, { statusCode: 406 })
 	@OnUndefined(204)
-	@OpenAPI({ description: 'Delete a specified runner (if it exists).' })
+	@OpenAPI({ description: 'Delete the runner whose id you provided. <br> This will also delete all scans and cards associated with the runner. <br> If no runner with this id exists it will just return 204(no content).' })
 	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
 		let runner = await this.runnerRepository.findOne({ id: id });
 		if (!runner) { return null; }
-		const responseRunner = await this.runnerRepository.findOne(runner, { relations: ['scans', 'group'] });
+		const responseRunner = await this.runnerRepository.findOne(runner, { relations: ['scans', 'group', 'scans.track', 'cards'] });
 
 		if (!runner) {
 			throw new RunnerNotFoundError();
 		}
 
+		const runnerDonations = (await this.runnerRepository.findOne({ id: runner.id }, { relations: ["distanceDonations"] })).distanceDonations;
+		if (runnerDonations.length > 0 && !force) {
+			throw new RunnerHasDistanceDonationsError();
+		}
+		const donationController = new DonationController();
+		for (let donation of runnerDonations) {
+			await donationController.remove(donation.id, force);
+		}
+
+		const runnerCards = (await this.runnerRepository.findOne({ id: runner.id }, { relations: ["cards"] })).cards;
+		const cardController = new RunnerCardController;
+		for (let card of runnerCards) {
+			await cardController.remove(card.id, force);
+		}
+
+		const runnerScans = (await this.runnerRepository.findOne({ id: runner.id }, { relations: ["scans"] })).scans;
+		const scanController = new ScanController;
+		for (let scan of runnerScans) {
+			await scanController.remove(scan.id, force);
+		}
+
 		await this.runnerRepository.delete(runner);
 		return new ResponseRunner(responseRunner);
 	}

src/controllers/RunnerOrganisationController.ts

@@ -2,8 +2,8 @@ import { Authorized, Body, Delete, Get, JsonController, OnUndefined, Param, Post
 import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
 import { getConnectionManager, Repository } from 'typeorm';
 import { RunnerOrganisationHasRunnersError, RunnerOrganisationHasTeamsError, RunnerOrganisationIdsNotMatchingError, RunnerOrganisationNotFoundError } from '../errors/RunnerOrganisationErrors';
-import { CreateRunnerOrganisation } from '../models/actions/CreateRunnerOrganisation';
-import { UpdateRunnerOrganisation } from '../models/actions/UpdateRunnerOrganisation';
+import { CreateRunnerOrganisation } from '../models/actions/create/CreateRunnerOrganisation';
+import { UpdateRunnerOrganisation } from '../models/actions/update/UpdateRunnerOrganisation';
 import { RunnerOrganisation } from '../models/entities/RunnerOrganisation';
 import { ResponseEmpty } from '../models/responses/ResponseEmpty';
 import { ResponseRunnerOrganisation } from '../models/responses/ResponseRunnerOrganisation';
@@ -12,7 +12,7 @@ import { RunnerTeamController } from './RunnerTeamController';
 
 
 @JsonController('/organisations')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class RunnerOrganisationController {
 	private runnerOrganisationRepository: Repository<RunnerOrganisation>;
 
@@ -26,10 +26,10 @@ export class RunnerOrganisationController {
 	@Get()
 	@Authorized("ORGANISATION:GET")
 	@ResponseSchema(ResponseRunnerOrganisation, { isArray: true })
-	@OpenAPI({ description: 'Lists all runnerOrganisations.' })
+	@OpenAPI({ description: 'Lists all organisations. <br> This includes their address, contact and teams (if existing/associated).' })
 	async getAll() {
 		let responseTeams: ResponseRunnerOrganisation[] = new Array<ResponseRunnerOrganisation>();
-		const runners = await this.runnerOrganisationRepository.find({ relations: ['address', 'contact', 'teams'] });
+		const runners = await this.runnerOrganisationRepository.find({ relations: ['contact', 'teams'] });
 		runners.forEach(runner => {
 			responseTeams.push(new ResponseRunnerOrganisation(runner));
 		});
@@ -41,9 +41,9 @@ export class RunnerOrganisationController {
 	@ResponseSchema(ResponseRunnerOrganisation)
 	@ResponseSchema(RunnerOrganisationNotFoundError, { statusCode: 404 })
 	@OnUndefined(RunnerOrganisationNotFoundError)
-	@OpenAPI({ description: 'Returns a runnerOrganisation of a specified id (if it exists)' })
+	@OpenAPI({ description: 'Lists all information about the organisation whose id got provided.' })
 	async getOne(@Param('id') id: number) {
-		let runnerOrg = await this.runnerOrganisationRepository.findOne({ id: id }, { relations: ['address', 'contact', 'teams'] });
+		let runnerOrg = await this.runnerOrganisationRepository.findOne({ id: id }, { relations: ['contact', 'teams'] });
 		if (!runnerOrg) { throw new RunnerOrganisationNotFoundError(); }
 		return new ResponseRunnerOrganisation(runnerOrg);
 	}
@@ -51,18 +51,18 @@ export class RunnerOrganisationController {
 	@Post()
 	@Authorized("ORGANISATION:CREATE")
 	@ResponseSchema(ResponseRunnerOrganisation)
-	@OpenAPI({ description: 'Create a new runnerOrganisation object (id will be generated automagicly).' })
+	@OpenAPI({ description: 'Create a new organsisation.' })
 	async post(@Body({ validate: true }) createRunnerOrganisation: CreateRunnerOrganisation) {
 		let runnerOrganisation;
 		try {
-			runnerOrganisation = await createRunnerOrganisation.toRunnerOrganisation();
+			runnerOrganisation = await createRunnerOrganisation.toEntity();
 		} catch (error) {
 			throw error;
 		}
 
 		runnerOrganisation = await this.runnerOrganisationRepository.save(runnerOrganisation);
 
-		return new ResponseRunnerOrganisation(await this.runnerOrganisationRepository.findOne(runnerOrganisation, { relations: ['address', 'contact', 'teams'] }));
+		return new ResponseRunnerOrganisation(await this.runnerOrganisationRepository.findOne(runnerOrganisation, { relations: ['contact', 'teams'] }));
 	}
 
 	@Put('/:id')
@@ -70,7 +70,7 @@ export class RunnerOrganisationController {
 	@ResponseSchema(ResponseRunnerOrganisation)
 	@ResponseSchema(RunnerOrganisationNotFoundError, { statusCode: 404 })
 	@ResponseSchema(RunnerOrganisationIdsNotMatchingError, { statusCode: 406 })
-	@OpenAPI({ description: "Update a runnerOrganisation object (id can't be changed)." })
+	@OpenAPI({ description: "Update the organisation whose id you provided. <br> Please remember that ids can't be changed." })
 	async put(@Param('id') id: number, @Body({ validate: true }) updateOrganisation: UpdateRunnerOrganisation) {
 		let oldRunnerOrganisation = await this.runnerOrganisationRepository.findOne({ id: id });
 
@@ -82,9 +82,9 @@ export class RunnerOrganisationController {
 			throw new RunnerOrganisationIdsNotMatchingError();
 		}
 
-		await this.runnerOrganisationRepository.save(await updateOrganisation.updateRunnerOrganisation(oldRunnerOrganisation));
+		await this.runnerOrganisationRepository.save(await updateOrganisation.update(oldRunnerOrganisation));
 
-		return new ResponseRunnerOrganisation(await this.runnerOrganisationRepository.findOne(id, { relations: ['address', 'contact', 'teams'] }));
+		return new ResponseRunnerOrganisation(await this.runnerOrganisationRepository.findOne(id, { relations: ['contact', 'teams'] }));
 	}
 
 	@Delete('/:id')
@@ -94,11 +94,11 @@ export class RunnerOrganisationController {
 	@ResponseSchema(RunnerOrganisationHasTeamsError, { statusCode: 406 })
 	@ResponseSchema(RunnerOrganisationHasRunnersError, { statusCode: 406 })
 	@OnUndefined(204)
-	@OpenAPI({ description: 'Delete a specified runnerOrganisation (if it exists).' })
+	@OpenAPI({ description: 'Delete the organsisation whose id you provided. <br> If the organisation still has runners and/or teams associated this will fail. <br> To delete the organisation with all associated runners and teams set the force QueryParam to true (cascading deletion might take a while). <br> This won\'t delete the associated contact. <br> If no organisation with this id exists it will just return 204(no content).' })
 	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
 		let organisation = await this.runnerOrganisationRepository.findOne({ id: id });
 		if (!organisation) { return null; }
-		let runnerOrganisation = await this.runnerOrganisationRepository.findOne(organisation, { relations: ['address', 'contact', 'runners', 'teams'] });
+		let runnerOrganisation = await this.runnerOrganisationRepository.findOne(organisation, { relations: ['contact', 'runners', 'teams'] });
 
 		if (!force) {
 			if (runnerOrganisation.teams.length != 0) {

src/controllers/RunnerTeamController.ts

@@ -2,8 +2,8 @@ import { Authorized, Body, Delete, Get, JsonController, OnUndefined, Param, Post
 import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
 import { getConnectionManager, Repository } from 'typeorm';
 import { RunnerTeamHasRunnersError, RunnerTeamIdsNotMatchingError, RunnerTeamNotFoundError } from '../errors/RunnerTeamErrors';
-import { CreateRunnerTeam } from '../models/actions/CreateRunnerTeam';
-import { UpdateRunnerTeam } from '../models/actions/UpdateRunnerTeam';
+import { CreateRunnerTeam } from '../models/actions/create/CreateRunnerTeam';
+import { UpdateRunnerTeam } from '../models/actions/update/UpdateRunnerTeam';
 import { RunnerTeam } from '../models/entities/RunnerTeam';
 import { ResponseEmpty } from '../models/responses/ResponseEmpty';
 import { ResponseRunnerTeam } from '../models/responses/ResponseRunnerTeam';
@@ -11,7 +11,7 @@ import { RunnerController } from './RunnerController';
 
 
 @JsonController('/teams')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class RunnerTeamController {
 	private runnerTeamRepository: Repository<RunnerTeam>;
 
@@ -25,7 +25,7 @@ export class RunnerTeamController {
 	@Get()
 	@Authorized("TEAM:GET")
 	@ResponseSchema(ResponseRunnerTeam, { isArray: true })
-	@OpenAPI({ description: 'Lists all runnerTeams.' })
+	@OpenAPI({ description: 'Lists all teams. <br> This includes their parent organisation and contact (if existing/associated).' })
 	async getAll() {
 		let responseTeams: ResponseRunnerTeam[] = new Array<ResponseRunnerTeam>();
 		const runners = await this.runnerTeamRepository.find({ relations: ['parentGroup', 'contact'] });
@@ -40,7 +40,7 @@ export class RunnerTeamController {
 	@ResponseSchema(ResponseRunnerTeam)
 	@ResponseSchema(RunnerTeamNotFoundError, { statusCode: 404 })
 	@OnUndefined(RunnerTeamNotFoundError)
-	@OpenAPI({ description: 'Returns a runnerTeam of a specified id (if it exists)' })
+	@OpenAPI({ description: 'Lists all information about the team whose id got provided.' })
 	async getOne(@Param('id') id: number) {
 		let runnerTeam = await this.runnerTeamRepository.findOne({ id: id }, { relations: ['parentGroup', 'contact'] });
 		if (!runnerTeam) { throw new RunnerTeamNotFoundError(); }
@@ -50,11 +50,11 @@ export class RunnerTeamController {
 	@Post()
 	@Authorized("TEAM:CREATE")
 	@ResponseSchema(ResponseRunnerTeam)
-	@OpenAPI({ description: 'Create a new runnerTeam object (id will be generated automagicly).' })
+	@OpenAPI({ description: 'Create a new organsisation. <br> Please remember to provide it\'s parent group\'s id.' })
 	async post(@Body({ validate: true }) createRunnerTeam: CreateRunnerTeam) {
 		let runnerTeam;
 		try {
-			runnerTeam = await createRunnerTeam.toRunnerTeam();
+			runnerTeam = await createRunnerTeam.toEntity();
 		} catch (error) {
 			throw error;
 		}
@@ -70,7 +70,7 @@ export class RunnerTeamController {
 	@ResponseSchema(ResponseRunnerTeam)
 	@ResponseSchema(RunnerTeamNotFoundError, { statusCode: 404 })
 	@ResponseSchema(RunnerTeamIdsNotMatchingError, { statusCode: 406 })
-	@OpenAPI({ description: "Update a runnerTeam object (id can't be changed)." })
+	@OpenAPI({ description: "Update the team whose id you provided. <br> Please remember that ids can't be changed." })
 	async put(@Param('id') id: number, @Body({ validate: true }) runnerTeam: UpdateRunnerTeam) {
 		let oldRunnerTeam = await this.runnerTeamRepository.findOne({ id: id }, { relations: ['parentGroup', 'contact'] });
 
@@ -82,7 +82,7 @@ export class RunnerTeamController {
 			throw new RunnerTeamIdsNotMatchingError();
 		}
 
-		await this.runnerTeamRepository.save(await runnerTeam.updateRunnerTeam(oldRunnerTeam));
+		await this.runnerTeamRepository.save(await runnerTeam.update(oldRunnerTeam));
 
 		return new ResponseRunnerTeam(await this.runnerTeamRepository.findOne({ id: runnerTeam.id }, { relations: ['parentGroup', 'contact'] }));
 	}
@@ -93,7 +93,7 @@ export class RunnerTeamController {
 	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
 	@ResponseSchema(RunnerTeamHasRunnersError, { statusCode: 406 })
 	@OnUndefined(204)
-	@OpenAPI({ description: 'Delete a specified runnerTeam (if it exists).' })
+	@OpenAPI({ description: 'Delete the team whose id you provided. <br> If the team still has runners associated this will fail. <br> To delete the team with all associated runners set the force QueryParam to true (cascading deletion might take a while). <br> This won\'t delete the associated contact.<br> If no team with this id exists it will just return 204(no content).' })
 	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
 		let team = await this.runnerTeamRepository.findOne({ id: id });
 		if (!team) { return null; }

src/controllers/ScanController.ts

@@ -0,0 +1,140 @@
+import { Authorized, Body, Delete, Get, JsonController, OnUndefined, Param, Post, Put, QueryParam, UseBefore } from 'routing-controllers';
+import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
+import { getConnectionManager, Repository } from 'typeorm';
+import { RunnerNotFoundError } from '../errors/RunnerErrors';
+import { ScanIdsNotMatchingError, ScanNotFoundError } from '../errors/ScanErrors';
+import { ScanStationNotFoundError } from '../errors/ScanStationErrors';
+import ScanAuth from '../middlewares/ScanAuth';
+import { CreateScan } from '../models/actions/create/CreateScan';
+import { CreateTrackScan } from '../models/actions/create/CreateTrackScan';
+import { UpdateScan } from '../models/actions/update/UpdateScan';
+import { UpdateTrackScan } from '../models/actions/update/UpdateTrackScan';
+import { Scan } from '../models/entities/Scan';
+import { TrackScan } from '../models/entities/TrackScan';
+import { ResponseEmpty } from '../models/responses/ResponseEmpty';
+import { ResponseScan } from '../models/responses/ResponseScan';
+import { ResponseTrackScan } from '../models/responses/ResponseTrackScan';
+
+@JsonController('/scans')
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+export class ScanController {
+	private scanRepository: Repository<Scan>;
+	private trackScanRepository: Repository<TrackScan>;
+
+	/**
+	 * Gets the repository of this controller's model/entity.
+	 */
+	constructor() {
+		this.scanRepository = getConnectionManager().get().getRepository(Scan);
+		this.trackScanRepository = getConnectionManager().get().getRepository(TrackScan);
+	}
+
+	@Get()
+	@Authorized("SCAN:GET")
+	@ResponseSchema(ResponseScan, { isArray: true })
+	@ResponseSchema(ResponseTrackScan, { isArray: true })
+	@OpenAPI({ description: 'Lists all scans (normal or track) from all runners. <br> This includes the scan\'s runner\'s distance ran.' })
+	async getAll() {
+		let responseScans: ResponseScan[] = new Array<ResponseScan>();
+		const scans = await this.scanRepository.find({ relations: ['runner', 'track', 'runner.scans', 'runner.scans.track', 'card', 'station'] });
+		scans.forEach(scan => {
+			responseScans.push(scan.toResponse());
+		});
+		return responseScans;
+	}
+
+	@Get('/:id')
+	@Authorized("SCAN:GET")
+	@ResponseSchema(ResponseScan)
+	@ResponseSchema(ResponseTrackScan)
+	@ResponseSchema(ScanNotFoundError, { statusCode: 404 })
+	@OnUndefined(ScanNotFoundError)
+	@OpenAPI({ description: 'Lists all information about the scan whose id got provided. This includes the scan\'s runner\'s distance ran.' })
+	async getOne(@Param('id') id: number) {
+		let scan = await this.scanRepository.findOne({ id: id }, { relations: ['runner', 'track', 'runner.scans', 'runner.scans.track', 'card', 'station'] })
+		if (!scan) { throw new ScanNotFoundError(); }
+		return scan.toResponse();
+	}
+
+	@Post()
+	@UseBefore(ScanAuth)
+	@ResponseSchema(ResponseScan)
+	@ResponseSchema(RunnerNotFoundError, { statusCode: 404 })
+	@OpenAPI({ description: 'Create a new scan (not track scan - use /scans/trackscans instead). <br> Please rmemember to provide the scan\'s runner\'s id and distance.', security: [{ "ScanApiToken": [] }, { "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+	async post(@Body({ validate: true }) createScan: CreateScan) {
+		let scan = await createScan.toEntity();
+		scan = await this.scanRepository.save(scan);
+		return (await this.scanRepository.findOne({ id: scan.id }, { relations: ['runner', 'track', 'runner.scans', 'runner.scans.track', 'card', 'station'] })).toResponse();
+	}
+
+	@Post("/trackscans")
+	@UseBefore(ScanAuth)
+	@ResponseSchema(ResponseTrackScan)
+	@ResponseSchema(RunnerNotFoundError, { statusCode: 404 })
+	@OpenAPI({ description: 'Create a new track scan (for "normal" scans use /scans instead). <br> Please remember that to provide the scan\'s card\'s station\'s id.', security: [{ "ScanApiToken": [] }, { "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+	async postTrackScans(@Body({ validate: true }) createScan: CreateTrackScan) {
+		let scan = await createScan.toEntity();
+		scan = await this.trackScanRepository.save(scan);
+		return (await this.scanRepository.findOne({ id: scan.id }, { relations: ['runner', 'track', 'runner.scans', 'runner.scans.track', 'card', 'station'] })).toResponse();
+	}
+
+	@Put('/:id')
+	@Authorized("SCAN:UPDATE")
+	@ResponseSchema(ResponseScan)
+	@ResponseSchema(ScanNotFoundError, { statusCode: 404 })
+	@ResponseSchema(RunnerNotFoundError, { statusCode: 404 })
+	@ResponseSchema(ScanIdsNotMatchingError, { statusCode: 406 })
+	@OpenAPI({ description: "Update the scan (not track scan use /scans/trackscans/:id instead) whose id you provided. <br> Please remember that ids can't be changed and distances must be positive." })
+	async put(@Param('id') id: number, @Body({ validate: true }) scan: UpdateScan) {
+		let oldScan = await this.scanRepository.findOne({ id: id });
+
+		if (!oldScan) {
+			throw new ScanNotFoundError();
+		}
+
+		if (oldScan.id != scan.id) {
+			throw new ScanIdsNotMatchingError();
+		}
+
+		await this.scanRepository.save(await scan.update(oldScan));
+		return (await this.scanRepository.findOne({ id: id }, { relations: ['runner', 'track', 'runner.scans', 'runner.scans.track', 'card', 'station'] })).toResponse();
+	}
+
+	@Put('/trackscans/:id')
+	@Authorized("SCAN:UPDATE")
+	@ResponseSchema(ResponseTrackScan)
+	@ResponseSchema(ScanNotFoundError, { statusCode: 404 })
+	@ResponseSchema(RunnerNotFoundError, { statusCode: 404 })
+	@ResponseSchema(ScanStationNotFoundError, { statusCode: 404 })
+	@ResponseSchema(ScanIdsNotMatchingError, { statusCode: 406 })
+	@OpenAPI({ description: 'Update the track scan (not "normal" scan use /scans/trackscans/:id instead) whose id you provided. <br> Please remember that only the validity, runner and track can be changed.' })
+	async putTrackScan(@Param('id') id: number, @Body({ validate: true }) scan: UpdateTrackScan) {
+		let oldScan = await this.trackScanRepository.findOne({ id: id });
+
+		if (!oldScan) {
+			throw new ScanNotFoundError();
+		}
+
+		if (oldScan.id != scan.id) {
+			throw new ScanIdsNotMatchingError();
+		}
+
+		await this.trackScanRepository.save(await scan.update(oldScan));
+		return (await this.scanRepository.findOne({ id: id }, { relations: ['runner', 'track', 'runner.scans', 'runner.scans.track', 'card', 'station'] })).toResponse();
+	}
+
+	@Delete('/:id')
+	@Authorized("SCAN:DELETE")
+	@ResponseSchema(ResponseScan)
+	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
+	@OnUndefined(204)
+	@OpenAPI({ description: 'Delete the scan whose id you provided. <br> If no scan with this id exists it will just return 204(no content).' })
+	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
+		let scan = await this.scanRepository.findOne({ id: id });
+		if (!scan) { return null; }
+		const responseScan = await this.scanRepository.findOne({ id: scan.id }, { relations: ['runner', 'track', 'runner.scans', 'runner.scans.track', 'card', 'station'] });
+
+		await this.scanRepository.delete(scan);
+		return responseScan.toResponse();
+	}
+}

src/controllers/ScanStationController.ts

@@ -0,0 +1,108 @@
+import { Authorized, Body, Delete, Get, JsonController, OnUndefined, Param, Post, Put, QueryParam } from 'routing-controllers';
+import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
+import { getConnectionManager, Repository } from 'typeorm';
+import { ScanStationHasScansError, ScanStationIdsNotMatchingError, ScanStationNotFoundError } from '../errors/ScanStationErrors';
+import { TrackNotFoundError } from '../errors/TrackErrors';
+import { CreateScanStation } from '../models/actions/create/CreateScanStation';
+import { UpdateScanStation } from '../models/actions/update/UpdateScanStation';
+import { ScanStation } from '../models/entities/ScanStation';
+import { ResponseEmpty } from '../models/responses/ResponseEmpty';
+import { ResponseScanStation } from '../models/responses/ResponseScanStation';
+import { ScanController } from './ScanController';
+
+@JsonController('/stations')
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+export class ScanStationController {
+	private stationRepository: Repository<ScanStation>;
+
+	/**
+	 * Gets the repository of this controller's model/entity.
+	 */
+	constructor() {
+		this.stationRepository = getConnectionManager().get().getRepository(ScanStation);
+	}
+
+	@Get()
+	@Authorized("STATION:GET")
+	@ResponseSchema(ResponseScanStation, { isArray: true })
+	@OpenAPI({ description: 'Lists all stations. <br> This includes their associated tracks.' })
+	async getAll() {
+		let responseStations: ResponseScanStation[] = new Array<ResponseScanStation>();
+		const stations = await this.stationRepository.find({ relations: ['track'] });
+		stations.forEach(station => {
+			responseStations.push(station.toResponse());
+		});
+		return responseStations;
+	}
+
+	@Get('/:id')
+	@Authorized("STATION:GET")
+	@ResponseSchema(ResponseScanStation)
+	@ResponseSchema(ScanStationNotFoundError, { statusCode: 404 })
+	@OnUndefined(ScanStationNotFoundError)
+	@OpenAPI({ description: 'Lists all information about the station whose id got provided. <br> This includes it\'s associated track.' })
+	async getOne(@Param('id') id: number) {
+		let scan = await this.stationRepository.findOne({ id: id }, { relations: ['track'] })
+		if (!scan) { throw new ScanStationNotFoundError(); }
+		return scan.toResponse();
+	}
+
+	@Post()
+	@Authorized("STATION:CREATE")
+	@ResponseSchema(ResponseScanStation)
+	@ResponseSchema(TrackNotFoundError, { statusCode: 404 })
+	@OpenAPI({ description: 'Create a new station. <br> Please remeber to provide the station\'s track\'s id. <br> Please also remember that the station key is only visibe on creation.' })
+	async post(@Body({ validate: true }) createStation: CreateScanStation) {
+		let newStation = await createStation.toEntity();
+		const station = await this.stationRepository.save(newStation);
+		let responseStation = (await this.stationRepository.findOne({ id: station.id }, { relations: ['track'] })).toResponse();
+		responseStation.key = newStation.cleartextkey;
+		return responseStation;
+	}
+
+	@Put('/:id')
+	@Authorized("STATION:UPDATE")
+	@ResponseSchema(ResponseScanStation)
+	@ResponseSchema(ScanStationNotFoundError, { statusCode: 404 })
+	@ResponseSchema(ScanStationIdsNotMatchingError, { statusCode: 406 })
+	@OpenAPI({ description: "Update the station whose id you provided. <br> Please remember that only the description and enabled state can be changed." })
+	async put(@Param('id') id: number, @Body({ validate: true }) station: UpdateScanStation) {
+		let oldStation = await this.stationRepository.findOne({ id: id });
+
+		if (!oldStation) {
+			throw new ScanStationNotFoundError();
+		}
+
+		if (oldStation.id != station.id) {
+			throw new ScanStationIdsNotMatchingError();
+		}
+
+		await this.stationRepository.save(await station.update(oldStation));
+		return (await this.stationRepository.findOne({ id: id }, { relations: ['track'] })).toResponse();
+	}
+
+	@Delete('/:id')
+	@Authorized("STATION:DELETE")
+	@ResponseSchema(ResponseScanStation)
+	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
+	@ResponseSchema(ScanStationHasScansError, { statusCode: 406 })
+	@OnUndefined(204)
+	@OpenAPI({ description: 'Delete the station whose id you provided. <br> If no station with this id exists it will just return 204(no content). <br> If the station still has scans associated you have to provide the force=true query param (warning: this deletes all scans associated with/created by this station - please disable it instead).' })
+	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
+		let station = await this.stationRepository.findOne({ id: id });
+		if (!station) { return null; }
+
+		const stationScans = (await this.stationRepository.findOne({ id: station.id }, { relations: ["scans"] })).scans;
+		if (stationScans.length != 0 && !force) {
+			throw new ScanStationHasScansError();
+		}
+		const scanController = new ScanController;
+		for (let scan of stationScans) {
+			await scanController.remove(scan.id, force);
+		}
+
+		const responseStation = await this.stationRepository.findOne({ id: station.id }, { relations: ["track"] });
+		await this.stationRepository.delete(station);
+		return responseStation.toResponse();
+	}
+}

src/controllers/StatsClientController.ts

@@ -0,0 +1,75 @@
+import { Authorized, Body, Delete, Get, JsonController, OnUndefined, Param, Post, QueryParam } from 'routing-controllers';
+import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
+import { getConnectionManager, Repository } from 'typeorm';
+import { StatsClientNotFoundError } from '../errors/StatsClientErrors';
+import { TrackNotFoundError } from "../errors/TrackErrors";
+import { CreateStatsClient } from '../models/actions/create/CreateStatsClient';
+import { StatsClient } from '../models/entities/StatsClient';
+import { ResponseEmpty } from '../models/responses/ResponseEmpty';
+import { ResponseStatsClient } from '../models/responses/ResponseStatsClient';
+
+@JsonController('/statsclients')
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+export class StatsClientController {
+	private clientRepository: Repository<StatsClient>;
+
+	/**
+	 * Gets the repository of this controller's model/entity.
+	 */
+	constructor() {
+		this.clientRepository = getConnectionManager().get().getRepository(StatsClient);
+	}
+
+	@Get()
+	@Authorized("STATSCLIENT:GET")
+	@ResponseSchema(ResponseStatsClient, { isArray: true })
+	@OpenAPI({ description: 'Lists all stats clients. Please remember that the key can only be viewed on creation.' })
+	async getAll() {
+		let responseClients: ResponseStatsClient[] = new Array<ResponseStatsClient>();
+		const clients = await this.clientRepository.find();
+		clients.forEach(clients => {
+			responseClients.push(new ResponseStatsClient(clients));
+		});
+		return responseClients;
+	}
+
+	@Get('/:id')
+	@Authorized("STATSCLIENT:GET")
+	@ResponseSchema(ResponseStatsClient)
+	@ResponseSchema(StatsClientNotFoundError, { statusCode: 404 })
+	@OnUndefined(StatsClientNotFoundError)
+	@OpenAPI({ description: "Lists all information about the stats client whose id got provided. Please remember that the key can only be viewed on creation." })
+	async getOne(@Param('id') id: number) {
+		let client = await this.clientRepository.findOne({ id: id });
+		if (!client) { throw new TrackNotFoundError(); }
+		return new ResponseStatsClient(client);
+	}
+
+	@Post()
+	@Authorized("STATSCLIENT:CREATE")
+	@ResponseSchema(ResponseStatsClient)
+	@OpenAPI({ description: "Create a new stats client. <br> Please remember that the client\'s key will be generated automaticly and that it can only be viewed on creation." })
+	async post(
+		@Body({ validate: true })
+		client: CreateStatsClient
+	) {
+		let newClient = await this.clientRepository.save(await client.toEntity());
+		let responseClient = new ResponseStatsClient(newClient);
+		responseClient.key = newClient.cleartextkey;
+		return responseClient;
+	}
+
+	@Delete('/:id')
+	@Authorized("STATSCLIENT:DELETE")
+	@ResponseSchema(ResponseStatsClient)
+	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
+	@OnUndefined(204)
+	@OpenAPI({ description: "Delete the stats client whose id you provided. <br> If no client with this id exists it will just return 204(no content)." })
+	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
+		let client = await this.clientRepository.findOne({ id: id });
+		if (!client) { return null; }
+
+		await this.clientRepository.delete(client);
+		return new ResponseStatsClient(client);
+	}
+}

src/controllers/StatsController.ts

@@ -0,0 +1,124 @@
+import { Get, JsonController, UseBefore } from 'routing-controllers';
+import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
+import { getConnection } from 'typeorm';
+import StatsAuth from '../middlewares/StatsAuth';
+import { Donation } from '../models/entities/Donation';
+import { Runner } from '../models/entities/Runner';
+import { RunnerOrganisation } from '../models/entities/RunnerOrganisation';
+import { RunnerTeam } from '../models/entities/RunnerTeam';
+import { Scan } from '../models/entities/Scan';
+import { User } from '../models/entities/User';
+import { ResponseStats } from '../models/responses/ResponseStats';
+import { ResponseStatsOrgnisation } from '../models/responses/ResponseStatsOrganisation';
+import { ResponseStatsRunner } from '../models/responses/ResponseStatsRunner';
+import { ResponseStatsTeam } from '../models/responses/ResponseStatsTeam';
+
+@JsonController('/stats')
+export class StatsController {
+
+    @Get()
+    @ResponseSchema(ResponseStats)
+    @OpenAPI({ description: "A very basic stats endpoint providing basic counters for a dashboard or simmilar" })
+    async get() {
+        let connection = getConnection();
+        let runners = await connection.getRepository(Runner).find({ relations: ['scans', 'scans.track'] });
+        let teams = await connection.getRepository(RunnerTeam).find();
+        let orgs = await connection.getRepository(RunnerOrganisation).find();
+        let users = await connection.getRepository(User).find();
+        let scans = await connection.getRepository(Scan).find();
+        let donations = await connection.getRepository(Donation).find({ relations: ['runner', 'runner.scans', 'runner.scans.track'] });
+        return new ResponseStats(runners, teams, orgs, users, scans, donations)
+    }
+
+    @Get("/runners/distance")
+    @UseBefore(StatsAuth)
+    @ResponseSchema(ResponseStatsRunner, { isArray: true })
+    @OpenAPI({ description: "Returns the top ten runners by distance.", security: [{ "StatsApiToken": [] }, { "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+    async getTopRunnersByDistance() {
+        let runners = await getConnection().getRepository(Runner).find({ relations: ['scans', 'group', 'distanceDonations', 'scans.track'] });
+        let topRunners = runners.sort((runner1, runner2) => runner1.distance - runner2.distance).slice(0, 9);
+        let responseRunners: ResponseStatsRunner[] = new Array<ResponseStatsRunner>();
+        topRunners.forEach(runner => {
+            responseRunners.push(new ResponseStatsRunner(runner));
+        });
+        return responseRunners;
+    }
+
+    @Get("/runners/donations")
+    @UseBefore(StatsAuth)
+    @ResponseSchema(ResponseStatsRunner, { isArray: true })
+    @OpenAPI({ description: "Returns the top ten runners by donations.", security: [{ "StatsApiToken": [] }, { "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+    async getTopRunnersByDonations() {
+        let runners = await getConnection().getRepository(Runner).find({ relations: ['scans', 'group', 'distanceDonations', 'scans.track'] });
+        let topRunners = runners.sort((runner1, runner2) => runner1.distanceDonationAmount - runner2.distanceDonationAmount).slice(0, 9);
+        let responseRunners: ResponseStatsRunner[] = new Array<ResponseStatsRunner>();
+        topRunners.forEach(runner => {
+            responseRunners.push(new ResponseStatsRunner(runner));
+        });
+        return responseRunners;
+    }
+
+    @Get("/scans")
+    @UseBefore(StatsAuth)
+    @ResponseSchema(ResponseStatsRunner, { isArray: true })
+    @OpenAPI({ description: "Returns the top ten fastest track times (with their runner and the runner's group).", security: [{ "StatsApiToken": [] }, { "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+    async getTopRunnersByTrackTime() {
+        throw new Error("Not implemented yet.")
+    }
+
+    @Get("/teams/distance")
+    @UseBefore(StatsAuth)
+    @ResponseSchema(ResponseStatsTeam, { isArray: true })
+    @OpenAPI({ description: "Returns the top ten teams by distance.", security: [{ "StatsApiToken": [] }, { "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+    async getTopTeamsByDistance() {
+        let teams = await getConnection().getRepository(RunnerTeam).find({ relations: ['runners', 'runners.scans', 'runners.distanceDonations', 'runners.scans.track'] });
+        let topTeams = teams.sort((team1, team2) => team1.distance - team2.distance).slice(0, 9);
+        let responseTeams: ResponseStatsTeam[] = new Array<ResponseStatsTeam>();
+        topTeams.forEach(team => {
+            responseTeams.push(new ResponseStatsTeam(team));
+        });
+        return responseTeams;
+    }
+
+    @Get("/teams/donations")
+    @UseBefore(StatsAuth)
+    @ResponseSchema(ResponseStatsTeam, { isArray: true })
+    @OpenAPI({ description: "Returns the top ten teams by donations.", security: [{ "StatsApiToken": [] }, { "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+    async getTopTeamsByDonations() {
+        let teams = await getConnection().getRepository(RunnerTeam).find({ relations: ['runners', 'runners.scans', 'runners.distanceDonations', 'runners.scans.track'] });
+        let topTeams = teams.sort((team1, team2) => team1.distanceDonationAmount - team2.distanceDonationAmount).slice(0, 9);
+        let responseTeams: ResponseStatsTeam[] = new Array<ResponseStatsTeam>();
+        topTeams.forEach(team => {
+            responseTeams.push(new ResponseStatsTeam(team));
+        });
+        return responseTeams;
+    }
+
+    @Get("/organisations/distance")
+    @UseBefore(StatsAuth)
+    @ResponseSchema(ResponseStatsOrgnisation, { isArray: true })
+    @OpenAPI({ description: "Returns the top ten organisations by distance.", security: [{ "StatsApiToken": [] }, { "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+    async getTopOrgsByDistance() {
+        let orgs = await getConnection().getRepository(RunnerOrganisation).find({ relations: ['runners', 'runners.scans', 'runners.distanceDonations', 'runners.scans.track', 'teams', 'teams.runners', 'teams.runners.scans', 'teams.runners.distanceDonations', 'teams.runners.scans.track'] });
+        let topOrgs = orgs.sort((org1, org2) => org1.distance - org2.distance).slice(0, 9);
+        let responseOrgs: ResponseStatsOrgnisation[] = new Array<ResponseStatsOrgnisation>();
+        topOrgs.forEach(org => {
+            responseOrgs.push(new ResponseStatsOrgnisation(org));
+        });
+        return responseOrgs;
+    }
+
+    @Get("/organisations/donations")
+    @UseBefore(StatsAuth)
+    @ResponseSchema(ResponseStatsOrgnisation, { isArray: true })
+    @OpenAPI({ description: "Returns the top ten organisations by donations.", security: [{ "StatsApiToken": [] }, { "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
+    async getTopOrgsByDonations() {
+        let orgs = await getConnection().getRepository(RunnerOrganisation).find({ relations: ['runners', 'runners.scans', 'runners.distanceDonations', 'runners.scans.track', 'teams', 'teams.runners', 'teams.runners.scans', 'teams.runners.distanceDonations', 'teams.runners.scans.track'] });
+        let topOrgs = orgs.sort((org1, org2) => org1.distanceDonationAmount - org2.distanceDonationAmount).slice(0, 9);
+        let responseOrgs: ResponseStatsOrgnisation[] = new Array<ResponseStatsOrgnisation>();
+        topOrgs.forEach(org => {
+            responseOrgs.push(new ResponseStatsOrgnisation(org));
+        });
+        return responseOrgs;
+    }
+}

src/controllers/StatusController.ts

@@ -1,12 +1,13 @@
 import { Get, JsonController } from 'routing-controllers';
 import { OpenAPI } from 'routing-controllers-openapi';
 import { getConnection } from 'typeorm';
+import { config } from '../config';
 
-@JsonController('/status')
+@JsonController()
 export class StatusController {
 
-    @Get()
-    @OpenAPI({ description: "Lists all tracks." })
+    @Get('/status')
+    @OpenAPI({ description: "A very basic status/health endpoint that just checks if the database connection is available. <br> The available information depth will be expanded later." })
     get() {
         let connection;
         try {
@@ -19,4 +20,12 @@ export class StatusController {
             "database connection": "✔"
         };
     }
+
+    @Get('/version')
+    @OpenAPI({ description: "A very basic endpoint that just returns the curent package version." })
+    getVersion() {
+        return {
+            "version": config.version
+        }
+    }
 }

src/controllers/TrackController.ts

@@ -1,15 +1,16 @@
-import { Authorized, Body, Delete, Get, JsonController, OnUndefined, Param, Post, Put } from 'routing-controllers';
+import { Authorized, Body, Delete, Get, JsonController, OnUndefined, Param, Post, Put, QueryParam } from 'routing-controllers';
 import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
 import { getConnectionManager, Repository } from 'typeorm';
-import { EntityFromBody } from 'typeorm-routing-controllers-extensions';
-import { TrackIdsNotMatchingError, TrackNotFoundError } from "../errors/TrackErrors";
-import { CreateTrack } from '../models/actions/CreateTrack';
+import { TrackHasScanStationsError, TrackIdsNotMatchingError, TrackLapTimeCantBeNegativeError, TrackNotFoundError } from "../errors/TrackErrors";
+import { CreateTrack } from '../models/actions/create/CreateTrack';
+import { UpdateTrack } from '../models/actions/update/UpdateTrack';
 import { Track } from '../models/entities/Track';
 import { ResponseEmpty } from '../models/responses/ResponseEmpty';
 import { ResponseTrack } from '../models/responses/ResponseTrack';
+import { ScanStationController } from './ScanStationController';
 
 @JsonController('/tracks')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class TrackController {
 	private trackRepository: Repository<Track>;
 
@@ -23,6 +24,7 @@ export class TrackController {
 	@Get()
 	@Authorized("TRACK:GET")
 	@ResponseSchema(ResponseTrack, { isArray: true })
+	@OpenAPI({ description: 'Lists all tracks.' })
 	async getAll() {
 		let responseTracks: ResponseTrack[] = new Array<ResponseTrack>();
 		const tracks = await this.trackRepository.find();
@@ -37,7 +39,7 @@ export class TrackController {
 	@ResponseSchema(ResponseTrack)
 	@ResponseSchema(TrackNotFoundError, { statusCode: 404 })
 	@OnUndefined(TrackNotFoundError)
-	@OpenAPI({ description: "Returns a track of a specified id (if it exists)" })
+	@OpenAPI({ description: "Lists all information about the track whose id got provided." })
 	async getOne(@Param('id') id: number) {
 		let track = await this.trackRepository.findOne({ id: id });
 		if (!track) { throw new TrackNotFoundError(); }
@@ -47,12 +49,13 @@ export class TrackController {
 	@Post()
 	@Authorized("TRACK:CREATE")
 	@ResponseSchema(ResponseTrack)
-	@OpenAPI({ description: "Create a new track object (id will be generated automagicly)." })
+	@ResponseSchema(TrackLapTimeCantBeNegativeError, { statusCode: 406 })
+	@OpenAPI({ description: "Create a new track. <br> Please remember that the track\'s distance must be greater than 0." })
 	async post(
 		@Body({ validate: true })
 		track: CreateTrack
 	) {
-		return new ResponseTrack(await this.trackRepository.save(track.toTrack()));
+		return new ResponseTrack(await this.trackRepository.save(await track.toEntity()));
 	}
 
 	@Put('/:id')
@@ -60,20 +63,21 @@ export class TrackController {
 	@ResponseSchema(ResponseTrack)
 	@ResponseSchema(TrackNotFoundError, { statusCode: 404 })
 	@ResponseSchema(TrackIdsNotMatchingError, { statusCode: 406 })
-	@OpenAPI({ description: "Update a track object (id can't be changed)." })
-	async put(@Param('id') id: number, @EntityFromBody() track: Track) {
+	@ResponseSchema(TrackLapTimeCantBeNegativeError, { statusCode: 406 })
+	@OpenAPI({ description: "Update the track whose id you provided. <br> Please remember that ids can't be changed." })
+	async put(@Param('id') id: number, @Body({ validate: true }) updateTrack: UpdateTrack) {
 		let oldTrack = await this.trackRepository.findOne({ id: id });
 
 		if (!oldTrack) {
 			throw new TrackNotFoundError();
 		}
 
-		if (oldTrack.id != track.id) {
+		if (oldTrack.id != updateTrack.id) {
 			throw new TrackIdsNotMatchingError();
 		}
+		await this.trackRepository.save(await updateTrack.update(oldTrack));
 
-		await this.trackRepository.save(track);
-		return new ResponseTrack(track);
+		return new ResponseTrack(await this.trackRepository.findOne({ id: id }));
 	}
 
 	@Delete('/:id')
@@ -81,11 +85,20 @@ export class TrackController {
 	@ResponseSchema(ResponseTrack)
 	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
 	@OnUndefined(204)
-	@OpenAPI({ description: "Delete a specified track (if it exists)." })
-	async remove(@Param("id") id: number) {
+	@OpenAPI({ description: "Delete the track whose id you provided. <br> If no track with this id exists it will just return 204(no content)." })
+	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
 		let track = await this.trackRepository.findOne({ id: id });
 		if (!track) { return null; }
 
+		const trackStations = (await this.trackRepository.findOne({ id: id }, { relations: ["stations"] })).stations;
+		if (trackStations.length != 0 && !force) {
+			throw new TrackHasScanStationsError();
+		}
+		const stationController = new ScanStationController;
+		for (let station of trackStations) {
+			await stationController.remove(station.id, force);
+		}
+
 		await this.trackRepository.delete(track);
 		return new ResponseTrack(track);
 	}

src/controllers/UserController.ts

@@ -1,18 +1,19 @@
 import { Authorized, Body, Delete, Get, JsonController, OnUndefined, Param, Post, Put, QueryParam } from 'routing-controllers';
 import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
 import { getConnectionManager, Repository } from 'typeorm';
-import { UserIdsNotMatchingError, UserNotFoundError } from '../errors/UserErrors';
+import { UserDeletionNotConfirmedError, UserIdsNotMatchingError, UsernameContainsIllegalCharacterError, UserNotFoundError } from '../errors/UserErrors';
 import { UserGroupNotFoundError } from '../errors/UserGroupErrors';
-import { CreateUser } from '../models/actions/CreateUser';
-import { UpdateUser } from '../models/actions/UpdateUser';
+import { CreateUser } from '../models/actions/create/CreateUser';
+import { UpdateUser } from '../models/actions/update/UpdateUser';
 import { User } from '../models/entities/User';
 import { ResponseEmpty } from '../models/responses/ResponseEmpty';
 import { ResponseUser } from '../models/responses/ResponseUser';
+import { ResponseUserPermissions } from '../models/responses/ResponseUserPermissions';
 import { PermissionController } from './PermissionController';
 
 
 @JsonController('/users')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class UserController {
 	private userRepository: Repository<User>;
 
@@ -25,11 +26,11 @@ export class UserController {
 
 	@Get()
 	@Authorized("USER:GET")
-	@ResponseSchema(User, { isArray: true })
-	@OpenAPI({ description: 'Lists all users.' })
+	@ResponseSchema(ResponseUser, { isArray: true })
+	@OpenAPI({ description: 'Lists all users. <br> This includes their groups and permissions granted to them.' })
 	async getAll() {
 		let responseUsers: ResponseUser[] = new Array<ResponseUser>();
-		const users = await this.userRepository.find({ relations: ['permissions', 'groups'] });
+		const users = await this.userRepository.find({ relations: ['permissions', 'groups', 'groups.permissions'] });
 		users.forEach(user => {
 			responseUsers.push(new ResponseUser(user));
 		});
@@ -38,39 +39,53 @@ export class UserController {
 
 	@Get('/:id')
 	@Authorized("USER:GET")
-	@ResponseSchema(User)
+	@ResponseSchema(ResponseUser)
 	@ResponseSchema(UserNotFoundError, { statusCode: 404 })
 	@OnUndefined(UserNotFoundError)
-	@OpenAPI({ description: 'Returns a user of a specified id (if it exists)' })
+	@OpenAPI({ description: 'Lists all information about the user whose id got provided. <br> Please remember that all permissions granted to the user will show up here.' })
 	async getOne(@Param('id') id: number) {
-		let user = await this.userRepository.findOne({ id: id }, { relations: ['permissions', 'groups'] })
+		let user = await this.userRepository.findOne({ id: id }, { relations: ['permissions', 'groups', 'groups.permissions'] })
 		if (!user) { throw new UserNotFoundError(); }
 		return new ResponseUser(user);
 	}
 
+	@Get('/:id/permissions')
+	@Authorized("USER:GET")
+	@ResponseSchema(ResponseUser)
+	@ResponseSchema(UserNotFoundError, { statusCode: 404 })
+	@OnUndefined(UserNotFoundError)
+	@OpenAPI({ description: 'Lists all permissions granted to the user sorted into directly granted and inherited as permission response objects.' })
+	async getPermissions(@Param('id') id: number) {
+		let user = await this.userRepository.findOne({ id: id }, { relations: ['permissions', 'groups', 'groups.permissions', 'permissions.principal', 'groups.permissions.principal'] })
+		if (!user) { throw new UserNotFoundError(); }
+		return new ResponseUserPermissions(user);
+	}
+
 	@Post()
 	@Authorized("USER:CREATE")
-	@ResponseSchema(User)
-	@ResponseSchema(UserGroupNotFoundError)
-	@OpenAPI({ description: 'Create a new user object (id will be generated automagicly).' })
+	@ResponseSchema(ResponseUser)
+	@ResponseSchema(UserGroupNotFoundError, { statusCode: 404 })
+	@ResponseSchema(UsernameContainsIllegalCharacterError, { statusCode: 406 })
+	@OpenAPI({ description: 'Create a new user. <br> If you want to grant permissions to the user you have to create them seperately by posting to /api/permissions after creating the user.' })
 	async post(@Body({ validate: true }) createUser: CreateUser) {
 		let user;
 		try {
-			user = await createUser.toUser();
+			user = await createUser.toEntity();
 		} catch (error) {
 			throw error;
 		}
 
 		user = await this.userRepository.save(user)
-		return new ResponseUser(await this.userRepository.findOne(user, { relations: ['permissions', 'groups'] }));
+		return new ResponseUser(await this.userRepository.findOne({ id: user.id }, { relations: ['permissions', 'groups', 'groups.permissions'] }));
 	}
 
 	@Put('/:id')
 	@Authorized("USER:UPDATE")
-	@ResponseSchema(User)
+	@ResponseSchema(ResponseUser)
 	@ResponseSchema(UserNotFoundError, { statusCode: 404 })
 	@ResponseSchema(UserIdsNotMatchingError, { statusCode: 406 })
-	@OpenAPI({ description: "Update a user object (id can't be changed)." })
+	@ResponseSchema(UsernameContainsIllegalCharacterError, { statusCode: 406 })
+	@OpenAPI({ description: "Update the user whose id you provided. <br> To change the permissions directly granted to the user please use /api/permissions instead. <br> Please remember that ids can't be changed." })
 	async put(@Param('id') id: number, @Body({ validate: true }) updateUser: UpdateUser) {
 		let oldUser = await this.userRepository.findOne({ id: id });
 
@@ -81,21 +96,23 @@ export class UserController {
 		if (oldUser.id != updateUser.id) {
 			throw new UserIdsNotMatchingError();
 		}
-		await this.userRepository.save(await updateUser.updateUser(oldUser));
+		await this.userRepository.save(await updateUser.update(oldUser));
 
-		return new ResponseUser(await this.userRepository.findOne({ id: id }, { relations: ['permissions', 'groups'] }));
+		return new ResponseUser(await this.userRepository.findOne({ id: id }, { relations: ['permissions', 'groups', 'groups.permissions'] }));
 	}
 
 	@Delete('/:id')
 	@Authorized("USER:DELETE")
-	@ResponseSchema(User)
+	@ResponseSchema(ResponseUser)
 	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
+	@ResponseSchema(UserDeletionNotConfirmedError, { statusCode: 406 })
 	@OnUndefined(204)
-	@OpenAPI({ description: 'Delete a user runner (if it exists).' })
+	@OpenAPI({ description: 'Delete the user whose id you provided. <br> You have to confirm your decision by providing the ?force=true query param. <br> If there are any permissions directly granted to the user they will get deleted as well. <br> If no user with this id exists it will just return 204(no content).' })
 	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
+		if (!force) { throw new UserDeletionNotConfirmedError; }
 		let user = await this.userRepository.findOne({ id: id });
 		if (!user) { return null; }
-		const responseUser = await this.userRepository.findOne({ id: id }, { relations: ['permissions', 'groups'] });;
+		const responseUser = await this.userRepository.findOne({ id: id }, { relations: ['permissions', 'groups', 'groups.permissions'] });;
 
 		const permissionControler = new PermissionController();
 		for (let permission of responseUser.permissions) {

src/controllers/UserGroupController.ts

@@ -3,7 +3,8 @@ import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
 import { getConnectionManager, Repository } from 'typeorm';
 import { EntityFromBody } from 'typeorm-routing-controllers-extensions';
 import { UserGroupIdsNotMatchingError, UserGroupNotFoundError } from '../errors/UserGroupErrors';
-import { CreateUserGroup } from '../models/actions/CreateUserGroup';
+import { CreateUserGroup } from '../models/actions/create/CreateUserGroup';
+import { UpdateUserGroup } from '../models/actions/update/UpdateUserGroup';
 import { UserGroup } from '../models/entities/UserGroup';
 import { ResponseEmpty } from '../models/responses/ResponseEmpty';
 import { ResponseUserGroup } from '../models/responses/ResponseUserGroup';
@@ -11,7 +12,7 @@ import { PermissionController } from './PermissionController';
 
 
 @JsonController('/usergroups')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class UserGroupController {
 	private userGroupsRepository: Repository<UserGroup>;
 
@@ -25,9 +26,9 @@ export class UserGroupController {
 	@Get()
 	@Authorized("USERGROUP:GET")
 	@ResponseSchema(UserGroup, { isArray: true })
-	@OpenAPI({ description: 'Lists all usergroups.' })
+	@OpenAPI({ description: 'Lists all groups. <br> The information provided might change while the project continues to evolve.' })
 	getAll() {
-		return this.userGroupsRepository.find();
+		return this.userGroupsRepository.find({ relations: ["permissions"] });
 	}
 
 	@Get('/:id')
@@ -35,20 +36,20 @@ export class UserGroupController {
 	@ResponseSchema(UserGroup)
 	@ResponseSchema(UserGroupNotFoundError, { statusCode: 404 })
 	@OnUndefined(UserGroupNotFoundError)
-	@OpenAPI({ description: 'Returns a usergroup of a specified id (if it exists)' })
+	@OpenAPI({ description: 'Lists all information about the group whose id got provided. <br> The information provided might change while the project continues to evolve.' })
 	getOne(@Param('id') id: number) {
-		return this.userGroupsRepository.findOne({ id: id });
+		return this.userGroupsRepository.findOne({ id: id }, { relations: ["permissions"] });
 	}
 
 	@Post()
 	@Authorized("USERGROUP:CREATE")
 	@ResponseSchema(UserGroup)
 	@ResponseSchema(UserGroupNotFoundError)
-	@OpenAPI({ description: 'Create a new usergroup object (id will be generated automagicly).' })
+	@OpenAPI({ description: 'Create a new group. <br> If you want to grant permissions to the group you have to create them seperately by posting to /api/permissions after creating the group.' })
 	async post(@Body({ validate: true }) createUserGroup: CreateUserGroup) {
 		let userGroup;
 		try {
-			userGroup = await createUserGroup.toUserGroup();
+			userGroup = await createUserGroup.toEntity();
 		} catch (error) {
 			throw error;
 		}
@@ -61,20 +62,20 @@ export class UserGroupController {
 	@ResponseSchema(UserGroup)
 	@ResponseSchema(UserGroupNotFoundError, { statusCode: 404 })
 	@ResponseSchema(UserGroupIdsNotMatchingError, { statusCode: 406 })
-	@OpenAPI({ description: "Update a usergroup object (id can't be changed)." })
-	async put(@Param('id') id: number, @EntityFromBody() userGroup: UserGroup) {
-		let oldUserGroup = await this.userGroupsRepository.findOne({ id: id });
+	@OpenAPI({ description: "Update the group whose id you provided. <br> To change the permissions granted to the group please use /api/permissions instead. <br> Please remember that ids can't be changed." })
+	async put(@Param('id') id: number, @EntityFromBody() updateGroup: UpdateUserGroup) {
+		let oldGroup = await this.userGroupsRepository.findOne({ id: id });
 
-		if (!oldUserGroup) {
-			throw new UserGroupNotFoundError()
+		if (!oldGroup) {
+			throw new UserGroupNotFoundError();
 		}
 
-		if (oldUserGroup.id != userGroup.id) {
+		if (oldGroup.id != updateGroup.id) {
 			throw new UserGroupIdsNotMatchingError();
 		}
+		await this.userGroupsRepository.save(await updateGroup.update(oldGroup));
 
-		await this.userGroupsRepository.save(userGroup);
-		return userGroup;
+		return (await this.userGroupsRepository.findOne({ id: id }, { relations: ['permissions', 'groups'] })).toResponse();
 	}
 
 	@Delete('/:id')
@@ -82,15 +83,15 @@ export class UserGroupController {
 	@ResponseSchema(ResponseUserGroup)
 	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
 	@OnUndefined(204)
-	@OpenAPI({ description: 'Delete a specified usergroup (if it exists).' })
+	@OpenAPI({ description: 'Delete the group whose id you provided. <br> If there are any permissions directly granted to the group they will get deleted as well. <br> Users associated with this group won\'t get deleted - just deassociated. <br> If no group with this id exists it will just return 204(no content).' })
 	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
-		let group = await this.userGroupsRepository.findOne({ id: id });
+		let group = await this.userGroupsRepository.findOne({ id: id }, { relations: ["permissions"] });
 		if (!group) { return null; }
-		const responseGroup = await this.userGroupsRepository.findOne({ id: id }, { relations: ['permissions'] });;
+		const responseGroup = await this.userGroupsRepository.findOne({ id: id }, { relations: ['permissions'] });
 
-		const permissionControler = new PermissionController();
+		const permissionController = new PermissionController();
 		for (let permission of responseGroup.permissions) {
-			await permissionControler.remove(permission.id, true);
+			await permissionController.remove(permission.id, true);
 		}
 
 		await this.userGroupsRepository.delete(group);

src/errors/AddressErrors.ts

@@ -1,24 +1,57 @@
 import { IsString } from 'class-validator';
-import { NotAcceptableError, NotFoundError } from 'routing-controllers';
+import { BadRequestError } from 'routing-controllers';
 
 /**
- * Error to throw, when to provided address doesn't belong to the accepted types.
+ * Error to throw when an address's postal code fails validation.
  */
-export class AddressWrongTypeError extends NotAcceptableError {
+export class AddressPostalCodeInvalidError extends BadRequestError {
 	@IsString()
-	name = "AddressWrongTypeError"
+	name = "AddressPostalCodeInvalidError"
 
 	@IsString()
-	message = "The address must be an existing adress's id. \n You provided a object of another type."
+	message = "The postal code you provided is invalid. \n Please check if your postal code follows the postal code validation guidelines."
 }
 
 /**
- * Error to throw, when a non-existant address get's loaded.
+ * Error to throw when an non-empty address's first line isn't set.
  */
-export class AddressNotFoundError extends NotFoundError {
+export class AddressFirstLineEmptyError extends BadRequestError {
 	@IsString()
-	name = "AddressNotFoundError"
+	name = "AddressFirstLineEmptyError"
 
 	@IsString()
-	message = "The address you provided couldn't be located in the system. \n Please check your request."
+	message = "You provided a empty first address line. \n If you want an empty address please set all propertys to null. \n For non-empty addresses the following fields have to be set: address1, postalcode, city, country"
+}
+
+/**
+ * Error to throw when an non-empty address's postal code isn't set.
+ */
+export class AddressPostalCodeEmptyError extends BadRequestError {
+	@IsString()
+	name = "AddressPostalCodeEmptyError"
+
+	@IsString()
+	message = "You provided a empty postal code. \n If you want an empty address please set all propertys to null. \n For non-empty addresses the following fields have to be set: address1, postalcode, city, country"
+}
+
+/**
+ * Error to throw when an non-empty address's city isn't set.
+ */
+export class AddressCityEmptyError extends BadRequestError {
+	@IsString()
+	name = "AddressCityEmptyError"
+
+	@IsString()
+	message = "You provided a empty city. \n If you want an empty address please set all propertys to null. \n For non-empty addresses the following fields have to be set: address1, postalcode, city, country"
+}
+
+/**
+ * Error to throw when an non-empty address's country isn't set.
+ */
+export class AddressCountryEmptyError extends BadRequestError {
+	@IsString()
+	name = "AddressCountryEmptyError"
+
+	@IsString()
+	message = "You provided a empty country. \n If you want an empty address please set all propertys to null. \n For non-empty addresses the following fields have to be set: address1, postalcode, city, country"
 }

src/errors/AuthError.ts

@@ -115,4 +115,26 @@ export class RefreshTokenCountInvalidError extends NotAcceptableError {
 
 	@IsString()
 	message = "Refresh token count is invalid."
+}
+
+/**
+ * Error to throw when someone tries to reset a user's password more than once in 15 minutes.
+ */
+export class ResetAlreadyRequestedError extends NotAcceptableError {
+	@IsString()
+	name = "ResetAlreadyRequestedError"
+
+	@IsString()
+	message = "You already requested a password reset in the last 15 minutes. \n Please wait until the old reset code expires before requesting a new one."
+}
+
+/**
+ * Error to throw when someone tries a disabled user's password or login as a disabled user.
+ */
+export class UserDisabledError extends NotAcceptableError {
+	@IsString()
+	name = "UserDisabledError"
+
+	@IsString()
+	message = "This user is currently disabled. \n Please contact your administrator if this is a mistake."
 }

src/errors/DonationErrors.ts

@@ -0,0 +1,25 @@
+import { IsString } from 'class-validator';
+import { NotAcceptableError, NotFoundError } from 'routing-controllers';
+
+/**
+ * Error to throw when a Donation couldn't be found.
+ */
+export class DonationNotFoundError extends NotFoundError {
+	@IsString()
+	name = "DonationNotFoundError"
+
+	@IsString()
+	message = "Donation not found!"
+}
+
+/**
+ * Error to throw when two Donations' ids don't match.
+ * Usually occurs when a user tries to change a Donation's id.
+ */
+export class DonationIdsNotMatchingError extends NotAcceptableError {
+	@IsString()
+	name = "DonationIdsNotMatchingError"
+
+	@IsString()
+	message = "The ids don't match! \n And if you wanted to change a Donation's id: This isn't allowed!"
+}

src/errors/DonorErrors.ts

@@ -0,0 +1,47 @@
+import { IsString } from 'class-validator';
+import { NotAcceptableError, NotFoundError } from 'routing-controllers';
+
+/**
+ * Error to throw when a donor couldn't be found.
+ */
+export class DonorNotFoundError extends NotFoundError {
+	@IsString()
+	name = "DonorNotFoundError"
+
+	@IsString()
+	message = "Donor not found!"
+}
+
+/**
+ * Error to throw when two donors' ids don't match.
+ * Usually occurs when a user tries to change a donor's id.
+ */
+export class DonorIdsNotMatchingError extends NotAcceptableError {
+	@IsString()
+	name = "DonorIdsNotMatchingError"
+
+	@IsString()
+	message = "The ids don't match! \n And if you wanted to change a donor's id: This isn't allowed!"
+}
+
+/**
+ * Error to throw when a donor needs a receipt, but no address is associated with them.
+ */
+export class DonorReceiptAddressNeededError extends NotAcceptableError {
+	@IsString()
+	name = "DonorReceiptAddressNeededError"
+
+	@IsString()
+	message = "An address is needed to create a receipt for a donor. \n You didn't provide one."
+}
+
+/**
+* Error to throw when a donor still has donations associated.
+*/
+export class DonorHasDonationsError extends NotAcceptableError {
+	@IsString()
+	name = "DonorHasDonationsError"
+
+	@IsString()
+	message = "This donor still has donations associated with it. \n If you want to delete this donor with all it's donations and teams add `?force` to your query."
+}

src/errors/GroupContactErrors.ts

@@ -2,18 +2,7 @@ import { IsString } from 'class-validator';
 import { NotAcceptableError, NotFoundError } from 'routing-controllers';
 
 /**
- * Error to throw, when a provided groupContact doesn't belong to the accepted types.
- */
-export class GroupContactWrongTypeError extends NotAcceptableError {
-	@IsString()
-	name = "GroupContactWrongTypeError"
-
-	@IsString()
-	message = "The groupContact must be an existing groupContact's id. \n You provided a object of another type."
-}
-
-/**
- * Error to throw, when a non-existant groupContact get's loaded.
+ * Error to throw, when a non-existent contact get's requested.
  */
 export class GroupContactNotFoundError extends NotFoundError {
 	@IsString()
@@ -21,4 +10,16 @@ export class GroupContactNotFoundError extends NotFoundError {
 
 	@IsString()
 	message = "The groupContact you provided couldn't be located in the system. \n Please check your request."
-}
+}
+
+/**
+ * Error to throw when two contacts' ids don't match.
+ * Usually occurs when a user tries to change a contact's id.
+ */
+export class GroupContactIdsNotMatchingError extends NotAcceptableError {
+	@IsString()
+	name = "GroupContactIdsNotMatchingError"
+
+	@IsString()
+	message = "The ids don't match! \n And if you wanted to change a contact's id: This isn't allowed!"
+}

src/errors/PrincipalErrors.ts

@@ -13,12 +13,12 @@ export class PrincipalNotFoundError extends NotFoundError {
 }
 
 /**
- * Error to throw, when a provided runnerOrganisation doesn't belong to the accepted types.
+ * Error to throw, when a provided runner organization doesn't belong to the accepted types.
  */
 export class PrincipalWrongTypeError extends NotAcceptableError {
 	@IsString()
 	name = "PrincipalWrongTypeError"
 
 	@IsString()
-	message = "The princial must have an existing principal's id. \n You provided a object of another type."
+	message = "The principal must have an existing principal's id. \n You provided a object of another type."
 }

src/errors/RunnerCardErrors.ts

@@ -0,0 +1,48 @@
+import { IsString } from 'class-validator';
+import { NotAcceptableError, NotFoundError } from 'routing-controllers';
+
+/**
+ * Error to throw when a card couldn't be found.
+ */
+export class RunnerCardNotFoundError extends NotFoundError {
+	@IsString()
+	name = "RunnerCardNotFoundError"
+
+	@IsString()
+	message = "Card not found!"
+}
+
+/**
+ * Error to throw when two cards' ids don't match.
+ * Usually occurs when a user tries to change a card's id.
+ */
+export class RunnerCardIdsNotMatchingError extends NotAcceptableError {
+	@IsString()
+	name = "RunnerCardIdsNotMatchingError"
+
+	@IsString()
+	message = "The ids don't match! \n And if you wanted to change a cards's id: This isn't allowed"
+}
+
+/**
+ * Error to throw when a card still has scans associated.
+ */
+export class RunnerCardHasScansError extends NotAcceptableError {
+	@IsString()
+	name = "RunnerCardHasScansError"
+
+	@IsString()
+	message = "This card still has scans associated with it. \n If you want to delete this card with all it's scans add `?force` to your query. \n Otherwise please consider just disabling it."
+}
+
+/**
+ * Error to throw when a card's id is too big to generate a ean-13 barcode for it.
+ * This error should never reach a end user.
+ */
+export class RunnerCardIdOutOfRangeError extends Error {
+	@IsString()
+	name = "RunnerCardIdOutOfRangeError"
+
+	@IsString()
+	message = "The card's id is too big to fit into a ean-13 barcode. \n This has a very low probability of happening but means that you might want to switch your barcode format for something that can accept numbers over 9999999999."
+}

src/errors/RunnerErrors.ts

@@ -32,5 +32,16 @@ export class RunnerGroupNeededError extends NotAcceptableError {
 	name = "RunnerGroupNeededError"
 
 	@IsString()
-	message = "Runner's need to be part of one group (team or organisiation)! \n You provided neither."
+	message = "Runner's need to be part of one group (team or organisation)! \n You provided neither."
+}
+
+/**
+* Error to throw when a runner still has distance donations associated.
+*/
+export class RunnerHasDistanceDonationsError extends NotAcceptableError {
+	@IsString()
+	name = "RunnerHasDistanceDonationsError"
+
+	@IsString()
+	message = "This runner still has distance donations associated with it. \n If you want to delete this runner with all it's donations and teams add `?force` to your query."
 }

src/errors/RunnerOrganisationErrors.ts

@@ -13,7 +13,7 @@ export class RunnerOrganisationNotFoundError extends NotFoundError {
 }
 
 /**
- * Error to throw when two runner organisations' ids don't match.
+ * Error to throw when two runner organisation's ids don't match.
  * Usually occurs when a user tries to change a runner organisation's id.
  */
 export class RunnerOrganisationIdsNotMatchingError extends NotAcceptableError {

src/errors/ScanErrors.ts

@@ -0,0 +1,25 @@
+import { IsString } from 'class-validator';
+import { NotAcceptableError, NotFoundError } from 'routing-controllers';
+
+/**
+ * Error to throw when a Scan couldn't be found.
+ */
+export class ScanNotFoundError extends NotFoundError {
+	@IsString()
+	name = "ScanNotFoundError"
+
+	@IsString()
+	message = "Scan not found!"
+}
+
+/**
+ * Error to throw when two Scans' ids don't match.
+ * Usually occurs when a user tries to change a Scan's id.
+ */
+export class ScanIdsNotMatchingError extends NotAcceptableError {
+	@IsString()
+	name = "ScanIdsNotMatchingError"
+
+	@IsString()
+	message = "The ids don't match! \n And if you wanted to change a Scan's id: This isn't allowed!"
+}

src/errors/ScanStationErrors.ts

@@ -0,0 +1,36 @@
+import { IsString } from 'class-validator';
+import { NotAcceptableError, NotFoundError } from 'routing-controllers';
+
+/**
+ * Error to throw, when a non-existent scan station get's loaded.
+ */
+export class ScanStationNotFoundError extends NotFoundError {
+	@IsString()
+	name = "ScanStationNotFoundError"
+
+	@IsString()
+	message = "The scan station you provided couldn't be located in the system. \n Please check your request."
+}
+
+/**
+ * Error to throw when two scan stations' ids don't match.
+ * Usually occurs when a user tries to change a scan station's id.
+ */
+export class ScanStationIdsNotMatchingError extends NotAcceptableError {
+	@IsString()
+	name = "ScanStationIdsNotMatchingError"
+
+	@IsString()
+	message = "The ids don't match! \n And if you wanted to change a scan station's id: This isn't allowed!"
+}
+
+/**
+ * Error to throw when a station still has scans associated.
+ */
+export class ScanStationHasScansError extends NotAcceptableError {
+	@IsString()
+	name = "ScanStationHasScansError"
+
+	@IsString()
+	message = "This station still has scans associated with it. \n If you want to delete this station with all it's scans add `?force` to your query."
+}

src/errors/StatsClientErrors.ts

@@ -0,0 +1,25 @@
+import { IsString } from 'class-validator';
+import { NotAcceptableError, NotFoundError } from 'routing-controllers';
+
+/**
+ * Error to throw, when a non-existent stats client get's loaded.
+ */
+export class StatsClientNotFoundError extends NotFoundError {
+	@IsString()
+	name = "StatsClientNotFoundError"
+
+	@IsString()
+	message = "The stats client you provided couldn't be located in the system. \n Please check your request."
+}
+
+/**
+ * Error to throw when two stats clients' ids don't match.
+ * Usually occurs when a user tries to change a stats client's id.
+ */
+export class StatsClientIdsNotMatchingError extends NotAcceptableError {
+	@IsString()
+	name = "StatsClientIdsNotMatchingError"
+
+	@IsString()
+	message = "The ids don't match! \n And if you wanted to change a stats client's id: This isn't allowed!"
+}

src/errors/TrackErrors.ts

@@ -22,4 +22,23 @@ export class TrackIdsNotMatchingError extends NotAcceptableError {
 
 	@IsString()
 	message = "The ids don't match! \n And if you wanted to change a track's id: This isn't allowed"
+}
+
+/**
+ * Error to throw when a track's lap time is set to a negative value.
+ */
+export class TrackLapTimeCantBeNegativeError extends NotAcceptableError {
+	@IsString()
+	name = "TrackLapTimeCantBeNegativeError"
+
+	@IsString()
+	message = "The minimum lap time you provided is negative - That isn't possible. \n If you wanted to disable it: Just set it to 0/null."
+}
+
+export class TrackHasScanStationsError extends NotAcceptableError {
+	@IsString()
+	name = "TrackHasScanStationsError"
+
+	@IsString()
+	message = "This track still has stations associated with it. \n If you want to delete this track with all it's stations and scans add `?force` to your query."
 }

src/errors/UserErrors.ts

@@ -4,7 +4,7 @@ import { NotAcceptableError, NotFoundError } from 'routing-controllers';
 
 /**
  * Error to throw when no username or email is set.
- * We somehow need to identify you :)
+ * We somehow need to identify you on login.
  */
 export class UsernameOrEmailNeededError extends NotFoundError {
 	@IsString()
@@ -14,6 +14,30 @@ export class UsernameOrEmailNeededError extends NotFoundError {
 	message = "No username or email is set!"
 }
 
+/**
+ * Error to throw when no username contains illegal characters.
+ * Right now the only one is "@" but this could change in the future.
+ */
+export class UsernameContainsIllegalCharacterError extends NotAcceptableError {
+	@IsString()
+	name = "UsernameContainsIllegalCharacterError"
+
+	@IsString()
+	message = "The provided username contains illegal characters! \n Right now the following characters are considered illegal: '@'"
+}
+
+/**
+ * Error to throw when no email is set.
+ * We somehow need to identify you :)
+ */
+export class UserEmailNeededError extends NotFoundError {
+	@IsString()
+	name = "UserEmailNeededError"
+
+	@IsString()
+	message = "No email is set! \n You have to provide email addresses for users (used for password reset among others)."
+}
+
 /**
  * Error to throw when a user couldn't be found.
  */
@@ -35,4 +59,16 @@ export class UserIdsNotMatchingError extends NotAcceptableError {
 
 	@IsString()
 	message = "The ids don't match!! \n And if you wanted to change a user's id: This isn't allowed!"
+}
+
+/**
+ * Error to throw when two users' ids don't match.
+ * Usually occurs when a user tries to change a user's id.
+ */
+export class UserDeletionNotConfirmedError extends NotAcceptableError {
+	@IsString()
+	name = "UserDeletionNotConfirmedError"
+
+	@IsString()
+	message = "You are trying to delete a user! \n If you're sure about doing this: provide the ?force=true query param."
 }

src/errors/UserGroupErrors.ts

@@ -2,7 +2,7 @@ import { IsString } from 'class-validator';
 import { NotAcceptableError, NotFoundError } from 'routing-controllers';
 
 /**
- * Error to throw when no groupname is set.
+ * Error to throw when no group name is set.
  */
 export class GroupNameNeededError extends NotFoundError {
 	@IsString()
@@ -13,7 +13,7 @@ export class GroupNameNeededError extends NotFoundError {
 }
 
 /**
- * Error to throw when a usergroup couldn't be found.
+ * Error to throw when a user group couldn't be found.
  */
 export class UserGroupNotFoundError extends NotFoundError {
 	@IsString()
@@ -24,13 +24,13 @@ export class UserGroupNotFoundError extends NotFoundError {
 }
 
 /**
- * Error to throw when two usergroups' ids don't match.
- * Usually occurs when a user tries to change a usergroups's id.
+ * Error to throw when two user groups' ids don't match.
+ * Usually occurs when a user tries to change a user groups's id.
  */
 export class UserGroupIdsNotMatchingError extends NotAcceptableError {
 	@IsString()
 	name = "UserGroupIdsNotMatchingError"
 
 	@IsString()
-	message = "The ids don't match!! \n If you wanted to change a usergroup's id: This isn't allowed!"
+	message = "The ids don't match!! \n If you wanted to change a user group's id: This isn't allowed!"
 }

src/jwtcreator.ts

@@ -33,6 +33,20 @@ export class JwtCreator {
             exp: expiry_timestamp
         }, config.jwt_secret)
     }
+
+    /**
+     * Creates a new password reset token for a given user.
+     * The token is valid for 15 minutes or 1 use - whatever comes first.
+     * @param user User entity that the password reset token shall be created for
+     */
+    public static createReset(user: User) {
+        let expiry_timestamp = Math.floor(Date.now() / 1000) + 15 * 60;
+        return jsonwebtoken.sign({
+            id: user.id,
+            refreshTokenCount: user.refreshTokenCount,
+            exp: expiry_timestamp
+        }, config.jwt_secret)
+    }
 }
 
 /**
@@ -92,23 +106,6 @@ export class JwtUser {
         this.refreshTokenCount = user.refreshTokenCount;
         this.uuid = user.uuid;
         this.profilePic = user.profilePic;
-        this.permissions = this.getPermissions(user);
-    }
-
-    /**
-     * Handels getting the permissions granted to this user (direct or indirect).
-     * @param user User which's permissions shall be gotten.
-     */
-    public getPermissions(user: User): string[] {
-        let returnPermissions: string[] = new Array<string>();
-        for (let permission of user.permissions) {
-            returnPermissions.push(permission.toString());
-        }
-        for (let group of user.groups) {
-            for (let permission of group.permissions) {
-                returnPermissions.push(permission.toString());
-            }
-        }
-        return Array.from(new Set(returnPermissions));
+        this.permissions = user.allPermissions;
     }
 }

src/loaders/openapi.ts

@@ -1,8 +1,8 @@
-import { validationMetadatasToSchemas } from "class-validator-jsonschema";
-import { Application } from "express";
+import { validationMetadatasToSchemas } from "@odit/class-validator-jsonschema";
+import express, { Application } from "express";
+import path from 'path';
 import { getMetadataArgsStorage } from "routing-controllers";
-import { routingControllersToSpec } from "routing-controllers-openapi";
-import * as swaggerUiExpress from "swagger-ui-express";
+import { generateSpec } from '../apispec';
 
 /**
  * Loader for everything openapi related - from creating the schema to serving it via a static route and swaggerUiExpress.
@@ -15,42 +15,10 @@ export default async (app: Application) => {
   });
 
   //Spec creation based on the previously created schemas
-  const spec = routingControllersToSpec(
-    storage,
-    {
-      routePrefix: "/api"
-    },
-    {
-      components: {
-        schemas,
-        "securitySchemes": {
-          "AuthToken": {
-            "type": "http",
-            "scheme": "bearer",
-            "bearerFormat": "JWT",
-            description: "A JWT based access token. Use /api/auth/login or /api/auth/refresh to get one."
-          }
-        }
-      },
-      info: {
-        description: "The the backend API for the LfK! runner system.",
-        title: "LfK! Backend API",
-        version: "1.0.0",
-      },
-    }
-  );
-
-  //Options for swaggerUiExpress
-  const options = {
-    explorer: true,
-  };
-  app.use(
-    "/api/docs",
-    swaggerUiExpress.serve,
-    swaggerUiExpress.setup(spec, options)
-  );
-  app.get(["/api/openapi.json", "/api/swagger.json"], (req, res) => {
+  const spec = generateSpec(storage, schemas);
+  app.get(["/api/docs/openapi.json", "/api/docs/swagger.json"], (req, res) => {
     res.json(spec);
   });
+  app.use('/api/docs', express.static(path.join(__dirname, '../static/docs'), { index: "index.html", extensions: ['html'] }));
   return app;
 };

src/middlewares/RawBody.ts

@@ -1,8 +1,8 @@
 import { Request, Response } from 'express';
 
 /**
- * Custom express middleware that appends the raw body to the request obeject.
- * Mainly used for parsing csvs from boddies.
+ * Custom express middleware that appends the raw body to the request object.
+ * Mainly used for parsing csvs from bodies.
  */
 
 const RawBodyMiddleware = (req: Request, res: Response, next: () => void) => {

src/middlewares/ScanAuth.ts

@@ -0,0 +1,69 @@
+import * as argon2 from "argon2";
+import { Request, Response } from 'express';
+import { getConnectionManager } from 'typeorm';
+import { ScanStation } from '../models/entities/ScanStation';
+import authchecker from './authchecker';
+
+/**
+ * This middleware handles the authentication of scan station api tokens.
+ * The tokens have to be provided via Bearer authorization header.
+ * You have to manually use this middleware via @UseBefore(ScanAuth) instead of using @Authorized().
+ * @param req Express request object.
+ * @param res Express response object.
+ * @param next Next function to call on success.
+ */
+const ScanAuth = async (req: Request, res: Response, next: () => void) => {
+    let provided_token: string = req.headers["authorization"];
+    if (provided_token == "" || provided_token === undefined || provided_token === null) {
+        res.status(401).send("No api token provided.");
+        return;
+    }
+
+    try {
+        provided_token = provided_token.replace("Bearer ", "");
+    } catch (error) {
+        res.status(401).send("No valid jwt or api token provided.");
+        return;
+    }
+
+    let prefix = "";
+    try {
+        prefix = provided_token.split(".")[0];
+    }
+    finally {
+        if (prefix == "" || prefix == undefined || prefix == null) {
+            res.status(401).send("Api token non-existent or invalid syntax.");
+            return;
+        }
+    }
+
+    const station = await getConnectionManager().get().getRepository(ScanStation).findOne({ prefix: prefix });
+    if (!station) {
+        let user_authorized = false;
+        try {
+            let action = { request: req, response: res, context: null, next: next }
+            user_authorized = await authchecker(action, ["SCAN:CREATE"]);
+        }
+        finally {
+            if (user_authorized == false) {
+                res.status(401).send("Api token non-existent or invalid syntax.");
+                return;
+            }
+            else {
+                next();
+            }
+        }
+    }
+    else {
+        if (station.enabled == false) {
+            res.status(401).send("Station disabled.");
+        }
+        if (!(await argon2.verify(station.key, provided_token))) {
+            res.status(401).send("Api token invalid.");
+            return;
+        }
+
+        next();
+    }
+}
+export default ScanAuth;

src/middlewares/StatsAuth.ts

@@ -0,0 +1,66 @@
+import * as argon2 from "argon2";
+import { Request, Response } from 'express';
+import { getConnectionManager } from 'typeorm';
+import { StatsClient } from '../models/entities/StatsClient';
+import authchecker from './authchecker';
+
+/**
+ * This middleware handles the authentication of stats client api tokens.
+ * The tokens have to be provided via Bearer authorization header.
+ * You have to manually use this middleware via @UseBefore(StatsAuth) instead of using @Authorized().
+ * @param req Express request object.
+ * @param res Express response object.
+ * @param next Next function to call on success.
+ */
+const StatsAuth = async (req: Request, res: Response, next: () => void) => {
+    let provided_token: string = req.headers["authorization"];
+    if (provided_token == "" || provided_token === undefined || provided_token === null) {
+        res.status(401).send("No api token provided.");
+        return;
+    }
+
+    try {
+        provided_token = provided_token.replace("Bearer ", "");
+    } catch (error) {
+        res.status(401).send("No valid jwt or api token provided.");
+        return;
+    }
+
+    let prefix = "";
+    try {
+        prefix = provided_token.split(".")[0];
+    }
+    finally {
+        if (prefix == "" || prefix == undefined || prefix == null) {
+            res.status(401).send("Api token non-existant or invalid syntax.");
+            return;
+        }
+    }
+
+    const client = await getConnectionManager().get().getRepository(StatsClient).findOne({ prefix: prefix });
+    if (!client) {
+        let user_authorized = false;
+        try {
+            let action = { request: req, response: res, context: null, next: next }
+            user_authorized = await authchecker(action, ["RUNNER:GET", "TEAM:GET", "ORGANISATION:GET"]);
+        }
+        finally {
+            if (user_authorized == false) {
+                res.status(401).send("Api token non-existant or invalid syntax.");
+                return;
+            }
+            else {
+                next();
+            }
+        }
+    }
+    else {
+        if (!(await argon2.verify(client.key, provided_token))) {
+            res.status(401).send("Api token invalid.");
+            return;
+        }
+
+        next();
+    }
+}
+export default StatsAuth;

src/middlewares/UserChecker.ts

@@ -0,0 +1,58 @@
+import cookie from "cookie";
+import * as jwt from "jsonwebtoken";
+import { Action } from 'routing-controllers';
+import { getConnectionManager } from 'typeorm';
+import { config } from '../config';
+import { IllegalJWTError, UserDisabledError, UserNonexistantOrRefreshtokenInvalidError } from '../errors/AuthError';
+import { JwtCreator, JwtUser } from '../jwtcreator';
+import { User } from '../models/entities/User';
+
+/**
+ * TODO:
+ */
+const UserChecker = async (action: Action) => {
+    let jwtPayload = undefined
+    try {
+        let provided_token = "" + action.request.headers["authorization"].replace("Bearer ", "");
+        jwtPayload = <any>jwt.verify(provided_token, config.jwt_secret);
+        jwtPayload = jwtPayload["userdetails"];
+    } catch (error) {
+        jwtPayload = await refresh(action);
+    }
+
+    const user = await getConnectionManager().get().getRepository(User).findOne({ id: jwtPayload["id"], refreshTokenCount: jwtPayload["refreshTokenCount"] })
+    if (!user) { throw new UserNonexistantOrRefreshtokenInvalidError() }
+    if (user.enabled == false) { throw new UserDisabledError(); }
+    return user;
+};
+
+/**
+ * Handles soft-refreshing of access-tokens.
+ * @param action Routing-Controllers action object that provides request and response objects among other stuff.
+ */
+const refresh = async (action: Action) => {
+    let refresh_token = undefined;
+    try {
+        refresh_token = cookie.parse(action.request.headers["cookie"])["lfk_backend__refresh_token"];
+    }
+    catch {
+        throw new IllegalJWTError();
+    }
+
+    let jwtPayload = undefined;
+    try {
+        jwtPayload = <any>jwt.verify(refresh_token, config.jwt_secret);
+    } catch (error) {
+        throw new IllegalJWTError();
+    }
+
+    const user = await getConnectionManager().get().getRepository(User).findOne({ id: jwtPayload["id"], refreshTokenCount: jwtPayload["refreshTokenCount"] }, { relations: ['permissions', 'groups', 'groups.permissions'] })
+    if (!user) { throw new UserNonexistantOrRefreshtokenInvalidError() }
+    if (user.enabled == false) { throw new UserDisabledError(); }
+
+    let newAccess = JwtCreator.createAccess(user);
+    action.response.header("authorization", "Bearer " + newAccess);
+
+    return await new JwtUser(user);
+}
+export default UserChecker;

src/middlewares/authchecker.ts

@@ -2,13 +2,13 @@ import cookie from "cookie";
 import * as jwt from "jsonwebtoken";
 import { Action } from "routing-controllers";
 import { getConnectionManager } from 'typeorm';
-import { config } from './config';
-import { IllegalJWTError, NoPermissionError, UserNonexistantOrRefreshtokenInvalidError } from './errors/AuthError';
-import { JwtCreator, JwtUser } from './jwtcreator';
-import { User } from './models/entities/User';
+import { config } from '../config';
+import { IllegalJWTError, NoPermissionError, UserDisabledError, UserNonexistantOrRefreshtokenInvalidError } from '../errors/AuthError';
+import { JwtCreator, JwtUser } from '../jwtcreator';
+import { User } from '../models/entities/User';
 
 /**
- * Handels authorisation verification via jwt's for all api endpoints using the @Authorized decorator.
+ * Handles authentication via jwt's (Bearer authorization header) for all api endpoints using the @Authorized decorator.
  * @param action Routing-Controllers action object that provides request and response objects among other stuff.
  * @param permissions The permissions that the endpoint using @Authorized requires.
  */
@@ -31,6 +31,7 @@ const authchecker = async (action: Action, permissions: string[] | string) => {
 
     const user = await getConnectionManager().get().getRepository(User).findOne({ id: jwtPayload["id"], refreshTokenCount: jwtPayload["refreshTokenCount"] }, { relations: ['permissions'] })
     if (!user) { throw new UserNonexistantOrRefreshtokenInvalidError() }
+    if (user.enabled == false) { throw new UserDisabledError(); }
     if (!jwtPayload["permissions"]) { throw new NoPermissionError(); }
 
     action.response.local = {}
@@ -42,7 +43,7 @@ const authchecker = async (action: Action, permissions: string[] | string) => {
 }
 
 /**
- * Handels soft-refreshing of access-tokens.
+ * Handles soft-refreshing of access-tokens.
  * @param action Routing-Controllers action object that provides request and response objects among other stuff.
  */
 const refresh = async (action: Action) => {
@@ -63,6 +64,7 @@ const refresh = async (action: Action) => {
 
     const user = await getConnectionManager().get().getRepository(User).findOne({ id: jwtPayload["id"], refreshTokenCount: jwtPayload["refreshTokenCount"] }, { relations: ['permissions', 'groups', 'groups.permissions'] })
     if (!user) { throw new UserNonexistantOrRefreshtokenInvalidError() }
+    if (user.enabled == false) { throw new UserDisabledError(); }
 
     let newAccess = JwtCreator.createAccess(user);
     action.response.header("authorization", "Bearer " + newAccess);

src/models/actions/CreateAddress.ts

@@ -1,69 +0,0 @@
-import { IsNotEmpty, IsOptional, IsPostalCode, IsString } from 'class-validator';
-import { Address } from '../entities/Address';
-
-/**
- * This classed is used to create a new Address entity from a json body (post request).
- */
-export class CreateAddress {
-    /**
-     * The newaddress's description.
-     */
-    @IsString()
-    @IsOptional()
-    description?: string;
-
-    /**
-     * The new address's first line.
-     * Containing the street and house number.
-     */
-    @IsString()
-    @IsNotEmpty()
-    address1: string;
-
-    /**
-     * The new address's second line.
-     * Containing optional information.
-     */
-    @IsString()
-    @IsOptional()
-    address2?: string;
-
-    /**
-     * The new address's postal code.
-     * This will get checked against the postal code syntax for the configured country.
-     * TODO: Implement the config option. 
-     */
-    @IsString()
-    @IsNotEmpty()
-    @IsPostalCode("DE")
-    postalcode: string;
-
-    /**
-     * The new address's city.
-     */
-    @IsString()
-    @IsNotEmpty()
-    city: string;
-
-    /**
-     * The new address's country.
-     */
-    @IsString()
-    @IsNotEmpty()
-    country: string;
-
-    /**
-     * Creates a new Address entity from this.
-     */
-    public toAddress(): Address {
-        let newAddress: Address = new Address();
-
-        newAddress.address1 = this.address1;
-        newAddress.address2 = this.address2;
-        newAddress.postalcode = this.postalcode;
-        newAddress.city = this.city;
-        newAddress.country = this.country;
-
-        return newAddress;
-    }
-}

src/models/actions/CreateGroupContact.ts

@@ -1,85 +0,0 @@
-import { IsEmail, IsInt, IsNotEmpty, IsOptional, IsPhoneNumber, IsString } from 'class-validator';
-import { getConnectionManager } from 'typeorm';
-import { config } from '../../config';
-import { AddressNotFoundError, AddressWrongTypeError } from '../../errors/AddressErrors';
-import { Address } from '../entities/Address';
-import { GroupContact } from '../entities/GroupContact';
-
-/**
- * This classed is used to create a new Group entity from a json body (post request).
- */
-export class CreateGroupContact {
-    /**
-     * The new contact's first name.
-     */
-    @IsNotEmpty()
-    @IsString()
-    firstname: string;
-
-    /**
-     * The new contact's middle name.
-     */
-    @IsOptional()
-    @IsString()
-    middlename?: string;
-
-    /**
-     * The new contact's last name.
-     */
-    @IsNotEmpty()
-    @IsString()
-    lastname: string;
-
-    /**
-     * The new contact's address.
-     * Must be the address's id.
-     */
-    @IsInt()
-    @IsOptional()
-    address?: number;
-
-    /**
-     * The contact's phone number.
-     * This will be validated against the configured country phone numer syntax (default: international).
-     */
-    @IsOptional()
-    @IsPhoneNumber(config.phone_validation_countrycode)
-    phone?: string;
-
-    /**
-     * The contact's email address.
-     */
-    @IsOptional()
-    @IsEmail()
-    email?: string;
-
-    /**
-     * Gets the new contact's address by it's id.
-     */
-    public async getAddress(): Promise<Address> {
-        if (this.address === undefined || this.address === null) {
-            return null;
-        }
-        if (!isNaN(this.address)) {
-            let address = await getConnectionManager().get().getRepository(Address).findOne({ id: this.address });
-            if (!address) { throw new AddressNotFoundError; }
-            return address;
-        }
-
-        throw new AddressWrongTypeError;
-    }
-
-    /**
-     * Creates a new Address entity from this.
-     */
-    public async toGroupContact(): Promise<GroupContact> {
-        let contact: GroupContact = new GroupContact();
-        contact.firstname = this.firstname;
-        contact.middlename = this.middlename;
-        contact.lastname = this.lastname;
-        contact.email = this.email;
-        contact.phone = this.phone;
-        contact.address = await this.getAddress();
-        return null;
-    }
-}

src/models/actions/CreateParticipant.ts

@@ -1,72 +0,0 @@
-import { IsEmail, IsInt, IsNotEmpty, IsOptional, IsPhoneNumber, IsString } from 'class-validator';
-import { getConnectionManager } from 'typeorm';
-import { config } from '../../config';
-import { AddressNotFoundError, AddressWrongTypeError } from '../../errors/AddressErrors';
-import { Address } from '../entities/Address';
-
-/**
- * This classed is used to create a new Participant entity from a json body (post request).
- */
-export abstract class CreateParticipant {
-    /**
-     * The new participant's first name.
-     */
-    @IsString()
-    @IsNotEmpty()
-    firstname: string;
-
-    /**
-     * The new participant's middle name.
-     */
-    @IsString()
-    @IsOptional()
-    middlename?: string;
-
-    /**
-     * The new participant's last name.
-     */
-    @IsString()
-    @IsNotEmpty()
-    lastname: string;
-
-    /**
-     * The new participant's phone number.
-     * This will be validated against the configured country phone numer syntax (default: international).
-     */
-    @IsString()
-    @IsOptional()
-    @IsPhoneNumber(config.phone_validation_countrycode)
-    phone?: string;
-
-    /**
-     * The new participant's e-mail address.
-     */
-    @IsString()
-    @IsOptional()
-    @IsEmail()
-    email?: string;
-
-    /**
-     * The new participant's address.
-     * Must be of type number (address id).
-     */
-    @IsInt()
-    @IsOptional()
-    address?: number;
-
-    /**
-     * Gets the new participant's address by it's address.
-     */
-    public async getAddress(): Promise<Address> {
-        if (this.address === undefined || this.address === null) {
-            return null;
-        }
-        if (!isNaN(this.address)) {
-            let address = await getConnectionManager().get().getRepository(Address).findOne({ id: this.address });
-            if (!address) { throw new AddressNotFoundError; }
-            return address;
-        }
-
-        throw new AddressWrongTypeError;
-    }
-}

src/models/actions/CreateRunnerGroup.ts

@@ -1,40 +0,0 @@
-import { IsInt, IsNotEmpty, IsOptional, IsString } from 'class-validator';
-import { getConnectionManager } from 'typeorm';
-import { GroupContactNotFoundError, GroupContactWrongTypeError } from '../../errors/GroupContactErrors';
-import { GroupContact } from '../entities/GroupContact';
-
-/**
- * This classed is used to create a new RunnerGroup entity from a json body (post request).
- */
-export abstract class CreateRunnerGroup {
-    /**
-     * The new group's name.
-     */
-    @IsNotEmpty()
-    @IsString()
-    name: string;
-
-    /**
-     * The new group's contact.
-     * Optional
-     */
-    @IsInt()
-    @IsOptional()
-    contact?: number;
-
-    /**
-     * Gets the new group's contact by it's id.
-     */
-    public async getContact(): Promise<GroupContact> {
-        if (this.contact === undefined || this.contact === null) {
-            return null;
-        }
-        if (!isNaN(this.contact)) {
-            let contact = await getConnectionManager().get().getRepository(GroupContact).findOne({ id: this.contact });
-            if (!contact) { throw new GroupContactNotFoundError; }
-            return contact;
-        }
-
-        throw new GroupContactWrongTypeError;
-    }
-}

src/models/actions/CreateRunnerOrganisation.ts

@@ -1,48 +0,0 @@
-import { IsInt, IsOptional } from 'class-validator';
-import { getConnectionManager } from 'typeorm';
-import { AddressNotFoundError, AddressWrongTypeError } from '../../errors/AddressErrors';
-import { Address } from '../entities/Address';
-import { RunnerOrganisation } from '../entities/RunnerOrganisation';
-import { CreateRunnerGroup } from './CreateRunnerGroup';
-
-/**
- * This classed is used to create a new RunnerOrganisation entity from a json body (post request).
- */
-export class CreateRunnerOrganisation extends CreateRunnerGroup {
-    /**
-     * The new organisation's address.
-     * Must be of type number (address id).
-     */
-    @IsInt()
-    @IsOptional()
-    address?: number;
-
-    /**
-     * Gets the org's address by it's id.
-     */
-    public async getAddress(): Promise<Address> {
-        if (this.address === undefined || this.address === null) {
-            return null;
-        }
-        if (!isNaN(this.address)) {
-            let address = await getConnectionManager().get().getRepository(Address).findOne({ id: this.address });
-            if (!address) { throw new AddressNotFoundError; }
-            return address;
-        }
-
-        throw new AddressWrongTypeError;
-    }
-
-    /**
-     * Creates a new RunnerOrganisation entity from this.
-     */
-    public async toRunnerOrganisation(): Promise<RunnerOrganisation> {
-        let newRunnerOrganisation: RunnerOrganisation = new RunnerOrganisation();
-
-        newRunnerOrganisation.name = this.name;
-        newRunnerOrganisation.contact = await this.getContact();
-        newRunnerOrganisation.address = await this.getAddress();
-
-        return newRunnerOrganisation;
-    }
-}

src/models/actions/CreateTrack.ts

@@ -1,33 +0,0 @@
-import { IsInt, IsNotEmpty, IsPositive, IsString } from 'class-validator';
-import { Track } from '../entities/Track';
-
-/**
- * This classed is used to create a new Track entity from a json body (post request).
- */
-export class CreateTrack {
-    /**
-     * The new track's name.
-     */
-    @IsString()
-    @IsNotEmpty()
-    name: string;
-
-    /**
-     * The new track's distance in meters (must be greater than 0).
-     */
-    @IsInt()
-    @IsPositive()
-    distance: number;
-
-    /**
-     * Creates a new Track entity from this.
-     */
-    public toTrack(): Track {
-        let newTrack: Track = new Track();
-
-        newTrack.name = this.name;
-        newTrack.distance = this.distance;
-
-        return newTrack;
-    }
-}

src/models/actions/ImportRunner.ts

@@ -5,7 +5,7 @@ import { RunnerOrganisationNotFoundError } from '../../errors/RunnerOrganisation
 import { RunnerGroup } from '../entities/RunnerGroup';
 import { RunnerOrganisation } from '../entities/RunnerOrganisation';
 import { RunnerTeam } from '../entities/RunnerTeam';
-import { CreateRunner } from './CreateRunner';
+import { CreateRunner } from './create/CreateRunner';
 
 /**
  * Special class used to import runners from csv files - or json arrays created from csv to be exact.

src/models/actions/RefreshAuth.ts

@@ -2,10 +2,10 @@ import { IsOptional, IsString } from 'class-validator';
 import * as jsonwebtoken from 'jsonwebtoken';
 import { getConnectionManager } from 'typeorm';
 import { config } from '../../config';
-import { IllegalJWTError, JwtNotProvidedError, RefreshTokenCountInvalidError, UserNotFoundError } from '../../errors/AuthError';
+import { IllegalJWTError, JwtNotProvidedError, RefreshTokenCountInvalidError, UserDisabledError, UserNotFoundError } from '../../errors/AuthError';
 import { JwtCreator } from "../../jwtcreator";
 import { User } from '../entities/User';
-import { Auth } from '../responses/ResponseAuth';
+import { ResponseAuth } from '../responses/ResponseAuth';
 
 /**
  * This class is used to create refreshed auth credentials.
@@ -24,8 +24,8 @@ export class RefreshAuth {
     /**
      * Creates a new auth object based on this.
      */
-    public async toAuth(): Promise<Auth> {
-        let newAuth: Auth = new Auth();
+    public async toAuth(): Promise<ResponseAuth> {
+        let newAuth: ResponseAuth = new ResponseAuth();
         if (!this.token || this.token === undefined) {
             throw new JwtNotProvidedError()
         }
@@ -39,6 +39,7 @@ export class RefreshAuth {
         if (!found_user) {
             throw new UserNotFoundError()
         }
+        if (found_user.enabled == false) { throw new UserDisabledError(); }
         if (found_user.refreshTokenCount !== decoded["refreshTokenCount"]) {
             throw new RefreshTokenCountInvalidError()
         }

src/models/actions/ResetPassword.ts

@@ -0,0 +1,57 @@
+import * as argon2 from "argon2";
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
+import * as jsonwebtoken from 'jsonwebtoken';
+import { getConnectionManager } from 'typeorm';
+import { config } from '../../config';
+import { IllegalJWTError, JwtNotProvidedError, PasswordNeededError, RefreshTokenCountInvalidError, UserNotFoundError } from '../../errors/AuthError';
+import { User } from '../entities/User';
+
+/**
+ * This class can be used to reset a user's password.
+ * To set a new password the user needs to provide a valid password reset token.
+ */
+export class ResetPassword {
+    /**
+     * The reset token on which the password reset will be based.
+     */
+    @IsOptional()
+    @IsString()
+    resetToken?: string;
+
+    /**
+     * The user's new password
+     */
+    @IsNotEmpty()
+    @IsString()
+    password: string;
+
+
+    /**
+     * Create a password reset token based on this.
+     */
+    public async resetPassword(): Promise<any> {
+        if (!this.resetToken || this.resetToken === undefined) {
+            throw new JwtNotProvidedError()
+        }
+        if (!this.password || this.password === undefined) {
+            throw new PasswordNeededError()
+        }
+
+        let decoded;
+        try {
+            decoded = jsonwebtoken.verify(this.resetToken, config.jwt_secret)
+        } catch (error) {
+            throw new IllegalJWTError()
+        }
+
+        const found_user = await getConnectionManager().get().getRepository(User).findOne({ id: decoded["id"] });
+        if (!found_user) { throw new UserNotFoundError(); }
+        if (found_user.refreshTokenCount !== decoded["refreshTokenCount"]) { throw new RefreshTokenCountInvalidError(); }
+
+        found_user.refreshTokenCount = found_user.refreshTokenCount + 1;
+        found_user.password = await argon2.hash(this.password + found_user.uuid);
+        await getConnectionManager().get().getRepository(User).save(found_user);
+
+        return "password reset successfull";
+    }
+}

src/models/actions/UpdateRunner.ts

@@ -1,59 +0,0 @@
-import { IsInt, IsObject } from 'class-validator';
-import { getConnectionManager } from 'typeorm';
-import { RunnerGroupNotFoundError } from '../../errors/RunnerGroupErrors';
-import { RunnerOrganisationWrongTypeError } from '../../errors/RunnerOrganisationErrors';
-import { RunnerTeamNeedsParentError } from '../../errors/RunnerTeamErrors';
-import { Runner } from '../entities/Runner';
-import { RunnerGroup } from '../entities/RunnerGroup';
-import { CreateParticipant } from './CreateParticipant';
-
-/**
- * This class is used to update a Runner entity (via put request).
- */
-export class UpdateRunner extends CreateParticipant {
-
-    /**
-     * The updated runner's id.
-     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
-     */
-    @IsInt()
-    id: number;
-
-    /**
-     * The updated runner's new team/org.
-     * Just has to contain the group's id -everything else won't be checked or changed.
-     */
-    @IsObject()
-    group: RunnerGroup;
-
-    /**
-     * Updates a provided Runner entity based on this.
-     */
-    public async updateRunner(runner: Runner): Promise<Runner> {
-        runner.firstname = this.firstname;
-        runner.middlename = this.middlename;
-        runner.lastname = this.lastname;
-        runner.phone = this.phone;
-        runner.email = this.email;
-        runner.group = await this.getGroup();
-        runner.address = await this.getAddress();
-
-        return runner;
-    }
-
-    /**
-     * Loads the updated runner's group based on it's id.
-     */
-    public async getGroup(): Promise<RunnerGroup> {
-        if (this.group === undefined || this.group === null) {
-            throw new RunnerTeamNeedsParentError();
-        }
-        if (!isNaN(this.group.id)) {
-            let group = await getConnectionManager().get().getRepository(RunnerGroup).findOne({ id: this.group.id });
-            if (!group) { throw new RunnerGroupNotFoundError; }
-            return group;
-        }
-
-        throw new RunnerOrganisationWrongTypeError;
-    }
-}

src/models/actions/UpdateRunnerOrganisation.ts

@@ -1,52 +0,0 @@
-import { IsInt, IsOptional } from 'class-validator';
-import { getConnectionManager } from 'typeorm';
-import { AddressNotFoundError } from '../../errors/AddressErrors';
-import { Address } from '../entities/Address';
-import { RunnerOrganisation } from '../entities/RunnerOrganisation';
-import { CreateRunnerGroup } from './CreateRunnerGroup';
-
-/**
- * This class is used to update a RunnerOrganisation entity (via put request).
- */
-export class UpdateRunnerOrganisation extends CreateRunnerGroup {
-
-    /**
-     * The updated orgs's id.
-     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
-     */
-    @IsInt()
-    id: number;
-
-    /**
-     * The updated organisation's address.
-     * Just has to contain the address's id - everything else won't be checked or changed.
-     * Optional.
-     */
-    @IsInt()
-    @IsOptional()
-    address?: Address;
-
-    /**
-     * Loads the organisation's address based on it's id.
-     */
-    public async getAddress(): Promise<Address> {
-        if (this.address === undefined || this.address === null) {
-            return null;
-        }
-        let address = await getConnectionManager().get().getRepository(Address).findOne({ id: this.address.id });
-        if (!address) { throw new AddressNotFoundError; }
-        return address;
-    }
-
-    /**
-     * Updates a provided RunnerOrganisation entity based on this.
-     */
-    public async updateRunnerOrganisation(organisation: RunnerOrganisation): Promise<RunnerOrganisation> {
-
-        organisation.name = this.name;
-        organisation.contact = await this.getContact();
-        organisation.address = await this.getAddress();
-
-        return organisation;
-    }
-}

src/models/actions/UpdateRunnerTeam.ts

@@ -1,56 +0,0 @@
-import { IsInt, IsNotEmpty, IsObject } from 'class-validator';
-import { getConnectionManager } from 'typeorm';
-import { RunnerOrganisationNotFoundError, RunnerOrganisationWrongTypeError } from '../../errors/RunnerOrganisationErrors';
-import { RunnerTeamNeedsParentError } from '../../errors/RunnerTeamErrors';
-import { RunnerOrganisation } from '../entities/RunnerOrganisation';
-import { RunnerTeam } from '../entities/RunnerTeam';
-import { CreateRunnerGroup } from './CreateRunnerGroup';
-
-/**
- * This class is used to update a RunnerTeam entity (via put request).
- */
-export class UpdateRunnerTeam extends CreateRunnerGroup {
-
-    /**
-     * The updated team's id.
-     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
-     */
-    @IsInt()
-    id: number;
-
-    /**
-     * The updated team's parentGroup.
-     * Just has to contain the organisation's id - everything else won't be checked or changed.
-     */
-    @IsObject()
-    @IsNotEmpty()
-    parentGroup: RunnerOrganisation;
-
-    /**
-     * Loads the updated teams's parentGroup based on it's id.
-     */
-    public async getParent(): Promise<RunnerOrganisation> {
-        if (this.parentGroup === undefined || this.parentGroup === null) {
-            throw new RunnerTeamNeedsParentError();
-        }
-        if (!isNaN(this.parentGroup.id)) {
-            let parentGroup = await getConnectionManager().get().getRepository(RunnerOrganisation).findOne({ id: this.parentGroup.id });
-            if (!parentGroup) { throw new RunnerOrganisationNotFoundError();; }
-            return parentGroup;
-        }
-
-        throw new RunnerOrganisationWrongTypeError;
-    }
-
-    /**
-     * Updates a provided RunnerTeam entity based on this.
-     */
-    public async updateRunnerTeam(team: RunnerTeam): Promise<RunnerTeam> {
-
-        team.name = this.name;
-        team.parentGroup = await this.getParent();
-        team.contact = await this.getContact()
-
-        return team;
-    }
-}

src/models/actions/create/CreateAuth.ts

@@ -1,11 +1,11 @@
 import * as argon2 from "argon2";
 import { IsEmail, IsNotEmpty, IsOptional, IsString } from 'class-validator';
 import { getConnectionManager } from 'typeorm';
-import { InvalidCredentialsError, PasswordNeededError, UserNotFoundError } from '../../errors/AuthError';
-import { UsernameOrEmailNeededError } from '../../errors/UserErrors';
-import { JwtCreator } from '../../jwtcreator';
-import { User } from '../entities/User';
-import { Auth } from '../responses/ResponseAuth';
+import { InvalidCredentialsError, PasswordNeededError, UserDisabledError, UserNotFoundError } from '../../../errors/AuthError';
+import { UsernameOrEmailNeededError } from '../../../errors/UserErrors';
+import { JwtCreator } from '../../../jwtcreator';
+import { User } from '../../entities/User';
+import { ResponseAuth } from '../../responses/ResponseAuth';
 
 /**
  * This class is used to create auth credentials based on user credentials provided in a json body (post request).
@@ -42,8 +42,8 @@ export class CreateAuth {
     /**
      * Creates a new auth object based on this.
      */
-    public async toAuth(): Promise<Auth> {
-        let newAuth: Auth = new Auth();
+    public async toAuth(): Promise<ResponseAuth> {
+        let newAuth: ResponseAuth = new ResponseAuth();
 
         if (this.email === undefined && this.username === undefined) {
             throw new UsernameOrEmailNeededError();
@@ -55,6 +55,7 @@ export class CreateAuth {
         if (!found_user) {
             throw new UserNotFoundError();
         }
+        if (found_user.enabled == false) { throw new UserDisabledError(); }
         if (!(await argon2.verify(found_user.password, this.password + found_user.uuid))) {
             throw new InvalidCredentialsError();
         }

src/models/actions/create/CreateDistanceDonation.ts

@@ -0,0 +1,52 @@
+import { IsInt, IsPositive } from 'class-validator';
+import { getConnection } from 'typeorm';
+import { RunnerNotFoundError } from '../../../errors/RunnerErrors';
+import { DistanceDonation } from '../../entities/DistanceDonation';
+import { Runner } from '../../entities/Runner';
+import { CreateDonation } from './CreateDonation';
+
+/**
+ * This class is used to create a new FixedDonation entity from a json body (post request).
+ */
+export class CreateDistanceDonation extends CreateDonation {
+
+    /**
+     * The donation's associated runner's id.
+     * This is important to link the runner's distance ran to the donation.
+     */
+    @IsInt()
+    @IsPositive()
+    runner: number;
+
+    /**
+     * The donation's amount per distance (full kilometer aka 1000 meters).
+     * The unit is your currency's smallest unit (default: euro cent).
+     */
+    @IsInt()
+    @IsPositive()
+    amountPerDistance: number;
+
+    /**
+     * Creates a new FixedDonation entity from this.
+     */
+    public async toEntity(): Promise<DistanceDonation> {
+        let newDonation = new DistanceDonation;
+
+        newDonation.amountPerDistance = this.amountPerDistance;
+        newDonation.donor = await this.getDonor();
+        newDonation.runner = await this.getRunner();
+
+        return newDonation;
+    }
+
+    /**
+     * Gets a runner based on the runner id provided via this.runner.
+     */
+    public async getRunner(): Promise<Runner> {
+        const runner = await getConnection().getRepository(Runner).findOne({ id: this.runner });
+        if (!runner) {
+            throw new RunnerNotFoundError();
+        }
+        return runner;
+    }
+}

src/models/actions/create/CreateDonation.ts

@@ -0,0 +1,34 @@
+import { IsInt, IsPositive } from 'class-validator';
+import { getConnection } from 'typeorm';
+import { DonorNotFoundError } from '../../../errors/DonorErrors';
+import { Donation } from '../../entities/Donation';
+import { Donor } from '../../entities/Donor';
+
+/**
+ * This class is used to create a new Donation entity from a json body (post request).
+ */
+export abstract class CreateDonation {
+    /**
+     * The donation's associated donor's id.
+     * This is important to link donations to donors.
+     */
+    @IsInt()
+    @IsPositive()
+    donor: number;
+
+    /**
+     * Creates a new Donation entity from this.
+     */
+    public abstract toEntity(): Promise<Donation>;
+
+    /**
+     * Gets a donor based on the donor id provided via this.donor.
+     */
+    public async getDonor(): Promise<Donor> {
+        const donor = await getConnection().getRepository(Donor).findOne({ id: this.donor });
+        if (!donor) {
+            throw new DonorNotFoundError();
+        }
+        return donor;
+    }
+}

src/models/actions/create/CreateDonor.ts

@@ -0,0 +1,39 @@
+import { IsBoolean, IsOptional } from 'class-validator';
+import { DonorReceiptAddressNeededError } from '../../../errors/DonorErrors';
+import { Address } from '../../entities/Address';
+import { Donor } from '../../entities/Donor';
+import { CreateParticipant } from './CreateParticipant';
+
+/**
+ * This classed is used to create a new Donor entity from a json body (post request).
+ */
+export class CreateDonor extends CreateParticipant {
+
+    /**
+     * Does this donor need a receipt?
+     */
+    @IsBoolean()
+    @IsOptional()
+    receiptNeeded?: boolean = false;
+
+    /**
+     * Creates a new Donor entity from this.
+     */
+    public async toEntity(): Promise<Donor> {
+        let newDonor: Donor = new Donor();
+
+        newDonor.firstname = this.firstname;
+        newDonor.middlename = this.middlename;
+        newDonor.lastname = this.lastname;
+        newDonor.phone = this.phone;
+        newDonor.email = this.email;
+        newDonor.receiptNeeded = this.receiptNeeded;
+        newDonor.address = this.address;
+        Address.validate(newDonor.address);
+        if (this.receiptNeeded == true && Address.isValidAddress(newDonor.address) == false) {
+            throw new DonorReceiptAddressNeededError()
+        }
+
+        return newDonor;
+    }
+}

src/models/actions/create/CreateFixedDonation.ts

@@ -0,0 +1,28 @@
+import { IsInt, IsPositive } from 'class-validator';
+import { FixedDonation } from '../../entities/FixedDonation';
+import { CreateDonation } from './CreateDonation';
+
+/**
+ * This class is used to create a new FixedDonation entity from a json body (post request).
+ */
+export class CreateFixedDonation extends CreateDonation {
+    /**
+     * The donation's amount.
+     * The unit is your currency's smallest unit (default: euro cent).
+     */
+    @IsInt()
+    @IsPositive()
+    amount: number;
+
+    /**
+     * Creates a new FixedDonation entity from this.
+     */
+    public async toEntity(): Promise<FixedDonation> {
+        let newDonation = new FixedDonation;
+
+        newDonation.amount = this.amount;
+        newDonation.donor = await this.getDonor();
+
+        return newDonation;
+    }
+}

src/models/actions/create/CreateGroupContact.ts

@@ -0,0 +1,97 @@
+import { IsEmail, IsNotEmpty, IsObject, IsOptional, IsPhoneNumber, IsString } from 'class-validator';
+import { getConnectionManager } from 'typeorm';
+import { config } from '../../../config';
+import { RunnerGroupNotFoundError } from '../../../errors/RunnerGroupErrors';
+import { Address } from '../../entities/Address';
+import { GroupContact } from '../../entities/GroupContact';
+import { RunnerGroup } from '../../entities/RunnerGroup';
+
+/**
+ * This classed is used to create a new GroupContact entity from a json body (post request).
+ */
+export class CreateGroupContact {
+    /**
+     * The new contact's first name.
+     */
+    @IsNotEmpty()
+    @IsString()
+    firstname: string;
+
+    /**
+     * The new contact's middle name.
+     */
+    @IsOptional()
+    @IsString()
+    middlename?: string;
+
+    /**
+     * The new contact's last name.
+     */
+    @IsNotEmpty()
+    @IsString()
+    lastname: string;
+
+    /**
+     * The new contact's address.
+     */
+    @IsOptional()
+    @IsObject()
+    address?: Address;
+
+    /**
+     * The contact's phone number.
+     * This will be validated against the configured country phone numer syntax (default: international).
+     */
+    @IsOptional()
+    @IsPhoneNumber(config.phone_validation_countrycode)
+    phone?: string;
+
+    /**
+     * The new contact's email address.
+     */
+    @IsOptional()
+    @IsEmail()
+    email?: string;
+
+    /**
+     * The new contacts's groups' ids.
+     * You can provide either one groupId or an array of groupIDs.
+     */
+    @IsOptional()
+    groups?: number[] | number
+
+
+    /**
+     * Get's all groups for this contact by their id's;
+     */
+    public async getGroups(): Promise<RunnerGroup[]> {
+        if (!this.groups) { return null; }
+        let groups = new Array<RunnerGroup>();
+        if (!Array.isArray(this.groups)) {
+            this.groups = [this.groups]
+        }
+        for (let group of this.groups) {
+            let found = await getConnectionManager().get().getRepository(RunnerGroup).findOne({ id: group });
+            if (!found) { throw new RunnerGroupNotFoundError(); }
+            groups.push(found);
+        }
+        return groups;
+    }
+
+    /**
+     * Creates a new GroupContact entity from this.
+     */
+    public async toEntity(): Promise<GroupContact> {
+        let newContact: GroupContact = new GroupContact();
+        newContact.firstname = this.firstname;
+        newContact.middlename = this.middlename;
+        newContact.lastname = this.lastname;
+        newContact.email = this.email;
+        newContact.phone = this.phone;
+        newContact.address = this.address;
+        Address.validate(newContact.address);
+        newContact.groups = await this.getGroups();
+
+        return newContact;
+    }
+}

src/models/actions/create/CreateParticipant.ts

@@ -0,0 +1,53 @@
+import { IsEmail, IsNotEmpty, IsObject, IsOptional, IsPhoneNumber, IsString } from 'class-validator';
+import { config } from '../../../config';
+import { Address } from '../../entities/Address';
+
+/**
+ * This classed is used to create a new Participant entity from a json body (post request).
+ */
+export abstract class CreateParticipant {
+    /**
+     * The new participant's first name.
+     */
+    @IsString()
+    @IsNotEmpty()
+    firstname: string;
+
+    /**
+     * The new participant's middle name.
+     */
+    @IsString()
+    @IsOptional()
+    middlename?: string;
+
+    /**
+     * The new participant's last name.
+     */
+    @IsString()
+    @IsNotEmpty()
+    lastname: string;
+
+    /**
+     * The new participant's phone number.
+     * This will be validated against the configured country phone numer syntax (default: international).
+     */
+    @IsString()
+    @IsOptional()
+    @IsPhoneNumber(config.phone_validation_countrycode)
+    phone?: string;
+
+    /**
+     * The new participant's e-mail address.
+     */
+    @IsString()
+    @IsOptional()
+    @IsEmail()
+    email?: string;
+
+    /**
+     * The new participant's address.
+     */
+    @IsOptional()
+    @IsObject()
+    address?: Address;
+}

src/models/actions/create/CreatePermission.ts

@@ -4,11 +4,11 @@ import {
     IsNotEmpty
 } from "class-validator";
 import { getConnectionManager } from 'typeorm';
-import { PrincipalNotFoundError } from '../../errors/PrincipalErrors';
-import { Permission } from '../entities/Permission';
-import { Principal } from '../entities/Principal';
-import { PermissionAction } from '../enums/PermissionAction';
-import { PermissionTarget } from '../enums/PermissionTargets';
+import { PrincipalNotFoundError } from '../../../errors/PrincipalErrors';
+import { Permission } from '../../entities/Permission';
+import { Principal } from '../../entities/Principal';
+import { PermissionAction } from '../../enums/PermissionAction';
+import { PermissionTarget } from '../../enums/PermissionTargets';
 
 /**
  * This classed is used to create a new Permission entity from a json body (post request).
@@ -39,7 +39,7 @@ export class CreatePermission {
     /**
      * Creates a new Permission entity from this.
      */
-    public async toPermission(): Promise<Permission> {
+    public async toEntity(): Promise<Permission> {
         let newPermission: Permission = new Permission();
 
         newPermission.principal = await this.getPrincipal();

src/models/actions/create/CreateResetToken.ts

@@ -0,0 +1,50 @@
+import { IsEmail, IsOptional, IsString } from 'class-validator';
+import { getConnectionManager } from 'typeorm';
+import { ResetAlreadyRequestedError, UserDisabledError, UserNotFoundError } from '../../../errors/AuthError';
+import { UsernameOrEmailNeededError } from '../../../errors/UserErrors';
+import { JwtCreator } from '../../../jwtcreator';
+import { User } from '../../entities/User';
+
+/**
+ * This calss is used to create password reset tokens for users.
+ * These password reset token can be used to set a new password for the user for the next 15mins.
+ */
+export class CreateResetToken {
+    /**
+     * The username of the user that wants to reset their password.
+     */
+    @IsOptional()
+    @IsString()
+    username?: string;
+
+    /**
+     * The email address of the user that wants to reset their password.
+     */
+    @IsOptional()
+    @IsEmail()
+    @IsString()
+    email?: string;
+
+
+    /**
+     * Create a password reset token based on this.
+     */
+    public async toResetToken(): Promise<any> {
+        if (this.email === undefined && this.username === undefined) {
+            throw new UsernameOrEmailNeededError();
+        }
+        let found_user = await getConnectionManager().get().getRepository(User).findOne({ where: [{ username: this.username }, { email: this.email }] });
+        if (!found_user) { throw new UserNotFoundError(); }
+        if (found_user.enabled == false) { throw new UserDisabledError(); }
+        if (found_user.resetRequestedTimestamp > (Math.floor(Date.now() / 1000) - 15 * 60)) { throw new ResetAlreadyRequestedError(); }
+
+        found_user.refreshTokenCount = found_user.refreshTokenCount + 1;
+        found_user.resetRequestedTimestamp = Math.floor(Date.now() / 1000);
+        await getConnectionManager().get().getRepository(User).save(found_user);
+
+        //Create the reset token
+        let reset_token = JwtCreator.createReset(found_user);
+
+        return reset_token;
+    }
+}

src/models/actions/create/CreateRunner.ts

@@ -1,10 +1,11 @@
 import { IsInt } from 'class-validator';
 import { getConnectionManager } from 'typeorm';
-import { RunnerGroupNotFoundError } from '../../errors/RunnerGroupErrors';
-import { RunnerOrganisationWrongTypeError } from '../../errors/RunnerOrganisationErrors';
-import { RunnerTeamNeedsParentError } from '../../errors/RunnerTeamErrors';
-import { Runner } from '../entities/Runner';
-import { RunnerGroup } from '../entities/RunnerGroup';
+import { RunnerGroupNotFoundError } from '../../../errors/RunnerGroupErrors';
+import { RunnerOrganisationWrongTypeError } from '../../../errors/RunnerOrganisationErrors';
+import { RunnerTeamNeedsParentError } from '../../../errors/RunnerTeamErrors';
+import { Address } from '../../entities/Address';
+import { Runner } from '../../entities/Runner';
+import { RunnerGroup } from '../../entities/RunnerGroup';
 import { CreateParticipant } from './CreateParticipant';
 
 /**
@@ -21,7 +22,7 @@ export class CreateRunner extends CreateParticipant {
     /**
      * Creates a new Runner entity from this.
      */
-    public async toRunner(): Promise<Runner> {
+    public async toEntity(): Promise<Runner> {
         let newRunner: Runner = new Runner();
 
         newRunner.firstname = this.firstname;
@@ -30,7 +31,8 @@ export class CreateRunner extends CreateParticipant {
         newRunner.phone = this.phone;
         newRunner.email = this.email;
         newRunner.group = await this.getGroup();
-        newRunner.address = await this.getAddress();
+        newRunner.address = this.address;
+        Address.validate(newRunner.address);
 
         return newRunner;
     }

src/models/actions/create/CreateRunnerCard.ts

@@ -0,0 +1,45 @@
+import { IsBoolean, IsInt, IsOptional } from 'class-validator';
+import { getConnection } from 'typeorm';
+import { RunnerNotFoundError } from '../../../errors/RunnerErrors';
+import { Runner } from '../../entities/Runner';
+import { RunnerCard } from '../../entities/RunnerCard';
+
+/**
+ * This classed is used to create a new RunnerCard entity from a json body (post request).
+ */
+export class CreateRunnerCard {
+    /**
+     * The card's associated runner's id.
+     */
+    @IsInt()
+    @IsOptional()
+    runner?: number;
+
+    /**
+     * Is the new card enabled (for fraud reasons)?
+     * Default: true
+     */
+    @IsBoolean()
+    enabled: boolean = true;
+
+    /**
+     * Creates a new RunnerCard entity from this.
+     */
+    public async toEntity(): Promise<RunnerCard> {
+        let newCard: RunnerCard = new RunnerCard();
+
+        newCard.enabled = this.enabled;
+        newCard.runner = await this.getRunner();
+
+        return newCard;
+    }
+
+    public async getRunner(): Promise<Runner> {
+        if (!this.runner) { return null; }
+        const runner = await getConnection().getRepository(Runner).findOne({ id: this.runner });
+        if (!runner) {
+            throw new RunnerNotFoundError();
+        }
+        return runner;
+    }
+}

src/models/actions/create/CreateRunnerGroup.ts

@@ -0,0 +1,35 @@
+import { IsInt, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+import { getConnectionManager } from 'typeorm';
+import { GroupContactNotFoundError } from '../../../errors/GroupContactErrors';
+import { GroupContact } from '../../entities/GroupContact';
+
+/**
+ * This classed is used to create a new RunnerGroup entity from a json body (post request).
+ */
+export abstract class CreateRunnerGroup {
+    /**
+     * The new group's name.
+     */
+    @IsNotEmpty()
+    @IsString()
+    name: string;
+
+    /**
+     * The new group's contact's id.
+     * Optional
+     */
+    @IsInt()
+    @IsOptional()
+    contact?: number;
+
+    /**
+     * Gets the new group's contact by it's id.
+     */
+    public async getContact(): Promise<GroupContact> {
+        if (!this.contact) { return null; }
+        let contact = await getConnectionManager().get().getRepository(GroupContact).findOne({ id: this.contact });
+        if (!contact) { throw new GroupContactNotFoundError; }
+        return contact;
+
+    }
+}

src/models/actions/create/CreateRunnerOrganisation.ts

@@ -0,0 +1,30 @@
+import { IsObject, IsOptional } from 'class-validator';
+import { Address } from '../../entities/Address';
+import { RunnerOrganisation } from '../../entities/RunnerOrganisation';
+import { CreateRunnerGroup } from './CreateRunnerGroup';
+
+/**
+ * This classed is used to create a new RunnerOrganisation entity from a json body (post request).
+ */
+export class CreateRunnerOrganisation extends CreateRunnerGroup {
+    /**
+     * The new organisation's address.
+     */
+    @IsOptional()
+    @IsObject()
+    address?: Address;
+
+    /**
+     * Creates a new RunnerOrganisation entity from this.
+     */
+    public async toEntity(): Promise<RunnerOrganisation> {
+        let newRunnerOrganisation: RunnerOrganisation = new RunnerOrganisation();
+
+        newRunnerOrganisation.name = this.name;
+        newRunnerOrganisation.contact = await this.getContact();
+        newRunnerOrganisation.address = this.address;
+        Address.validate(newRunnerOrganisation.address);
+
+        return newRunnerOrganisation;
+    }
+}

src/models/actions/create/CreateRunnerTeam.ts

@@ -1,9 +1,9 @@
 import { IsInt, IsNotEmpty } from 'class-validator';
 import { getConnectionManager } from 'typeorm';
-import { RunnerOrganisationNotFoundError, RunnerOrganisationWrongTypeError } from '../../errors/RunnerOrganisationErrors';
-import { RunnerTeamNeedsParentError } from '../../errors/RunnerTeamErrors';
-import { RunnerOrganisation } from '../entities/RunnerOrganisation';
-import { RunnerTeam } from '../entities/RunnerTeam';
+import { RunnerOrganisationNotFoundError } from '../../../errors/RunnerOrganisationErrors';
+import { RunnerTeamNeedsParentError } from '../../../errors/RunnerTeamErrors';
+import { RunnerOrganisation } from '../../entities/RunnerOrganisation';
+import { RunnerTeam } from '../../entities/RunnerTeam';
 import { CreateRunnerGroup } from './CreateRunnerGroup';
 
 /**
@@ -12,7 +12,7 @@ import { CreateRunnerGroup } from './CreateRunnerGroup';
 export class CreateRunnerTeam extends CreateRunnerGroup {
 
     /**
-     * The new team's parent group (organisation).
+     * The new team's parent org's id.
      */
     @IsInt()
     @IsNotEmpty()
@@ -25,24 +25,19 @@ export class CreateRunnerTeam extends CreateRunnerGroup {
         if (this.parentGroup === undefined || this.parentGroup === null) {
             throw new RunnerTeamNeedsParentError();
         }
-        if (!isNaN(this.parentGroup)) {
-            let parentGroup = await getConnectionManager().get().getRepository(RunnerOrganisation).findOne({ id: this.parentGroup });
-            if (!parentGroup) { throw new RunnerOrganisationNotFoundError();; }
-            return parentGroup;
-        }
-
-        throw new RunnerOrganisationWrongTypeError;
+        let parentGroup = await getConnectionManager().get().getRepository(RunnerOrganisation).findOne({ id: this.parentGroup });
+        if (!parentGroup) { throw new RunnerOrganisationNotFoundError();; }
+        return parentGroup;
     }
 
     /**
      * Creates a new RunnerTeam entity from this.
      */
-    public async toRunnerTeam(): Promise<RunnerTeam> {
+    public async toEntity(): Promise<RunnerTeam> {
         let newRunnerTeam: RunnerTeam = new RunnerTeam();
 
         newRunnerTeam.name = this.name;
         newRunnerTeam.parentGroup = await this.getParent();
-
         newRunnerTeam.contact = await this.getContact()
 
         return newRunnerTeam;

src/models/actions/create/CreateScan.ts

@@ -0,0 +1,59 @@
+import { IsBoolean, IsInt, IsOptional, IsPositive } from 'class-validator';
+import { getConnection } from 'typeorm';
+import { RunnerNotFoundError } from '../../../errors/RunnerErrors';
+import { Runner } from '../../entities/Runner';
+import { Scan } from '../../entities/Scan';
+
+/**
+ * This class is used to create a new Scan entity from a json body (post request).
+ */
+export abstract class CreateScan {
+    /**
+     * The scan's associated runner's id.
+     * This is important to link ran distances to runners.
+     */
+    @IsInt()
+    @IsPositive()
+    runner: number;
+
+    /**
+     * Is the scan valid (for fraud reasons).
+     * The determination of validity will work differently for every child class.
+     * Default: true
+     */
+    @IsBoolean()
+    @IsOptional()
+    valid?: boolean = true;
+
+    /**
+     * The scan's distance in meters.
+     * Can be set manually or derived from another object.
+     */
+    @IsInt()
+    @IsPositive()
+    public distance: number;
+
+    /**
+     * Creates a new Scan entity from this.
+     */
+    public async toEntity(): Promise<Scan> {
+        let newScan = new Scan();
+
+        newScan.distance = this.distance;
+        newScan.valid = this.valid;
+        newScan.runner = await this.getRunner();
+
+        return newScan;
+    }
+
+    /**
+     * Gets a runner based on the runner id provided via this.runner.
+     */
+    public async getRunner(): Promise<Runner> {
+        const runner = await getConnection().getRepository(Runner).findOne({ id: this.runner });
+        if (!runner) {
+            throw new RunnerNotFoundError();
+        }
+        return runner;
+    }
+}

src/models/actions/create/CreateScanStation.ts

@@ -0,0 +1,64 @@
+import * as argon2 from "argon2";
+import { IsBoolean, IsInt, IsOptional, IsPositive, IsString } from 'class-validator';
+import crypto from 'crypto';
+import { getConnection } from 'typeorm';
+import * as uuid from 'uuid';
+import { TrackNotFoundError } from '../../../errors/TrackErrors';
+import { ScanStation } from '../../entities/ScanStation';
+import { Track } from '../../entities/Track';
+
+/**
+ * This class is used to create a new StatsClient entity from a json body (post request).
+ */
+export class CreateScanStation {
+    /**
+     * The new station's description.
+     */
+    @IsString()
+    @IsOptional()
+    description?: string;
+
+    /**
+     * The station's associated track's id.
+     */
+    @IsInt()
+    @IsPositive()
+    track: number;
+
+    /**
+     * Is this station enabled?
+     */
+    @IsBoolean()
+    @IsOptional()
+    enabled?: boolean = true;
+
+    /**
+     * Converts this to a ScanStation entity.
+     */
+    public async toEntity(): Promise<ScanStation> {
+        let newStation: ScanStation = new ScanStation();
+
+        newStation.description = this.description;
+        newStation.enabled = this.enabled;
+        newStation.track = await this.getTrack();
+
+        let newUUID = uuid.v4().toUpperCase();
+        newStation.prefix = crypto.createHash("sha3-512").update(newUUID).digest('hex').substring(0, 7).toUpperCase();
+        newStation.key = await argon2.hash(newStation.prefix + "." + newUUID);
+        newStation.cleartextkey = newStation.prefix + "." + newUUID;
+
+        return newStation;
+    }
+
+    /**
+     * Get's a track by it's id provided via this.track.
+     * Used to link the new station to a track.
+     */
+    public async getTrack(): Promise<Track> {
+        const track = await getConnection().getRepository(Track).findOne({ id: this.track });
+        if (!track) {
+            throw new TrackNotFoundError();
+        }
+        return track;
+    }
+}

src/models/actions/create/CreateStatsClient.ts

@@ -0,0 +1,33 @@
+import * as argon2 from "argon2";
+import { IsOptional, IsString } from 'class-validator';
+import crypto from 'crypto';
+import * as uuid from 'uuid';
+import { StatsClient } from '../../entities/StatsClient';
+
+/**
+ * This classed is used to create a new StatsClient entity from a json body (post request).
+ */
+export class CreateStatsClient {
+    /**
+     * The new client's description.
+     */
+    @IsString()
+    @IsOptional()
+    description?: string;
+
+    /**
+     * Converts this to a StatsClient entity.
+     */
+    public async toEntity(): Promise<StatsClient> {
+        let newClient: StatsClient = new StatsClient();
+
+        newClient.description = this.description;
+
+        let newUUID = uuid.v4().toUpperCase();
+        newClient.prefix = crypto.createHash("sha3-512").update(newUUID).digest('hex').substring(0, 7).toUpperCase();
+        newClient.key = await argon2.hash(newClient.prefix + "." + newUUID);
+        newClient.cleartextkey = newClient.prefix + "." + newUUID;
+
+        return newClient;
+    }
+}

src/models/actions/create/CreateTrack.ts

@@ -0,0 +1,46 @@
+import { IsInt, IsNotEmpty, IsOptional, IsPositive, IsString } from 'class-validator';
+import { TrackLapTimeCantBeNegativeError } from '../../../errors/TrackErrors';
+import { Track } from '../../entities/Track';
+
+/**
+ * This classed is used to create a new Track entity from a json body (post request).
+ */
+export class CreateTrack {
+    /**
+     * The new track's name.
+     */
+    @IsString()
+    @IsNotEmpty()
+    name: string;
+
+    /**
+     * The new track's distance in meters (must be greater than 0).
+     */
+    @IsInt()
+    @IsPositive()
+    distance: number;
+
+    /**
+     * The minimum time a runner should take to run a lap on this track (in seconds).
+     * Will be used for fraud detection.
+     */
+    @IsInt()
+    @IsOptional()
+    minimumLapTime: number;
+
+    /**
+     * Creates a new Track entity from this.
+     */
+    public toEntity(): Track {
+        let newTrack: Track = new Track();
+
+        newTrack.name = this.name;
+        newTrack.distance = this.distance;
+        newTrack.minimumLapTime = this.minimumLapTime;
+        if (this.minimumLapTime < 0) {
+            throw new TrackLapTimeCantBeNegativeError();
+        }
+
+        return newTrack;
+    }
+}

src/models/actions/create/CreateTrackScan.ts

@@ -0,0 +1,79 @@
+import { IsInt, IsPositive } from 'class-validator';
+import { getConnection } from 'typeorm';
+import { RunnerCardNotFoundError } from '../../../errors/RunnerCardErrors';
+import { RunnerNotFoundError } from '../../../errors/RunnerErrors';
+import { ScanStationNotFoundError } from '../../../errors/ScanStationErrors';
+import { RunnerCard } from '../../entities/RunnerCard';
+import { ScanStation } from '../../entities/ScanStation';
+import { TrackScan } from '../../entities/TrackScan';
+
+/**
+ * This classed is used to create a new Scan entity from a json body (post request).
+ */
+export class CreateTrackScan {
+    /**
+     * The id of the runnerCard associated with the scan.
+     * This get's saved for documentation and management purposes.
+     */
+    @IsInt()
+    @IsPositive()
+    card: number;
+
+    /**
+     * The scanning station's id that created the scan.
+     * Mainly used for logging and traceing back scans (or errors).
+     */
+    @IsInt()
+    @IsPositive()
+    station: number;
+
+    /**
+     * Creates a new Track entity from this.
+     */
+    public async toEntity(): Promise<TrackScan> {
+        let newScan: TrackScan = new TrackScan();
+
+        newScan.station = await this.getStation();
+        newScan.card = await this.getCard();
+
+        newScan.track = newScan.station.track;
+        newScan.runner = newScan.card.runner;
+
+        if (!newScan.runner) {
+            throw new RunnerNotFoundError();
+        }
+
+        newScan.timestamp = Math.round(new Date().getTime() / 1000);
+        newScan.valid = await this.validateScan(newScan);
+
+        return newScan;
+    }
+
+    public async getCard(): Promise<RunnerCard> {
+        const track = await getConnection().getRepository(RunnerCard).findOne({ id: this.card }, { relations: ["runner"] });
+        if (!track) {
+            throw new RunnerCardNotFoundError();
+        }
+        return track;
+    }
+
+    public async getStation(): Promise<ScanStation> {
+        const station = await getConnection().getRepository(ScanStation).findOne({ id: this.station }, { relations: ["track"] });
+        if (!station) {
+            throw new ScanStationNotFoundError();
+        }
+        return station;
+    }
+
+    public async validateScan(scan: TrackScan): Promise<boolean> {
+        const scans = await getConnection().getRepository(TrackScan).find({ where: { runner: scan.runner, valid: true }, relations: ["track"] });
+        if (scans.length == 0) { return true; }
+
+        const newestScan = scans[scans.length - 1];
+        if ((scan.timestamp - newestScan.timestamp) > scan.track.minimumLapTime) {
+            return true;
+        }
+
+        return false;
+    }
+}

src/models/actions/create/CreateUser.ts

@@ -1,115 +1,132 @@
-import * as argon2 from "argon2";
-import { IsEmail, IsOptional, IsPhoneNumber, IsString } from 'class-validator';
-import { getConnectionManager } from 'typeorm';
-import * as uuid from 'uuid';
-import { config } from '../../config';
-import { UsernameOrEmailNeededError } from '../../errors/UserErrors';
-import { UserGroupNotFoundError } from '../../errors/UserGroupErrors';
-import { User } from '../entities/User';
-import { UserGroup } from '../entities/UserGroup';
-
-/**
- * This classed is used to create a new User entity from a json body (post request).
- */
-export class CreateUser {
-    /**
-     * The new user's first name.
-     */
-    @IsString()
-    firstname: string;
-
-    /**
-     * The new user's middle name.
-     */
-    @IsString()
-    @IsOptional()
-    middlename?: string;
-
-    /**
-     * The new user's last name.
-     */
-    @IsString()
-    lastname: string;
-
-    /**
-     * The new user's username.
-     * You have to provide at least one of: {email, username}.
-     */
-    @IsOptional()
-    @IsString()
-    username?: string;
-
-    /**
-     * The new user's email address.
-     * You have to provide at least one of: {email, username}.
-     */
-    @IsEmail()
-    @IsString()
-    @IsOptional()
-    email?: string;
-
-    /**
-     * The new user's phone number.
-     * This will be validated against the configured country phone numer syntax (default: international).
-     */
-    @IsPhoneNumber(config.phone_validation_countrycode)
-    @IsOptional()
-    phone?: string;
-
-    /**
-     * The new user's password.
-     * This will of course not be saved in plaintext :)
-     */
-    @IsString()
-    password: string;
-
-    /**
-     * The new user's groups' id(s).
-     * You can provide either one groupId or an array of groupIDs.
-     */
-    @IsOptional()
-    groups?: number[] | number
-
-    //TODO: ProfilePics
-
-    /**
-     * Converts this to a User entity.
-     */
-    public async toUser(): Promise<User> {
-        let newUser: User = new User();
-
-        if (this.email === undefined && this.username === undefined) {
-            throw new UsernameOrEmailNeededError();
-        }
-
-        newUser.email = this.email
-        newUser.username = this.username
-        newUser.firstname = this.firstname
-        newUser.middlename = this.middlename
-        newUser.lastname = this.lastname
-        newUser.uuid = uuid.v4()
-        newUser.phone = this.phone
-        newUser.password = await argon2.hash(this.password + newUser.uuid);
-        newUser.groups = await this.getGroups();
-        //TODO: ProfilePics
-
-        return newUser;
-    }
-
-    /**
-     * Get's all groups for this user by their id's;
-     */
-    public async getGroups() {
-        if (!this.groups) { return null; }
-        let groups = new Array<UserGroup>();
-        if (!Array.isArray(this.groups)) {
-            this.groups = [this.groups]
-        }
-        for (let group of this.groups) {
-            let found = await getConnectionManager().get().getRepository(UserGroup).findOne({ id: group });
-            if (!found) { throw new UserGroupNotFoundError(); }
-            groups.push(found);
-        }
-        return groups;
-    }
+import * as argon2 from "argon2";
+import { IsBoolean, IsEmail, IsNotEmpty, IsOptional, IsPhoneNumber, IsString, IsUrl } from 'class-validator';
+import { getConnectionManager } from 'typeorm';
+import * as uuid from 'uuid';
+import { config } from '../../../config';
+import { UserEmailNeededError, UsernameContainsIllegalCharacterError } from '../../../errors/UserErrors';
+import { UserGroupNotFoundError } from '../../../errors/UserGroupErrors';
+import { User } from '../../entities/User';
+import { UserGroup } from '../../entities/UserGroup';
+
+/**
+ * This classed is used to create a new User entity from a json body (post request).
+ */
+export class CreateUser {
+    /**
+     * The new user's first name.
+     */
+    @IsString()
+    firstname: string;
+
+    /**
+     * The new user's middle name.
+     */
+    @IsString()
+    @IsOptional()
+    middlename?: string;
+
+    /**
+     * The new user's last name.
+     */
+    @IsString()
+    lastname: string;
+
+    /**
+     * The new user's username.
+     * You have to provide a email addres, so this is optional.
+     */
+    @IsOptional()
+    @IsString()
+    username?: string;
+
+    /**
+     * The new user's email address.
+     */
+    @IsEmail()
+    @IsString()
+    @IsNotEmpty()
+    email: string;
+
+    /**
+     * The new user's phone number.
+     * This will be validated against the configured country phone numer syntax (default: international).
+     */
+    @IsPhoneNumber(config.phone_validation_countrycode)
+    @IsOptional()
+    phone?: string;
+
+    /**
+     * The new user's password.
+     * This will of course not be saved in plaintext :)
+     */
+    @IsString()
+    password: string;
+
+    /**
+     * Will the new user be enabled from the start?
+     * Default: true
+     */
+    @IsBoolean()
+    @IsOptional()
+    enabled?: boolean = true;
+
+    /**
+     * The new user's groups' ids.
+     * You can provide either one groupId or an array of groupIDs.
+     */
+    @IsOptional()
+    groups?: number[] | number
+
+    /**
+    * The user's profile pic (or rather a url pointing to it).
+    */
+    @IsString()
+    @IsUrl()
+    @IsOptional()
+    profilePic?: string;
+
+    /**
+     * Converts this to a User entity.
+     */
+    public async toEntity(): Promise<User> {
+        let newUser: User = new User();
+
+        if (!this.email) {
+            throw new UserEmailNeededError();
+        }
+        if (this.username.includes("@")) { throw new UsernameContainsIllegalCharacterError(); }
+
+        newUser.email = this.email
+        newUser.username = this.username
+        newUser.firstname = this.firstname
+        newUser.middlename = this.middlename
+        newUser.lastname = this.lastname
+        newUser.uuid = uuid.v4()
+        newUser.phone = this.phone
+        newUser.password = await argon2.hash(this.password + newUser.uuid);
+        newUser.groups = await this.getGroups();
+        newUser.enabled = this.enabled;
+
+        if (!this.profilePic) { newUser.profilePic = `https://dev.lauf-fuer-kaya.de/lfk-logo.png`; }
+        else { newUser.profilePic = this.profilePic; }
+
+        return newUser;
+    }
+
+    /**
+     * Get's all groups for this user by their id's;
+     */
+    public async getGroups() {
+        if (!this.groups) { return null; }
+        let groups = new Array<UserGroup>();
+        if (!Array.isArray(this.groups)) {
+            this.groups = [this.groups]
+        }
+        for (let group of this.groups) {
+            let found = await getConnectionManager().get().getRepository(UserGroup).findOne({ id: group });
+            if (!found) { throw new UserGroupNotFoundError(); }
+            groups.push(found);
+        }
+        return groups;
+    }
 }

src/models/actions/create/CreateUserGroup.ts

@@ -1,5 +1,5 @@
 import { IsOptional, IsString } from 'class-validator';
-import { UserGroup } from '../entities/UserGroup';
+import { UserGroup } from '../../entities/UserGroup';
 
 /**
  * This classed is used to create a new UserGroup entity from a json body (post request).
@@ -22,7 +22,7 @@ export class CreateUserGroup {
     /**
      * Creates a new UserGroup entity from this.
      */
-    public async toUserGroup(): Promise<UserGroup> {
+    public async toEntity(): Promise<UserGroup> {
         let newUserGroup: UserGroup = new UserGroup();
 
         newUserGroup.name = this.name;

src/models/actions/update/UpdateDistanceDonation.ts

@@ -0,0 +1,51 @@
+import { IsInt, IsPositive } from 'class-validator';
+import { getConnection } from 'typeorm';
+import { RunnerNotFoundError } from '../../../errors/RunnerErrors';
+import { DistanceDonation } from '../../entities/DistanceDonation';
+import { Runner } from '../../entities/Runner';
+import { UpdateDonation } from './UpdateDonation';
+
+/**
+ * This class is used to update a DistanceDonation entity (via put request).
+ */
+export class UpdateDistanceDonation extends UpdateDonation {
+
+    /**
+     * The donation's associated runner's id.
+     * This is important to link the runner's distance ran to the donation.
+     */
+    @IsInt()
+    @IsPositive()
+    runner: number;
+
+    /**
+     * The donation's amount per distance (full kilometer aka 1000 meters).
+     * The unit is your currency's smallest unit (default: euro cent).
+     */
+    @IsInt()
+    @IsPositive()
+    amountPerDistance: number;
+
+    /**
+     * Update a DistanceDonation entity based on this.
+     * @param donation The donation that shall be updated.
+     */
+    public async update(donation: DistanceDonation): Promise<DistanceDonation> {
+        donation.amountPerDistance = this.amountPerDistance;
+        donation.donor = await this.getDonor();
+        donation.runner = await this.getRunner();
+
+        return donation;
+    }
+
+    /**
+     * Gets a runner based on the runner id provided via this.runner.
+     */
+    public async getRunner(): Promise<Runner> {
+        const runner = await getConnection().getRepository(Runner).findOne({ id: this.runner });
+        if (!runner) {
+            throw new RunnerNotFoundError();
+        }
+        return runner;
+    }
+}

src/models/actions/update/UpdateDonation.ts

@@ -0,0 +1,41 @@
+import { IsInt, IsPositive } from 'class-validator';
+import { getConnection } from 'typeorm';
+import { DonorNotFoundError } from '../../../errors/DonorErrors';
+import { Donation } from '../../entities/Donation';
+import { Donor } from '../../entities/Donor';
+
+/**
+ * This class is used to update a Donation entity (via put request).
+ */
+export abstract class UpdateDonation {
+    /**
+     * The updated donation's id.
+     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
+     */
+    @IsInt()
+    id: number;
+
+    /**
+     * The updated donation's associated donor's id.
+     * This is important to link donations to donors.
+     */
+    @IsInt()
+    @IsPositive()
+    donor: number;
+
+    /**
+     * Creates a new Donation entity from this.
+     */
+    public abstract update(donation: Donation): Promise<Donation>;
+
+    /**
+     * Gets a donor based on the donor id provided via this.donor.
+     */
+    public async getDonor(): Promise<Donor> {
+        const donor = await getConnection().getRepository(Donor).findOne({ id: this.donor });
+        if (!donor) {
+            throw new DonorNotFoundError();
+        }
+        return donor;
+    }
+}

src/models/actions/update/UpdateDonor.ts

@@ -0,0 +1,46 @@
+import { IsBoolean, IsInt, IsOptional } from 'class-validator';
+import { DonorReceiptAddressNeededError } from '../../../errors/DonorErrors';
+import { Address } from '../../entities/Address';
+import { Donor } from '../../entities/Donor';
+import { CreateParticipant } from '../create/CreateParticipant';
+
+/**
+ * This class is used to update a Donor entity (via put request).
+ */
+export class UpdateDonor extends CreateParticipant {
+
+    /**
+     * The updated donor's id.
+     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
+     */
+    @IsInt()
+    id: number;
+
+    /**
+     * Does the updated donor need a receipt?
+     */
+    @IsBoolean()
+    @IsOptional()
+    receiptNeeded?: boolean;
+
+
+    /**
+     * Updates a provided Donor entity based on this.
+     */
+    public async update(donor: Donor): Promise<Donor> {
+        donor.firstname = this.firstname;
+        donor.middlename = this.middlename;
+        donor.lastname = this.lastname;
+        donor.phone = this.phone;
+        donor.email = this.email;
+        donor.receiptNeeded = this.receiptNeeded;
+        if (!this.address) { donor.address.reset(); }
+        else { donor.address = this.address; }
+        Address.validate(donor.address);
+        if (this.receiptNeeded == true && Address.isValidAddress(donor.address) == false) {
+            throw new DonorReceiptAddressNeededError()
+        }
+
+        return donor;
+    }
+}

src/models/actions/update/UpdateFixedDonation.ts

@@ -0,0 +1,27 @@
+import { IsInt, IsPositive } from 'class-validator';
+import { FixedDonation } from '../../entities/FixedDonation';
+import { UpdateDonation } from './UpdateDonation';
+
+/**
+ * This class is used to update a FixedDonation entity (via put request).
+ */
+export class UpdateFixedDonation extends UpdateDonation {
+    /**
+     * The updated donation's amount.
+     * The unit is your currency's smallest unit (default: euro cent).
+     */
+    @IsInt()
+    @IsPositive()
+    amount: number;
+
+    /**
+     * Update a FixedDonation entity based on this.
+     * @param donation The donation that shall be updated.
+     */
+    public async update(donation: FixedDonation): Promise<FixedDonation> {
+        donation.amount = this.amount;
+        donation.donor = await this.getDonor();
+
+        return donation;
+    }
+}

src/models/actions/update/UpdateGroupContact.ts

@@ -0,0 +1,106 @@
+import { IsEmail, IsInt, IsNotEmpty, IsObject, IsOptional, IsPhoneNumber, IsString } from 'class-validator';
+import { getConnectionManager } from 'typeorm';
+import { config } from '../../../config';
+import { RunnerGroupNotFoundError } from '../../../errors/RunnerGroupErrors';
+import { Address } from '../../entities/Address';
+import { GroupContact } from '../../entities/GroupContact';
+import { RunnerGroup } from '../../entities/RunnerGroup';
+
+
+/**
+ * This class is used to update a GroupContact entity (via put request).
+ */
+export class UpdateGroupContact {
+    /**
+     * The updated contact's id.
+     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
+     */
+    @IsInt()
+    id: number;
+
+    /**
+     * The updated contact's first name.
+     */
+    @IsNotEmpty()
+    @IsString()
+    firstname: string;
+
+    /**
+     * The updated contact's middle name.
+     */
+    @IsOptional()
+    @IsString()
+    middlename?: string;
+
+    /**
+     * The updated contact's last name.
+     */
+    @IsNotEmpty()
+    @IsString()
+    lastname: string;
+
+    /**
+     * The updated contact's address.
+     */
+    @IsOptional()
+    @IsObject()
+    address?: Address;
+
+    /**
+     * The updated contact's phone number.
+     * This will be validated against the configured country phone numer syntax (default: international).
+     */
+    @IsOptional()
+    @IsPhoneNumber(config.phone_validation_countrycode)
+    phone?: string;
+
+    /**
+     * The updated contact's email address.
+     */
+    @IsOptional()
+    @IsEmail()
+    email?: string;
+
+    /**
+     * The updated contacts's groups' ids.
+     * You can provide either one groupId or an array of groupIDs.
+     */
+    @IsOptional()
+    groups?: number[] | number
+
+
+    /**
+     * Get's all groups for this contact by their id's;
+     */
+    public async getGroups(): Promise<RunnerGroup[]> {
+        if (!this.groups) { return null; }
+        let groups = new Array<RunnerGroup>();
+        if (!Array.isArray(this.groups)) {
+            this.groups = [this.groups]
+        }
+        for (let group of this.groups) {
+            let found = await getConnectionManager().get().getRepository(RunnerGroup).findOne({ id: group });
+            if (!found) { throw new RunnerGroupNotFoundError(); }
+            groups.push(found);
+        }
+        return groups;
+    }
+
+    /**
+     * Updates a provided Donor entity based on this.
+     * @param contact the contact you want to update.
+     */
+    public async update(contact: GroupContact): Promise<GroupContact> {
+        contact.firstname = this.firstname; GroupContact
+        contact.middlename = this.middlename;
+        contact.lastname = this.lastname;
+        contact.phone = this.phone;
+        contact.email = this.email;
+        if (!this.address) { contact.address.reset(); }
+        else { contact.address = this.address; }
+        Address.validate(contact.address);
+        contact.groups = await this.getGroups();
+
+        return contact;
+    }
+}

src/models/actions/update/UpdatePermission.ts

@@ -1,11 +1,11 @@
-import { IsInt, IsNotEmpty, IsObject } from 'class-validator';
+import { IsInt, IsNotEmpty, IsPositive } from 'class-validator';
 import { getConnectionManager } from 'typeorm';
-import { PermissionNeedsPrincipalError } from '../../errors/PermissionErrors';
-import { PrincipalNotFoundError, PrincipalWrongTypeError } from '../../errors/PrincipalErrors';
-import { Permission } from '../entities/Permission';
-import { Principal } from '../entities/Principal';
-import { PermissionAction } from '../enums/PermissionAction';
-import { PermissionTarget } from '../enums/PermissionTargets';
+import { PermissionNeedsPrincipalError } from '../../../errors/PermissionErrors';
+import { PrincipalNotFoundError } from '../../../errors/PrincipalErrors';
+import { Permission } from '../../entities/Permission';
+import { Principal } from '../../entities/Principal';
+import { PermissionAction } from '../../enums/PermissionAction';
+import { PermissionTarget } from '../../enums/PermissionTargets';
 
 /**
  * This class is used to update a Permission entity (via put request).
@@ -20,12 +20,11 @@ export class UpdatePermission {
     id: number;
 
     /**
-     * The updated permissions's principal.
-     * Just has to contain the principal's id -everything else won't be checked or changed.
+     * The updated permissions's principal's id.
      */
-    @IsObject()
-    @IsNotEmpty()
-    principal: Principal;
+    @IsInt()
+    @IsPositive()
+    principal: number;
 
     /**
      * The permissions's target.
@@ -42,7 +41,7 @@ export class UpdatePermission {
     /**
      * Updates a provided Permission entity based on this.
      */
-    public async updatePermission(permission: Permission): Promise<Permission> {
+    public async update(permission: Permission): Promise<Permission> {
         permission.principal = await this.getPrincipal();
         permission.target = this.target;
         permission.action = this.action;
@@ -57,12 +56,8 @@ export class UpdatePermission {
         if (this.principal === undefined || this.principal === null) {
             throw new PermissionNeedsPrincipalError();
         }
-        if (!isNaN(this.principal.id)) {
-            let principal = await getConnectionManager().get().getRepository(Principal).findOne({ id: this.principal.id });
-            if (!principal) { throw new PrincipalNotFoundError(); }
-            return principal;
-        }
-
-        throw new PrincipalWrongTypeError();
+        let principal = await getConnectionManager().get().getRepository(Principal).findOne({ id: this.principal });
+        if (!principal) { throw new PrincipalNotFoundError(); }
+        return principal;
     }
 }

src/models/actions/update/UpdateRunner.ts

@@ -0,0 +1,57 @@
+import { IsInt, IsPositive } from 'class-validator';
+import { getConnectionManager } from 'typeorm';
+import { RunnerGroupNotFoundError } from '../../../errors/RunnerGroupErrors';
+import { RunnerTeamNeedsParentError } from '../../../errors/RunnerTeamErrors';
+import { Address } from '../../entities/Address';
+import { Runner } from '../../entities/Runner';
+import { RunnerGroup } from '../../entities/RunnerGroup';
+import { CreateParticipant } from '../create/CreateParticipant';
+
+/**
+ * This class is used to update a Runner entity (via put request).
+ */
+export class UpdateRunner extends CreateParticipant {
+
+    /**
+     * The updated runner's id.
+     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
+     */
+    @IsInt()
+    id: number;
+
+    /**
+     * The updated runner's group's id.
+     */
+    @IsInt()
+    @IsPositive()
+    group: number;
+
+    /**
+     * Updates a provided Runner entity based on this.
+     */
+    public async update(runner: Runner): Promise<Runner> {
+        runner.firstname = this.firstname;
+        runner.middlename = this.middlename;
+        runner.lastname = this.lastname;
+        runner.phone = this.phone;
+        runner.email = this.email;
+        runner.group = await this.getGroup();
+        if (!this.address) { runner.address.reset(); }
+        else { runner.address = this.address; }
+        Address.validate(runner.address);
+
+        return runner;
+    }
+
+    /**
+     * Loads the updated runner's group based on it's id.
+     */
+    public async getGroup(): Promise<RunnerGroup> {
+        if (this.group === undefined || this.group === null) {
+            throw new RunnerTeamNeedsParentError();
+        }
+        let group = await getConnectionManager().get().getRepository(RunnerGroup).findOne({ id: this.group });
+        if (!group) { throw new RunnerGroupNotFoundError; }
+        return group;
+    }
+}

src/models/actions/update/UpdateRunnerCard.ts

@@ -0,0 +1,51 @@
+import { IsBoolean, IsInt, IsOptional, IsPositive } from 'class-validator';
+import { getConnection } from 'typeorm';
+import { RunnerNotFoundError } from '../../../errors/RunnerErrors';
+import { Runner } from '../../entities/Runner';
+import { RunnerCard } from '../../entities/RunnerCard';
+
+/**
+ * This class is used to update a RunnerCard entity (via put request).
+ */
+export class UpdateRunnerCard {
+    /**
+     * The updated card's id.
+     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
+     */
+    @IsInt()
+    @IsPositive()
+    id?: number;
+
+    /**
+     * The updated card's associated runner's id.
+     */
+    @IsInt()
+    @IsOptional()
+    runner?: number;
+
+    /**
+     * Is the updated card enabled (for fraud reasons)?
+     * Default: true
+     */
+    @IsBoolean()
+    enabled: boolean = true;
+
+    /**
+     * Creates a new RunnerCard entity from this.
+     */
+    public async update(card: RunnerCard): Promise<RunnerCard> {
+        card.enabled = this.enabled;
+        card.runner = await this.getRunner();
+
+        return card;
+    }
+
+    public async getRunner(): Promise<Runner> {
+        if (!this.runner) { return null; }
+        const runner = await getConnection().getRepository(Runner).findOne({ id: this.runner });
+        if (!runner) {
+            throw new RunnerNotFoundError();
+        }
+        return runner;
+    }
+}

src/models/actions/update/UpdateRunnerOrganisation.ts

@@ -0,0 +1,38 @@
+import { IsInt, IsObject, IsOptional } from 'class-validator';
+import { Address } from '../../entities/Address';
+import { RunnerOrganisation } from '../../entities/RunnerOrganisation';
+import { CreateRunnerGroup } from '../create/CreateRunnerGroup';
+
+/**
+ * This class is used to update a RunnerOrganisation entity (via put request).
+ */
+export class UpdateRunnerOrganisation extends CreateRunnerGroup {
+
+    /**
+     * The updated orgs's id.
+     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
+     */
+    @IsInt()
+    id: number;
+
+    /**
+     * The updated organisation's address.
+     */
+    @IsOptional()
+    @IsObject()
+    address?: Address;
+
+    /**
+     * Updates a provided RunnerOrganisation entity based on this.
+     */
+    public async update(organisation: RunnerOrganisation): Promise<RunnerOrganisation> {
+
+        organisation.name = this.name;
+        organisation.contact = await this.getContact();
+        if (!this.address) { organisation.address.reset(); }
+        else { organisation.address = this.address; }
+        Address.validate(organisation.address);
+
+        return organisation;
+    }
+}

src/models/actions/update/UpdateRunnerTeam.ts

@@ -0,0 +1,51 @@
+import { IsInt, IsPositive } from 'class-validator';
+import { getConnectionManager } from 'typeorm';
+import { RunnerOrganisationNotFoundError } from '../../../errors/RunnerOrganisationErrors';
+import { RunnerTeamNeedsParentError } from '../../../errors/RunnerTeamErrors';
+import { RunnerOrganisation } from '../../entities/RunnerOrganisation';
+import { RunnerTeam } from '../../entities/RunnerTeam';
+import { CreateRunnerGroup } from '../create/CreateRunnerGroup';
+
+/**
+ * This class is used to update a RunnerTeam entity (via put request).
+ */
+export class UpdateRunnerTeam extends CreateRunnerGroup {
+
+    /**
+     * The updated team's id.
+     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
+     */
+    @IsInt()
+    id: number;
+
+    /**
+     * The updated team's parentGroup's id.
+     */
+    @IsInt()
+    @IsPositive()
+    parentGroup: number;
+
+    /**
+     * Loads the updated teams's parentGroup based on it's id.
+     */
+    public async getParent(): Promise<RunnerOrganisation> {
+        if (this.parentGroup === undefined || this.parentGroup === null) {
+            throw new RunnerTeamNeedsParentError();
+        }
+        let parentGroup = await getConnectionManager().get().getRepository(RunnerOrganisation).findOne({ id: this.parentGroup });
+        if (!parentGroup) { throw new RunnerOrganisationNotFoundError();; }
+        return parentGroup;
+    }
+
+    /**
+     * Updates a provided RunnerTeam entity based on this.
+     */
+    public async update(team: RunnerTeam): Promise<RunnerTeam> {
+
+        team.name = this.name;
+        team.parentGroup = await this.getParent();
+        team.contact = await this.getContact()
+
+        return team;
+    }
+}

src/models/actions/update/UpdateScan.ts

@@ -0,0 +1,62 @@
+import { IsBoolean, IsInt, IsOptional, IsPositive } from 'class-validator';
+import { getConnection } from 'typeorm';
+import { RunnerNotFoundError } from '../../../errors/RunnerErrors';
+import { Runner } from '../../entities/Runner';
+import { Scan } from '../../entities/Scan';
+
+/**
+ * This class is used to update a Scan entity (via put request)
+ */
+export abstract class UpdateScan {
+    /**
+     * The updated scan's id.
+     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
+     */
+    @IsInt()
+    id: number;
+
+    /**
+     * The updated scan's associated runner's id.
+     * This is important to link ran distances to runners.
+     */
+    @IsInt()
+    @IsPositive()
+    runner: number;
+
+    /**
+     * Is the updated scan valid (for fraud reasons).
+     */
+    @IsBoolean()
+    @IsOptional()
+    valid?: boolean = true;
+
+    /**
+     * The updated scan's distance in meters.
+     */
+    @IsInt()
+    @IsPositive()
+    public distance: number;
+
+    /**
+     * Update a Scan entity based on this.
+     * @param scan The scan that shall be updated.
+     */
+    public async update(scan: Scan): Promise<Scan> {
+        scan.distance = this.distance;
+        scan.valid = this.valid;
+        scan.runner = await this.getRunner();
+
+        return scan;
+    }
+
+    /**
+     * Gets a runner based on the runner id provided via this.runner.
+     */
+    public async getRunner(): Promise<Runner> {
+        const runner = await getConnection().getRepository(Runner).findOne({ id: this.runner });
+        if (!runner) {
+            throw new RunnerNotFoundError();
+        }
+        return runner;
+    }
+}

src/models/actions/update/UpdateScanStation.ts

@@ -0,0 +1,39 @@
+import { IsBoolean, IsInt, IsOptional, IsString } from 'class-validator';
+import { ScanStation } from '../../entities/ScanStation';
+
+/**
+ * This class is used to update a ScanStation entity (via put request)
+ */
+export class UpdateScanStation {
+    /**
+     * The updated station's id.
+     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
+     */
+    @IsInt()
+    id: number;
+
+    /**
+     * The updated station's description.
+     */
+    @IsString()
+    @IsOptional()
+    description?: string;
+
+    /**
+     * Is this station enabled?
+     */
+    @IsBoolean()
+    @IsOptional()
+    enabled?: boolean = true;
+
+    /**
+     * Update a ScanStation entity based on this.
+     * @param station The station that shall be updated.
+     */
+    public async update(station: ScanStation): Promise<ScanStation> {
+        station.description = this.description;
+        station.enabled = this.enabled;
+
+        return station;
+    }
+}

src/models/actions/update/UpdateTrack.ts

@@ -0,0 +1,50 @@
+import { IsInt, IsNotEmpty, IsOptional, IsPositive, IsString } from 'class-validator';
+import { TrackLapTimeCantBeNegativeError } from '../../../errors/TrackErrors';
+import { Track } from '../../entities/Track';
+
+/**
+ * This class is used to update a Track entity (via put request).
+ */
+export class UpdateTrack {
+    /**
+     * The updated track's id.
+     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
+     */
+    @IsInt()
+    id: number;
+
+    @IsString()
+    @IsNotEmpty()
+    name: string;
+
+    /**
+     * The updated track's distance in meters (must be greater than 0).
+     */
+    @IsInt()
+    @IsPositive()
+    distance: number;
+
+    /**
+     * The minimum time a runner should take to run a lap on this track (in seconds).
+     * Will be used for fraud detection.
+     */
+    @IsInt()
+    @IsOptional()
+    minimumLapTime: number;
+
+
+    /**
+     * Update a Track entity based on this.
+     * @param track The track that shall be updated.
+     */
+    public async update(track: Track): Promise<Track> {
+        track.name = this.name;
+        track.distance = this.distance;
+        track.minimumLapTime = this.minimumLapTime;
+        if (this.minimumLapTime < 0) {
+            throw new TrackLapTimeCantBeNegativeError();
+        }
+
+        return track;
+    }
+}

src/models/actions/update/UpdateTrackScan.ts

@@ -0,0 +1,77 @@
+import { IsBoolean, IsInt, IsOptional, IsPositive } from 'class-validator';
+import { getConnection } from 'typeorm';
+import { RunnerNotFoundError } from '../../../errors/RunnerErrors';
+import { ScanStationNotFoundError } from '../../../errors/ScanStationErrors';
+import { Runner } from '../../entities/Runner';
+import { ScanStation } from '../../entities/ScanStation';
+import { TrackScan } from '../../entities/TrackScan';
+
+/**
+ * This class is used to update a TrackScan entity (via put request)
+ */
+export abstract class UpdateTrackScan {
+    /**
+     * The updated scan's id.
+     * This shouldn't have changed but it is here in case anyone ever wants to enable id changes (whyever they would want to).
+     */
+    @IsInt()
+    id: number;
+
+    /**
+     * The updated scan's associated runner's id.
+     * This is important to link ran distances to runners.
+     */
+    @IsInt()
+    @IsPositive()
+    runner: number;
+
+    /**
+     * Is the updated scan valid (for fraud reasons).
+     */
+    @IsBoolean()
+    @IsOptional()
+    valid?: boolean = true;
+
+    /**
+     * The updated scan's associated station's id.
+     * This is important to link ran distances to runners.
+     */
+    @IsInt()
+    @IsPositive()
+    public station: number;
+
+    /**
+     * Update a TrackScan entity based on this.
+     * @param scan The scan that shall be updated.
+     */
+    public async update(scan: TrackScan): Promise<TrackScan> {
+        scan.valid = this.valid;
+        scan.runner = await this.getRunner();
+        scan.station = await this.getStation();
+        scan.track = scan.station.track;
+
+        return scan;
+    }
+
+    /**
+     * Gets a runner based on the runner id provided via this.runner.
+     */
+    public async getRunner(): Promise<Runner> {
+        const runner = await getConnection().getRepository(Runner).findOne({ id: this.runner });
+        if (!runner) {
+            throw new RunnerNotFoundError();
+        }
+        return runner;
+    }
+
+    /**
+     * Gets a runner based on the runner id provided via this.runner.
+     */
+    public async getStation(): Promise<ScanStation> {
+        const station = await getConnection().getRepository(ScanStation).findOne({ id: this.station }, { relations: ['track'] });
+        if (!station) {
+            throw new ScanStationNotFoundError();
+        }
+        return station;
+    }
+}

src/models/actions/update/UpdateUser.ts

@@ -1,11 +1,11 @@
 import * as argon2 from "argon2";
-import { IsBoolean, IsEmail, IsInt, IsOptional, IsPhoneNumber, IsString } from 'class-validator';
+import { IsBoolean, IsEmail, IsInt, IsNotEmpty, IsOptional, IsPhoneNumber, IsString, IsUrl } from 'class-validator';
 import { getConnectionManager } from 'typeorm';
-import { config } from '../../config';
-import { UsernameOrEmailNeededError } from '../../errors/AuthError';
-import { UserGroupNotFoundError } from '../../errors/UserGroupErrors';
-import { User } from '../entities/User';
-import { UserGroup } from '../entities/UserGroup';
+import { config } from '../../../config';
+import { UserEmailNeededError, UsernameContainsIllegalCharacterError } from '../../../errors/UserErrors';
+import { UserGroupNotFoundError } from '../../../errors/UserGroupErrors';
+import { User } from '../../entities/User';
+import { UserGroup } from '../../entities/UserGroup';
 
 /**
  * This class is used to update a User entity (via put request).
@@ -40,7 +40,7 @@ export class UpdateUser {
 
     /**
      * The updated user's username.
-     * You have to provide at least one of: {email, username}.
+     * You have to provide a email addres, so this is optional.
      */
     @IsOptional()
     @IsString()
@@ -48,12 +48,11 @@ export class UpdateUser {
 
     /**
      * The updated user's email address.
-     * You have to provide at least one of: {email, username}.
      */
     @IsEmail()
     @IsString()
-    @IsOptional()
-    email?: string;
+    @IsNotEmpty()
+    email: string;
 
     /**
      * The updated user's phone number.
@@ -77,42 +76,55 @@ export class UpdateUser {
      * Should the user be enabled?
      */
     @IsBoolean()
+    @IsOptional()
     enabled: boolean = true;
 
     /**
-     * The updated user's groups.
-     * This just has to contain the group's id - everything else won't be changed.
+     * The updated user's groups' ids.
      */
     @IsOptional()
-    groups?: UserGroup[]
+    groups?: number | number[]
 
     /**
-     * Updates a provided User entity based on this.
+    * The user's profile pic (or rather a url pointing to it).
+    */
+    @IsString()
+    @IsUrl()
+    @IsOptional()
+    profilePic?: string;
+
+    /**
+     * Updates a user entity based on this.
+     * @param user The user that shall be updated.
      */
-    public async updateUser(user: User): Promise<User> {
-        user.email = this.email;
-        user.username = this.username;
-        if ((user.email === undefined || user.email === null) && (user.username === undefined || user.username === null)) {
-            throw new UsernameOrEmailNeededError();
+    public async update(user: User): Promise<User> {
+        if (!this.email) {
+            throw new UserEmailNeededError();
         }
+        if (this.username.includes("@")) { throw new UsernameContainsIllegalCharacterError(); }
+
         if (this.password) {
             user.password = await argon2.hash(this.password + user.uuid);
             user.refreshTokenCount = user.refreshTokenCount + 1;
         }
 
+        user.email = this.email;
+        user.username = this.username;
         user.enabled = this.enabled;
         user.firstname = this.firstname
         user.middlename = this.middlename
         user.lastname = this.lastname
         user.phone = this.phone;
         user.groups = await this.getGroups();
-        //TODO: ProfilePics
+
+        if (!this.profilePic) { user.profilePic = `https://dev.lauf-fuer-kaya.de/lfk-logo.png`; }
+        else { user.profilePic = this.profilePic; }
 
         return user;
     }
 
     /**
-     * Loads the updated user's groups based on their ids.
+     * Get's all groups for this user by their id's;
      */
     public async getGroups() {
         if (!this.groups) { return null; }
@@ -121,7 +133,7 @@ export class UpdateUser {
             this.groups = [this.groups]
         }
         for (let group of this.groups) {
-            let found = await getConnectionManager().get().getRepository(UserGroup).findOne({ id: group.id });
+            let found = await getConnectionManager().get().getRepository(UserGroup).findOne({ id: group });
             if (!found) { throw new UserGroupNotFoundError(); }
             groups.push(found);
         }