From 9f9d135785de64ddbe59ba3e4a9031a9df6e0ba5 Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Tue, 13 Aug 2024 11:28:21 +0200
Subject: [PATCH 01/32] add voting API endpoint WIP

---
 .../src/server-middleware/api/events/log.js   |  2 +-
 .../src/server-middleware/api/events/pg.js    | 26 --------------
 .../server-middleware/api/events/trending.js  |  2 +-
 .../src/server-middleware/api/events/views.js |  2 +-
 .../portal/src/server-middleware/api/index.js |  5 +++
 .../server-middleware/api/events/pg.spec.js   | 36 -------------------
 6 files changed, 8 insertions(+), 65 deletions(-)
 delete mode 100644 packages/portal/src/server-middleware/api/events/pg.js
 delete mode 100644 packages/portal/tests/unit/server-middleware/api/events/pg.spec.js

diff --git a/packages/portal/src/server-middleware/api/events/log.js b/packages/portal/src/server-middleware/api/events/log.js
index b2598b211c..b0000bba9f 100644
--- a/packages/portal/src/server-middleware/api/events/log.js
+++ b/packages/portal/src/server-middleware/api/events/log.js
@@ -1,5 +1,5 @@
 import isbot from 'isbot';
-import pg from './pg.js';
+import pg from '../pg/pg.js';
 
 // TODO: use `next` for error handling
 // TODO: accept multiple uris for the same action
diff --git a/packages/portal/src/server-middleware/api/events/pg.js b/packages/portal/src/server-middleware/api/events/pg.js
deleted file mode 100644
index 636478f1cc..0000000000
--- a/packages/portal/src/server-middleware/api/events/pg.js
+++ /dev/null
@@ -1,26 +0,0 @@
-import { Pool } from 'pg';
-
-let pool;
-
-export default {
-  config: {},
-
-  get enabled() {
-    return this.config.enabled;
-  },
-
-  get pool() {
-    if (!pool) {
-      pool = new Pool(this.config);
-      pool.on('error', (err) => {
-        console.error('PostgreSQL pool error', err);
-        pool = null;
-      });
-    }
-    return pool;
-  },
-
-  query() {
-    return this.pool.query(...arguments);
-  }
-};
diff --git a/packages/portal/src/server-middleware/api/events/trending.js b/packages/portal/src/server-middleware/api/events/trending.js
index f46d49f136..13828e5fd9 100644
--- a/packages/portal/src/server-middleware/api/events/trending.js
+++ b/packages/portal/src/server-middleware/api/events/trending.js
@@ -1,4 +1,4 @@
-import pg from './pg.js';
+import pg from '../pg/pg.js';
 
 // TODO: use `next` for error handling
 export default (config = {}) => {
diff --git a/packages/portal/src/server-middleware/api/events/views.js b/packages/portal/src/server-middleware/api/events/views.js
index 39b7703ab2..42946fa509 100644
--- a/packages/portal/src/server-middleware/api/events/views.js
+++ b/packages/portal/src/server-middleware/api/events/views.js
@@ -1,4 +1,4 @@
-import pg from './pg.js';
+import pg from '../pg/pg.js';
 
 // TODO: use `next` for error handling
 export default (config = {}) => {
diff --git a/packages/portal/src/server-middleware/api/index.js b/packages/portal/src/server-middleware/api/index.js
index 3597077f0a..ba79ddd35f 100644
--- a/packages/portal/src/server-middleware/api/index.js
+++ b/packages/portal/src/server-middleware/api/index.js
@@ -59,6 +59,11 @@ app.post('/jira-service-desk/galleries', jiraServiceDeskGalleries(runtimeConfig.
 import version from './version.js';
 app.get('/version', version);
 
+import votes from './polls/votes.js';
+app.get('/votes', votes);
+import vote from './polls/vote.js';
+app.post('/vote', vote);
+
 app.all('/*', (req, res) => res.sendStatus(404));
 
 export default app;
diff --git a/packages/portal/tests/unit/server-middleware/api/events/pg.spec.js b/packages/portal/tests/unit/server-middleware/api/events/pg.spec.js
deleted file mode 100644
index 17c2af88b5..0000000000
--- a/packages/portal/tests/unit/server-middleware/api/events/pg.spec.js
+++ /dev/null
@@ -1,36 +0,0 @@
-import pg from 'pg';
-import sinon from 'sinon';
-
-import pgEvents from '@/server-middleware/api/events/pg';
-
-const pgPoolOn = sinon.stub();
-const pgPoolQuery = sinon.stub();
-
-describe('@/server-middleware/api/events/pg', () => {
-  beforeAll(() => {
-    sinon.replace(pg.Pool.prototype, 'on', pgPoolOn);
-    sinon.replace(pg.Pool.prototype, 'query', pgPoolQuery);
-  });
-  afterEach(sinon.resetHistory);
-  afterAll(sinon.resetBehavior);
-
-  describe('pool', () => {
-    it('creates and returns a pg pool, with error handler', () => {
-      const pool = pgEvents.pool;
-
-      expect(pool instanceof pg.Pool).toBe(true);
-      expect(pgPoolOn.calledWith('error', sinon.match.func)).toBe(true);
-    });
-  });
-
-  describe('query', () => {
-    it('delegates with all args to pg pool', () => {
-      const sql = 'SELECT * FROM table WHERE type=$1';
-      const params = ['like'];
-
-      pgEvents.query(sql, params);
-
-      expect(pgPoolQuery.calledWith(sql, params)).toBe(true);
-    });
-  });
-});

From a5086c78f8e7035eaee7bbe5f18f902c92adce26 Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Tue, 13 Aug 2024 13:23:16 +0200
Subject: [PATCH 02/32] polls API middleware

---
 .../portal/src/server-middleware/api/pg/pg.js | 26 ++++++++
 .../src/server-middleware/api/polls/vote.js   | 61 +++++++++++++++++++
 .../src/server-middleware/api/polls/votes.js  | 39 ++++++++++++
 .../unit/server-middleware/api/pg/pg.spec.js  | 36 +++++++++++
 .../server-middleware/api/polls/votes.spec.js | 51 ++++++++++++++++
 5 files changed, 213 insertions(+)
 create mode 100644 packages/portal/src/server-middleware/api/pg/pg.js
 create mode 100644 packages/portal/src/server-middleware/api/polls/vote.js
 create mode 100644 packages/portal/src/server-middleware/api/polls/votes.js
 create mode 100644 packages/portal/tests/unit/server-middleware/api/pg/pg.spec.js
 create mode 100644 packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js

diff --git a/packages/portal/src/server-middleware/api/pg/pg.js b/packages/portal/src/server-middleware/api/pg/pg.js
new file mode 100644
index 0000000000..636478f1cc
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/pg/pg.js
@@ -0,0 +1,26 @@
+import { Pool } from 'pg';
+
+let pool;
+
+export default {
+  config: {},
+
+  get enabled() {
+    return this.config.enabled;
+  },
+
+  get pool() {
+    if (!pool) {
+      pool = new Pool(this.config);
+      pool.on('error', (err) => {
+        console.error('PostgreSQL pool error', err);
+        pool = null;
+      });
+    }
+    return pool;
+  },
+
+  query() {
+    return this.pool.query(...arguments);
+  }
+};
diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
new file mode 100644
index 0000000000..9512e2f38b
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -0,0 +1,61 @@
+import pg from '../pg/pg.js';
+
+// TODO: validate user login
+export default (config = {}) => {
+  pg.config = config;
+
+  return async(req, res) => {
+    try {
+      if (!pg.enabled) {
+        return;
+      }
+
+      const { userExternalId, optionExternalId } = req.body;
+
+      // if(notAuthorized) {
+      //   res.sendStatus(401);
+      // }
+
+      let userRow;
+      const selectUserResult = await pg.query(
+        'SELECT id FROM polls.users WHERE external_id=$1',
+        [userExternalId]
+      );
+      if (selectUserResult.rowCount > 0) {
+        userRow = selectUserResult.rows[0];
+      } else {
+        const insertUserResult = await pg.query(
+          'INSERT INTO polls.users (external_id) VALUES($1) RETURNING id',
+          [userExternalId]
+        );
+        userRow = insertUserResult.rows[0];
+      }
+
+      let optionRow;
+      const selectOptionResult = await pg.query(
+        'SELECT id FROM polls.options WHERE external_id=$1',
+        [optionExternalId]
+      );
+      if (selectOptionResult.rowCount > 0) {
+        optionRow =selectOptionResult.rows[0];
+      } else {
+        const insertOptionResult = await pg.query(
+          'INSERT INTO polls.options (external_id) VALUES($1) RETURNING id',
+          [optionExternalId]
+        );
+        optionRow = insertOptionResult.rows[0];
+      };
+
+      await pg.query(`
+        INSERT INTO polls.votes (user_id, option_id, occurred_at)
+        VALUES($1, $2, CURRENT_TIMESTAMP)
+        `,
+      [userRow.id, optionRow.id]
+      );
+      res.sendStatus(204);
+    } catch (err) {
+      res.sendStatus(409);
+      console.error(err);
+    }
+  };
+};
\ No newline at end of file
diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
new file mode 100644
index 0000000000..ace4f370ae
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -0,0 +1,39 @@
+import pg from '../pg/pg.js';
+
+// TODO: use `next` for error handling
+// TODO: accept multiple uris for the same action
+// TODO: log user agent?
+// TODO: validate action_types
+export default (config = {}) => {
+  pg.config = config;
+
+  return async(req, res) => {
+    try {
+      if (!pg.enabled) {
+        return;
+      }
+
+      const { optionIDs } = req.body;
+
+      const votesForOptions = await pg.query(`
+        SELECT o.external_id, COUNT(*) FROM polls.votes v LEFT JOIN polls.options o
+          ON v.option_id=o.id
+        WHERE o.external_id LIKE ANY('{$1}')
+        GROUP BY (o.id)
+        `,
+      [optionIDs]
+      );
+      if (votesForOptions.rowCount < 0) {
+        // Nobody has voted on anything yet
+        res.json([]);
+      }
+
+      res.json(votesForOptions.rows.reduce((memo, row) => {
+        memo[row.id] = row.count;
+        return memo;
+      }, {}));
+    } catch (err) {
+      console.error(err);
+    }
+  };
+};
diff --git a/packages/portal/tests/unit/server-middleware/api/pg/pg.spec.js b/packages/portal/tests/unit/server-middleware/api/pg/pg.spec.js
new file mode 100644
index 0000000000..5c993b843b
--- /dev/null
+++ b/packages/portal/tests/unit/server-middleware/api/pg/pg.spec.js
@@ -0,0 +1,36 @@
+import pg from 'pg';
+import sinon from 'sinon';
+
+import pgEvents from '@/server-middleware/api/pg/pg.js';
+
+const pgPoolOn = sinon.stub();
+const pgPoolQuery = sinon.stub();
+
+describe('@/server-middleware/api/pg/pg', () => {
+  beforeAll(() => {
+    sinon.replace(pg.Pool.prototype, 'on', pgPoolOn);
+    sinon.replace(pg.Pool.prototype, 'query', pgPoolQuery);
+  });
+  afterEach(sinon.resetHistory);
+  afterAll(sinon.resetBehavior);
+
+  describe('pool', () => {
+    it('creates and returns a pg pool, with error handler', () => {
+      const pool = pgEvents.pool;
+
+      expect(pool instanceof pg.Pool).toBe(true);
+      expect(pgPoolOn.calledWith('error', sinon.match.func)).toBe(true);
+    });
+  });
+
+  describe('query', () => {
+    it('delegates with all args to pg pool', () => {
+      const sql = 'SELECT * FROM table WHERE type=$1';
+      const params = ['like'];
+
+      pgEvents.query(sql, params);
+
+      expect(pgPoolQuery.calledWith(sql, params)).toBe(true);
+    });
+  });
+});
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
new file mode 100644
index 0000000000..f324cc6191
--- /dev/null
+++ b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
@@ -0,0 +1,51 @@
+import pg from 'pg';
+import sinon from 'sinon';
+
+import votesEventsHandler from '@/server-middleware/api/polls/votes';
+
+const pgPoolQuery = sinon.stub().resolves({
+  rows: [
+    {
+      'id': '5Ca2xEt6t10fxqMbvrw9aO',
+      'count': 40
+    }
+  ]
+});
+
+const reqBody = { optionIDs: ['5Ca2xEt6t10fxqMbvrw9aO', '5Ca2xEt6t10fxqMbvrw9a1', '5Ca2xEt6t10fxqMbvrw9a2'] };
+
+const expressReqStub = {
+  body: reqBody,
+  get: sinon.spy()
+};
+const expressResStub = {
+  json: sinon.spy(),
+  sendStatus: sinon.spy()
+};
+
+describe('@/server-middleware/api/polls/votes', () => {
+  beforeAll(() => {
+    sinon.replace(pg.Pool.prototype, 'query', pgPoolQuery);
+  });
+  afterEach(sinon.resetHistory);
+  afterAll(sinon.resetBehavior);
+
+  describe('when some of the options have been voted on', () => {
+    const options = { enabled: true };
+
+    it('queries postgres for the votes', async() => {
+      await votesEventsHandler(options)(expressReqStub, expressResStub);
+
+      expect(pgPoolQuery.calledWith(
+        sinon.match((sql) => sql.trim().startsWith('SELECT ')),
+        [['5Ca2xEt6t10fxqMbvrw9aO', '5Ca2xEt6t10fxqMbvrw9a1', '5Ca2xEt6t10fxqMbvrw9a2']]
+      )).toBe(true);
+    });
+
+    it('responds with the view count as json', async() => {
+      await votesEventsHandler(options)(expressReqStub, expressResStub);
+
+      expect(expressResStub.json.calledWith({ '5Ca2xEt6t10fxqMbvrw9aO': 40 })).toBe(true);
+    });
+  });
+});

From 1624f81d284f87523591aeb03d17aad1fcfa0292 Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Tue, 13 Aug 2024 14:21:28 +0200
Subject: [PATCH 03/32] linting

---
 packages/portal/src/server-middleware/api/polls/vote.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index 9512e2f38b..bf23558bc1 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -37,14 +37,14 @@ export default (config = {}) => {
         [optionExternalId]
       );
       if (selectOptionResult.rowCount > 0) {
-        optionRow =selectOptionResult.rows[0];
+        optionRow = selectOptionResult.rows[0];
       } else {
         const insertOptionResult = await pg.query(
           'INSERT INTO polls.options (external_id) VALUES($1) RETURNING id',
           [optionExternalId]
         );
         optionRow = insertOptionResult.rows[0];
-      };
+      }
 
       await pg.query(`
         INSERT INTO polls.votes (user_id, option_id, occurred_at)
@@ -58,4 +58,4 @@ export default (config = {}) => {
       console.error(err);
     }
   };
-};
\ No newline at end of file
+};

From 1221e96e165977b4f331e2839b14a81447224489 Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Tue, 13 Aug 2024 15:05:38 +0200
Subject: [PATCH 04/32] specs for votes

---
 .../src/server-middleware/api/polls/vote.js   |   3 +
 .../server-middleware/api/polls/vote.spec.js  | 100 ++++++++++++++++++
 2 files changed, 103 insertions(+)
 create mode 100644 packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js

diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index bf23558bc1..07259b0bfd 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -7,6 +7,7 @@ export default (config = {}) => {
   return async(req, res) => {
     try {
       if (!pg.enabled) {
+        res.sendStatus(503);
         return;
       }
 
@@ -46,6 +47,8 @@ export default (config = {}) => {
         optionRow = insertOptionResult.rows[0];
       }
 
+      // TODO: should this query the DB as to whether the user has already voted on this option first?
+
       await pg.query(`
         INSERT INTO polls.votes (user_id, option_id, occurred_at)
         VALUES($1, $2, CURRENT_TIMESTAMP)
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
new file mode 100644
index 0000000000..85c5b31a29
--- /dev/null
+++ b/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
@@ -0,0 +1,100 @@
+import pg from 'pg';
+import sinon from 'sinon';
+
+import voteEventsHandler from '@/server-middleware/api/polls/vote';
+
+const fixtures = {
+  db: {
+    userId: 2,
+    optionId: 1
+  },
+  reqBody: {
+    userExternalId: 'keycloak_uuid',
+    optionExternalId: 'contentful_sys_id'
+  }
+};
+
+const pgPoolQuery = sinon.stub();
+pgPoolQuery.withArgs(
+  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.users ')),
+  [fixtures.reqBody.userExternalId]
+)
+  .resolves({ rowCount: 0 });
+pgPoolQuery.withArgs(
+  sinon.match((sql) => sql.startsWith('INSERT INTO polls.users ')),
+  [fixtures.reqBody.userExternalId]
+)
+  .resolves({ rows: [{ id: fixtures.db.userId }] });
+pgPoolQuery.withArgs(
+  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.options ')),
+  [fixtures.reqBody.optionExternalId]
+)
+  .resolves({ rowCount: 0 });
+pgPoolQuery.withArgs(
+  sinon.match((sql) => sql.startsWith('INSERT INTO polls.options ')),
+  [fixtures.reqBody.optionExternalId]
+)
+  .resolves({ rows: [{ id: fixtures.db.optionId }] });
+pgPoolQuery.withArgs(
+  sinon.match((sql) => sql.trim().startsWith('INSERT INTO polls.votes ')),
+  [fixtures.db.userId, fixtures.db.optionId]
+)
+  .resolves({});
+
+const expressReqStub = {
+  body: fixtures.reqBody,
+  get: sinon.spy()
+};
+const expressResStub = {
+  json: sinon.spy(),
+  sendStatus: sinon.spy()
+};
+
+describe('@/server-middleware/api/polls/vote', () => {
+  beforeAll(() => {
+    sinon.replace(pg.Pool.prototype, 'query', pgPoolQuery);
+  });
+  afterEach(sinon.resetHistory);
+  afterAll(sinon.resetBehavior);
+
+  describe('when not explicitly enabled', () => {
+    const options = {};
+
+    it('does not query postgres', async() => {
+      await voteEventsHandler(options)(expressReqStub, expressResStub);
+
+      expect(pgPoolQuery.called).toBe(false);
+    });
+
+    it('responds with 503 status', async() => {
+      await voteEventsHandler(options)(expressReqStub, expressResStub);
+
+      expect(expressResStub.sendStatus.calledWith(503)).toBe(true);
+    });
+  });
+
+  describe('when explicitly enabled', () => {
+    const options = { enabled: true };
+
+    const expressReqStub = {
+      body: fixtures.reqBody,
+      get: sinon.spy()
+    };
+
+    describe('when for voting on behalf of a user with a valid session', () => {
+      // TODO: authorisation
+      it('runs all postgres queries to vote on the option', async() => {
+        await voteEventsHandler(options)(expressReqStub, expressResStub);
+
+        expect(pgPoolQuery.getCalls().length).toBe(5);
+      });
+
+      it('responds with 204 status', async() => {
+        await voteEventsHandler(options)(expressReqStub, expressResStub);
+
+        expect(expressResStub.sendStatus.calledWith(204)).toBe(true);
+      });
+    });
+  });
+});
+

From d624cd958e3c615a8ef0f2ef7006b5b5c5554fcb Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Tue, 13 Aug 2024 16:06:07 +0200
Subject: [PATCH 05/32] restructure votes data

---
 .../src/server-middleware/api/polls/votes.js  | 23 +++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index ace4f370ae..963847f876 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -13,15 +13,27 @@ export default (config = {}) => {
         return;
       }
 
-      const { optionIDs } = req.body;
+      const { optionIDs, userExternalId } = req.body;
+
+      let userRow = { id: null };
+      if (userExternalId) {
+        const selectUserResult = await pg.query(
+          'SELECT id FROM polls.users WHERE external_id=$1',
+          [userExternalId]
+        );
+        if (selectUserResult.rowCount > 0) {
+          userRow = selectUserResult.rows[0];
+        }
+      }
 
       const votesForOptions = await pg.query(`
-        SELECT o.external_id, COUNT(*) FROM polls.votes v LEFT JOIN polls.options o
+        SELECT o.external_id, COUNT(*) AS total, ((SELECT COUNT(*) FROM polls.votes WHERE user_id=$2 AND option_id=o.id) AS votedByCurrentUser
+          FROM polls.votes v LEFT JOIN polls.options o
           ON v.option_id=o.id
         WHERE o.external_id LIKE ANY('{$1}')
         GROUP BY (o.id)
         `,
-      [optionIDs]
+      [optionIDs, userRow.id]
       );
       if (votesForOptions.rowCount < 0) {
         // Nobody has voted on anything yet
@@ -29,7 +41,10 @@ export default (config = {}) => {
       }
 
       res.json(votesForOptions.rows.reduce((memo, row) => {
-        memo[row.id] = row.count;
+        memo[row.id] = {
+          total: row.total,
+          votedByCurrentUser: row.votedByCurrentUser
+        };
         return memo;
       }, {}));
     } catch (err) {

From 66869fa8f82a480b93009adeb780c6dcb47734bc Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Tue, 13 Aug 2024 16:35:31 +0200
Subject: [PATCH 06/32] update TODO with new criteria

---
 packages/portal/src/server-middleware/api/polls/vote.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index 07259b0bfd..4a0abb3c44 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -47,7 +47,7 @@ export default (config = {}) => {
         optionRow = insertOptionResult.rows[0];
       }
 
-      // TODO: should this query the DB as to whether the user has already voted on this option first?
+      // TODO: This needs to check if the vote already exists, then conditionally do the insert or a delete.
 
       await pg.query(`
         INSERT INTO polls.votes (user_id, option_id, occurred_at)

From 71f7d5a79ba015134bd4dbb1e391cc747a7759fb Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Fri, 16 Aug 2024 14:35:25 +0200
Subject: [PATCH 07/32] fix parenthesis

---
 packages/portal/src/server-middleware/api/polls/votes.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index 963847f876..d80515ce54 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -27,7 +27,7 @@ export default (config = {}) => {
       }
 
       const votesForOptions = await pg.query(`
-        SELECT o.external_id, COUNT(*) AS total, ((SELECT COUNT(*) FROM polls.votes WHERE user_id=$2 AND option_id=o.id) AS votedByCurrentUser
+        SELECT o.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE user_id=$2 AND option_id=o.id) AS votedByCurrentUser
           FROM polls.votes v LEFT JOIN polls.options o
           ON v.option_id=o.id
         WHERE o.external_id LIKE ANY('{$1}')

From 4d4ed86014378b90078e74fae441088b4483cf39 Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Fri, 16 Aug 2024 16:26:34 +0200
Subject: [PATCH 08/32] remove vote endpoint

---
 .../portal/src/server-middleware/api/index.js |  2 +
 .../api/polls/remove-vote.js                  | 69 +++++++++++++++++++
 .../src/server-middleware/api/polls/vote.js   | 25 ++++---
 .../src/server-middleware/api/polls/votes.js  |  2 +
 .../server-middleware/api/polls/votes.spec.js | 33 +++++----
 5 files changed, 110 insertions(+), 21 deletions(-)
 create mode 100644 packages/portal/src/server-middleware/api/polls/remove-vote.js

diff --git a/packages/portal/src/server-middleware/api/index.js b/packages/portal/src/server-middleware/api/index.js
index ba79ddd35f..414ab61c00 100644
--- a/packages/portal/src/server-middleware/api/index.js
+++ b/packages/portal/src/server-middleware/api/index.js
@@ -63,6 +63,8 @@ import votes from './polls/votes.js';
 app.get('/votes', votes);
 import vote from './polls/vote.js';
 app.post('/vote', vote);
+import removeVote from './polls/removeVote.js';
+app.delete('/vote', removeVote);
 
 app.all('/*', (req, res) => res.sendStatus(404));
 
diff --git a/packages/portal/src/server-middleware/api/polls/remove-vote.js b/packages/portal/src/server-middleware/api/polls/remove-vote.js
new file mode 100644
index 0000000000..7bfdfe1032
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/polls/remove-vote.js
@@ -0,0 +1,69 @@
+import pg from '../pg/pg.js';
+
+// TODO: validate user login
+export default (config = {}) => {
+  pg.config = config;
+
+  return async(req, res) => {
+    try {
+      if (!pg.enabled) {
+        res.sendStatus(503);
+        return;
+      }
+
+      const { userExternalId, optionExternalId } = req.body;
+
+      // if(notAuthorized) {
+      //   res.sendStatus(401);
+      // }
+
+      let userRow;
+      const selectUserResult = await pg.query(
+        'SELECT id FROM polls.users WHERE external_id=$1',
+        [userExternalId]
+      );
+      if (selectUserResult.rowCount > 0) {
+        userRow = selectUserResult.rows[0];
+      } else {
+        // user doesn't exist, can't have voted on anything
+        res.sendStatus(204);
+        return;
+      }
+
+      let optionRow;
+      const selectOptionResult = await pg.query(
+        'SELECT id FROM polls.options WHERE external_id=$1',
+        [optionExternalId]
+      );
+      if (selectOptionResult.rowCount > 0) {
+        optionRow = selectOptionResult.rows[0];
+      } else {
+        // option doesn't exist, can't have been voted on
+        res.sendStatus(204);
+        return;
+      }
+
+      let voteRow;
+      const selectVoteResult = await pg.query(
+        'SELECT id FROM polls.votes WHERE user_id=$1 AND option_id=$2',
+        [userRow.id, optionRow.id]
+      );
+      if (selectVoteResult.rowCount > 0) {
+        voteRow = selectVoteResult.rows[0];
+      } else {
+        // vote doesn't exist, no need to remove
+        res.sendStatus(204);
+        return;
+      }
+
+      await pg.query(
+        'DELETE FROM polls.votes WHERE id=$1',
+        [voteRow.id]
+      );
+      res.sendStatus(200);
+    } catch (err) {
+      res.sendStatus(409);
+      console.error(err);
+    }
+  };
+};
diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index 4a0abb3c44..178cd69e2f 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -47,15 +47,24 @@ export default (config = {}) => {
         optionRow = insertOptionResult.rows[0];
       }
 
-      // TODO: This needs to check if the vote already exists, then conditionally do the insert or a delete.
-
-      await pg.query(`
-        INSERT INTO polls.votes (user_id, option_id, occurred_at)
-        VALUES($1, $2, CURRENT_TIMESTAMP)
-        `,
-      [userRow.id, optionRow.id]
+      let voteRow;
+      const selectVoteResult = await pg.query(
+        'SELECT id FROM polls.votes WHERE user_id=$1 AND option_id=$2',
+        [userRow.id, optionRow.id]
       );
-      res.sendStatus(204);
+
+      if (selectVoteResult.rowCount > 0) {
+        // No need to insert new vote, user has already voted for this option
+        // Return 409 error?
+      } else {
+        await pg.query(`
+          INSERT INTO polls.votes (user_id, option_id, occurred_at)
+          VALUES($1, $2, CURRENT_TIMESTAMP)
+          `,
+        [userRow.id, optionRow.id]
+        );
+      }
+      res.sendStatus(200);
     } catch (err) {
       res.sendStatus(409);
       console.error(err);
diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index d80515ce54..51f09770d0 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -10,6 +10,7 @@ export default (config = {}) => {
   return async(req, res) => {
     try {
       if (!pg.enabled) {
+        res.json([]);
         return;
       }
 
@@ -38,6 +39,7 @@ export default (config = {}) => {
       if (votesForOptions.rowCount < 0) {
         // Nobody has voted on anything yet
         res.json([]);
+        return;
       }
 
       res.json(votesForOptions.rows.reduce((memo, row) => {
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
index f324cc6191..82cdaabf39 100644
--- a/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
@@ -12,7 +12,7 @@ const pgPoolQuery = sinon.stub().resolves({
   ]
 });
 
-const reqBody = { optionIDs: ['5Ca2xEt6t10fxqMbvrw9aO', '5Ca2xEt6t10fxqMbvrw9a1', '5Ca2xEt6t10fxqMbvrw9a2'] };
+const reqBody = { optionIDs: ['5Ca2xEt6t10fxqMbvrw9aO', '5Ca2xEt6t10fxqMbvrw9a1', '5Ca2xEt6t10fxqMbvrw9a2'], userExternalId: 'External-UUID' };
 
 const expressReqStub = {
   body: reqBody,
@@ -30,22 +30,29 @@ describe('@/server-middleware/api/polls/votes', () => {
   afterEach(sinon.resetHistory);
   afterAll(sinon.resetBehavior);
 
-  describe('when some of the options have been voted on', () => {
-    const options = { enabled: true };
+  describe('when there is an external user ID', () => {
+    // TODO: mock user SQL request
+    describe('when some of the options have been voted on', () => {
+      const options = { enabled: true };
 
-    it('queries postgres for the votes', async() => {
-      await votesEventsHandler(options)(expressReqStub, expressResStub);
+      it('queries postgres for the votes', async() => {
+        await votesEventsHandler(options)(expressReqStub, expressResStub);
 
-      expect(pgPoolQuery.calledWith(
-        sinon.match((sql) => sql.trim().startsWith('SELECT ')),
-        [['5Ca2xEt6t10fxqMbvrw9aO', '5Ca2xEt6t10fxqMbvrw9a1', '5Ca2xEt6t10fxqMbvrw9a2']]
-      )).toBe(true);
-    });
+        expect(pgPoolQuery.calledWith(
+          sinon.match((sql) => sql.trim().startsWith('SELECT ')),
+          [['5Ca2xEt6t10fxqMbvrw9aO', '5Ca2xEt6t10fxqMbvrw9a1', '5Ca2xEt6t10fxqMbvrw9a2'], 1]
+        )).toBe(true);
+      });
 
-    it('responds with the view count as json', async() => {
-      await votesEventsHandler(options)(expressReqStub, expressResStub);
+      it('responds with the view count as json', async() => {
+        await votesEventsHandler(options)(expressReqStub, expressResStub);
 
-      expect(expressResStub.json.calledWith({ '5Ca2xEt6t10fxqMbvrw9aO': 40 })).toBe(true);
+        expect(expressResStub.json.calledWith({ '5Ca2xEt6t10fxqMbvrw9aO': 40 })).toBe(true);
+      });
     });
   });
+
+  describe('when there is NO external user ID', () => {
+    // TODO: Add tests for anonymous retrieval
+  });
 });

From 1974bb77c282b7444108fdd50dd9dffe966b2b2f Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Mon, 19 Aug 2024 13:05:08 +0200
Subject: [PATCH 09/32] fix specs

---
 .../api/polls/remove-vote.js                  |  4 +-
 .../src/server-middleware/api/polls/vote.js   |  1 -
 .../src/server-middleware/api/polls/votes.js  | 10 +-
 .../api/polls/remove-vote.spec.js             | 96 +++++++++++++++++++
 .../server-middleware/api/polls/vote.spec.js  | 16 +++-
 .../server-middleware/api/polls/votes.spec.js | 39 ++++----
 6 files changed, 137 insertions(+), 29 deletions(-)
 create mode 100644 packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js

diff --git a/packages/portal/src/server-middleware/api/polls/remove-vote.js b/packages/portal/src/server-middleware/api/polls/remove-vote.js
index 7bfdfe1032..b5a7c859ba 100644
--- a/packages/portal/src/server-middleware/api/polls/remove-vote.js
+++ b/packages/portal/src/server-middleware/api/polls/remove-vote.js
@@ -60,9 +60,9 @@ export default (config = {}) => {
         'DELETE FROM polls.votes WHERE id=$1',
         [voteRow.id]
       );
-      res.sendStatus(200);
+      res.sendStatus(204);
     } catch (err) {
-      res.sendStatus(409);
+      res.sendStatus(409); // 409 doesn't make sense here, what should this be?
       console.error(err);
     }
   };
diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index 178cd69e2f..c2aea5a922 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -55,7 +55,6 @@ export default (config = {}) => {
 
       if (selectVoteResult.rowCount > 0) {
         // No need to insert new vote, user has already voted for this option
-        // Return 409 error?
       } else {
         await pg.query(`
           INSERT INTO polls.votes (user_id, option_id, occurred_at)
diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index 51f09770d0..f58d12e847 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -1,9 +1,6 @@
 import pg from '../pg/pg.js';
 
-// TODO: use `next` for error handling
-// TODO: accept multiple uris for the same action
-// TODO: log user agent?
-// TODO: validate action_types
+// TODO: authorisation for current user before retrieving the userId
 export default (config = {}) => {
   pg.config = config;
 
@@ -14,7 +11,7 @@ export default (config = {}) => {
         return;
       }
 
-      const { optionIDs, userExternalId } = req.body;
+      const { optionIds, userExternalId } = req.body;
 
       let userRow = { id: null };
       if (userExternalId) {
@@ -34,8 +31,9 @@ export default (config = {}) => {
         WHERE o.external_id LIKE ANY('{$1}')
         GROUP BY (o.id)
         `,
-      [optionIDs, userRow.id]
+      [optionIds, userRow.id]
       );
+
       if (votesForOptions.rowCount < 0) {
         // Nobody has voted on anything yet
         res.json([]);
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js
new file mode 100644
index 0000000000..3d7b59fc8c
--- /dev/null
+++ b/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js
@@ -0,0 +1,96 @@
+import pg from 'pg';
+import sinon from 'sinon';
+
+import removeVoteEventsHandler from '@/server-middleware/api/polls/remove-vote';
+
+const fixtures = {
+  db: {
+    userId: 1,
+    optionId: 2,
+    voteId: 3
+  },
+  reqBody: {
+    userExternalId: 'keycloak_uuid',
+    optionExternalId: 'contentful_sys_id'
+  }
+};
+
+const pgPoolQuery = sinon.stub();
+pgPoolQuery.withArgs(
+  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.users ')),
+  [fixtures.reqBody.userExternalId]
+).resolves({ rowCount: 1, rows: [{ id: fixtures.db.userId }] });
+
+pgPoolQuery.withArgs(
+  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.options ')),
+  [fixtures.reqBody.optionExternalId]
+).resolves({ rowCount: 1, rows: [{ id: fixtures.db.optionId }] });
+
+pgPoolQuery.withArgs(
+  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.votes ')),
+  [fixtures.db.userId, fixtures.db.optionId]
+).resolves({ rowCount: 1, rows: [{ id: fixtures.db.voteId }] });
+
+pgPoolQuery.withArgs(
+  sinon.match((sql) => sql.startsWith('DELETE FROM polls.votes ')),
+  [fixtures.db.voteId]
+).resolves();
+
+const expressReqStub = {
+  body: fixtures.reqBody,
+  get: sinon.spy()
+};
+
+const expressResStub = {
+  json: sinon.spy(),
+  sendStatus: sinon.spy()
+};
+
+describe('@/server-middleware/api/polls/vote', () => {
+  beforeAll(() => {
+    sinon.replace(pg.Pool.prototype, 'query', pgPoolQuery);
+  });
+  afterEach(sinon.resetHistory);
+  afterAll(sinon.resetBehavior);
+
+  describe('when not explicitly enabled', () => {
+    const options = {};
+
+    it('does not query postgres', async() => {
+      await removeVoteEventsHandler(options)(expressReqStub, expressResStub);
+
+      expect(pgPoolQuery.called).toBe(false);
+    });
+
+    it('responds with 503 status', async() => {
+      await removeVoteEventsHandler(options)(expressReqStub, expressResStub);
+
+      expect(expressResStub.sendStatus.calledWith(503)).toBe(true);
+    });
+  });
+
+  describe('when explicitly enabled', () => {
+    const options = { enabled: true };
+
+    const expressReqStub = {
+      body: fixtures.reqBody,
+      get: sinon.spy()
+    };
+
+    describe('when voting on behalf of a user with a valid session', () => {
+      // TODO: authorisation
+      it('runs all postgres queries to vote on the option', async() => {
+        await removeVoteEventsHandler(options)(expressReqStub, expressResStub);
+
+        expect(pgPoolQuery.getCalls().length).toBe(4);
+      });
+
+      it('responds with 204 status', async() => {
+        await removeVoteEventsHandler(options)(expressReqStub, expressResStub);
+
+        expect(expressResStub.sendStatus.calledWith(204)).toBe(true);
+      });
+    });
+  });
+});
+
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
index 85c5b31a29..2929781e63 100644
--- a/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
@@ -15,6 +15,7 @@ const fixtures = {
 };
 
 const pgPoolQuery = sinon.stub();
+// Stub user queries
 pgPoolQuery.withArgs(
   sinon.match((sql) => sql.startsWith('SELECT id FROM polls.users ')),
   [fixtures.reqBody.userExternalId]
@@ -25,6 +26,8 @@ pgPoolQuery.withArgs(
   [fixtures.reqBody.userExternalId]
 )
   .resolves({ rows: [{ id: fixtures.db.userId }] });
+
+// Stub option queries
 pgPoolQuery.withArgs(
   sinon.match((sql) => sql.startsWith('SELECT id FROM polls.options ')),
   [fixtures.reqBody.optionExternalId]
@@ -35,6 +38,13 @@ pgPoolQuery.withArgs(
   [fixtures.reqBody.optionExternalId]
 )
   .resolves({ rows: [{ id: fixtures.db.optionId }] });
+
+// Stub vote queries
+pgPoolQuery.withArgs(
+  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.votes ')),
+  [fixtures.db.userId, fixtures.db.optionId]
+)
+  .resolves({ rowCount: 0 });
 pgPoolQuery.withArgs(
   sinon.match((sql) => sql.trim().startsWith('INSERT INTO polls.votes ')),
   [fixtures.db.userId, fixtures.db.optionId]
@@ -86,13 +96,13 @@ describe('@/server-middleware/api/polls/vote', () => {
       it('runs all postgres queries to vote on the option', async() => {
         await voteEventsHandler(options)(expressReqStub, expressResStub);
 
-        expect(pgPoolQuery.getCalls().length).toBe(5);
+        expect(pgPoolQuery.getCalls().length).toBe(6);
       });
 
-      it('responds with 204 status', async() => {
+      it('responds with 200 status', async() => {
         await voteEventsHandler(options)(expressReqStub, expressResStub);
 
-        expect(expressResStub.sendStatus.calledWith(204)).toBe(true);
+        expect(expressResStub.sendStatus.calledWith(200)).toBe(true);
       });
     });
   });
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
index 82cdaabf39..fb37a37194 100644
--- a/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
@@ -3,19 +3,29 @@ import sinon from 'sinon';
 
 import votesEventsHandler from '@/server-middleware/api/polls/votes';
 
-const pgPoolQuery = sinon.stub().resolves({
-  rows: [
-    {
-      'id': '5Ca2xEt6t10fxqMbvrw9aO',
-      'count': 40
-    }
-  ]
-});
+const fixtures = {
+  db: {
+    userId: 1
+  },
+  reqBody: {
+    optionIds: ['5Ca2xEt6t10fxqMbvrw9aO', '5Ca2xEt6t10fxqMbvrw9a1', '5Ca2xEt6t10fxqMbvrw9a2'],
+    userExternalId: 'keycloak_uuid'
+  }
+};
 
-const reqBody = { optionIDs: ['5Ca2xEt6t10fxqMbvrw9aO', '5Ca2xEt6t10fxqMbvrw9a1', '5Ca2xEt6t10fxqMbvrw9a2'], userExternalId: 'External-UUID' };
+const pgPoolQuery = sinon.stub();
+pgPoolQuery.withArgs(
+  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.users ')),
+  [fixtures.reqBody.userExternalId]
+).resolves({ rowCount: 1, rows: [{ id: fixtures.db.userId }] });
+
+pgPoolQuery.withArgs(
+  sinon.match((sql) => sql.trim().startsWith('SELECT o.external_id, COUNT(*) AS total, ')),
+  [fixtures.reqBody.optionIds, fixtures.db.userId]
+).resolves({ rowCount: 1, rows: [{ 'id': '5Ca2xEt6t10fxqMbvrw9aO', 'total': 40, votedByCurrentUser: 1 }] });
 
 const expressReqStub = {
-  body: reqBody,
+  body: fixtures.reqBody,
   get: sinon.spy()
 };
 const expressResStub = {
@@ -31,23 +41,18 @@ describe('@/server-middleware/api/polls/votes', () => {
   afterAll(sinon.resetBehavior);
 
   describe('when there is an external user ID', () => {
-    // TODO: mock user SQL request
     describe('when some of the options have been voted on', () => {
       const options = { enabled: true };
 
       it('queries postgres for the votes', async() => {
         await votesEventsHandler(options)(expressReqStub, expressResStub);
 
-        expect(pgPoolQuery.calledWith(
-          sinon.match((sql) => sql.trim().startsWith('SELECT ')),
-          [['5Ca2xEt6t10fxqMbvrw9aO', '5Ca2xEt6t10fxqMbvrw9a1', '5Ca2xEt6t10fxqMbvrw9a2'], 1]
-        )).toBe(true);
+        expect(pgPoolQuery.getCalls().length).toBe(2);
       });
 
       it('responds with the view count as json', async() => {
         await votesEventsHandler(options)(expressReqStub, expressResStub);
-
-        expect(expressResStub.json.calledWith({ '5Ca2xEt6t10fxqMbvrw9aO': 40 })).toBe(true);
+        expect(expressResStub.json.calledWith({ '5Ca2xEt6t10fxqMbvrw9aO': { total: 40, votedByCurrentUser: 1 } })).toBe(true);
       });
     });
   });

From 4519652961efec801b591fa9e65b070c87d5b3d9 Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Mon, 19 Aug 2024 13:15:26 +0200
Subject: [PATCH 10/32] remove unuised voteRow variable

---
 packages/portal/src/server-middleware/api/polls/vote.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index c2aea5a922..8ca1f745cd 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -47,7 +47,6 @@ export default (config = {}) => {
         optionRow = insertOptionResult.rows[0];
       }
 
-      let voteRow;
       const selectVoteResult = await pg.query(
         'SELECT id FROM polls.votes WHERE user_id=$1 AND option_id=$2',
         [userRow.id, optionRow.id]

From 621d4a4655a6fc1d6c6d60ab66d2e3c188c4b165 Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Mon, 19 Aug 2024 15:32:48 +0200
Subject: [PATCH 11/32] update varibles/queries for naming changes

---
 packages/portal/nuxt.config.js                |  2 +-
 .../api/polls/remove-vote.js                  | 34 ++++++------
 .../src/server-middleware/api/polls/vote.js   | 52 +++++++++----------
 .../src/server-middleware/api/polls/votes.js  | 34 ++++++------
 .../api/polls/remove-vote.spec.js             | 26 +++++-----
 .../server-middleware/api/polls/vote.spec.js  | 40 +++++++-------
 .../server-middleware/api/polls/votes.spec.js | 24 ++++-----
 7 files changed, 106 insertions(+), 106 deletions(-)

diff --git a/packages/portal/nuxt.config.js b/packages/portal/nuxt.config.js
index 985f380a8f..981b2b3a6d 100644
--- a/packages/portal/nuxt.config.js
+++ b/packages/portal/nuxt.config.js
@@ -43,7 +43,7 @@ const redisConfig = () => {
 const postgresConfig = () => {
   // see https://node-postgres.com/apis/pool
   const postgresOptions = {
-    enabled: featureIsEnabled('eventLogging'),
+    enabled: featureIsEnabled('eventLogging'), // TODO: Split out option(s) for toggling event Logging and feature voting separately
     connectionString: process.env.POSTGRES_URL,
     connectionTimeoutMillis: Number(process.env.POSTGRES_POOL_CONNECTION_TIMEOUT || 0),
     idleTimeoutMillis: Number(process.env.POSTGRES_POOL_IDLE_TIMEOUT || 10000),
diff --git a/packages/portal/src/server-middleware/api/polls/remove-vote.js b/packages/portal/src/server-middleware/api/polls/remove-vote.js
index b5a7c859ba..47ee4b5482 100644
--- a/packages/portal/src/server-middleware/api/polls/remove-vote.js
+++ b/packages/portal/src/server-middleware/api/polls/remove-vote.js
@@ -11,42 +11,42 @@ export default (config = {}) => {
         return;
       }
 
-      const { userExternalId, optionExternalId } = req.body;
+      const { voterExternalId, candidateExternalId } = req.body;
 
       // if(notAuthorized) {
       //   res.sendStatus(401);
       // }
 
-      let userRow;
-      const selectUserResult = await pg.query(
-        'SELECT id FROM polls.users WHERE external_id=$1',
-        [userExternalId]
+      let voterRow;
+      const selectVoterResult = await pg.query(
+        'SELECT id FROM polls.voters WHERE external_id=$1',
+        [voterExternalId]
       );
-      if (selectUserResult.rowCount > 0) {
-        userRow = selectUserResult.rows[0];
+      if (selectVoterResult.rowCount > 0) {
+        voterRow = selectVoterResult.rows[0];
       } else {
-        // user doesn't exist, can't have voted on anything
+        // voter doesn't exist, can't have voted on anything
         res.sendStatus(204);
         return;
       }
 
-      let optionRow;
-      const selectOptionResult = await pg.query(
-        'SELECT id FROM polls.options WHERE external_id=$1',
-        [optionExternalId]
+      let candidateRow;
+      const selectCandidateResult = await pg.query(
+        'SELECT id FROM polls.candidates WHERE external_id=$1',
+        [candidateExternalId]
       );
-      if (selectOptionResult.rowCount > 0) {
-        optionRow = selectOptionResult.rows[0];
+      if (selectCandidateResult.rowCount > 0) {
+        candidateRow = selectCandidateResult.rows[0];
       } else {
-        // option doesn't exist, can't have been voted on
+        // candidate doesn't exist, can't have been voted on
         res.sendStatus(204);
         return;
       }
 
       let voteRow;
       const selectVoteResult = await pg.query(
-        'SELECT id FROM polls.votes WHERE user_id=$1 AND option_id=$2',
-        [userRow.id, optionRow.id]
+        'SELECT id FROM polls.votes WHERE voter_id=$1 AND candidate_id=$2',
+        [voterRow.id, candidateRow.id]
       );
       if (selectVoteResult.rowCount > 0) {
         voteRow = selectVoteResult.rows[0];
diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index 8ca1f745cd..17cc80b785 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -11,55 +11,55 @@ export default (config = {}) => {
         return;
       }
 
-      const { userExternalId, optionExternalId } = req.body;
+      const { voterExternalId, candidateExternalId } = req.body;
 
       // if(notAuthorized) {
       //   res.sendStatus(401);
       // }
 
-      let userRow;
-      const selectUserResult = await pg.query(
-        'SELECT id FROM polls.users WHERE external_id=$1',
-        [userExternalId]
+      let voterRow;
+      const selectVoterResult = await pg.query(
+        'SELECT id FROM polls.voters WHERE external_id=$1',
+        [voterExternalId]
       );
-      if (selectUserResult.rowCount > 0) {
-        userRow = selectUserResult.rows[0];
+      if (selectVoterResult.rowCount > 0) {
+        voterRow = selectVoterResult.rows[0];
       } else {
-        const insertUserResult = await pg.query(
-          'INSERT INTO polls.users (external_id) VALUES($1) RETURNING id',
-          [userExternalId]
+        const insertVoterResult = await pg.query(
+          'INSERT INTO polls.voters (external_id) VALUES($1) RETURNING id',
+          [voterExternalId]
         );
-        userRow = insertUserResult.rows[0];
+        voterRow = insertVoterResult.rows[0];
       }
 
-      let optionRow;
-      const selectOptionResult = await pg.query(
-        'SELECT id FROM polls.options WHERE external_id=$1',
-        [optionExternalId]
+      let candidateRow;
+      const selectCandidateResult = await pg.query(
+        'SELECT id FROM polls.candidates WHERE external_id=$1',
+        [candidateExternalId]
       );
-      if (selectOptionResult.rowCount > 0) {
-        optionRow = selectOptionResult.rows[0];
+      if (selectCandidateResult.rowCount > 0) {
+        candidateRow = selectCandidateResult.rows[0];
       } else {
-        const insertOptionResult = await pg.query(
-          'INSERT INTO polls.options (external_id) VALUES($1) RETURNING id',
-          [optionExternalId]
+        const insertCandidateResult = await pg.query(
+          'INSERT INTO polls.candidates (external_id) VALUES($1) RETURNING id',
+          [candidateExternalId]
         );
-        optionRow = insertOptionResult.rows[0];
+        candidateRow = insertCandidateResult.rows[0];
       }
 
       const selectVoteResult = await pg.query(
-        'SELECT id FROM polls.votes WHERE user_id=$1 AND option_id=$2',
-        [userRow.id, optionRow.id]
+        'SELECT id FROM polls.votes WHERE voter_id=$1 AND candidate_id=$2',
+        [voterRow.id, candidateRow.id]
       );
 
       if (selectVoteResult.rowCount > 0) {
-        // No need to insert new vote, user has already voted for this option
+        // No need to insert new vote, voter has already voted for this candidate
       } else {
         await pg.query(`
-          INSERT INTO polls.votes (user_id, option_id, occurred_at)
+          INSERT INTO polls.votes (voter_id, candidate_id, occurred_at)
           VALUES($1, $2, CURRENT_TIMESTAMP)
           `,
-        [userRow.id, optionRow.id]
+        [voterRow.id, candidateRow.id]
         );
       }
       res.sendStatus(200);
diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index f58d12e847..bfc578fa08 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -1,6 +1,6 @@
 import pg from '../pg/pg.js';
 
-// TODO: authorisation for current user before retrieving the userId
+// TODO: authorisation for current user before retrieving the voterId
 export default (config = {}) => {
   pg.config = config;
 
@@ -11,39 +11,39 @@ export default (config = {}) => {
         return;
       }
 
-      const { optionIds, userExternalId } = req.body;
+      const { candidateIds, voterExternalId } = req.body;
 
-      let userRow = { id: null };
-      if (userExternalId) {
-        const selectUserResult = await pg.query(
-          'SELECT id FROM polls.users WHERE external_id=$1',
-          [userExternalId]
+      let voterRow = { id: null };
+      if (voterExternalId) {
+        const selectVoterResult = await pg.query(
+          'SELECT id FROM polls.voters WHERE external_id=$1',
+          [voterExternalId]
         );
-        if (selectUserResult.rowCount > 0) {
-          userRow = selectUserResult.rows[0];
+        if (selectVoterResult.rowCount > 0) {
+          voterRow = selectVoterResult.rows[0];
         }
       }
 
-      const votesForOptions = await pg.query(`
-        SELECT o.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE user_id=$2 AND option_id=o.id) AS votedByCurrentUser
-          FROM polls.votes v LEFT JOIN polls.options o
-          ON v.option_id=o.id
+      const votesForCandidates = await pg.query(`
+        SELECT o.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE voter_id=$2 AND candidate_id=o.id) AS votedByCurrentVoter
+          FROM polls.votes v LEFT JOIN polls.candidates o
+          ON v.candidate_id=o.id
         WHERE o.external_id LIKE ANY('{$1}')
         GROUP BY (o.id)
         `,
-      [optionIds, userRow.id]
+      [candidateIds, voterRow.id]
       );
 
-      if (votesForOptions.rowCount < 0) {
+      if (votesForCandidates.rowCount < 0) {
         // Nobody has voted on anything yet
         res.json([]);
         return;
       }
 
-      res.json(votesForOptions.rows.reduce((memo, row) => {
+      res.json(votesForCandidates.rows.reduce((memo, row) => {
         memo[row.id] = {
           total: row.total,
-          votedByCurrentUser: row.votedByCurrentUser
+          votedByCurrentVoter: row.votedByCurrentVoter
         };
         return memo;
       }, {}));
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js
index 3d7b59fc8c..3f7de5818b 100644
--- a/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js
@@ -5,30 +5,30 @@ import removeVoteEventsHandler from '@/server-middleware/api/polls/remove-vote';
 
 const fixtures = {
   db: {
-    userId: 1,
-    optionId: 2,
+    voterId: 1,
+    candidateId: 2,
     voteId: 3
   },
   reqBody: {
-    userExternalId: 'keycloak_uuid',
-    optionExternalId: 'contentful_sys_id'
+    voterExternalId: 'keycloak_uuid',
+    candidateExternalId: 'contentful_sys_id'
   }
 };
 
 const pgPoolQuery = sinon.stub();
 pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.users ')),
-  [fixtures.reqBody.userExternalId]
-).resolves({ rowCount: 1, rows: [{ id: fixtures.db.userId }] });
+  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.voters ')),
+  [fixtures.reqBody.voterExternalId]
+).resolves({ rowCount: 1, rows: [{ id: fixtures.db.voterId }] });
 
 pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.options ')),
-  [fixtures.reqBody.optionExternalId]
-).resolves({ rowCount: 1, rows: [{ id: fixtures.db.optionId }] });
+  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.candidates ')),
+  [fixtures.reqBody.candidateExternalId]
+).resolves({ rowCount: 1, rows: [{ id: fixtures.db.candidateId }] });
 
 pgPoolQuery.withArgs(
   sinon.match((sql) => sql.startsWith('SELECT id FROM polls.votes ')),
-  [fixtures.db.userId, fixtures.db.optionId]
+  [fixtures.db.voterId, fixtures.db.candidateId]
 ).resolves({ rowCount: 1, rows: [{ id: fixtures.db.voteId }] });
 
 pgPoolQuery.withArgs(
@@ -77,9 +77,9 @@ describe('@/server-middleware/api/polls/vote', () => {
       get: sinon.spy()
     };
 
-    describe('when voting on behalf of a user with a valid session', () => {
+    describe('when voting on behalf of a voter with a valid session', () => {
       // TODO: authorisation
-      it('runs all postgres queries to vote on the option', async() => {
+      it('runs all postgres queries to vote on the candidate', async() => {
         await removeVoteEventsHandler(options)(expressReqStub, expressResStub);
 
         expect(pgPoolQuery.getCalls().length).toBe(4);
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
index 2929781e63..df319330c6 100644
--- a/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
@@ -5,49 +5,49 @@ import voteEventsHandler from '@/server-middleware/api/polls/vote';
 
 const fixtures = {
   db: {
-    userId: 2,
-    optionId: 1
+    voterId: 2,
+    candidateId: 1
   },
   reqBody: {
-    userExternalId: 'keycloak_uuid',
-    optionExternalId: 'contentful_sys_id'
+    voterExternalId: 'keycloak_uuid',
+    candidateExternalId: 'contentful_sys_id'
   }
 };
 
 const pgPoolQuery = sinon.stub();
-// Stub user queries
+// Stub voter queries
 pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.users ')),
-  [fixtures.reqBody.userExternalId]
+  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.voters ')),
+  [fixtures.reqBody.voterExternalId]
 )
   .resolves({ rowCount: 0 });
 pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('INSERT INTO polls.users ')),
-  [fixtures.reqBody.userExternalId]
+  sinon.match((sql) => sql.startsWith('INSERT INTO polls.voters ')),
+  [fixtures.reqBody.voterExternalId]
 )
-  .resolves({ rows: [{ id: fixtures.db.userId }] });
+  .resolves({ rows: [{ id: fixtures.db.voterId }] });
 
-// Stub option queries
+// Stub candidate queries
 pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.options ')),
-  [fixtures.reqBody.optionExternalId]
+  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.candidates ')),
+  [fixtures.reqBody.candidateExternalId]
 )
   .resolves({ rowCount: 0 });
 pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('INSERT INTO polls.options ')),
-  [fixtures.reqBody.optionExternalId]
+  sinon.match((sql) => sql.startsWith('INSERT INTO polls.candidates ')),
+  [fixtures.reqBody.candidateExternalId]
 )
-  .resolves({ rows: [{ id: fixtures.db.optionId }] });
+  .resolves({ rows: [{ id: fixtures.db.candidateId }] });
 
 // Stub vote queries
 pgPoolQuery.withArgs(
   sinon.match((sql) => sql.startsWith('SELECT id FROM polls.votes ')),
-  [fixtures.db.userId, fixtures.db.optionId]
+  [fixtures.db.voterId, fixtures.db.candidateId]
 )
   .resolves({ rowCount: 0 });
 pgPoolQuery.withArgs(
   sinon.match((sql) => sql.trim().startsWith('INSERT INTO polls.votes ')),
-  [fixtures.db.userId, fixtures.db.optionId]
+  [fixtures.db.voterId, fixtures.db.candidateId]
 )
   .resolves({});
 
@@ -91,9 +91,9 @@ describe('@/server-middleware/api/polls/vote', () => {
       get: sinon.spy()
     };
 
-    describe('when for voting on behalf of a user with a valid session', () => {
+    describe('when for voting on behalf of a voter with a valid session', () => {
       // TODO: authorisation
-      it('runs all postgres queries to vote on the option', async() => {
+      it('runs all postgres queries to vote on the candidate', async() => {
         await voteEventsHandler(options)(expressReqStub, expressResStub);
 
         expect(pgPoolQuery.getCalls().length).toBe(6);
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
index fb37a37194..f7d8bf7462 100644
--- a/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
@@ -5,24 +5,24 @@ import votesEventsHandler from '@/server-middleware/api/polls/votes';
 
 const fixtures = {
   db: {
-    userId: 1
+    voterId: 1
   },
   reqBody: {
-    optionIds: ['5Ca2xEt6t10fxqMbvrw9aO', '5Ca2xEt6t10fxqMbvrw9a1', '5Ca2xEt6t10fxqMbvrw9a2'],
-    userExternalId: 'keycloak_uuid'
+    candidateIds: ['5Ca2xEt6t10fxqMbvrw9aO', '5Ca2xEt6t10fxqMbvrw9a1', '5Ca2xEt6t10fxqMbvrw9a2'],
+    voterExternalId: 'keycloak_uuid'
   }
 };
 
 const pgPoolQuery = sinon.stub();
 pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.users ')),
-  [fixtures.reqBody.userExternalId]
-).resolves({ rowCount: 1, rows: [{ id: fixtures.db.userId }] });
+  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.voters ')),
+  [fixtures.reqBody.voterExternalId]
+).resolves({ rowCount: 1, rows: [{ id: fixtures.db.voterId }] });
 
 pgPoolQuery.withArgs(
   sinon.match((sql) => sql.trim().startsWith('SELECT o.external_id, COUNT(*) AS total, ')),
-  [fixtures.reqBody.optionIds, fixtures.db.userId]
-).resolves({ rowCount: 1, rows: [{ 'id': '5Ca2xEt6t10fxqMbvrw9aO', 'total': 40, votedByCurrentUser: 1 }] });
+  [fixtures.reqBody.candidateIds, fixtures.db.voterId]
+).resolves({ rowCount: 1, rows: [{ 'id': '5Ca2xEt6t10fxqMbvrw9aO', 'total': 40, votedByCurrentVoter: 1 }] });
 
 const expressReqStub = {
   body: fixtures.reqBody,
@@ -40,8 +40,8 @@ describe('@/server-middleware/api/polls/votes', () => {
   afterEach(sinon.resetHistory);
   afterAll(sinon.resetBehavior);
 
-  describe('when there is an external user ID', () => {
-    describe('when some of the options have been voted on', () => {
+  describe('when there is an external voter ID', () => {
+    describe('when some of the candidates have been voted on', () => {
       const options = { enabled: true };
 
       it('queries postgres for the votes', async() => {
@@ -52,12 +52,12 @@ describe('@/server-middleware/api/polls/votes', () => {
 
       it('responds with the view count as json', async() => {
         await votesEventsHandler(options)(expressReqStub, expressResStub);
-        expect(expressResStub.json.calledWith({ '5Ca2xEt6t10fxqMbvrw9aO': { total: 40, votedByCurrentUser: 1 } })).toBe(true);
+        expect(expressResStub.json.calledWith({ '5Ca2xEt6t10fxqMbvrw9aO': { total: 40, votedByCurrentVoter: 1 } })).toBe(true);
       });
     });
   });
 
-  describe('when there is NO external user ID', () => {
+  describe('when there is NO external voter ID', () => {
     // TODO: Add tests for anonymous retrieval
   });
 });

From e1017ccb5a9a8df0eaffe58d1677ff2e433f4274 Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Tue, 20 Aug 2024 13:53:14 +0200
Subject: [PATCH 12/32] use feature toggle for enabling postgres

---
 packages/portal/nuxt.config.js                     | 2 +-
 packages/portal/src/server-middleware/api/index.js | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/portal/nuxt.config.js b/packages/portal/nuxt.config.js
index 981b2b3a6d..574aa0d051 100644
--- a/packages/portal/nuxt.config.js
+++ b/packages/portal/nuxt.config.js
@@ -43,7 +43,7 @@ const redisConfig = () => {
 const postgresConfig = () => {
   // see https://node-postgres.com/apis/pool
   const postgresOptions = {
-    enabled: featureIsEnabled('eventLogging'), // TODO: Split out option(s) for toggling event Logging and feature voting separately
+    enabled: featureIsEnabled('eventLogging') || featureIsEnabled('featureIdeas'),
     connectionString: process.env.POSTGRES_URL,
     connectionTimeoutMillis: Number(process.env.POSTGRES_POOL_CONNECTION_TIMEOUT || 0),
     idleTimeoutMillis: Number(process.env.POSTGRES_POOL_IDLE_TIMEOUT || 10000),
diff --git a/packages/portal/src/server-middleware/api/index.js b/packages/portal/src/server-middleware/api/index.js
index 414ab61c00..dc605cb605 100644
--- a/packages/portal/src/server-middleware/api/index.js
+++ b/packages/portal/src/server-middleware/api/index.js
@@ -60,11 +60,11 @@ import version from './version.js';
 app.get('/version', version);
 
 import votes from './polls/votes.js';
-app.get('/votes', votes);
+app.get('/votes', votes(runtimeConfig.postgres));
 import vote from './polls/vote.js';
-app.post('/vote', vote);
+app.post('/vote', vote(runtimeConfig.postgres));
 import removeVote from './polls/removeVote.js';
-app.delete('/vote', removeVote);
+app.delete('/vote', removeVote(runtimeConfig.postgres));
 
 app.all('/*', (req, res) => res.sendStatus(404));
 

From e8f7c13eaf7f1c06d315b6ef53393ebc5a3f48de Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Tue, 20 Aug 2024 13:38:33 +0100
Subject: [PATCH 13/32] fix: correct import of remove vote module

---
 packages/portal/src/server-middleware/api/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/portal/src/server-middleware/api/index.js b/packages/portal/src/server-middleware/api/index.js
index dc605cb605..91e48c6782 100644
--- a/packages/portal/src/server-middleware/api/index.js
+++ b/packages/portal/src/server-middleware/api/index.js
@@ -63,7 +63,7 @@ import votes from './polls/votes.js';
 app.get('/votes', votes(runtimeConfig.postgres));
 import vote from './polls/vote.js';
 app.post('/vote', vote(runtimeConfig.postgres));
-import removeVote from './polls/removeVote.js';
+import removeVote from './polls/remove-vote.js';
 app.delete('/vote', removeVote(runtimeConfig.postgres));
 
 app.all('/*', (req, res) => res.sendStatus(404));

From 6f5ddb36ead7484e88fd9d63fdfde340319f0cb8 Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Tue, 20 Aug 2024 15:01:33 +0200
Subject: [PATCH 14/32] use params in /votes request

---
 .../src/server-middleware/api/polls/votes.js   | 15 ++++++++-------
 .../api/polls/remove-vote.spec.js              |  2 +-
 .../server-middleware/api/polls/vote.spec.js   |  2 +-
 .../server-middleware/api/polls/votes.spec.js  | 18 +++++++++---------
 4 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index bfc578fa08..39c36d431f 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -11,7 +11,8 @@ export default (config = {}) => {
         return;
       }
 
-      const { candidateIds, voterExternalId } = req.body;
+      const candidateExternalIds = req.query?.candidate || [];
+      const voterExternalId  = req.query?.voter;
 
       let voterRow = { id: null };
       if (voterExternalId) {
@@ -25,13 +26,13 @@ export default (config = {}) => {
       }
 
       const votesForCandidates = await pg.query(`
-        SELECT o.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE voter_id=$2 AND candidate_id=o.id) AS votedByCurrentVoter
-          FROM polls.votes v LEFT JOIN polls.candidates o
-          ON v.candidate_id=o.id
-        WHERE o.external_id LIKE ANY('{$1}')
-        GROUP BY (o.id)
+        SELECT c.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE voter_id=$2 AND candidate_id=c.id) AS votedByCurrentVoter
+          FROM polls.votes v LEFT JOIN polls.candidates c
+          ON v.candidate_id=c.id
+        WHERE c.external_id LIKE ANY('{$1}')
+        GROUP BY (c.id)
         `,
-      [candidateIds, voterRow.id]
+      [candidateExternalIds, voterRow.id]
       );
 
       if (votesForCandidates.rowCount < 0) {
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js
index 3f7de5818b..f1324ce4c7 100644
--- a/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js
@@ -11,7 +11,7 @@ const fixtures = {
   },
   reqBody: {
     voterExternalId: 'keycloak_uuid',
-    candidateExternalId: 'contentful_sys_id'
+    candidateExternalId: 'contentful_id'
   }
 };
 
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
index df319330c6..7b346f917e 100644
--- a/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
@@ -10,7 +10,7 @@ const fixtures = {
   },
   reqBody: {
     voterExternalId: 'keycloak_uuid',
-    candidateExternalId: 'contentful_sys_id'
+    candidateExternalId: 'contentful_id'
   }
 };
 
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
index f7d8bf7462..b6de260580 100644
--- a/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
@@ -7,25 +7,25 @@ const fixtures = {
   db: {
     voterId: 1
   },
-  reqBody: {
-    candidateIds: ['5Ca2xEt6t10fxqMbvrw9aO', '5Ca2xEt6t10fxqMbvrw9a1', '5Ca2xEt6t10fxqMbvrw9a2'],
-    voterExternalId: 'keycloak_uuid'
+  reqQuery: {
+    candidate: ['feature-id-one', 'feature-id-two', 'feature-id-three'],
+    voter: 'keycloak_uuid'
   }
 };
 
 const pgPoolQuery = sinon.stub();
 pgPoolQuery.withArgs(
   sinon.match((sql) => sql.startsWith('SELECT id FROM polls.voters ')),
-  [fixtures.reqBody.voterExternalId]
+  [fixtures.reqQuery.voter]
 ).resolves({ rowCount: 1, rows: [{ id: fixtures.db.voterId }] });
 
 pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.trim().startsWith('SELECT o.external_id, COUNT(*) AS total, ')),
-  [fixtures.reqBody.candidateIds, fixtures.db.voterId]
-).resolves({ rowCount: 1, rows: [{ 'id': '5Ca2xEt6t10fxqMbvrw9aO', 'total': 40, votedByCurrentVoter: 1 }] });
+  sinon.match((sql) => sql.trim().startsWith('SELECT c.external_id, COUNT(*) AS total, ')),
+  [fixtures.reqQuery.candidate, fixtures.db.voterId]
+).resolves({ rowCount: 1, rows: [{ 'id': 'feature-id-one', 'total': 40, votedByCurrentVoter: 1 }] });
 
 const expressReqStub = {
-  body: fixtures.reqBody,
+  query: fixtures.reqQuery,
   get: sinon.spy()
 };
 const expressResStub = {
@@ -52,7 +52,7 @@ describe('@/server-middleware/api/polls/votes', () => {
 
       it('responds with the view count as json', async() => {
         await votesEventsHandler(options)(expressReqStub, expressResStub);
-        expect(expressResStub.json.calledWith({ '5Ca2xEt6t10fxqMbvrw9aO': { total: 40, votedByCurrentVoter: 1 } })).toBe(true);
+        expect(expressResStub.json.calledWith({ 'feature-id-one': { total: 40, votedByCurrentVoter: 1 } })).toBe(true);
       });
     });
   });

From 2b5c87aa62ae5392b1df506f6f08d6380d9250c5 Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Tue, 20 Aug 2024 14:25:23 +0100
Subject: [PATCH 15/32] fix: split candidate query param

---
 packages/portal/src/server-middleware/api/polls/votes.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index 39c36d431f..f64abda97f 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -11,7 +11,7 @@ export default (config = {}) => {
         return;
       }
 
-      const candidateExternalIds = req.query?.candidate || [];
+      const candidateExternalIds = req.query?.candidate?.split(',') || [];
       const voterExternalId  = req.query?.voter;
 
       let voterRow = { id: null };
@@ -29,7 +29,7 @@ export default (config = {}) => {
         SELECT c.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE voter_id=$2 AND candidate_id=c.id) AS votedByCurrentVoter
           FROM polls.votes v LEFT JOIN polls.candidates c
           ON v.candidate_id=c.id
-        WHERE c.external_id LIKE ANY('{$1}')
+        WHERE c.external_id LIKE ANY($1)
         GROUP BY (c.id)
         `,
       [candidateExternalIds, voterRow.id]
@@ -50,6 +50,7 @@ export default (config = {}) => {
       }, {}));
     } catch (err) {
       console.error(err);
+      res.sendStatus(500);
     }
   };
 };

From 2eef9a951be09e42c7ef30355bd466d18e0f5384 Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Tue, 20 Aug 2024 14:49:31 +0100
Subject: [PATCH 16/32] feat: hook feature ideas component up to API

---
 .../src/components/generic/FeatureIdeas.vue   | 34 +++++++++----------
 .../api/polls/remove-vote.js                  |  3 +-
 .../src/server-middleware/api/polls/vote.js   |  3 +-
 .../src/server-middleware/api/polls/votes.js  |  6 ++--
 4 files changed, 24 insertions(+), 22 deletions(-)

diff --git a/packages/portal/src/components/generic/FeatureIdeas.vue b/packages/portal/src/components/generic/FeatureIdeas.vue
index 945797e03b..24fb6a8859 100644
--- a/packages/portal/src/components/generic/FeatureIdeas.vue
+++ b/packages/portal/src/components/generic/FeatureIdeas.vue
@@ -43,6 +43,7 @@
 </template>
 
 <script>
+  import axios from 'axios';
   import keycloakMixin from '@/mixins/keycloak';
   import ContentCard from '@/components/content/ContentCard';
 
@@ -69,20 +70,18 @@
       };
     },
 
-    fetch() {
+    async fetch() {
       if (this.features.length < 1) {
         const error = new Error('No feature ideas');
         error.code = 'noFeatureIdeas';
         this.$error(error);
       }
 
-      // TODO: fetch the votes for each feature and remove mock functionality
-      // const featureIds = this.features.map((feature) => feature.sys.id).join(',');
-      // this.votesOnFeatures = await this.$axios.$get(`/api/votes/${featureIds}`);
-      for (const feature of this.features) {
-        const featureVotes = { count: Math.floor(Math.random() * 99), currentlyVotedOn: false };
-        this.votesOnFeatures[feature.sys.id] = featureVotes;
-      }
+      const featureIds = this.features.map((feature) => feature.sys.id).join(',');
+      const votesResponse = await axios.create({
+        baseURL: this.$config.app.baseUrl
+      }).get('/_api/votes', { params: { candidate: featureIds, voter: this.userId } });
+      this.votesOnFeatures = votesResponse.data;
     },
 
     computed: {
@@ -92,27 +91,28 @@
     },
 
     methods: {
-      voteOnFeature(featureId) {
-        // TODO: Implement voting on feature and remove mock functionality
-        // await this.$axios.$post(`/api/vote/${featureId}`);
+      async voteOnFeature(featureId) {
         console.log('Voting on feature', featureId);
         if (this.$auth.loggedIn) {
           if (this.hasVotedOnFeature(featureId)) {
-            this.votesOnFeatures[featureId].count = (this.votesOnFeatures[featureId]?.count || 0) - 1;
-            this.votesOnFeatures[featureId].currentlyVotedOn = false;
+            await axios.create({
+              baseURL: this.$config.app.baseUrl
+            }).delete('/_api/vote', { data: { candidate: featureId, voter: this.userId } });
           } else {
-            this.votesOnFeatures[featureId].count = (this.votesOnFeatures[featureId]?.count || 0) + 1;
-            this.votesOnFeatures[featureId].currentlyVotedOn = true;
+            await axios.create({
+              baseURL: this.$config.app.baseUrl
+            }).post('/_api/vote', { candidate: featureId, voter: this.userId });
           }
+          this.$fetch();
         } else {
           this.keycloakLogin();
         }
       },
       voteCountOnFeature(featureId) {
-        return this.votesOnFeatures[featureId]?.count;
+        return this.votesOnFeatures[featureId]?.total || 0;
       },
       hasVotedOnFeature(featureId) {
-        return this.votesOnFeatures[featureId]?.currentlyVotedOn;
+        return this.votesOnFeatures[featureId]?.votedByCurrentVoter;
       }
     }
   };
diff --git a/packages/portal/src/server-middleware/api/polls/remove-vote.js b/packages/portal/src/server-middleware/api/polls/remove-vote.js
index 47ee4b5482..d189d56fdb 100644
--- a/packages/portal/src/server-middleware/api/polls/remove-vote.js
+++ b/packages/portal/src/server-middleware/api/polls/remove-vote.js
@@ -11,7 +11,8 @@ export default (config = {}) => {
         return;
       }
 
-      const { voterExternalId, candidateExternalId } = req.body;
+      const candidateExternalId = req.body?.candidate;
+      const voterExternalId = req.body?.voter;
 
       // if(notAuthorized) {
       //   res.sendStatus(401);
diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index 17cc80b785..ec615950b2 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -11,7 +11,8 @@ export default (config = {}) => {
         return;
       }
 
-      const { voterExternalId, candidateExternalId } = req.body;
+      const candidateExternalId = req.body?.candidate;
+      const voterExternalId = req.body?.voter;
 
       // if(notAuthorized) {
       //   res.sendStatus(401);
diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index f64abda97f..bd85a6ec33 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -26,7 +26,7 @@ export default (config = {}) => {
       }
 
       const votesForCandidates = await pg.query(`
-        SELECT c.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE voter_id=$2 AND candidate_id=c.id) AS votedByCurrentVoter
+        SELECT c.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE voter_id=$2 AND candidate_id=c.id) AS voted_by_current_voter
           FROM polls.votes v LEFT JOIN polls.candidates c
           ON v.candidate_id=c.id
         WHERE c.external_id LIKE ANY($1)
@@ -42,9 +42,9 @@ export default (config = {}) => {
       }
 
       res.json(votesForCandidates.rows.reduce((memo, row) => {
-        memo[row.id] = {
+        memo[row.external_id] = {
           total: row.total,
-          votedByCurrentVoter: row.votedByCurrentVoter
+          votedByCurrentVoter: row.voted_by_current_voter
         };
         return memo;
       }, {}));

From a8dac161eb830937b93bd5c3356e089c6ddda02b Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Wed, 21 Aug 2024 08:45:28 +0100
Subject: [PATCH 17/32] feat: authorize voting via keycloak

---
 .../src/components/generic/FeatureIdeas.vue   | 46 ++++++++++++-------
 .../portal/src/server-middleware/api/index.js |  7 +--
 .../api/polls/remove-vote.js                  | 16 ++++++-
 .../src/server-middleware/api/polls/vote.js   | 16 ++++++-
 .../src/server-middleware/api/polls/votes.js  | 23 ++++++++--
 .../portal/src/server-middleware/api/utils.js | 11 +++++
 6 files changed, 91 insertions(+), 28 deletions(-)

diff --git a/packages/portal/src/components/generic/FeatureIdeas.vue b/packages/portal/src/components/generic/FeatureIdeas.vue
index 24fb6a8859..277452208c 100644
--- a/packages/portal/src/components/generic/FeatureIdeas.vue
+++ b/packages/portal/src/components/generic/FeatureIdeas.vue
@@ -24,6 +24,7 @@
       >
         <template #footer>
           <b-button
+            v-show="!$fetchState.pending"
             class="vote-button d-inline-flex align-items-center text-uppercase mt-auto mr-auto"
             :class="{ voted: hasVotedOnFeature(feature.sys.id) }"
             variant="light-flat"
@@ -70,6 +71,7 @@
       };
     },
 
+    // TODO: prevent flickering from "0 votes" to "x votes"
     async fetch() {
       if (this.features.length < 1) {
         const error = new Error('No feature ideas');
@@ -77,16 +79,25 @@
         this.$error(error);
       }
 
-      const featureIds = this.features.map((feature) => feature.sys.id).join(',');
-      const votesResponse = await axios.create({
-        baseURL: this.$config.app.baseUrl
-      }).get('/_api/votes', { params: { candidate: featureIds, voter: this.userId } });
+      const headers = { authorization: this.accessToken };
+      const params = { candidate: this.features.map((feature) => feature.sys.id).join(',') };
+      const votesResponse = await axios({
+        baseURL: this.$config.app.baseUrl,
+        url: '/_api/votes',
+        method: 'get',
+        headers,
+        params
+      });
+
       this.votesOnFeatures = votesResponse.data;
     },
 
+    // client-side only for oAuth authorization
+    fetchOnServer: false,
+
     computed: {
-      userId() {
-        return this.$auth.user?.sub;
+      accessToken() {
+        return this.$auth.getToken(this.$auth.strategy?.name) || null;
       }
     },
 
@@ -94,15 +105,18 @@
       async voteOnFeature(featureId) {
         console.log('Voting on feature', featureId);
         if (this.$auth.loggedIn) {
-          if (this.hasVotedOnFeature(featureId)) {
-            await axios.create({
-              baseURL: this.$config.app.baseUrl
-            }).delete('/_api/vote', { data: { candidate: featureId, voter: this.userId } });
-          } else {
-            await axios.create({
-              baseURL: this.$config.app.baseUrl
-            }).post('/_api/vote', { candidate: featureId, voter: this.userId });
-          }
+          const method = this.hasVotedOnFeature(featureId) ? 'delete' : 'post';
+          const data = { candidate: featureId };
+          const headers = { authorization: this.accessToken };
+
+          await axios({
+            baseURL: this.$config.app.baseUrl,
+            url: '/_api/vote',
+            method,
+            data,
+            headers
+          });
+
           this.$fetch();
         } else {
           this.keycloakLogin();
@@ -112,7 +126,7 @@
         return this.votesOnFeatures[featureId]?.total || 0;
       },
       hasVotedOnFeature(featureId) {
-        return this.votesOnFeatures[featureId]?.votedByCurrentVoter;
+        return this.votesOnFeatures[featureId]?.votedByCurrentVoter || false;
       }
     }
   };
diff --git a/packages/portal/src/server-middleware/api/index.js b/packages/portal/src/server-middleware/api/index.js
index 91e48c6782..8785fbd7f7 100644
--- a/packages/portal/src/server-middleware/api/index.js
+++ b/packages/portal/src/server-middleware/api/index.js
@@ -59,12 +59,13 @@ app.post('/jira-service-desk/galleries', jiraServiceDeskGalleries(runtimeConfig.
 import version from './version.js';
 app.get('/version', version);
 
+const pollsConfig = { auth: runtimeConfig.auth, postgres: runtimeConfig.postgres };
 import votes from './polls/votes.js';
-app.get('/votes', votes(runtimeConfig.postgres));
+app.get('/votes', votes(pollsConfig));
 import vote from './polls/vote.js';
-app.post('/vote', vote(runtimeConfig.postgres));
+app.post('/vote', vote(pollsConfig));
 import removeVote from './polls/remove-vote.js';
-app.delete('/vote', removeVote(runtimeConfig.postgres));
+app.delete('/vote', removeVote(pollsConfig));
 
 app.all('/*', (req, res) => res.sendStatus(404));
 
diff --git a/packages/portal/src/server-middleware/api/polls/remove-vote.js b/packages/portal/src/server-middleware/api/polls/remove-vote.js
index d189d56fdb..a15fdef602 100644
--- a/packages/portal/src/server-middleware/api/polls/remove-vote.js
+++ b/packages/portal/src/server-middleware/api/polls/remove-vote.js
@@ -1,8 +1,9 @@
 import pg from '../pg/pg.js';
+import { keycloakUserinfo } from '../utils.js';
 
 // TODO: validate user login
 export default (config = {}) => {
-  pg.config = config;
+  pg.config = config.postgres;
 
   return async(req, res) => {
     try {
@@ -11,8 +12,19 @@ export default (config = {}) => {
         return;
       }
 
+      let voterExternalId = null;
+      if (req.headers.authorization) {
+        try {
+          const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
+          voterExternalId = userinfo?.sub || null;
+        } catch (err) {
+          console.error('keycloak error', err);
+          // TODO: handle
+          res.sendStatus(500);
+        }
+      }
+
       const candidateExternalId = req.body?.candidate;
-      const voterExternalId = req.body?.voter;
 
       // if(notAuthorized) {
       //   res.sendStatus(401);
diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index ec615950b2..d22980a5c6 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -1,8 +1,9 @@
 import pg from '../pg/pg.js';
+import { keycloakUserinfo } from '../utils.js';
 
 // TODO: validate user login
 export default (config = {}) => {
-  pg.config = config;
+  pg.config = config.postgres;
 
   return async(req, res) => {
     try {
@@ -11,8 +12,19 @@ export default (config = {}) => {
         return;
       }
 
+      let voterExternalId = null;
+      if (req.headers.authorization) {
+        try {
+          const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
+          voterExternalId = userinfo?.sub || null;
+        } catch (err) {
+          console.error('keycloak error', err);
+          // TODO: handle
+          res.sendStatus(500);
+        }
+      }
+
       const candidateExternalId = req.body?.candidate;
-      const voterExternalId = req.body?.voter;
 
       // if(notAuthorized) {
       //   res.sendStatus(401);
diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index bd85a6ec33..1dab732fa9 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -1,8 +1,9 @@
 import pg from '../pg/pg.js';
+import { keycloakUserinfo } from '../utils.js';
 
 // TODO: authorisation for current user before retrieving the voterId
 export default (config = {}) => {
-  pg.config = config;
+  pg.config = config.postgres;
 
   return async(req, res) => {
     try {
@@ -11,8 +12,19 @@ export default (config = {}) => {
         return;
       }
 
+      let voterExternalId = null;
+      if (req.headers.authorization) {
+        try {
+          const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
+          voterExternalId = userinfo?.sub || null;
+        } catch (err) {
+          console.error('keycloak error', err);
+          // TODO: handle
+          res.sendStatus(500);
+        }
+      }
+
       const candidateExternalIds = req.query?.candidate?.split(',') || [];
-      const voterExternalId  = req.query?.voter;
 
       let voterRow = { id: null };
       if (voterExternalId) {
@@ -29,8 +41,8 @@ export default (config = {}) => {
         SELECT c.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE voter_id=$2 AND candidate_id=c.id) AS voted_by_current_voter
           FROM polls.votes v LEFT JOIN polls.candidates c
           ON v.candidate_id=c.id
-        WHERE c.external_id LIKE ANY($1)
-        GROUP BY (c.id)
+          WHERE c.external_id LIKE ANY($1)
+          GROUP BY (c.id)
         `,
       [candidateExternalIds, voterRow.id]
       );
@@ -42,9 +54,10 @@ export default (config = {}) => {
       }
 
       res.json(votesForCandidates.rows.reduce((memo, row) => {
+        console.log('votesForCandidates row', row);
         memo[row.external_id] = {
           total: row.total,
-          votedByCurrentVoter: row.voted_by_current_voter
+          votedByCurrentVoter: row.voted_by_current_voter === '1'
         };
         return memo;
       }, {}));
diff --git a/packages/portal/src/server-middleware/api/utils.js b/packages/portal/src/server-middleware/api/utils.js
index 3ecf9d0bc3..6a9c859cb4 100644
--- a/packages/portal/src/server-middleware/api/utils.js
+++ b/packages/portal/src/server-middleware/api/utils.js
@@ -1,3 +1,4 @@
+import axios from 'axios';
 import defu  from 'defu';
 import createHttpError from 'http-errors';
 
@@ -35,3 +36,13 @@ export const forbiddenUnlessOriginAllowed = (origins) => (origin, callback) => {
     callback(createHttpError(403, 'Origin not permitted'));
   }
 };
+
+export const keycloakUserinfo = async(req, config) => {
+  const keycloakUserinfoResponse = await axios({
+    baseURL: config.origin,
+    url: `/auth/realms/${config.realm}/protocol/openid-connect/userinfo`,
+    method: 'get',
+    headers: { authorization: req.headers.authorization }
+  });
+  return keycloakUserinfoResponse.data;
+};

From 57e6f31962be02cc552dbe9046b2e4816ee80ff3 Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Wed, 21 Aug 2024 10:37:21 +0100
Subject: [PATCH 18/32] fix: don't send empty auth header

---
 .../src/components/generic/FeatureIdeas.vue     | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/packages/portal/src/components/generic/FeatureIdeas.vue b/packages/portal/src/components/generic/FeatureIdeas.vue
index 277452208c..96ee8b3c6f 100644
--- a/packages/portal/src/components/generic/FeatureIdeas.vue
+++ b/packages/portal/src/components/generic/FeatureIdeas.vue
@@ -79,13 +79,12 @@
         this.$error(error);
       }
 
-      const headers = { authorization: this.accessToken };
       const params = { candidate: this.features.map((feature) => feature.sys.id).join(',') };
       const votesResponse = await axios({
         baseURL: this.$config.app.baseUrl,
         url: '/_api/votes',
         method: 'get',
-        headers,
+        headers: this.headersForAuthorization,
         params
       });
 
@@ -96,25 +95,29 @@
     fetchOnServer: false,
 
     computed: {
-      accessToken() {
-        return this.$auth.getToken(this.$auth.strategy?.name) || null;
+      headersForAuthorization() {
+        if (this.$auth.loggedIn) {
+          return {
+            authorization: this.$auth.getToken(this.$auth.strategy?.name)
+          };
+        } else {
+          return {};
+        }
       }
     },
 
     methods: {
       async voteOnFeature(featureId) {
-        console.log('Voting on feature', featureId);
         if (this.$auth.loggedIn) {
           const method = this.hasVotedOnFeature(featureId) ? 'delete' : 'post';
           const data = { candidate: featureId };
-          const headers = { authorization: this.accessToken };
 
           await axios({
             baseURL: this.$config.app.baseUrl,
             url: '/_api/vote',
             method,
             data,
-            headers
+            headers: this.headersForAuthorization
           });
 
           this.$fetch();

From 41265f3e3472b57bf23415c3cda5f7d55eb1e673 Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Wed, 21 Aug 2024 13:17:25 +0100
Subject: [PATCH 19/32] feat: use keycloak error response handler in voting

---
 .../src/components/generic/FeatureIdeas.vue   | 27 +++++++++++--------
 packages/portal/src/i18n/lang/en.js           |  3 ++-
 packages/portal/src/plugins/europeana/auth.js |  5 ++++
 .../api/polls/remove-vote.js                  | 13 +++------
 .../src/server-middleware/api/polls/vote.js   | 13 +++------
 .../src/server-middleware/api/polls/votes.js  | 13 +++------
 6 files changed, 35 insertions(+), 39 deletions(-)

diff --git a/packages/portal/src/components/generic/FeatureIdeas.vue b/packages/portal/src/components/generic/FeatureIdeas.vue
index 96ee8b3c6f..09d6f14cd4 100644
--- a/packages/portal/src/components/generic/FeatureIdeas.vue
+++ b/packages/portal/src/components/generic/FeatureIdeas.vue
@@ -46,6 +46,7 @@
 <script>
   import axios from 'axios';
   import keycloakMixin from '@/mixins/keycloak';
+  import { keycloakResponseErrorHandler } from '@/plugins/europeana/auth';
   import ContentCard from '@/components/content/ContentCard';
 
   export default {
@@ -67,12 +68,21 @@
 
     data() {
       return {
+        axiosInstance: null,
         votesOnFeatures: {}
       };
     },
 
     // TODO: prevent flickering from "0 votes" to "x votes"
     async fetch() {
+      this.axiosInstance = axios.create({
+        baseURL: this.$config.app.baseUrl
+      });
+      this.axiosInstance.interceptors.response.use(
+        (response) => response,
+        (error) => keycloakResponseErrorHandler(this.$nuxt.context, error)
+      );
+
       if (this.features.length < 1) {
         const error = new Error('No feature ideas');
         error.code = 'noFeatureIdeas';
@@ -80,11 +90,10 @@
       }
 
       const params = { candidate: this.features.map((feature) => feature.sys.id).join(',') };
-      const votesResponse = await axios({
-        baseURL: this.$config.app.baseUrl,
+      const votesResponse = await this.axiosInstance({
         url: '/_api/votes',
         method: 'get',
-        headers: this.headersForAuthorization,
+        headers: this.headersForAuthorization(),
         params
       });
 
@@ -94,7 +103,7 @@
     // client-side only for oAuth authorization
     fetchOnServer: false,
 
-    computed: {
+    methods: {
       headersForAuthorization() {
         if (this.$auth.loggedIn) {
           return {
@@ -103,21 +112,17 @@
         } else {
           return {};
         }
-      }
-    },
-
-    methods: {
+      },
       async voteOnFeature(featureId) {
         if (this.$auth.loggedIn) {
           const method = this.hasVotedOnFeature(featureId) ? 'delete' : 'post';
           const data = { candidate: featureId };
 
-          await axios({
-            baseURL: this.$config.app.baseUrl,
+          await this.axiosInstance({
             url: '/_api/vote',
             method,
             data,
-            headers: this.headersForAuthorization
+            headers: this.headersForAuthorization()
           });
 
           this.$fetch();
diff --git a/packages/portal/src/i18n/lang/en.js b/packages/portal/src/i18n/lang/en.js
index ded41d97d5..8895cb5fa8 100644
--- a/packages/portal/src/i18n/lang/en.js
+++ b/packages/portal/src/i18n/lang/en.js
@@ -76,7 +76,8 @@ export default {
     "transcribeNow": "Transcribe now",
     "unlike": "Unlike",
     "viewAt": "View at {link}",
-    "viewDocument": "View document"
+    "viewDocument": "View document",
+    "vote": "Vote"
   },
   "attribution": {
     "country": "Country:",
diff --git a/packages/portal/src/plugins/europeana/auth.js b/packages/portal/src/plugins/europeana/auth.js
index 9931138c6a..84b6d98c0a 100644
--- a/packages/portal/src/plugins/europeana/auth.js
+++ b/packages/portal/src/plugins/europeana/auth.js
@@ -7,6 +7,7 @@ const refreshAccessToken = async({ $auth, $axios, redirect, route }, requestConf
     // Refresh token is no longer valid; clear tokens and try again
     $auth.logout();
     delete requestConfig.headers['Authorization'];
+    delete requestConfig.headers['authorization'];
     return $axios.request(requestConfig);
   }
 
@@ -18,6 +19,7 @@ const refreshAccessToken = async({ $auth, $axios, redirect, route }, requestConf
   updateRefreshToken($auth, refreshAccessTokenResponse);
 
   // Retry request with new access token
+  console.log('retrying request with new access token', requestConfig);
   return $axios.request(requestConfig);
 };
 
@@ -58,6 +60,9 @@ const updateAccessToken = ($auth, requestConfig, refreshAccessTokenResponse) =>
   $auth.strategy._setToken(newAccessToken); // eslint-disable-line no-underscore-dangle
 
   delete requestConfig.headers['Authorization'];
+  delete requestConfig.headers['authorization'];
+  // TODO: use axios instead of $axios, and set new Authorization header here
+  //       from newAccessToken?
 
   return newAccessToken;
 };
diff --git a/packages/portal/src/server-middleware/api/polls/remove-vote.js b/packages/portal/src/server-middleware/api/polls/remove-vote.js
index a15fdef602..14cb526cc1 100644
--- a/packages/portal/src/server-middleware/api/polls/remove-vote.js
+++ b/packages/portal/src/server-middleware/api/polls/remove-vote.js
@@ -14,14 +14,8 @@ export default (config = {}) => {
 
       let voterExternalId = null;
       if (req.headers.authorization) {
-        try {
-          const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
-          voterExternalId = userinfo?.sub || null;
-        } catch (err) {
-          console.error('keycloak error', err);
-          // TODO: handle
-          res.sendStatus(500);
-        }
+        const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
+        voterExternalId = userinfo?.sub || null;
       }
 
       const candidateExternalId = req.body?.candidate;
@@ -75,8 +69,9 @@ export default (config = {}) => {
       );
       res.sendStatus(204);
     } catch (err) {
-      res.sendStatus(409); // 409 doesn't make sense here, what should this be?
       console.error(err);
+      const status = err.response?.status || 500;
+      res.sendStatus(status);
     }
   };
 };
diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index d22980a5c6..cc3a70780e 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -14,14 +14,8 @@ export default (config = {}) => {
 
       let voterExternalId = null;
       if (req.headers.authorization) {
-        try {
-          const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
-          voterExternalId = userinfo?.sub || null;
-        } catch (err) {
-          console.error('keycloak error', err);
-          // TODO: handle
-          res.sendStatus(500);
-        }
+        const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
+        voterExternalId = userinfo?.sub || null;
       }
 
       const candidateExternalId = req.body?.candidate;
@@ -77,8 +71,9 @@ export default (config = {}) => {
       }
       res.sendStatus(200);
     } catch (err) {
-      res.sendStatus(409);
       console.error(err);
+      const status = err.response?.status || 500;
+      res.sendStatus(status);
     }
   };
 };
diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index 1dab732fa9..cc9e829ab2 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -14,14 +14,8 @@ export default (config = {}) => {
 
       let voterExternalId = null;
       if (req.headers.authorization) {
-        try {
-          const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
-          voterExternalId = userinfo?.sub || null;
-        } catch (err) {
-          console.error('keycloak error', err);
-          // TODO: handle
-          res.sendStatus(500);
-        }
+        const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
+        voterExternalId = userinfo?.sub || null;
       }
 
       const candidateExternalIds = req.query?.candidate?.split(',') || [];
@@ -63,7 +57,8 @@ export default (config = {}) => {
       }, {}));
     } catch (err) {
       console.error(err);
-      res.sendStatus(500);
+      const status = err.response?.status || 500;
+      res.sendStatus(status);
     }
   };
 };

From cfda1bdd70b9acd1fae9034adb0c0600a694f1eb Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Wed, 21 Aug 2024 13:25:51 +0100
Subject: [PATCH 20/32] refactor: use v-if (to prevent flickering change)

---
 packages/portal/src/components/generic/FeatureIdeas.vue | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/packages/portal/src/components/generic/FeatureIdeas.vue b/packages/portal/src/components/generic/FeatureIdeas.vue
index 09d6f14cd4..f3fd735450 100644
--- a/packages/portal/src/components/generic/FeatureIdeas.vue
+++ b/packages/portal/src/components/generic/FeatureIdeas.vue
@@ -24,7 +24,7 @@
       >
         <template #footer>
           <b-button
-            v-show="!$fetchState.pending"
+            v-if="!$fetchState.pending"
             class="vote-button d-inline-flex align-items-center text-uppercase mt-auto mr-auto"
             :class="{ voted: hasVotedOnFeature(feature.sys.id) }"
             variant="light-flat"
@@ -73,7 +73,6 @@
       };
     },
 
-    // TODO: prevent flickering from "0 votes" to "x votes"
     async fetch() {
       this.axiosInstance = axios.create({
         baseURL: this.$config.app.baseUrl

From 32d169c6b22f6a5521a7af9bf117e3fbd40ee57e Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Wed, 21 Aug 2024 14:26:17 +0200
Subject: [PATCH 21/32] use identifier, not sys-id

---
 packages/portal/src/components/generic/FeatureIdeas.vue   | 8 ++++----
 .../modules/contentful/queries/feature-ideas-page.graphql | 4 +---
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/packages/portal/src/components/generic/FeatureIdeas.vue b/packages/portal/src/components/generic/FeatureIdeas.vue
index 96ee8b3c6f..05a0261e02 100644
--- a/packages/portal/src/components/generic/FeatureIdeas.vue
+++ b/packages/portal/src/components/generic/FeatureIdeas.vue
@@ -26,16 +26,16 @@
           <b-button
             v-show="!$fetchState.pending"
             class="vote-button d-inline-flex align-items-center text-uppercase mt-auto mr-auto"
-            :class="{ voted: hasVotedOnFeature(feature.sys.id) }"
+            :class="{ voted: hasVotedOnFeature(feature.identifier) }"
             variant="light-flat"
             :aria-label="$t('actions.vote')"
-            @click="voteOnFeature(feature.sys.id)"
+            @click="voteOnFeature(feature.identifier)"
           >
             <span
               class="mr-1"
               :class="feature.voted ? 'icon-thumbsup' : 'icon-thumbsup-outlined'"
             />
-            {{ $tc('likes.count', voteCountOnFeature(feature.sys.id)) }}
+            {{ $tc('likes.count', voteCountOnFeature(feature.identifier)) }}
           </b-button>
         </template>
       </ContentCard>
@@ -79,7 +79,7 @@
         this.$error(error);
       }
 
-      const params = { candidate: this.features.map((feature) => feature.sys.id).join(',') };
+      const params = { candidate: this.features.map((feature) => feature.identifier).join(',') };
       const votesResponse = await axios({
         baseURL: this.$config.app.baseUrl,
         url: '/_api/votes',
diff --git a/packages/portal/src/modules/contentful/queries/feature-ideas-page.graphql b/packages/portal/src/modules/contentful/queries/feature-ideas-page.graphql
index ef48eeb2e9..7fa66e9b9d 100644
--- a/packages/portal/src/modules/contentful/queries/feature-ideas-page.graphql
+++ b/packages/portal/src/modules/contentful/queries/feature-ideas-page.graphql
@@ -11,10 +11,8 @@ query featureIdeasPage($locale: String!, $preview: Boolean = false) {
       hasPartCollection {
         items {
           ... on VoteableFeature {
-            sys {
-              id
-            }
             name
+            identifier
             text
             image {
               ... on Illustration {

From e316f0f9efd00111f4e12de9ef9bcd466fa3f8c4 Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Thu, 22 Aug 2024 07:23:16 +0100
Subject: [PATCH 22/32] refactor: make vote/unvote methods more RESTful

---
 .../src/components/generic/FeatureIdeas.vue   |  6 ++----
 .../portal/src/server-middleware/api/index.js |  8 ++++----
 .../api/polls/remove-vote.js                  | 16 ++++++++--------
 .../src/server-middleware/api/polls/vote.js   | 19 +++++++++++--------
 4 files changed, 25 insertions(+), 24 deletions(-)

diff --git a/packages/portal/src/components/generic/FeatureIdeas.vue b/packages/portal/src/components/generic/FeatureIdeas.vue
index 603134cddf..66f0c477cd 100644
--- a/packages/portal/src/components/generic/FeatureIdeas.vue
+++ b/packages/portal/src/components/generic/FeatureIdeas.vue
@@ -114,13 +114,11 @@
       },
       async voteOnFeature(featureId) {
         if (this.$auth.loggedIn) {
-          const method = this.hasVotedOnFeature(featureId) ? 'delete' : 'post';
-          const data = { candidate: featureId };
+          const method = this.hasVotedOnFeature(featureId) ? 'delete' : 'put';
 
           await this.axiosInstance({
-            url: '/_api/vote',
+            url: `/_api/votes/${featureId}`,
             method,
-            data,
             headers: this.headersForAuthorization()
           });
 
diff --git a/packages/portal/src/server-middleware/api/index.js b/packages/portal/src/server-middleware/api/index.js
index 8785fbd7f7..adf3c2d145 100644
--- a/packages/portal/src/server-middleware/api/index.js
+++ b/packages/portal/src/server-middleware/api/index.js
@@ -62,10 +62,10 @@ app.get('/version', version);
 const pollsConfig = { auth: runtimeConfig.auth, postgres: runtimeConfig.postgres };
 import votes from './polls/votes.js';
 app.get('/votes', votes(pollsConfig));
-import vote from './polls/vote.js';
-app.post('/vote', vote(pollsConfig));
-import removeVote from './polls/remove-vote.js';
-app.delete('/vote', removeVote(pollsConfig));
+import putPollVote from './polls/vote.js';
+app.put('/votes/:candidateExternalId', putPollVote(pollsConfig));
+import deletePollVote from './polls/remove-vote.js';
+app.delete('/votes/:candidateExternalId', deletePollVote(pollsConfig));
 
 app.all('/*', (req, res) => res.sendStatus(404));
 
diff --git a/packages/portal/src/server-middleware/api/polls/remove-vote.js b/packages/portal/src/server-middleware/api/polls/remove-vote.js
index 14cb526cc1..5331d440bd 100644
--- a/packages/portal/src/server-middleware/api/polls/remove-vote.js
+++ b/packages/portal/src/server-middleware/api/polls/remove-vote.js
@@ -17,12 +17,12 @@ export default (config = {}) => {
         const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
         voterExternalId = userinfo?.sub || null;
       }
+      if (voterExternalId === null) {
+        res.sendStatus(401);
+        return;
+      }
 
-      const candidateExternalId = req.body?.candidate;
-
-      // if(notAuthorized) {
-      //   res.sendStatus(401);
-      // }
+      const { candidateExternalId } = req.params;
 
       let voterRow;
       const selectVoterResult = await pg.query(
@@ -33,7 +33,7 @@ export default (config = {}) => {
         voterRow = selectVoterResult.rows[0];
       } else {
         // voter doesn't exist, can't have voted on anything
-        res.sendStatus(204);
+        res.sendStatus(403);
         return;
       }
 
@@ -46,7 +46,7 @@ export default (config = {}) => {
         candidateRow = selectCandidateResult.rows[0];
       } else {
         // candidate doesn't exist, can't have been voted on
-        res.sendStatus(204);
+        res.sendStatus(404);
         return;
       }
 
@@ -59,7 +59,7 @@ export default (config = {}) => {
         voteRow = selectVoteResult.rows[0];
       } else {
         // vote doesn't exist, no need to remove
-        res.sendStatus(204);
+        res.sendStatus(404);
         return;
       }
 
diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index cc3a70780e..513fdaf80c 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -1,7 +1,6 @@
 import pg from '../pg/pg.js';
 import { keycloakUserinfo } from '../utils.js';
 
-// TODO: validate user login
 export default (config = {}) => {
   pg.config = config.postgres;
 
@@ -17,12 +16,12 @@ export default (config = {}) => {
         const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
         voterExternalId = userinfo?.sub || null;
       }
+      if (voterExternalId === null) {
+        res.sendStatus(401);
+        return;
+      }
 
-      const candidateExternalId = req.body?.candidate;
-
-      // if(notAuthorized) {
-      //   res.sendStatus(401);
-      // }
+      const { candidateExternalId } = req.params;
 
       let voterRow;
       const selectVoterResult = await pg.query(
@@ -39,6 +38,7 @@ export default (config = {}) => {
         voterRow = insertVoterResult.rows[0];
       }
 
+      // TODO: sanity check this against external data sources
       let candidateRow;
       const selectCandidateResult = await pg.query(
         'SELECT id FROM polls.candidates WHERE external_id=$1',
@@ -60,7 +60,9 @@ export default (config = {}) => {
       );
 
       if (selectVoteResult.rowCount > 0) {
-        // No need to insert new vote, voter has already voted for this candidate
+        // Voter has already voted for this candidate
+        res.sendStatus(409);
+        return;
       } else {
         await pg.query(`
           INSERT INTO polls.votes (voter_id, candidate_id, occurred_at)
@@ -69,7 +71,8 @@ export default (config = {}) => {
         [voterRow.id, candidateRow.id]
         );
       }
-      res.sendStatus(200);
+
+      res.sendStatus(204);
     } catch (err) {
       console.error(err);
       const status = err.response?.status || 500;

From 3f84651ee5c01019bd31eb0a04efc504978defe5 Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Thu, 22 Aug 2024 07:24:36 +0100
Subject: [PATCH 23/32] chore: return error code

---
 packages/portal/src/server-middleware/api/events/log.js    | 2 ++
 .../portal/src/server-middleware/api/events/trending.js    | 7 ++++---
 packages/portal/src/server-middleware/api/events/views.js  | 7 ++++---
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/packages/portal/src/server-middleware/api/events/log.js b/packages/portal/src/server-middleware/api/events/log.js
index b0000bba9f..c09533b6eb 100644
--- a/packages/portal/src/server-middleware/api/events/log.js
+++ b/packages/portal/src/server-middleware/api/events/log.js
@@ -78,6 +78,8 @@ export default (config = {}) => {
       );
     } catch (err) {
       console.error(err);
+      const status = err.response?.status || 500;
+      res.sendStatus(status);
     }
   };
 };
diff --git a/packages/portal/src/server-middleware/api/events/trending.js b/packages/portal/src/server-middleware/api/events/trending.js
index 13828e5fd9..d2ae6b079b 100644
--- a/packages/portal/src/server-middleware/api/events/trending.js
+++ b/packages/portal/src/server-middleware/api/events/trending.js
@@ -78,9 +78,10 @@ export default (config = {}) => {
       );
 
       res.json({ items: selectObjectResult.rows });
-    } catch (e) {
-      console.error(e);
-      res.sendStatus(500);
+    } catch (err) {
+      console.error(err);
+      const status = err.response?.status || 500;
+      res.sendStatus(status);
     }
   };
 };
diff --git a/packages/portal/src/server-middleware/api/events/views.js b/packages/portal/src/server-middleware/api/events/views.js
index 42946fa509..9556fe8b72 100644
--- a/packages/portal/src/server-middleware/api/events/views.js
+++ b/packages/portal/src/server-middleware/api/events/views.js
@@ -47,9 +47,10 @@ export default (config = {}) => {
       const viewCount = Number(result.rows[0]?.views);
 
       res.json({ viewCount });
-    } catch (e) {
-      console.error(e);
-      res.sendStatus(500);
+    } catch (err) {
+      console.error(err);
+      const status = err.response?.status || 500;
+      res.sendStatus(status);
     }
   };
 };

From 23e2da1ae2b9595b7d9d474d051d5cfe437e1a37 Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Thu, 22 Aug 2024 07:43:51 +0100
Subject: [PATCH 24/32] test: update FeatureIdeas tests for refactor

---
 .../src/components/generic/FeatureIdeas.vue   |  1 +
 .../components/generic/FeatureIdeas.spec.js   | 23 +++++++++++++++----
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/packages/portal/src/components/generic/FeatureIdeas.vue b/packages/portal/src/components/generic/FeatureIdeas.vue
index 66f0c477cd..4ec7af6125 100644
--- a/packages/portal/src/components/generic/FeatureIdeas.vue
+++ b/packages/portal/src/components/generic/FeatureIdeas.vue
@@ -86,6 +86,7 @@
         const error = new Error('No feature ideas');
         error.code = 'noFeatureIdeas';
         this.$error(error);
+        return;
       }
 
       const params = { candidate: this.features.map((feature) => feature.identifier).join(',') };
diff --git a/packages/portal/tests/unit/components/generic/FeatureIdeas.spec.js b/packages/portal/tests/unit/components/generic/FeatureIdeas.spec.js
index 8c2aa30384..4db84a9170 100644
--- a/packages/portal/tests/unit/components/generic/FeatureIdeas.spec.js
+++ b/packages/portal/tests/unit/components/generic/FeatureIdeas.spec.js
@@ -1,5 +1,6 @@
 import { createLocalVue } from '@vue/test-utils';
 import { shallowMountNuxt } from '../../utils';
+import nock from 'nock';
 import sinon from 'sinon';
 
 import BootstrapVue from 'bootstrap-vue';
@@ -8,24 +9,38 @@ import FeatureIdeas from '@/components/generic/FeatureIdeas.vue';
 const localVue = createLocalVue();
 localVue.use(BootstrapVue);
 
-const factory = ({ propsData = {}, $fetchState = {} }) => {
+const factory = ({ propsData = {}, mocks = {} } = {}) => {
   return shallowMountNuxt(FeatureIdeas, {
     localVue,
     propsData,
     mocks: {
+      $auth: {
+        loggedIn: false
+      },
+      $config: {
+        app: {
+          baseUrl: 'https://www.example.org'
+        }
+      },
       $error: sinon.spy(),
-      $fetchState,
-      $t: (key) => key
+      $fetchState: {},
+      $nuxt: { context: {} },
+      $t: (key) => key,
+      $tc: (key) => key,
+      ...mocks
     },
     stubs: ['ErrorMessage']
   });
 };
 
 describe('components/generic/FeatureIdeas', () => {
+  beforeAll(() => nock.disableNetConnect());
+  afterAll(() => nock.enableNetConnect());
+
   describe('fetch', () => {
     describe('when there are no features', () => {
       it('renders a message', async() => {
-        const wrapper = factory({ $fetchState: { error: { code: 'noFeatureIdeas' } } });
+        const wrapper = factory({ mocks: { $fetchState: { error: { code: 'noFeatureIdeas' } } } });
 
         await wrapper.vm.fetch();
 

From f15dd004de327aef725c27f4857025113a159741 Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Thu, 22 Aug 2024 11:22:20 +0100
Subject: [PATCH 25/32] refactor: move db logic to model file

---
 .../portal/src/server-middleware/api/index.js |  3 +
 .../src/server-middleware/api/polls/model.js  | 87 +++++++++++++++++++
 .../api/polls/remove-vote.js                  | 48 +++-------
 .../src/server-middleware/api/polls/vote.js   | 57 ++----------
 .../src/server-middleware/api/polls/votes.js  | 40 ++-------
 5 files changed, 111 insertions(+), 124 deletions(-)
 create mode 100644 packages/portal/src/server-middleware/api/polls/model.js

diff --git a/packages/portal/src/server-middleware/api/index.js b/packages/portal/src/server-middleware/api/index.js
index adf3c2d145..7d2bbdcbda 100644
--- a/packages/portal/src/server-middleware/api/index.js
+++ b/packages/portal/src/server-middleware/api/index.js
@@ -1,3 +1,6 @@
+// TODO: replace route-specific error handling with one error handler middleware
+//       @see https://expressjs.com/en/guide/error-handling.html
+
 import express from 'express';
 import cors from 'cors';
 import apm from 'elastic-apm-node';
diff --git a/packages/portal/src/server-middleware/api/polls/model.js b/packages/portal/src/server-middleware/api/polls/model.js
new file mode 100644
index 0000000000..ac585342cc
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/polls/model.js
@@ -0,0 +1,87 @@
+import pg from '../pg/pg.js';
+
+const findVoter = async(voterExternalId) => {
+  const selectVoterResult = await pg.query(
+    'SELECT id FROM polls.voters WHERE external_id=$1',
+    [voterExternalId]
+  );
+  return (selectVoterResult.rowCount > 0) ? selectVoterResult.rows[0] : null;
+};
+
+const createVoter = async(voterExternalId) => {
+  const insertVoterResult = await pg.query(
+    'INSERT INTO polls.voters (external_id) VALUES($1) RETURNING id',
+    [voterExternalId]
+  );
+  return insertVoterResult.rows[0];
+};
+
+const findCandidate = async(candidateExternalId) => {
+  const selectCandidateResult = await pg.query(
+    'SELECT id FROM polls.candidates WHERE external_id=$1',
+    [candidateExternalId]
+  );
+  return (selectCandidateResult.rowCount > 0) ? selectCandidateResult.rows[0] : null;
+};
+
+// TODO: sanity check this against external data sources
+const createCandidate = async(candidateExternalId) => {
+  const insertCandidateResult = await pg.query(
+    'INSERT INTO polls.candidates (external_id) VALUES($1) RETURNING id',
+    [candidateExternalId]
+  );
+  return insertCandidateResult.rows[0];
+};
+
+const findVote = async(voterId, candidateId) => {
+  const selectVoteResult = await pg.query(
+    'SELECT id FROM polls.votes WHERE voter_id=$1 AND candidate_id=$2',
+    [voterId, candidateId]
+  );
+  return (selectVoteResult.rowCount > 0) ? selectVoteResult.rows[0] : null;
+};
+
+const findVotes = async(voterId, candidateExternalIds) => {
+  const selectVotesResult = await pg.query(`
+    SELECT c.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE voter_id=$2 AND candidate_id=c.id) AS voted_by_current_voter
+      FROM polls.votes v LEFT JOIN polls.candidates c
+      ON v.candidate_id=c.id
+      WHERE c.external_id LIKE ANY($1)
+      GROUP BY (c.id)
+    `,
+  [candidateExternalIds, voterId]
+  );
+  return selectVotesResult.rows || [];
+};
+
+const createVote = async(voterId, candidateId) => {
+  const insertVoteResult = await pg.query(`
+    INSERT INTO polls.votes (voter_id, candidate_id, occurred_at)
+    VALUES($1, $2, CURRENT_TIMESTAMP)
+    `,
+  [voterId, candidateId]
+  );
+  return insertVoteResult.rows[0];
+};
+
+const deleteVote = async(voteId) => {
+  return await pg.query(
+    'DELETE FROM polls.votes WHERE id=$1',
+    [voteId]
+  );
+};
+
+export default (config = {}) => {
+  pg.config = config;
+
+  return {
+    createCandidate,
+    createVote,
+    createVoter,
+    deleteVote,
+    findCandidate,
+    findVote,
+    findVotes,
+    findVoter
+  };
+};
diff --git a/packages/portal/src/server-middleware/api/polls/remove-vote.js b/packages/portal/src/server-middleware/api/polls/remove-vote.js
index 5331d440bd..b09ef00ea1 100644
--- a/packages/portal/src/server-middleware/api/polls/remove-vote.js
+++ b/packages/portal/src/server-middleware/api/polls/remove-vote.js
@@ -1,17 +1,11 @@
-import pg from '../pg/pg.js';
+import initModel from './model.js';
 import { keycloakUserinfo } from '../utils.js';
 
-// TODO: validate user login
 export default (config = {}) => {
-  pg.config = config.postgres;
+  const db = initModel(config.postgres);
 
   return async(req, res) => {
     try {
-      if (!pg.enabled) {
-        res.sendStatus(503);
-        return;
-      }
-
       let voterExternalId = null;
       if (req.headers.authorization) {
         const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
@@ -22,51 +16,29 @@ export default (config = {}) => {
         return;
       }
 
-      const { candidateExternalId } = req.params;
-
-      let voterRow;
-      const selectVoterResult = await pg.query(
-        'SELECT id FROM polls.voters WHERE external_id=$1',
-        [voterExternalId]
-      );
-      if (selectVoterResult.rowCount > 0) {
-        voterRow = selectVoterResult.rows[0];
-      } else {
+      const voterRow = await db.findVoter(voterExternalId);
+      if (!voterRow) {
         // voter doesn't exist, can't have voted on anything
         res.sendStatus(403);
         return;
       }
 
-      let candidateRow;
-      const selectCandidateResult = await pg.query(
-        'SELECT id FROM polls.candidates WHERE external_id=$1',
-        [candidateExternalId]
-      );
-      if (selectCandidateResult.rowCount > 0) {
-        candidateRow = selectCandidateResult.rows[0];
-      } else {
+      const { candidateExternalId } = req.params;
+      const candidateRow = await db.findCandidate(candidateExternalId);
+      if (!candidateRow) {
         // candidate doesn't exist, can't have been voted on
         res.sendStatus(404);
         return;
       }
 
-      let voteRow;
-      const selectVoteResult = await pg.query(
-        'SELECT id FROM polls.votes WHERE voter_id=$1 AND candidate_id=$2',
-        [voterRow.id, candidateRow.id]
-      );
-      if (selectVoteResult.rowCount > 0) {
-        voteRow = selectVoteResult.rows[0];
-      } else {
+      const voteRow = await db.findVote(voterRow.id, candidateRow.id);
+      if (!voteRow) {
         // vote doesn't exist, no need to remove
         res.sendStatus(404);
         return;
       }
 
-      await pg.query(
-        'DELETE FROM polls.votes WHERE id=$1',
-        [voteRow.id]
-      );
+      await db.deleteVote(voteRow.id);
       res.sendStatus(204);
     } catch (err) {
       console.error(err);
diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index 513fdaf80c..c7a47db8fc 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -1,16 +1,11 @@
-import pg from '../pg/pg.js';
+import initModel from './model.js';
 import { keycloakUserinfo } from '../utils.js';
 
 export default (config = {}) => {
-  pg.config = config.postgres;
+  const db = initModel(config.postgres);
 
   return async(req, res) => {
     try {
-      if (!pg.enabled) {
-        res.sendStatus(503);
-        return;
-      }
-
       let voterExternalId = null;
       if (req.headers.authorization) {
         const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
@@ -23,55 +18,15 @@ export default (config = {}) => {
 
       const { candidateExternalId } = req.params;
 
-      let voterRow;
-      const selectVoterResult = await pg.query(
-        'SELECT id FROM polls.voters WHERE external_id=$1',
-        [voterExternalId]
-      );
-      if (selectVoterResult.rowCount > 0) {
-        voterRow = selectVoterResult.rows[0];
-      } else {
-        const insertVoterResult = await pg.query(
-          'INSERT INTO polls.voters (external_id) VALUES($1) RETURNING id',
-          [voterExternalId]
-        );
-        voterRow = insertVoterResult.rows[0];
-      }
-
-      // TODO: sanity check this against external data sources
-      let candidateRow;
-      const selectCandidateResult = await pg.query(
-        'SELECT id FROM polls.candidates WHERE external_id=$1',
-        [candidateExternalId]
-      );
-      if (selectCandidateResult.rowCount > 0) {
-        candidateRow = selectCandidateResult.rows[0];
-      } else {
-        const insertCandidateResult = await pg.query(
-          'INSERT INTO polls.candidates (external_id) VALUES($1) RETURNING id',
-          [candidateExternalId]
-        );
-        candidateRow = insertCandidateResult.rows[0];
-      }
-
-      const selectVoteResult = await pg.query(
-        'SELECT id FROM polls.votes WHERE voter_id=$1 AND candidate_id=$2',
-        [voterRow.id, candidateRow.id]
-      );
-
-      if (selectVoteResult.rowCount > 0) {
+      const voterRow = await db.findVoter(voterExternalId) || await db.createVoter(voterExternalId);
+      const candidateRow = await db.findCandidate(candidateExternalId) || await db.createCandidate(candidateExternalId);
+      if (await db.findVote(voterRow.id, candidateRow.id)) {
         // Voter has already voted for this candidate
         res.sendStatus(409);
         return;
-      } else {
-        await pg.query(`
-          INSERT INTO polls.votes (voter_id, candidate_id, occurred_at)
-          VALUES($1, $2, CURRENT_TIMESTAMP)
-          `,
-        [voterRow.id, candidateRow.id]
-        );
       }
 
+      await db.createVote(voterRow.id, candidateRow.id);
       res.sendStatus(204);
     } catch (err) {
       console.error(err);
diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index cc9e829ab2..7374bf7b61 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -1,17 +1,11 @@
-import pg from '../pg/pg.js';
+import initModel from './model.js';
 import { keycloakUserinfo } from '../utils.js';
 
-// TODO: authorisation for current user before retrieving the voterId
 export default (config = {}) => {
-  pg.config = config.postgres;
+  const db = initModel(config.postgres);
 
   return async(req, res) => {
     try {
-      if (!pg.enabled) {
-        res.json([]);
-        return;
-      }
-
       let voterExternalId = null;
       if (req.headers.authorization) {
         const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
@@ -20,35 +14,11 @@ export default (config = {}) => {
 
       const candidateExternalIds = req.query?.candidate?.split(',') || [];
 
-      let voterRow = { id: null };
-      if (voterExternalId) {
-        const selectVoterResult = await pg.query(
-          'SELECT id FROM polls.voters WHERE external_id=$1',
-          [voterExternalId]
-        );
-        if (selectVoterResult.rowCount > 0) {
-          voterRow = selectVoterResult.rows[0];
-        }
-      }
+      const voterRow = await db.findVoter(voterExternalId) || { id: null };
 
-      const votesForCandidates = await pg.query(`
-        SELECT c.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE voter_id=$2 AND candidate_id=c.id) AS voted_by_current_voter
-          FROM polls.votes v LEFT JOIN polls.candidates c
-          ON v.candidate_id=c.id
-          WHERE c.external_id LIKE ANY($1)
-          GROUP BY (c.id)
-        `,
-      [candidateExternalIds, voterRow.id]
-      );
-
-      if (votesForCandidates.rowCount < 0) {
-        // Nobody has voted on anything yet
-        res.json([]);
-        return;
-      }
+      const votesForCandidates = await db.findVotes(voterRow.id, candidateExternalIds);
 
-      res.json(votesForCandidates.rows.reduce((memo, row) => {
-        console.log('votesForCandidates row', row);
+      res.json(votesForCandidates.reduce((memo, row) => {
         memo[row.external_id] = {
           total: row.total,
           votedByCurrentVoter: row.voted_by_current_voter === '1'

From 53c99a4292f5aa43faa179956c7fe4e4e32d58cb Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Thu, 22 Aug 2024 12:38:59 +0100
Subject: [PATCH 26/32] refactor: export router for polls and events

---
 packages/portal/nuxt.config.js                |   1 -
 .../portal/src/server-middleware/api/auth.js  |  15 ++
 .../src/server-middleware/api/events/index.js |  17 ++
 .../src/server-middleware/api/events/log.js   | 128 +++++++-------
 .../server-middleware/api/events/trending.js  | 157 +++++++++---------
 .../src/server-middleware/api/events/views.js |  94 +++++------
 .../portal/src/server-middleware/api/index.js |  24 +--
 .../src/server-middleware/api/{pg => }/pg.js  |   0
 .../src/server-middleware/api/polls/index.js  |  13 ++
 .../src/server-middleware/api/polls/model.js  |  24 ++-
 .../api/polls/remove-vote.js                  |  82 +++++----
 .../src/server-middleware/api/polls/vote.js   |  60 ++++---
 .../src/server-middleware/api/polls/votes.js  |  52 +++---
 .../portal/src/server-middleware/api/utils.js |  11 --
 14 files changed, 335 insertions(+), 343 deletions(-)
 create mode 100644 packages/portal/src/server-middleware/api/auth.js
 create mode 100644 packages/portal/src/server-middleware/api/events/index.js
 rename packages/portal/src/server-middleware/api/{pg => }/pg.js (100%)
 create mode 100644 packages/portal/src/server-middleware/api/polls/index.js

diff --git a/packages/portal/nuxt.config.js b/packages/portal/nuxt.config.js
index 574aa0d051..06d024d628 100644
--- a/packages/portal/nuxt.config.js
+++ b/packages/portal/nuxt.config.js
@@ -43,7 +43,6 @@ const redisConfig = () => {
 const postgresConfig = () => {
   // see https://node-postgres.com/apis/pool
   const postgresOptions = {
-    enabled: featureIsEnabled('eventLogging') || featureIsEnabled('featureIdeas'),
     connectionString: process.env.POSTGRES_URL,
     connectionTimeoutMillis: Number(process.env.POSTGRES_POOL_CONNECTION_TIMEOUT || 0),
     idleTimeoutMillis: Number(process.env.POSTGRES_POOL_IDLE_TIMEOUT || 10000),
diff --git a/packages/portal/src/server-middleware/api/auth.js b/packages/portal/src/server-middleware/api/auth.js
new file mode 100644
index 0000000000..4a9e3925c8
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/auth.js
@@ -0,0 +1,15 @@
+import axios from 'axios';
+
+export default {
+  config: {},
+
+  async userinfo(req) {
+    const keycloakUserinfoResponse = await axios({
+      baseURL: this.config.origin,
+      url: `/auth/realms/${this.config.realm}/protocol/openid-connect/userinfo`,
+      method: 'get',
+      headers: { authorization: req.headers.authorization }
+    });
+    return keycloakUserinfoResponse.data;
+  }
+};
diff --git a/packages/portal/src/server-middleware/api/events/index.js b/packages/portal/src/server-middleware/api/events/index.js
new file mode 100644
index 0000000000..2929ab1545
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/events/index.js
@@ -0,0 +1,17 @@
+// TODO: move to a standalone express micro-service, so the portal.js app does
+//       not have a direct dependency on postgres, indeed need not know what
+//       back-end storage is used.
+
+import express from 'express';
+
+import logEvent from './log.js';
+import eventTrending from './trending.js';
+import eventViews from './views.js';
+
+const router = express.Router();
+
+router.post('/', logEvent);
+router.get('/trending', eventTrending);
+router.get('/views', eventViews);
+
+export default router;
diff --git a/packages/portal/src/server-middleware/api/events/log.js b/packages/portal/src/server-middleware/api/events/log.js
index c09533b6eb..e2d6f210d8 100644
--- a/packages/portal/src/server-middleware/api/events/log.js
+++ b/packages/portal/src/server-middleware/api/events/log.js
@@ -1,85 +1,81 @@
 import isbot from 'isbot';
-import pg from '../pg/pg.js';
+import pg from '../pg.js';
 
 // TODO: use `next` for error handling
 // TODO: accept multiple uris for the same action
 // TODO: log user agent?
 // TODO: validate action_types
-export default (config = {}) => {
-  pg.config = config;
+export default async(req, res) => {
+  try {
+    // Respond early as clients don't need to wait for the results of this logging
+    res.sendStatus(204);
 
-  return async(req, res) => {
-    try {
-      // Respond early as clients don't need to wait for the results of this logging
-      res.sendStatus(204);
+    if (!pg.enabled || isbot(req.get('user-agent'))) {
+      return;
+    }
 
-      if (!pg.enabled || isbot(req.get('user-agent'))) {
-        return;
-      }
+    const { actionType, objectUri, sessionId } = req.body;
+    const url = new URL(objectUri);
+    // Ignore any search query or hash
+    const uri = `${url.origin}${url.pathname}`;
 
-      const { actionType, objectUri, sessionId } = req.body;
-      const url = new URL(objectUri);
-      // Ignore any search query or hash
-      const uri = `${url.origin}${url.pathname}`;
+    let objectRow;
+    const selectObjectResult = await pg.query(
+      'SELECT id FROM events.objects WHERE uri=$1',
+      [uri]
+    );
 
-      let objectRow;
-      const selectObjectResult = await pg.query(
-        'SELECT id FROM events.objects WHERE uri=$1',
+    if (selectObjectResult.rowCount > 0) {
+      objectRow = selectObjectResult.rows[0];
+    } else {
+      const insertObjectResult = await pg.query(
+        'INSERT INTO events.objects (uri) VALUES($1) RETURNING id',
         [uri]
       );
+      objectRow = insertObjectResult.rows[0];
+    }
 
-      if (selectObjectResult.rowCount > 0) {
-        objectRow = selectObjectResult.rows[0];
-      } else {
-        const insertObjectResult = await pg.query(
-          'INSERT INTO events.objects (uri) VALUES($1) RETURNING id',
-          [uri]
-        );
-        objectRow = insertObjectResult.rows[0];
-      }
+    let sessionRow;
+    const selectSessionResult = await pg.query(
+      'SELECT id FROM events.sessions WHERE uuid=$1',
+      [sessionId]
+    );
 
-      let sessionRow;
-      const selectSessionResult = await pg.query(
-        'SELECT id FROM events.sessions WHERE uuid=$1',
+    if (selectSessionResult.rowCount > 0) {
+      sessionRow = selectSessionResult.rows[0];
+    } else {
+      const insertSessionResult = await pg.query(
+        'INSERT INTO events.sessions (uuid) VALUES($1) RETURNING id',
         [sessionId]
       );
+      sessionRow = insertSessionResult.rows[0];
+    }
 
-      if (selectSessionResult.rowCount > 0) {
-        sessionRow = selectSessionResult.rows[0];
-      } else {
-        const insertSessionResult = await pg.query(
-          'INSERT INTO events.sessions (uuid) VALUES($1) RETURNING id',
-          [sessionId]
-        );
-        sessionRow = insertSessionResult.rows[0];
-      }
-
-      const selectActionResult = await pg.query(`
-        SELECT a.id FROM events.actions a LEFT JOIN events.action_types at
-          ON a.action_type_id=at.id
-        WHERE a.object_id=$1
-          AND at.name=$2
-          AND a.session_id=$3
-        `,
-      [objectRow.id, actionType, sessionRow.id]
-      );
-      if (selectActionResult.rowCount > 0) {
-        // this session has already logged this action type for this object; don't log it again
-        return;
-      }
-
-      await pg.query(`
-        INSERT INTO events.actions (object_id, action_type_id, session_id, occurred_at)
-        SELECT $1, at.id, $2, CURRENT_TIMESTAMP
-        FROM events.action_types at
-        WHERE at.name=$3
-        `,
-      [objectRow.id, sessionRow.id, actionType]
-      );
-    } catch (err) {
-      console.error(err);
-      const status = err.response?.status || 500;
-      res.sendStatus(status);
+    const selectActionResult = await pg.query(`
+      SELECT a.id FROM events.actions a LEFT JOIN events.action_types at
+        ON a.action_type_id=at.id
+      WHERE a.object_id=$1
+        AND at.name=$2
+        AND a.session_id=$3
+      `,
+    [objectRow.id, actionType, sessionRow.id]
+    );
+    if (selectActionResult.rowCount > 0) {
+      // this session has already logged this action type for this object; don't log it again
+      return;
     }
-  };
+
+    await pg.query(`
+      INSERT INTO events.actions (object_id, action_type_id, session_id, occurred_at)
+      SELECT $1, at.id, $2, CURRENT_TIMESTAMP
+      FROM events.action_types at
+      WHERE at.name=$3
+      `,
+    [objectRow.id, sessionRow.id, actionType]
+    );
+  } catch (err) {
+    console.error(err);
+    const status = err.response?.status || 500;
+    res.sendStatus(status);
+  }
 };
diff --git a/packages/portal/src/server-middleware/api/events/trending.js b/packages/portal/src/server-middleware/api/events/trending.js
index d2ae6b079b..97c5d1b74f 100644
--- a/packages/portal/src/server-middleware/api/events/trending.js
+++ b/packages/portal/src/server-middleware/api/events/trending.js
@@ -1,87 +1,78 @@
-import pg from '../pg/pg.js';
+import pg from '../pg.js';
 
 // TODO: use `next` for error handling
-export default (config = {}) => {
-  pg.config = config;
+export default async(req, res) => {
+  try {
+    const selectObjectResult = await pg.query(`
+      SELECT uri,
+             previous_score,
+             current_score,
+             CEIL(current_score ^ ((current_score - previous_score) / current_score)) trending_score,
+             last_occurred_at
+      FROM
+        (SELECT current_scores.uri,
+                COALESCE(SUM(current_scores.action_score), 0) current_score,
+                COALESCE(SUM(previous_scores.action_score), 0) previous_score,
+                GREATEST(MAX(current_scores.last_occurred_at), MAX(previous_scores.last_occurred_at)) last_occurred_at
+         FROM
+           (SELECT uri,
+                   num * action_weight AS action_score,
+                   last_occurred_at
+            FROM
+              (SELECT o.uri,
+                      at.name,
+                      COUNT(a.id) AS num,
+                      MAX(a.occurred_at) AS last_occurred_at,
+                      CASE
+                          WHEN at.name = 'view' THEN 1
+                          WHEN at.name = 'download' THEN 2
+                          WHEN at.name = 'like' THEN 4
+                          WHEN at.name = 'add' THEN 6
+                          ELSE 0
+                      END AS action_weight
+               FROM events.actions a
+               LEFT JOIN events.objects o ON a.object_id=o.id
+               LEFT JOIN events.action_types AT ON a.action_type_id=at.id
+               WHERE a.occurred_at > (CURRENT_TIMESTAMP - INTERVAL '1 day')
+                 AND o.uri LIKE '%/item/%'
+               GROUP BY o.uri,
+                        at.name) AS action_counts) AS current_scores
+         LEFT JOIN
+           (SELECT uri,
+                   num * action_weight AS action_score,
+                   last_occurred_at
+            FROM
+              (SELECT o.uri,
+                      at.name,
+                      COUNT(a.id) AS num,
+                      MAX(a.occurred_at) AS last_occurred_at,
+                      CASE
+                          WHEN at.name = 'view' THEN 1
+                          WHEN at.name = 'download' THEN 2
+                          WHEN at.name = 'like' THEN 4
+                          WHEN at.name = 'add' THEN 6
+                          ELSE 0
+                      END AS action_weight
+               FROM events.actions a
+               LEFT JOIN events.objects o ON a.object_id=o.id
+               LEFT JOIN events.action_types AT ON a.action_type_id=at.id
+               WHERE a.occurred_at > (CURRENT_TIMESTAMP - INTERVAL '2 day')
+                 AND a.occurred_at < (CURRENT_TIMESTAMP - INTERVAL '1 day')
+                 AND o.uri LIKE '%/item/%'
+               GROUP BY o.uri,
+                        at.name) AS action_counts) AS previous_scores ON current_scores.uri=previous_scores.uri
+         GROUP BY current_scores.uri) AS scores
+      WHERE current_score > previous_score
+      ORDER BY trending_score DESC,
+               last_occurred_at DESC
+      LIMIT 24
+      `
+    );
 
-  return async(req, res) => {
-    try {
-      if (!pg.enabled) {
-        res.json({ items: [] });
-        return;
-      }
-
-      const selectObjectResult = await pg.query(`
-        SELECT uri,
-               previous_score,
-               current_score,
-               CEIL(current_score ^ ((current_score - previous_score) / current_score)) trending_score,
-               last_occurred_at
-        FROM
-          (SELECT current_scores.uri,
-                  COALESCE(SUM(current_scores.action_score), 0) current_score,
-                  COALESCE(SUM(previous_scores.action_score), 0) previous_score,
-                  GREATEST(MAX(current_scores.last_occurred_at), MAX(previous_scores.last_occurred_at)) last_occurred_at
-           FROM
-             (SELECT uri,
-                     num * action_weight AS action_score,
-                     last_occurred_at
-              FROM
-                (SELECT o.uri,
-                        at.name,
-                        COUNT(a.id) AS num,
-                        MAX(a.occurred_at) AS last_occurred_at,
-                        CASE
-                            WHEN at.name = 'view' THEN 1
-                            WHEN at.name = 'download' THEN 2
-                            WHEN at.name = 'like' THEN 4
-                            WHEN at.name = 'add' THEN 6
-                            ELSE 0
-                        END AS action_weight
-                 FROM events.actions a
-                 LEFT JOIN events.objects o ON a.object_id=o.id
-                 LEFT JOIN events.action_types AT ON a.action_type_id=at.id
-                 WHERE a.occurred_at > (CURRENT_TIMESTAMP - INTERVAL '1 day')
-                   AND o.uri LIKE '%/item/%'
-                 GROUP BY o.uri,
-                          at.name) AS action_counts) AS current_scores
-           LEFT JOIN
-             (SELECT uri,
-                     num * action_weight AS action_score,
-                     last_occurred_at
-              FROM
-                (SELECT o.uri,
-                        at.name,
-                        COUNT(a.id) AS num,
-                        MAX(a.occurred_at) AS last_occurred_at,
-                        CASE
-                            WHEN at.name = 'view' THEN 1
-                            WHEN at.name = 'download' THEN 2
-                            WHEN at.name = 'like' THEN 4
-                            WHEN at.name = 'add' THEN 6
-                            ELSE 0
-                        END AS action_weight
-                 FROM events.actions a
-                 LEFT JOIN events.objects o ON a.object_id=o.id
-                 LEFT JOIN events.action_types AT ON a.action_type_id=at.id
-                 WHERE a.occurred_at > (CURRENT_TIMESTAMP - INTERVAL '2 day')
-                   AND a.occurred_at < (CURRENT_TIMESTAMP - INTERVAL '1 day')
-                   AND o.uri LIKE '%/item/%'
-                 GROUP BY o.uri,
-                          at.name) AS action_counts) AS previous_scores ON current_scores.uri=previous_scores.uri
-           GROUP BY current_scores.uri) AS scores
-        WHERE current_score > previous_score
-        ORDER BY trending_score DESC,
-                 last_occurred_at DESC
-        LIMIT 24
-        `
-      );
-
-      res.json({ items: selectObjectResult.rows });
-    } catch (err) {
-      console.error(err);
-      const status = err.response?.status || 500;
-      res.sendStatus(status);
-    }
-  };
+    res.json({ items: selectObjectResult.rows });
+  } catch (err) {
+    console.error(err);
+    const status = err.response?.status || 500;
+    res.sendStatus(status);
+  }
 };
diff --git a/packages/portal/src/server-middleware/api/events/views.js b/packages/portal/src/server-middleware/api/events/views.js
index 9556fe8b72..1fd3117870 100644
--- a/packages/portal/src/server-middleware/api/events/views.js
+++ b/packages/portal/src/server-middleware/api/events/views.js
@@ -1,56 +1,52 @@
-import pg from '../pg/pg.js';
+import pg from '../pg.js';
 
 // TODO: use `next` for error handling
-export default (config = {}) => {
-  pg.config = config;
-
-  return async(req, res) => {
-    try {
-      if (!pg.enabled) {
-        res.json({ viewCount: 0 });
-        return;
-      }
-      const url = new URL(req.query?.url);
-      // Ignore any search query or hash
-      const uri = `${url.origin}${url.pathname}`;
+export default async(req, res) => {
+  try {
+    if (!pg.enabled) {
+      res.json({ viewCount: 0 });
+      return;
+    }
+    const url = new URL(req.query?.url);
+    // Ignore any search query or hash
+    const uri = `${url.origin}${url.pathname}`;
 
-      // TODO: update old objects, then stop using legacy uris
-      // @/docker/compose/postgres/model/07-clean-up-blog-objects.psql
-      // TODO: or, stop hard-coding for blog posts/stories, and add redirects/
-      //       aliases to db to support other paths too
-      const legacyUri = url.pathname.startsWith('/stories') ? `${url.origin}${url.pathname.replace('/stories', '/blog')}` : uri;
+    // TODO: update old objects, then stop using legacy uris
+    // @/docker/compose/postgres/model/07-clean-up-blog-objects.psql
+    // TODO: or, stop hard-coding for blog posts/stories, and add redirects/
+    //       aliases to db to support other paths too
+    const legacyUri = url.pathname.startsWith('/stories') ? `${url.origin}${url.pathname.replace('/stories', '/blog')}` : uri;
 
-      const result = await pg.query(`
-        SELECT SUM(views) AS views
-        FROM
-          (SELECT o.uri,
-                  at.name AS action_type_name,
-                  sum(h.occurrences) AS views
-           FROM events.history h
-           LEFT JOIN events.objects o ON h.object_id=o.id
-           LEFT JOIN events.action_types AT ON h.action_type_id=at.id
-           GROUP BY at.name,
-                    o.uri
-           UNION ALL SELECT o.uri,
-                            at.name AS action_type_name,
-                            count(a.id) AS views
-           FROM events.actions a
-           LEFT JOIN events.objects o ON a.object_id=o.id
-           LEFT JOIN events.action_types AT ON a.action_type_id=at.id
-           GROUP BY at.name,
-                    o.uri) actions_and_history
-        WHERE action_type_name='view' AND (uri=$1 OR uri=$2)
-        `,
-      [uri, legacyUri]
-      );
+    const result = await pg.query(`
+      SELECT SUM(views) AS views
+      FROM
+        (SELECT o.uri,
+                at.name AS action_type_name,
+                sum(h.occurrences) AS views
+         FROM events.history h
+         LEFT JOIN events.objects o ON h.object_id=o.id
+         LEFT JOIN events.action_types AT ON h.action_type_id=at.id
+         GROUP BY at.name,
+                  o.uri
+         UNION ALL SELECT o.uri,
+                          at.name AS action_type_name,
+                          count(a.id) AS views
+         FROM events.actions a
+         LEFT JOIN events.objects o ON a.object_id=o.id
+         LEFT JOIN events.action_types AT ON a.action_type_id=at.id
+         GROUP BY at.name,
+                  o.uri) actions_and_history
+      WHERE action_type_name='view' AND (uri=$1 OR uri=$2)
+      `,
+    [uri, legacyUri]
+    );
 
-      const viewCount = Number(result.rows[0]?.views);
+    const viewCount = Number(result.rows[0]?.views);
 
-      res.json({ viewCount });
-    } catch (err) {
-      console.error(err);
-      const status = err.response?.status || 500;
-      res.sendStatus(status);
-    }
-  };
+    res.json({ viewCount });
+  } catch (err) {
+    console.error(err);
+    const status = err.response?.status || 500;
+    res.sendStatus(status);
+  }
 };
diff --git a/packages/portal/src/server-middleware/api/index.js b/packages/portal/src/server-middleware/api/index.js
index 7d2bbdcbda..99f3b39ad9 100644
--- a/packages/portal/src/server-middleware/api/index.js
+++ b/packages/portal/src/server-middleware/api/index.js
@@ -6,6 +6,8 @@ import cors from 'cors';
 import apm from 'elastic-apm-node';
 
 import logging from '../logging.js';
+import pg from './pg.js';
+import auth from './auth.js';
 import { forbiddenUnlessOriginAllowed, nuxtRuntimeConfig } from './utils.js';
 
 const app = express();
@@ -14,6 +16,8 @@ app.use(express.json());
 app.use(logging);
 
 const runtimeConfig = nuxtRuntimeConfig();
+pg.config = runtimeConfig.postgres;
+auth.config = runtimeConfig.auth.strategies.keycloak;
 
 app.use((req, res, next) => {
   if (apm.isStarted())  {
@@ -33,15 +37,8 @@ const cacheHandler = cache(runtimeConfig.redis);
 app.get('/cache', cacheHandler);
 app.get('/cache/*', cacheHandler);
 
-// TODO: move to a standalone express micro-service, so the portal.js app does
-//       not have a direct dependency on postgres, indeed need not know what
-//       back-end storage is used.
-import logEvent from './events/log.js';
-app.post('/events', logEvent(runtimeConfig.postgres));
-import eventTrending from './events/trending.js';
-app.get('/events/trending', eventTrending(runtimeConfig.postgres));
-import eventViews from './events/views.js';
-app.get('/events/views', eventViews(runtimeConfig.postgres));
+import events from './events/index.js';
+app.use('/events', events);
 
 import jiraServiceDeskFeedback from './jira-service-desk/feedback.js';
 const feedbackCorsOptions = {
@@ -62,13 +59,8 @@ app.post('/jira-service-desk/galleries', jiraServiceDeskGalleries(runtimeConfig.
 import version from './version.js';
 app.get('/version', version);
 
-const pollsConfig = { auth: runtimeConfig.auth, postgres: runtimeConfig.postgres };
-import votes from './polls/votes.js';
-app.get('/votes', votes(pollsConfig));
-import putPollVote from './polls/vote.js';
-app.put('/votes/:candidateExternalId', putPollVote(pollsConfig));
-import deletePollVote from './polls/remove-vote.js';
-app.delete('/votes/:candidateExternalId', deletePollVote(pollsConfig));
+import polls from './polls/index.js';
+app.use('/votes', polls);
 
 app.all('/*', (req, res) => res.sendStatus(404));
 
diff --git a/packages/portal/src/server-middleware/api/pg/pg.js b/packages/portal/src/server-middleware/api/pg.js
similarity index 100%
rename from packages/portal/src/server-middleware/api/pg/pg.js
rename to packages/portal/src/server-middleware/api/pg.js
diff --git a/packages/portal/src/server-middleware/api/polls/index.js b/packages/portal/src/server-middleware/api/polls/index.js
new file mode 100644
index 0000000000..07819e963b
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/polls/index.js
@@ -0,0 +1,13 @@
+import express from 'express';
+
+import getVotes from './votes.js';
+import putPollVote from './vote.js';
+import deletePollVote from './remove-vote.js';
+
+const router = express.Router();
+
+router.get('/', getVotes);
+router.put('/:candidateExternalId', putPollVote);
+router.delete('/:candidateExternalId', deletePollVote);
+
+export default router;
diff --git a/packages/portal/src/server-middleware/api/polls/model.js b/packages/portal/src/server-middleware/api/polls/model.js
index ac585342cc..136a94ce96 100644
--- a/packages/portal/src/server-middleware/api/polls/model.js
+++ b/packages/portal/src/server-middleware/api/polls/model.js
@@ -1,4 +1,4 @@
-import pg from '../pg/pg.js';
+import pg from '../pg.js';
 
 const findVoter = async(voterExternalId) => {
   const selectVoterResult = await pg.query(
@@ -71,17 +71,13 @@ const deleteVote = async(voteId) => {
   );
 };
 
-export default (config = {}) => {
-  pg.config = config;
-
-  return {
-    createCandidate,
-    createVote,
-    createVoter,
-    deleteVote,
-    findCandidate,
-    findVote,
-    findVotes,
-    findVoter
-  };
+export default {
+  createCandidate,
+  createVote,
+  createVoter,
+  deleteVote,
+  findCandidate,
+  findVote,
+  findVotes,
+  findVoter
 };
diff --git a/packages/portal/src/server-middleware/api/polls/remove-vote.js b/packages/portal/src/server-middleware/api/polls/remove-vote.js
index b09ef00ea1..1877323908 100644
--- a/packages/portal/src/server-middleware/api/polls/remove-vote.js
+++ b/packages/portal/src/server-middleware/api/polls/remove-vote.js
@@ -1,49 +1,45 @@
-import initModel from './model.js';
-import { keycloakUserinfo } from '../utils.js';
+import db from './model.js';
+import auth from '../auth.js';
 
-export default (config = {}) => {
-  const db = initModel(config.postgres);
-
-  return async(req, res) => {
-    try {
-      let voterExternalId = null;
-      if (req.headers.authorization) {
-        const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
-        voterExternalId = userinfo?.sub || null;
-      }
-      if (voterExternalId === null) {
-        res.sendStatus(401);
-        return;
-      }
-
-      const voterRow = await db.findVoter(voterExternalId);
-      if (!voterRow) {
-        // voter doesn't exist, can't have voted on anything
-        res.sendStatus(403);
-        return;
-      }
+export default async(req, res) => {
+  try {
+    let voterExternalId = null;
+    if (req.headers.authorization) {
+      const userinfo = await auth.userinfo(req);
+      voterExternalId = userinfo?.sub || null;
+    }
+    if (voterExternalId === null) {
+      res.sendStatus(401);
+      return;
+    }
 
-      const { candidateExternalId } = req.params;
-      const candidateRow = await db.findCandidate(candidateExternalId);
-      if (!candidateRow) {
-        // candidate doesn't exist, can't have been voted on
-        res.sendStatus(404);
-        return;
-      }
+    const voterRow = await db.findVoter(voterExternalId);
+    if (!voterRow) {
+      // voter doesn't exist, can't have voted on anything
+      res.sendStatus(403);
+      return;
+    }
 
-      const voteRow = await db.findVote(voterRow.id, candidateRow.id);
-      if (!voteRow) {
-        // vote doesn't exist, no need to remove
-        res.sendStatus(404);
-        return;
-      }
+    const { candidateExternalId } = req.params;
+    const candidateRow = await db.findCandidate(candidateExternalId);
+    if (!candidateRow) {
+      // candidate doesn't exist, can't have been voted on
+      res.sendStatus(404);
+      return;
+    }
 
-      await db.deleteVote(voteRow.id);
-      res.sendStatus(204);
-    } catch (err) {
-      console.error(err);
-      const status = err.response?.status || 500;
-      res.sendStatus(status);
+    const voteRow = await db.findVote(voterRow.id, candidateRow.id);
+    if (!voteRow) {
+      // vote doesn't exist, no need to remove
+      res.sendStatus(404);
+      return;
     }
-  };
+
+    await db.deleteVote(voteRow.id);
+    res.sendStatus(204);
+  } catch (err) {
+    console.error(err);
+    const status = err.response?.status || 500;
+    res.sendStatus(status);
+  }
 };
diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index c7a47db8fc..1b17ec8973 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -1,37 +1,33 @@
-import initModel from './model.js';
-import { keycloakUserinfo } from '../utils.js';
+import db from './model.js';
+import auth from '../auth.js';
 
-export default (config = {}) => {
-  const db = initModel(config.postgres);
-
-  return async(req, res) => {
-    try {
-      let voterExternalId = null;
-      if (req.headers.authorization) {
-        const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
-        voterExternalId = userinfo?.sub || null;
-      }
-      if (voterExternalId === null) {
-        res.sendStatus(401);
-        return;
-      }
-
-      const { candidateExternalId } = req.params;
+export default async(req, res) => {
+  try {
+    let voterExternalId = null;
+    if (req.headers.authorization) {
+      const userinfo = await auth.userinfo(req);
+      voterExternalId = userinfo?.sub || null;
+    }
+    if (voterExternalId === null) {
+      res.sendStatus(401);
+      return;
+    }
 
-      const voterRow = await db.findVoter(voterExternalId) || await db.createVoter(voterExternalId);
-      const candidateRow = await db.findCandidate(candidateExternalId) || await db.createCandidate(candidateExternalId);
-      if (await db.findVote(voterRow.id, candidateRow.id)) {
-        // Voter has already voted for this candidate
-        res.sendStatus(409);
-        return;
-      }
+    const { candidateExternalId } = req.params;
 
-      await db.createVote(voterRow.id, candidateRow.id);
-      res.sendStatus(204);
-    } catch (err) {
-      console.error(err);
-      const status = err.response?.status || 500;
-      res.sendStatus(status);
+    const voterRow = await db.findVoter(voterExternalId) || await db.createVoter(voterExternalId);
+    const candidateRow = await db.findCandidate(candidateExternalId) || await db.createCandidate(candidateExternalId);
+    if (await db.findVote(voterRow.id, candidateRow.id)) {
+      // Voter has already voted for this candidate
+      res.sendStatus(409);
+      return;
     }
-  };
+
+    await db.createVote(voterRow.id, candidateRow.id);
+    res.sendStatus(204);
+  } catch (err) {
+    console.error(err);
+    const status = err.response?.status || 500;
+    res.sendStatus(status);
+  }
 };
diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index 7374bf7b61..c522884a14 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -1,34 +1,30 @@
-import initModel from './model.js';
-import { keycloakUserinfo } from '../utils.js';
+import db from './model.js';
+import auth from '../auth.js';
 
-export default (config = {}) => {
-  const db = initModel(config.postgres);
-
-  return async(req, res) => {
-    try {
-      let voterExternalId = null;
-      if (req.headers.authorization) {
-        const userinfo = await keycloakUserinfo(req, config.auth.strategies.keycloak);
-        voterExternalId = userinfo?.sub || null;
-      }
+export default async(req, res) => {
+  try {
+    let voterExternalId = null;
+    if (req.headers.authorization) {
+      const userinfo = await auth.userinfo(req);
+      voterExternalId = userinfo?.sub || null;
+    }
 
-      const candidateExternalIds = req.query?.candidate?.split(',') || [];
+    const candidateExternalIds = req.query?.candidate?.split(',') || [];
 
-      const voterRow = await db.findVoter(voterExternalId) || { id: null };
+    const voterRow = await db.findVoter(voterExternalId) || { id: null };
 
-      const votesForCandidates = await db.findVotes(voterRow.id, candidateExternalIds);
+    const votesForCandidates = await db.findVotes(voterRow.id, candidateExternalIds);
 
-      res.json(votesForCandidates.reduce((memo, row) => {
-        memo[row.external_id] = {
-          total: row.total,
-          votedByCurrentVoter: row.voted_by_current_voter === '1'
-        };
-        return memo;
-      }, {}));
-    } catch (err) {
-      console.error(err);
-      const status = err.response?.status || 500;
-      res.sendStatus(status);
-    }
-  };
+    res.json(votesForCandidates.reduce((memo, row) => {
+      memo[row.external_id] = {
+        total: row.total,
+        votedByCurrentVoter: row.voted_by_current_voter === '1'
+      };
+      return memo;
+    }, {}));
+  } catch (err) {
+    console.error(err);
+    const status = err.response?.status || 500;
+    res.sendStatus(status);
+  }
 };
diff --git a/packages/portal/src/server-middleware/api/utils.js b/packages/portal/src/server-middleware/api/utils.js
index 6a9c859cb4..3ecf9d0bc3 100644
--- a/packages/portal/src/server-middleware/api/utils.js
+++ b/packages/portal/src/server-middleware/api/utils.js
@@ -1,4 +1,3 @@
-import axios from 'axios';
 import defu  from 'defu';
 import createHttpError from 'http-errors';
 
@@ -36,13 +35,3 @@ export const forbiddenUnlessOriginAllowed = (origins) => (origin, callback) => {
     callback(createHttpError(403, 'Origin not permitted'));
   }
 };
-
-export const keycloakUserinfo = async(req, config) => {
-  const keycloakUserinfoResponse = await axios({
-    baseURL: config.origin,
-    url: `/auth/realms/${config.realm}/protocol/openid-connect/userinfo`,
-    method: 'get',
-    headers: { authorization: req.headers.authorization }
-  });
-  return keycloakUserinfoResponse.data;
-};

From 96fa7b63075afcb3aa194ce7f3c8378d2be1650a Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Thu, 22 Aug 2024 13:21:42 +0100
Subject: [PATCH 27/32] refactor: use express next for error handling

---
 .../src/server-middleware/api/cache/index.js  |  5 +-
 .../src/server-middleware/api/events/log.js   |  7 +--
 .../server-middleware/api/events/trending.js  |  7 +--
 .../src/server-middleware/api/events/views.js |  7 +--
 .../portal/src/server-middleware/api/index.js |  6 +-
 .../api/jira-service-desk/feedback.js         |  7 +--
 .../api/jira-service-desk/galleries.js        |  7 +--
 .../api/polls/remove-vote.js                  | 63 ++++++++-----------
 .../src/server-middleware/api/polls/vote.js   | 43 ++++++-------
 .../src/server-middleware/api/polls/votes.js  | 36 +++++------
 .../portal/src/server-middleware/api/utils.js | 16 +++--
 11 files changed, 86 insertions(+), 118 deletions(-)

diff --git a/packages/portal/src/server-middleware/api/cache/index.js b/packages/portal/src/server-middleware/api/cache/index.js
index e12ac7046d..fee41d6916 100644
--- a/packages/portal/src/server-middleware/api/cache/index.js
+++ b/packages/portal/src/server-middleware/api/cache/index.js
@@ -1,5 +1,4 @@
 import { createClient } from 'redis';
-import { errorHandler } from '../utils.js';
 
 const cacheKey = (id) => `@europeana:portal.js:${id.replace(/\//g, ':')}`;
 
@@ -30,7 +29,7 @@ export const cached = async(ids, config = {}) => {
   return values;
 };
 
-export default (config = {}) => (req, res) => {
+export default (config = {}) => (req, res, next) => {
   const ids = req.params[0] ? req.params[0] : req.query.id;
 
   return cached(ids, config)
@@ -38,5 +37,5 @@ export default (config = {}) => (req, res) => {
       res.set('Content-Type', 'application/json');
       res.send(data);
     })
-    .catch(error => errorHandler(res, error));
+    .catch(next);
 };
diff --git a/packages/portal/src/server-middleware/api/events/log.js b/packages/portal/src/server-middleware/api/events/log.js
index e2d6f210d8..95089bb30b 100644
--- a/packages/portal/src/server-middleware/api/events/log.js
+++ b/packages/portal/src/server-middleware/api/events/log.js
@@ -1,11 +1,10 @@
 import isbot from 'isbot';
 import pg from '../pg.js';
 
-// TODO: use `next` for error handling
 // TODO: accept multiple uris for the same action
 // TODO: log user agent?
 // TODO: validate action_types
-export default async(req, res) => {
+export default async(req, res, next) => {
   try {
     // Respond early as clients don't need to wait for the results of this logging
     res.sendStatus(204);
@@ -74,8 +73,6 @@ export default async(req, res) => {
     [objectRow.id, sessionRow.id, actionType]
     );
   } catch (err) {
-    console.error(err);
-    const status = err.response?.status || 500;
-    res.sendStatus(status);
+    next(err);
   }
 };
diff --git a/packages/portal/src/server-middleware/api/events/trending.js b/packages/portal/src/server-middleware/api/events/trending.js
index 97c5d1b74f..9b4d289801 100644
--- a/packages/portal/src/server-middleware/api/events/trending.js
+++ b/packages/portal/src/server-middleware/api/events/trending.js
@@ -1,7 +1,6 @@
 import pg from '../pg.js';
 
-// TODO: use `next` for error handling
-export default async(req, res) => {
+export default async(req, res, next) => {
   try {
     const selectObjectResult = await pg.query(`
       SELECT uri,
@@ -71,8 +70,6 @@ export default async(req, res) => {
 
     res.json({ items: selectObjectResult.rows });
   } catch (err) {
-    console.error(err);
-    const status = err.response?.status || 500;
-    res.sendStatus(status);
+    next(err);
   }
 };
diff --git a/packages/portal/src/server-middleware/api/events/views.js b/packages/portal/src/server-middleware/api/events/views.js
index 1fd3117870..e6a893aa3e 100644
--- a/packages/portal/src/server-middleware/api/events/views.js
+++ b/packages/portal/src/server-middleware/api/events/views.js
@@ -1,7 +1,6 @@
 import pg from '../pg.js';
 
-// TODO: use `next` for error handling
-export default async(req, res) => {
+export default async(req, res, next) => {
   try {
     if (!pg.enabled) {
       res.json({ viewCount: 0 });
@@ -45,8 +44,6 @@ export default async(req, res) => {
 
     res.json({ viewCount });
   } catch (err) {
-    console.error(err);
-    const status = err.response?.status || 500;
-    res.sendStatus(status);
+    next(err);
   }
 };
diff --git a/packages/portal/src/server-middleware/api/index.js b/packages/portal/src/server-middleware/api/index.js
index 99f3b39ad9..afbf72ada9 100644
--- a/packages/portal/src/server-middleware/api/index.js
+++ b/packages/portal/src/server-middleware/api/index.js
@@ -1,6 +1,3 @@
-// TODO: replace route-specific error handling with one error handler middleware
-//       @see https://expressjs.com/en/guide/error-handling.html
-
 import express from 'express';
 import cors from 'cors';
 import apm from 'elastic-apm-node';
@@ -8,7 +5,7 @@ import apm from 'elastic-apm-node';
 import logging from '../logging.js';
 import pg from './pg.js';
 import auth from './auth.js';
-import { forbiddenUnlessOriginAllowed, nuxtRuntimeConfig } from './utils.js';
+import { errorHandler, forbiddenUnlessOriginAllowed, nuxtRuntimeConfig } from './utils.js';
 
 const app = express();
 app.disable('x-powered-by'); // Security: do not disclose technology fingerprints
@@ -63,5 +60,6 @@ import polls from './polls/index.js';
 app.use('/votes', polls);
 
 app.all('/*', (req, res) => res.sendStatus(404));
+app.use(errorHandler);
 
 export default app;
diff --git a/packages/portal/src/server-middleware/api/jira-service-desk/feedback.js b/packages/portal/src/server-middleware/api/jira-service-desk/feedback.js
index dbff8bc0fb..7ceefdb949 100644
--- a/packages/portal/src/server-middleware/api/jira-service-desk/feedback.js
+++ b/packages/portal/src/server-middleware/api/jira-service-desk/feedback.js
@@ -1,7 +1,6 @@
 import axios from 'axios';
 import createHttpError from 'http-errors';
 
-import { errorHandler } from '../utils.js';
 import { truncate } from '../../../mixins/truncate.js';
 
 const JIRA_SERVICE_DESK_API_PATH = '/rest/servicedeskapi/request';
@@ -60,12 +59,12 @@ const jiraOptions = (options) => ({
 });
 
 // Docs: https://developer.atlassian.com/cloud/jira/service-desk/rest/api-group-request/#api-rest-servicedeskapi-request-post
-export default (options = {}) => (req, res) => {
+export default (options = {}) => (req, res, next) => {
   return validateFeedback(req.body.feedback)
     .then(() => (axios
       .create({ baseURL: options.origin })
       .post(JIRA_SERVICE_DESK_API_PATH, jiraData(options, req), jiraOptions(options))
-      .then(jiraRes => res.sendStatus(jiraRes.status))
+      .then((jiraRes) => res.sendStatus(jiraRes.status))
     ))
-    .catch(error => errorHandler(res, error));
+    .catch(next);
 };
diff --git a/packages/portal/src/server-middleware/api/jira-service-desk/galleries.js b/packages/portal/src/server-middleware/api/jira-service-desk/galleries.js
index f9f0a30945..dfbc26507f 100644
--- a/packages/portal/src/server-middleware/api/jira-service-desk/galleries.js
+++ b/packages/portal/src/server-middleware/api/jira-service-desk/galleries.js
@@ -1,6 +1,5 @@
 import axios from 'axios';
 
-import { errorHandler } from '../utils.js';
 import { truncate } from '../../../mixins/truncate.js';
 
 const JIRA_SERVICE_DESK_API_PATH = '/rest/servicedeskapi/request';
@@ -45,9 +44,9 @@ const jiraOptions = options => ({
 });
 
 // Docs: https://developer.atlassian.com/cloud/jira/service-desk/rest/api-group-request/#api-rest-servicedeskapi-request-post
-export default (options = {}) => (req, res) => {
+export default (options = {}) => (req, res, next) => {
   return axios.create({ baseURL: options.origin })
     .post(JIRA_SERVICE_DESK_API_PATH, jiraData(options, req), jiraOptions(options))
-    .then(jiraRes => res.sendStatus(jiraRes.status))
-    .catch(error => errorHandler(res, error));
+    .then((jiraRes) => res.sendStatus(jiraRes.status))
+    .catch(next);
 };
diff --git a/packages/portal/src/server-middleware/api/polls/remove-vote.js b/packages/portal/src/server-middleware/api/polls/remove-vote.js
index 1877323908..51c43a8f81 100644
--- a/packages/portal/src/server-middleware/api/polls/remove-vote.js
+++ b/packages/portal/src/server-middleware/api/polls/remove-vote.js
@@ -1,45 +1,36 @@
 import db from './model.js';
 import auth from '../auth.js';
+import createHttpError from 'http-errors';
 
 export default async(req, res) => {
-  try {
-    let voterExternalId = null;
-    if (req.headers.authorization) {
-      const userinfo = await auth.userinfo(req);
-      voterExternalId = userinfo?.sub || null;
-    }
-    if (voterExternalId === null) {
-      res.sendStatus(401);
-      return;
-    }
-
-    const voterRow = await db.findVoter(voterExternalId);
-    if (!voterRow) {
-      // voter doesn't exist, can't have voted on anything
-      res.sendStatus(403);
-      return;
-    }
+  let voterExternalId = null;
+  if (req.headers.authorization) {
+    const userinfo = await auth.userinfo(req);
+    voterExternalId = userinfo?.sub || null;
+  }
+  if (voterExternalId === null) {
+    throw createHttpError(401);
+  }
 
-    const { candidateExternalId } = req.params;
-    const candidateRow = await db.findCandidate(candidateExternalId);
-    if (!candidateRow) {
-      // candidate doesn't exist, can't have been voted on
-      res.sendStatus(404);
-      return;
-    }
+  const voterRow = await db.findVoter(voterExternalId);
+  if (!voterRow) {
+    // voter doesn't exist, can't have voted on anything
+    throw createHttpError(403);
+  }
 
-    const voteRow = await db.findVote(voterRow.id, candidateRow.id);
-    if (!voteRow) {
-      // vote doesn't exist, no need to remove
-      res.sendStatus(404);
-      return;
-    }
+  const { candidateExternalId } = req.params;
+  const candidateRow = await db.findCandidate(candidateExternalId);
+  if (!candidateRow) {
+    // candidate doesn't exist, can't have been voted on
+    throw createHttpError(404);
+  }
 
-    await db.deleteVote(voteRow.id);
-    res.sendStatus(204);
-  } catch (err) {
-    console.error(err);
-    const status = err.response?.status || 500;
-    res.sendStatus(status);
+  const voteRow = await db.findVote(voterRow.id, candidateRow.id);
+  if (!voteRow) {
+    // vote doesn't exist, no need to remove
+    throw createHttpError(404);
   }
+
+  await db.deleteVote(voteRow.id);
+  res.sendStatus(204);
 };
diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index 1b17ec8973..55a25fb808 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -1,33 +1,26 @@
 import db from './model.js';
 import auth from '../auth.js';
+import createHttpError from 'http-errors';
 
 export default async(req, res) => {
-  try {
-    let voterExternalId = null;
-    if (req.headers.authorization) {
-      const userinfo = await auth.userinfo(req);
-      voterExternalId = userinfo?.sub || null;
-    }
-    if (voterExternalId === null) {
-      res.sendStatus(401);
-      return;
-    }
-
-    const { candidateExternalId } = req.params;
+  let voterExternalId = null;
+  if (req.headers.authorization) {
+    const userinfo = await auth.userinfo(req);
+    voterExternalId = userinfo?.sub || null;
+  }
+  if (voterExternalId === null) {
+    throw createHttpError(401);
+  }
 
-    const voterRow = await db.findVoter(voterExternalId) || await db.createVoter(voterExternalId);
-    const candidateRow = await db.findCandidate(candidateExternalId) || await db.createCandidate(candidateExternalId);
-    if (await db.findVote(voterRow.id, candidateRow.id)) {
-      // Voter has already voted for this candidate
-      res.sendStatus(409);
-      return;
-    }
+  const { candidateExternalId } = req.params;
 
-    await db.createVote(voterRow.id, candidateRow.id);
-    res.sendStatus(204);
-  } catch (err) {
-    console.error(err);
-    const status = err.response?.status || 500;
-    res.sendStatus(status);
+  const voterRow = await db.findVoter(voterExternalId) || await db.createVoter(voterExternalId);
+  const candidateRow = await db.findCandidate(candidateExternalId) || await db.createCandidate(candidateExternalId);
+  if (await db.findVote(voterRow.id, candidateRow.id)) {
+    // Voter has already voted for this candidate
+    throw createHttpError(409);
   }
+
+  await db.createVote(voterRow.id, candidateRow.id);
+  res.sendStatus(204);
 };
diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index c522884a14..752539f565 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -2,29 +2,23 @@ import db from './model.js';
 import auth from '../auth.js';
 
 export default async(req, res) => {
-  try {
-    let voterExternalId = null;
-    if (req.headers.authorization) {
-      const userinfo = await auth.userinfo(req);
-      voterExternalId = userinfo?.sub || null;
-    }
+  let voterExternalId = null;
+  if (req.headers.authorization) {
+    const userinfo = await auth.userinfo(req);
+    voterExternalId = userinfo?.sub || null;
+  }
 
-    const candidateExternalIds = req.query?.candidate?.split(',') || [];
+  const candidateExternalIds = req.query?.candidate?.split(',') || [];
 
-    const voterRow = await db.findVoter(voterExternalId) || { id: null };
+  const voterRow = await db.findVoter(voterExternalId) || { id: null };
 
-    const votesForCandidates = await db.findVotes(voterRow.id, candidateExternalIds);
+  const votesForCandidates = await db.findVotes(voterRow.id, candidateExternalIds);
 
-    res.json(votesForCandidates.reduce((memo, row) => {
-      memo[row.external_id] = {
-        total: row.total,
-        votedByCurrentVoter: row.voted_by_current_voter === '1'
-      };
-      return memo;
-    }, {}));
-  } catch (err) {
-    console.error(err);
-    const status = err.response?.status || 500;
-    res.sendStatus(status);
-  }
+  res.json(votesForCandidates.reduce((memo, row) => {
+    memo[row.external_id] = {
+      total: row.total,
+      votedByCurrentVoter: row.voted_by_current_voter === '1'
+    };
+    return memo;
+  }, {}));
 };
diff --git a/packages/portal/src/server-middleware/api/utils.js b/packages/portal/src/server-middleware/api/utils.js
index 3ecf9d0bc3..e8c32f9248 100644
--- a/packages/portal/src/server-middleware/api/utils.js
+++ b/packages/portal/src/server-middleware/api/utils.js
@@ -3,13 +3,17 @@ import createHttpError from 'http-errors';
 
 import nuxtConfig from '../../../nuxt.config.js';
 
-export const errorHandler = (res, error) => {
-  let status = error.status || 500;
-  let message = error.message;
+export const errorHandler = (err, req, res) => {
+  console.error(err);
 
-  if (error.response) {
-    status = error.response.status;
-    message = error.response.data.errorMessage;
+  let status = err.status || 500;
+  let message = err.message;
+
+  if (err.response) {
+    status = err.response.status;
+    if (err.response.data.errorMessage) {
+      message = err.response.data.errorMessage;
+    }
   }
 
   res.status(status).set('Content-Type', 'text/plain').send(message);

From d66118a4d1fc1fe21c545c5cd06fef68bb957afc Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Thu, 22 Aug 2024 13:55:24 +0100
Subject: [PATCH 28/32] test: update event/jira unit tests

---
 .../src/server-middleware/api/events/log.js   |  2 +-
 .../src/server-middleware/api/events/views.js |  4 --
 .../server-middleware/api/events/log.spec.js  | 59 ++++++-------------
 .../api/events/trending.spec.js               | 33 +++--------
 .../api/events/views.spec.js                  | 39 ++++--------
 .../api/jira-service-desk/feedback.spec.js    | 55 +++++++++--------
 .../api/jira-service-desk/galleries.spec.js   |  8 +--
 7 files changed, 69 insertions(+), 131 deletions(-)

diff --git a/packages/portal/src/server-middleware/api/events/log.js b/packages/portal/src/server-middleware/api/events/log.js
index 95089bb30b..a2522d0412 100644
--- a/packages/portal/src/server-middleware/api/events/log.js
+++ b/packages/portal/src/server-middleware/api/events/log.js
@@ -9,7 +9,7 @@ export default async(req, res, next) => {
     // Respond early as clients don't need to wait for the results of this logging
     res.sendStatus(204);
 
-    if (!pg.enabled || isbot(req.get('user-agent'))) {
+    if (isbot(req.get('user-agent'))) {
       return;
     }
 
diff --git a/packages/portal/src/server-middleware/api/events/views.js b/packages/portal/src/server-middleware/api/events/views.js
index e6a893aa3e..9ea8629358 100644
--- a/packages/portal/src/server-middleware/api/events/views.js
+++ b/packages/portal/src/server-middleware/api/events/views.js
@@ -2,10 +2,6 @@ import pg from '../pg.js';
 
 export default async(req, res, next) => {
   try {
-    if (!pg.enabled) {
-      res.json({ viewCount: 0 });
-      return;
-    }
     const url = new URL(req.query?.url);
     // Ignore any search query or hash
     const uri = `${url.origin}${url.pathname}`;
diff --git a/packages/portal/tests/unit/server-middleware/api/events/log.spec.js b/packages/portal/tests/unit/server-middleware/api/events/log.spec.js
index 0faeda78c8..39778a39b2 100644
--- a/packages/portal/tests/unit/server-middleware/api/events/log.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/events/log.spec.js
@@ -48,14 +48,11 @@ pgPoolQuery.withArgs(
 )
   .resolves({});
 
-const expressReqStub = {
-  body: fixtures.reqBody,
-  get: sinon.spy()
-};
 const expressResStub = {
   json: sinon.spy(),
   sendStatus: sinon.spy()
 };
+const expressNextStub = sinon.spy();
 
 describe('@/server-middleware/api/events/log', () => {
   beforeAll(() => {
@@ -64,60 +61,40 @@ describe('@/server-middleware/api/events/log', () => {
   afterEach(sinon.resetHistory);
   afterAll(sinon.resetBehavior);
 
-  describe('when not explicitly enabled', () => {
-    const options = {};
+  describe('when user agent is a known bot', () => {
+    const expressReqStub = {
+      get: sinon.stub().withArgs('user-agent').returns('search engine bot')
+    };
 
     it('does not query postgres', async() => {
-      await logEventsHandler(options)(expressReqStub, expressResStub);
+      await logEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
       expect(pgPoolQuery.called).toBe(false);
     });
 
     it('responds with 204 status', async() => {
-      await logEventsHandler(options)(expressReqStub, expressResStub);
+      await logEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
       expect(expressResStub.sendStatus.calledWith(204)).toBe(true);
     });
   });
 
-  describe('when explicitly enabled', () => {
-    const options = { enabled: true };
-
-    describe('and user agent is a known bot', () => {
-      const expressReqStub = {
-        get: sinon.stub().withArgs('user-agent').returns('search engine bot')
-      };
-
-      it('does not query postgres', async() => {
-        await logEventsHandler(options)(expressReqStub, expressResStub);
+  describe('when user agent is not a known bot', () => {
+    const expressReqStub = {
+      body: fixtures.reqBody,
+      get: sinon.spy()
+    };
 
-        expect(pgPoolQuery.called).toBe(false);
-      });
+    it('runs all postgres queries to log event', async() => {
+      await logEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
-      it('responds with 204 status', async() => {
-        await logEventsHandler(options)(expressReqStub, expressResStub);
-
-        expect(expressResStub.sendStatus.calledWith(204)).toBe(true);
-      });
+      expect(pgPoolQuery.getCalls().length).toBe(6);
     });
 
-    describe('and user agent is not a known bot', () => {
-      const expressReqStub = {
-        body: fixtures.reqBody,
-        get: sinon.spy()
-      };
-
-      it('runs all postgres queries to log event', async() => {
-        await logEventsHandler(options)(expressReqStub, expressResStub);
-
-        expect(pgPoolQuery.getCalls().length).toBe(6);
-      });
-
-      it('responds with 204 status', async() => {
-        await logEventsHandler(options)(expressReqStub, expressResStub);
+    it('responds with 204 status', async() => {
+      await logEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
-        expect(expressResStub.sendStatus.calledWith(204)).toBe(true);
-      });
+      expect(expressResStub.sendStatus.calledWith(204)).toBe(true);
     });
   });
 });
diff --git a/packages/portal/tests/unit/server-middleware/api/events/trending.spec.js b/packages/portal/tests/unit/server-middleware/api/events/trending.spec.js
index 6b70160785..49e01861bf 100644
--- a/packages/portal/tests/unit/server-middleware/api/events/trending.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/events/trending.spec.js
@@ -14,6 +14,7 @@ const expressResStub = {
   json: sinon.spy(),
   sendStatus: sinon.spy()
 };
+const expressNextStub = sinon.spy();
 
 describe('@/server-middleware/api/events/trending', () => {
   beforeAll(() => {
@@ -22,35 +23,15 @@ describe('@/server-middleware/api/events/trending', () => {
   afterEach(sinon.resetHistory);
   afterAll(sinon.resetBehavior);
 
-  describe('when not explicitly enabled', () => {
-    const options = {};
+  it('queries postgres for trending items', async() => {
+    await trendingEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
-    it('does not query postgres', async() => {
-      await trendingEventsHandler(options)(expressReqStub, expressResStub);
-
-      expect(pgPoolQuery.called).toBe(false);
-    });
-
-    it('responds with empty items array as json', async() => {
-      await trendingEventsHandler(options)(expressReqStub, expressResStub);
-
-      expect(expressResStub.json.calledWith({ items: [] })).toBe(true);
-    });
+    expect(pgPoolQuery.called).toBe(true);
   });
 
-  describe('when explicitly enabled', () => {
-    const options = { enabled: true };
-
-    it('queries postgres for trending items', async() => {
-      await trendingEventsHandler(options)(expressReqStub, expressResStub);
-
-      expect(pgPoolQuery.called).toBe(true);
-    });
-
-    it('responds with items as json', async() => {
-      await trendingEventsHandler(options)(expressReqStub, expressResStub);
+  it('responds with items as json', async() => {
+    await trendingEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
-      expect(expressResStub.json.calledWith({ items: fixtures.rows })).toBe(true);
-    });
+    expect(expressResStub.json.calledWith({ items: fixtures.rows })).toBe(true);
   });
 });
diff --git a/packages/portal/tests/unit/server-middleware/api/events/views.spec.js b/packages/portal/tests/unit/server-middleware/api/events/views.spec.js
index d4b0021a5d..993aadeacf 100644
--- a/packages/portal/tests/unit/server-middleware/api/events/views.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/events/views.spec.js
@@ -16,6 +16,7 @@ const expressResStub = {
   json: sinon.spy(),
   sendStatus: sinon.spy()
 };
+const expressNextStub = sinon.spy();
 
 describe('@/server-middleware/api/events/views', () => {
   beforeAll(() => {
@@ -24,38 +25,18 @@ describe('@/server-middleware/api/events/views', () => {
   afterEach(sinon.resetHistory);
   afterAll(sinon.resetBehavior);
 
-  describe('when not explicitly enabled', () => {
-    const options = {};
+  it('queries postgres for the views', async() => {
+    await viewsEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
-    it('does not query postgres', async() => {
-      await viewsEventsHandler(options)(expressReqStub, expressResStub);
-
-      expect(pgPoolQuery.called).toBe(false);
-    });
-
-    it('responds with viewCount 0 as json', async() => {
-      await viewsEventsHandler(options)(expressReqStub, expressResStub);
-
-      expect(expressResStub.json.calledWith({ viewCount: 0 })).toBe(true);
-    });
+    expect(pgPoolQuery.calledWith(
+      sinon.match((sql) => sql.trim().startsWith('SELECT ')),
+      ['https://example.com/example', 'https://example.com/example']
+    )).toBe(true);
   });
 
-  describe('when explicitly enabled', () => {
-    const options = { enabled: true };
-
-    it('queries postgres for the views', async() => {
-      await viewsEventsHandler(options)(expressReqStub, expressResStub);
-
-      expect(pgPoolQuery.calledWith(
-        sinon.match((sql) => sql.trim().startsWith('SELECT ')),
-        ['https://example.com/example', 'https://example.com/example']
-      )).toBe(true);
-    });
-
-    it('responds with the view count as json', async() => {
-      await viewsEventsHandler(options)(expressReqStub, expressResStub);
+  it('responds with the view count as json', async() => {
+    await viewsEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
-      expect(expressResStub.json.calledWith({ viewCount: 128 })).toBe(true);
-    });
+    expect(expressResStub.json.calledWith({ viewCount: 128 })).toBe(true);
   });
 });
diff --git a/packages/portal/tests/unit/server-middleware/api/jira-service-desk/feedback.spec.js b/packages/portal/tests/unit/server-middleware/api/jira-service-desk/feedback.spec.js
index b96bb799ad..91e0686916 100644
--- a/packages/portal/tests/unit/server-middleware/api/jira-service-desk/feedback.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/jira-service-desk/feedback.spec.js
@@ -1,7 +1,6 @@
 import serviceDesk from '@/server-middleware/api/jira-service-desk/feedback';
 
 import nock from 'nock';
-nock.disableNetConnect();
 import sinon from 'sinon';
 
 const options = {
@@ -31,12 +30,20 @@ const mockResponse = () => {
   res.send = sinon.stub().returns(res);
   return res;
 };
-const mockJiraApiRequest = body => nock(options.origin).post('/rest/servicedeskapi/request', body);
+const mockJiraApiRequest = (body) => nock(options.origin).post('/rest/servicedeskapi/request', body);
+const expressNextStub = sinon.spy();
 
 describe('server-middleware/api/jira-service-desk/feedback', () => {
+  beforeAll(() => {
+    nock.disableNetConnect();
+  });
   afterEach(() => {
+    sinon.resetHistory();
     nock.cleanAll();
   });
+  afterAll(() => {
+    nock.enableNetConnect();
+  });
 
   describe('middleware', () => {
     describe('request handling', () => {
@@ -45,7 +52,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
         const res = mockResponse();
         mockJiraApiRequest().reply(201);
 
-        await middleware(req, res);
+        await middleware(req, res, expressNextStub);
 
         expect(nock.isDone()).toBe(true);
       });
@@ -59,7 +66,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
             (body.requestTypeId === options.serviceDesk.feedback.requestTypeId)
           )).reply(201);
 
-          await middleware(req, res);
+          await middleware(req, res, expressNextStub);
 
           expect(nock.isDone()).toBe(true);
         });
@@ -72,7 +79,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const res = mockResponse();
           mockJiraApiRequest(body => body.requestFieldValues.description === reqBody.feedback).reply(201);
 
-          await middleware(req, res);
+          await middleware(req, res, expressNextStub);
 
           expect(nock.isDone()).toBe(true);
         });
@@ -84,9 +91,9 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const req = mockRequest(reqBody);
           const res = mockResponse();
 
-          await middleware(req, res);
-          expect(res.status.calledWith(400)).toBe(true);
-          expect(res.send.calledWith('Invalid feedback.')).toBe(true);
+          await middleware(req, res, expressNextStub);
+          expect(expressNextStub.calledWith(sinon.match.has('message', 'Invalid feedback.'))).toBe(true);
+          expect(expressNextStub.calledWith(sinon.match.has('status', 400))).toBe(true);
         });
 
         it('responds with an error when the feedback is less than five words', async() => {
@@ -96,9 +103,9 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const req = mockRequest(reqBody);
           const res = mockResponse();
 
-          await middleware(req, res);
-          expect(res.status.calledWith(400)).toBe(true);
-          expect(res.send.calledWith('Invalid feedback.')).toBe(true);
+          await middleware(req, res, expressNextStub);
+          expect(expressNextStub.calledWith(sinon.match.has('message', 'Invalid feedback.'))).toBe(true);
+          expect(expressNextStub.calledWith(sinon.match.has('status', 400))).toBe(true);
         });
 
         it('truncates feedback to 50 characters in summary field, removing newlines', async() => {
@@ -111,7 +118,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const res = mockResponse();
           mockJiraApiRequest(body => body.requestFieldValues.summary === summary).reply(201);
 
-          await middleware(req, res);
+          await middleware(req, res, expressNextStub);
 
           expect(nock.isDone()).toBe(true);
         });
@@ -127,7 +134,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const res = mockResponse();
           mockJiraApiRequest(body => body.requestFieldValues[options.serviceDesk.feedback.customFields.pageUrl] === reqBody.pageUrl).reply(201);
 
-          await middleware(req, res);
+          await middleware(req, res, expressNextStub);
 
           expect(nock.isDone()).toBe(true);
         });
@@ -140,7 +147,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const res = mockResponse();
           mockJiraApiRequest(body => !Object.keys(body).includes('raiseOnBehalfOf')).reply(201);
 
-          await middleware(req, res);
+          await middleware(req, res, expressNextStub);
 
           expect(nock.isDone()).toBe(true);
         });
@@ -154,7 +161,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const res = mockResponse();
           mockJiraApiRequest(body => body.raiseOnBehalfOf === reqBody.email).reply(201);
 
-          await middleware(req, res);
+          await middleware(req, res, expressNextStub);
 
           expect(nock.isDone()).toBe(true);
         });
@@ -168,35 +175,31 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
         const res = mockResponse();
         mockJiraApiRequest().reply(status);
 
-        await middleware(req, res);
+        await middleware(req, res, expressNextStub);
 
         expect(res.sendStatus.calledWith(status)).toBe(true);
       });
 
       it('responds with upstream error on failure', async() => {
         const status = 400;
-        const errorMessage = 'Summary is required.';
         const req = mockRequest();
         const res = mockResponse();
-        mockJiraApiRequest().reply(status, { errorMessage });
+        mockJiraApiRequest().reply(status);
 
-        await middleware(req, res);
+        await middleware(req, res, expressNextStub);
 
-        expect(res.status.calledWith(status)).toBe(true);
-        expect(res.send.calledWith(errorMessage)).toBe(true);
+        expect(expressNextStub.calledWith(sinon.match.has('message', 'Request failed with status code 400'))).toBe(true);
       });
 
-      it('responds with 500 status on request failure', async() => {
-        const status = 500;
+      it('responds with error on request failure', async() => {
         const errorMessage = 'Unknown error';
         const req = mockRequest();
         const res = mockResponse();
         mockJiraApiRequest().replyWithError(errorMessage);
 
-        await middleware(req, res);
+        await middleware(req, res, expressNextStub);
 
-        expect(res.status.calledWith(status)).toBe(true);
-        expect(res.send.calledWith(errorMessage)).toBe(true);
+        expect(expressNextStub.calledWith(sinon.match.has('message', errorMessage))).toBe(true);
       });
     });
   });
diff --git a/packages/portal/tests/unit/server-middleware/api/jira-service-desk/galleries.spec.js b/packages/portal/tests/unit/server-middleware/api/jira-service-desk/galleries.spec.js
index ee8c2d779d..9b6b96fef9 100644
--- a/packages/portal/tests/unit/server-middleware/api/jira-service-desk/galleries.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/jira-service-desk/galleries.spec.js
@@ -1,7 +1,6 @@
 import galleryPublicationServiceDesk from '@/server-middleware/api/jira-service-desk/galleries';
 
 import nock from 'nock';
-nock.disableNetConnect();
 import sinon from 'sinon';
 
 const options = {
@@ -35,12 +34,13 @@ describe('server-middleware/api/jira-service-desk/galleries', () => {
   beforeAll(() => {
     nock.disableNetConnect();
   });
-  afterAll(() => {
-    nock.enableNetConnect();
-  });
   afterEach(() => {
+    sinon.resetHistory();
     nock.cleanAll();
   });
+  afterAll(() => {
+    nock.enableNetConnect();
+  });
 
   describe('middleware', () => {
     describe('request handling', () => {

From 5ef092a43642ee5ae88c7f88749c23213e97c719 Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Fri, 23 Aug 2024 11:29:43 +0100
Subject: [PATCH 29/32] test: spec polls API

---
 .../api/{auth.js => keycloak.js}              |  15 +-
 .../src/server-middleware/api/polls/model.js  |  25 +-
 .../api/polls/remove-vote.js                  |  59 ++---
 .../src/server-middleware/api/polls/vote.js   |  41 ++--
 .../src/server-middleware/api/polls/votes.js  |  36 ++-
 .../server-middleware/api/{pg => }/pg.spec.js |   4 +-
 .../server-middleware/api/polls/model.spec.js | 215 ++++++++++++++++++
 .../api/polls/remove-vote.spec.js             | 177 ++++++++------
 .../server-middleware/api/polls/vote.spec.js  | 208 ++++++++++-------
 .../server-middleware/api/polls/votes.spec.js | 105 +++++----
 .../tests/unit/server-middleware/utils.js     |  17 ++
 11 files changed, 604 insertions(+), 298 deletions(-)
 rename packages/portal/src/server-middleware/api/{auth.js => keycloak.js} (50%)
 rename packages/portal/tests/unit/server-middleware/api/{pg => }/pg.spec.js (89%)
 create mode 100644 packages/portal/tests/unit/server-middleware/api/polls/model.spec.js
 create mode 100644 packages/portal/tests/unit/server-middleware/utils.js

diff --git a/packages/portal/src/server-middleware/api/auth.js b/packages/portal/src/server-middleware/api/keycloak.js
similarity index 50%
rename from packages/portal/src/server-middleware/api/auth.js
rename to packages/portal/src/server-middleware/api/keycloak.js
index 4a9e3925c8..ae105bbfd0 100644
--- a/packages/portal/src/server-middleware/api/auth.js
+++ b/packages/portal/src/server-middleware/api/keycloak.js
@@ -3,13 +3,22 @@ import axios from 'axios';
 export default {
   config: {},
 
-  async userinfo(req) {
+  async userInfo(authorization) {
     const keycloakUserinfoResponse = await axios({
       baseURL: this.config.origin,
-      url: `/auth/realms/${this.config.realm}/protocol/openid-connect/userinfo`,
+      url: `/auth/realms/${this.config.realm}/protocol/openid-connect/userInfo`,
       method: 'get',
-      headers: { authorization: req.headers.authorization }
+      headers: { authorization }
     });
     return keycloakUserinfoResponse.data;
+  },
+
+  async userId(authorization) {
+    let id = null;
+    if (authorization) {
+      const userInfo = await this.userInfo(authorization);
+      id = userInfo?.sub || null;
+    }
+    return id;
   }
 };
diff --git a/packages/portal/src/server-middleware/api/polls/model.js b/packages/portal/src/server-middleware/api/polls/model.js
index 136a94ce96..352a2e9df7 100644
--- a/packages/portal/src/server-middleware/api/polls/model.js
+++ b/packages/portal/src/server-middleware/api/polls/model.js
@@ -24,7 +24,7 @@ const findCandidate = async(candidateExternalId) => {
   return (selectCandidateResult.rowCount > 0) ? selectCandidateResult.rows[0] : null;
 };
 
-// TODO: sanity check this against external data sources
+// TODO: sanity check this against external data sources?
 const createCandidate = async(candidateExternalId) => {
   const insertCandidateResult = await pg.query(
     'INSERT INTO polls.candidates (external_id) VALUES($1) RETURNING id',
@@ -42,24 +42,23 @@ const findVote = async(voterId, candidateId) => {
 };
 
 const findVotes = async(voterId, candidateExternalIds) => {
-  const selectVotesResult = await pg.query(`
-    SELECT c.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE voter_id=$2 AND candidate_id=c.id) AS voted_by_current_voter
-      FROM polls.votes v LEFT JOIN polls.candidates c
-      ON v.candidate_id=c.id
-      WHERE c.external_id LIKE ANY($1)
-      GROUP BY (c.id)
+  const selectVotesResult = await pg.query(
+    `
+      SELECT c.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE voter_id=$2 AND candidate_id=c.id) AS voted_by_current_voter
+        FROM polls.votes v LEFT JOIN polls.candidates c
+        ON v.candidate_id=c.id
+        WHERE c.external_id LIKE ANY($1)
+        GROUP BY (c.id)
     `,
-  [candidateExternalIds, voterId]
+    [candidateExternalIds, voterId]
   );
   return selectVotesResult.rows || [];
 };
 
 const createVote = async(voterId, candidateId) => {
-  const insertVoteResult = await pg.query(`
-    INSERT INTO polls.votes (voter_id, candidate_id, occurred_at)
-    VALUES($1, $2, CURRENT_TIMESTAMP)
-    `,
-  [voterId, candidateId]
+  const insertVoteResult = await pg.query(
+    'INSERT INTO polls.votes (voter_id, candidate_id, occurred_at) VALUES($1, $2, CURRENT_TIMESTAMP)',
+    [voterId, candidateId]
   );
   return insertVoteResult.rows[0];
 };
diff --git a/packages/portal/src/server-middleware/api/polls/remove-vote.js b/packages/portal/src/server-middleware/api/polls/remove-vote.js
index 51c43a8f81..0db96dc03d 100644
--- a/packages/portal/src/server-middleware/api/polls/remove-vote.js
+++ b/packages/portal/src/server-middleware/api/polls/remove-vote.js
@@ -1,36 +1,37 @@
-import db from './model.js';
-import auth from '../auth.js';
 import createHttpError from 'http-errors';
 
-export default async(req, res) => {
-  let voterExternalId = null;
-  if (req.headers.authorization) {
-    const userinfo = await auth.userinfo(req);
-    voterExternalId = userinfo?.sub || null;
-  }
-  if (voterExternalId === null) {
-    throw createHttpError(401);
-  }
+import db from './model.js';
+import keycloak from '../keycloak.js';
 
-  const voterRow = await db.findVoter(voterExternalId);
-  if (!voterRow) {
-    // voter doesn't exist, can't have voted on anything
-    throw createHttpError(403);
-  }
+export default async(req, res, next) => {
+  try {
+    const voterExternalId = await keycloak.userId(req.headers.authorization);
+    if (voterExternalId === null) {
+      throw createHttpError(401);
+    }
 
-  const { candidateExternalId } = req.params;
-  const candidateRow = await db.findCandidate(candidateExternalId);
-  if (!candidateRow) {
-    // candidate doesn't exist, can't have been voted on
-    throw createHttpError(404);
-  }
+    const voterRow = await db.findVoter(voterExternalId);
+    if (!voterRow) {
+      // voter doesn't exist, can't have voted on anything
+      throw createHttpError(403);
+    }
 
-  const voteRow = await db.findVote(voterRow.id, candidateRow.id);
-  if (!voteRow) {
-    // vote doesn't exist, no need to remove
-    throw createHttpError(404);
-  }
+    const { candidateExternalId } = req.params;
+    const candidateRow = await db.findCandidate(candidateExternalId);
+    if (!candidateRow) {
+      // candidate doesn't exist, can't have been voted on
+      throw createHttpError(404);
+    }
 
-  await db.deleteVote(voteRow.id);
-  res.sendStatus(204);
+    const voteRow = await db.findVote(voterRow.id, candidateRow.id);
+    if (!voteRow) {
+      // vote doesn't exist, no need to remove
+      throw createHttpError(404);
+    }
+
+    await db.deleteVote(voteRow.id);
+    res.sendStatus(204);
+  } catch (err) {
+    next(err);
+  }
 };
diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
index 55a25fb808..569cb0f3dd 100644
--- a/packages/portal/src/server-middleware/api/polls/vote.js
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -1,26 +1,27 @@
-import db from './model.js';
-import auth from '../auth.js';
 import createHttpError from 'http-errors';
 
-export default async(req, res) => {
-  let voterExternalId = null;
-  if (req.headers.authorization) {
-    const userinfo = await auth.userinfo(req);
-    voterExternalId = userinfo?.sub || null;
-  }
-  if (voterExternalId === null) {
-    throw createHttpError(401);
-  }
+import db from './model.js';
+import keycloak from '../keycloak.js';
 
-  const { candidateExternalId } = req.params;
+export default async(req, res, next) => {
+  try {
+    const voterExternalId = await keycloak.userId(req.headers.authorization);
+    if (voterExternalId === null) {
+      throw createHttpError(401);
+    }
 
-  const voterRow = await db.findVoter(voterExternalId) || await db.createVoter(voterExternalId);
-  const candidateRow = await db.findCandidate(candidateExternalId) || await db.createCandidate(candidateExternalId);
-  if (await db.findVote(voterRow.id, candidateRow.id)) {
-    // Voter has already voted for this candidate
-    throw createHttpError(409);
-  }
+    const { candidateExternalId } = req.params;
+
+    const voterRow = await db.findVoter(voterExternalId) || await db.createVoter(voterExternalId);
+    const candidateRow = await db.findCandidate(candidateExternalId) || await db.createCandidate(candidateExternalId);
+    if (await db.findVote(voterRow.id, candidateRow.id)) {
+      // Voter has already voted for this candidate
+      throw createHttpError(409);
+    }
 
-  await db.createVote(voterRow.id, candidateRow.id);
-  res.sendStatus(204);
+    await db.createVote(voterRow.id, candidateRow.id);
+    res.sendStatus(204);
+  } catch (err) {
+    next(err);
+  }
 };
diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
index 752539f565..22d5779e6c 100644
--- a/packages/portal/src/server-middleware/api/polls/votes.js
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -1,24 +1,22 @@
 import db from './model.js';
-import auth from '../auth.js';
+import keycloak from '../keycloak.js';
 
-export default async(req, res) => {
-  let voterExternalId = null;
-  if (req.headers.authorization) {
-    const userinfo = await auth.userinfo(req);
-    voterExternalId = userinfo?.sub || null;
-  }
-
-  const candidateExternalIds = req.query?.candidate?.split(',') || [];
+export default async(req, res, next) => {
+  try {
+    const voterExternalId = await keycloak.userId(req.headers.authorization);
+    const candidateExternalIds = req.query?.candidate?.split(',') || [];
 
-  const voterRow = await db.findVoter(voterExternalId) || { id: null };
+    const voter = await db.findVoter(voterExternalId);
+    const votes = await db.findVotes(voter?.id, candidateExternalIds);
 
-  const votesForCandidates = await db.findVotes(voterRow.id, candidateExternalIds);
-
-  res.json(votesForCandidates.reduce((memo, row) => {
-    memo[row.external_id] = {
-      total: row.total,
-      votedByCurrentVoter: row.voted_by_current_voter === '1'
-    };
-    return memo;
-  }, {}));
+    res.json(votes.reduce((memo, row) => {
+      memo[row.external_id] = {
+        total: row.total,
+        votedByCurrentVoter: row.voted_by_current_voter === '1'
+      };
+      return memo;
+    }, {}));
+  } catch (err) {
+    next(err);
+  }
 };
diff --git a/packages/portal/tests/unit/server-middleware/api/pg/pg.spec.js b/packages/portal/tests/unit/server-middleware/api/pg.spec.js
similarity index 89%
rename from packages/portal/tests/unit/server-middleware/api/pg/pg.spec.js
rename to packages/portal/tests/unit/server-middleware/api/pg.spec.js
index 5c993b843b..13ddad7954 100644
--- a/packages/portal/tests/unit/server-middleware/api/pg/pg.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/pg.spec.js
@@ -1,12 +1,12 @@
 import pg from 'pg';
 import sinon from 'sinon';
 
-import pgEvents from '@/server-middleware/api/pg/pg.js';
+import pgEvents from '@/server-middleware/api/pg.js';
 
 const pgPoolOn = sinon.stub();
 const pgPoolQuery = sinon.stub();
 
-describe('@/server-middleware/api/pg/pg', () => {
+describe('@/server-middleware/api/pg', () => {
   beforeAll(() => {
     sinon.replace(pg.Pool.prototype, 'on', pgPoolOn);
     sinon.replace(pg.Pool.prototype, 'query', pgPoolQuery);
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/model.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/model.spec.js
new file mode 100644
index 0000000000..44a2b7dddb
--- /dev/null
+++ b/packages/portal/tests/unit/server-middleware/api/polls/model.spec.js
@@ -0,0 +1,215 @@
+import pg from 'pg';
+import sinon from 'sinon';
+
+import pollsModel from '@/server-middleware/api/polls/model.js';
+
+describe('@/server-middleware/api/polls/model', () => {
+  beforeEach(() => {
+    const pgPoolQueryStub = sinon.stub().rejects(new Error('Unstubbed query'));
+    sinon.replace(pg.Pool.prototype, 'query', pgPoolQueryStub);
+  });
+  afterEach(() => {
+    sinon.restore();
+  });
+
+  describe('findVoter', () => {
+    const voterExternalId = 'keycloak-uuid';
+    const voterRow = { id: 7 };
+    const sqlMatcher = 'SELECT id FROM polls.voters WHERE external_id=$1';
+    const argsMatcher = [voterExternalId];
+
+    it('selects from voters table', async() => {
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({});
+
+      await pollsModel.findVoter(voterExternalId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+    });
+
+    describe('when voter row is found', () => {
+      it('is returned', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rowCount: 1, rows: [voterRow] });
+
+        const voter = await pollsModel.findVoter(voterExternalId);
+
+        expect(voter).toEqual(voterRow);
+      });
+    });
+
+    describe('when voter row is not found', () => {
+      it('returns null', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rowCount: 0 });
+
+        const voter = await pollsModel.findVoter(voterExternalId);
+
+        expect(voter).toBeNull();
+      });
+    });
+  });
+
+  describe('createVoter', () => {
+    it('inserts row into voters table and returns it', async() => {
+      const voterExternalId = 'keycloak-uuid';
+      const voterRow = { id: 7 };
+      const sqlMatcher = 'INSERT INTO polls.voters (external_id) VALUES($1) RETURNING id';
+      const argsMatcher = [voterExternalId];
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rows: [voterRow] });
+
+      const voter = await pollsModel.createVoter(voterExternalId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+      expect(voter).toEqual(voterRow);
+    });
+  });
+
+  describe('findCandidate', () => {
+    const candidateExternalId = 'new-feature';
+    const candidateRow = { id: 7 };
+    const sqlMatcher = 'SELECT id FROM polls.candidates WHERE external_id=$1';
+    const argsMatcher = [candidateExternalId];
+
+    it('selects from candidates table', async() => {
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({});
+
+      await pollsModel.findCandidate(candidateExternalId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+    });
+
+    describe('when candidate row is found', () => {
+      it('is returned', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rowCount: 1, rows: [candidateRow] });
+
+        const voter = await pollsModel.findCandidate(candidateExternalId);
+
+        expect(voter).toEqual(candidateRow);
+      });
+    });
+
+    describe('when candidate row is not found', () => {
+      it('returns null', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rowCount: 0 });
+
+        const voter = await pollsModel.findCandidate(candidateExternalId);
+
+        expect(voter).toBeNull();
+      });
+    });
+  });
+
+  describe('createCandidate', () => {
+    it('inserts row into candidates table and returns it', async() => {
+      const candidateExternalId = 'new-feature';
+      const candidateRow = { id: 7 };
+      const sqlMatcher = 'INSERT INTO polls.candidates (external_id) VALUES($1) RETURNING id';
+      const argsMatcher = [candidateExternalId];
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rows: [candidateRow] });
+
+      const candidate = await pollsModel.createCandidate(candidateExternalId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+      expect(candidate).toEqual(candidateRow);
+    });
+  });
+
+  describe('findVote', () => {
+    const voterId = 5;
+    const candidateId = 6;
+    const voteRow = { id: 7 };
+    const sqlMatcher = 'SELECT id FROM polls.votes WHERE voter_id=$1 AND candidate_id=$2';
+    const argsMatcher = [voterId, candidateId];
+
+    it('selects from votes table', async() => {
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({});
+
+      await pollsModel.findVote(voterId, candidateId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+    });
+
+    describe('when candidate row is found', () => {
+      it('is returned', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rowCount: 1, rows: [voteRow] });
+
+        const vote = await pollsModel.findVote(voterId, candidateId);
+
+        expect(vote).toEqual(voteRow);
+      });
+    });
+
+    describe('when candidate row is not found', () => {
+      it('returns null', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rowCount: 0 });
+
+        const vote = await pollsModel.findVote(voterId, candidateId);
+
+        expect(vote).toBeNull();
+      });
+    });
+  });
+
+  describe('findVotes', () => {
+    const voterId = 5;
+    const candidateExternalIds = ['new-feature'];
+    const voteRows = [{ id: 6 }];
+    const sqlMatcher = sinon.match((sqlMatcher) => sqlMatcher.includes('FROM polls.votes v LEFT JOIN polls.candidates c'));
+    const argsMatcher = sinon.match.array.contains([voterId, candidateExternalIds]);
+
+    it('selects from votes table', async() => {
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({});
+
+      await pollsModel.findVotes(voterId, candidateExternalIds);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+    });
+
+    describe('when votes are found', () => {
+      it('returns them', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rows: voteRows });
+
+        const votes = await pollsModel.findVotes(voterId, candidateExternalIds);
+
+        expect(votes).toEqual(voteRows);
+      });
+    });
+
+    describe('when votes are not found', () => {
+      it('returns []', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({});
+
+        const votes = await pollsModel.findVotes(voterId, candidateExternalIds);
+
+        expect(votes).toEqual([]);
+      });
+    });
+  });
+
+  describe('createVote', () => {
+    it('inserts row into votes table and returns it', async() => {
+      const voterId = 5;
+      const candidateId = 6;
+      const voteRow = { id: 7 };
+      const sqlMatcher = 'INSERT INTO polls.votes (voter_id, candidate_id, occurred_at) VALUES($1, $2, CURRENT_TIMESTAMP)';
+      const argsMatcher = [voterId, candidateId];
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rows: [voteRow] });
+
+      const vote = await pollsModel.createVote(voterId, candidateId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+      expect(vote).toEqual(voteRow);
+    });
+  });
+
+  describe('deleteVote', () => {
+    it('deletes row from votes table', async() => {
+      const voteId = 8;
+      const sqlMatcher = 'DELETE FROM polls.votes WHERE id=$1';
+      const argsMatcher = [voteId];
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({});
+
+      await pollsModel.deleteVote(voteId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+    });
+  });
+});
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js
index f1324ce4c7..767f128562 100644
--- a/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js
@@ -1,96 +1,123 @@
-import pg from 'pg';
 import sinon from 'sinon';
 
-import removeVoteEventsHandler from '@/server-middleware/api/polls/remove-vote';
-
-const fixtures = {
-  db: {
-    voterId: 1,
-    candidateId: 2,
-    voteId: 3
-  },
-  reqBody: {
-    voterExternalId: 'keycloak_uuid',
-    candidateExternalId: 'contentful_id'
-  }
-};
-
-const pgPoolQuery = sinon.stub();
-pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.voters ')),
-  [fixtures.reqBody.voterExternalId]
-).resolves({ rowCount: 1, rows: [{ id: fixtures.db.voterId }] });
-
-pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.candidates ')),
-  [fixtures.reqBody.candidateExternalId]
-).resolves({ rowCount: 1, rows: [{ id: fixtures.db.candidateId }] });
-
-pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.votes ')),
-  [fixtures.db.voterId, fixtures.db.candidateId]
-).resolves({ rowCount: 1, rows: [{ id: fixtures.db.voteId }] });
-
-pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('DELETE FROM polls.votes ')),
-  [fixtures.db.voteId]
-).resolves();
-
-const expressReqStub = {
-  body: fixtures.reqBody,
-  get: sinon.spy()
-};
-
-const expressResStub = {
-  json: sinon.spy(),
-  sendStatus: sinon.spy()
-};
-
-describe('@/server-middleware/api/polls/vote', () => {
-  beforeAll(() => {
-    sinon.replace(pg.Pool.prototype, 'query', pgPoolQuery);
+import { expressReqStub, expressResStub, expressNextStub } from '../../utils.js';
+import removeVoteHandler from '@/server-middleware/api/polls/remove-vote.js';
+import pollsModel from '@/server-middleware/api/polls/model.js';
+import keycloak from '@/server-middleware/api/keycloak.js';
+
+describe('@/server-middleware/api/polls/remove-vote', () => {
+  beforeEach(() => {
+    sinon.stub(keycloak, 'userId').resolves(null);
+    sinon.stub(pollsModel, 'findVoter').resolves(null);
+    sinon.stub(pollsModel, 'findCandidate').resolves(null);
+    sinon.stub(pollsModel, 'findVote').resolves(null);
+    sinon.stub(pollsModel, 'deleteVote').resolves({});
   });
-  afterEach(sinon.resetHistory);
-  afterAll(sinon.resetBehavior);
 
-  describe('when not explicitly enabled', () => {
-    const options = {};
+  afterEach(() => {
+    sinon.restore();
+  });
 
-    it('does not query postgres', async() => {
-      await removeVoteEventsHandler(options)(expressReqStub, expressResStub);
+  it('authorizes request via keycloak', async() => {
+    const authorization = 'Bearer token';
+    const headers = { authorization };
 
-      expect(pgPoolQuery.called).toBe(false);
-    });
+    await removeVoteHandler(expressReqStub({ headers }), expressResStub(), expressNextStub());
+
+    expect(keycloak.userId.calledWith(authorization)).toBe(true);
+  });
 
-    it('responds with 503 status', async() => {
-      await removeVoteEventsHandler(options)(expressReqStub, expressResStub);
+  describe('when unauthorized', () => {
+    it('calls next with 401 error', async() => {
+      const next = expressNextStub();
 
-      expect(expressResStub.sendStatus.calledWith(503)).toBe(true);
+      await removeVoteHandler(expressReqStub(), expressResStub(), next);
+
+      expect(next.calledWith(sinon.match.has('status', 401))).toBe(true);
     });
   });
 
-  describe('when explicitly enabled', () => {
-    const options = { enabled: true };
+  describe('when authorized', () => {
+    const keycloakUserId = 'keycloak-uuid';
+    beforeEach(() => keycloak.userId.resolves(keycloakUserId));
+
+    it('queries db model to find voter row for keycloak user id', async() => {
+      await removeVoteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+      expect(pollsModel.findVoter.calledWith(keycloakUserId)).toBe(true);
+    });
+
+    describe('when voter row is not found', () => {
+      it('calls next with 403 error', async() => {
+        const next = expressNextStub();
+
+        await removeVoteHandler(expressReqStub(), expressResStub(), next);
+
+        expect(next.calledWith(sinon.match.has('status', 403))).toBe(true);
+      });
+    });
+
+    describe('when voter row is found', () => {
+      const voterId = 17;
+      beforeEach(() => pollsModel.findVoter.resolves({ id: voterId }));
 
-    const expressReqStub = {
-      body: fixtures.reqBody,
-      get: sinon.spy()
-    };
+      it('queries db model to find candidate row from req params', async() => {
+        const candidateExternalId = 'new-feature';
+        const params = { candidateExternalId };
+        await removeVoteHandler(expressReqStub({ params }), expressResStub(), expressNextStub());
 
-    describe('when voting on behalf of a voter with a valid session', () => {
-      // TODO: authorisation
-      it('runs all postgres queries to vote on the candidate', async() => {
-        await removeVoteEventsHandler(options)(expressReqStub, expressResStub);
+        expect(pollsModel.findCandidate.calledWith(candidateExternalId)).toBe(true);
+      });
+
+      describe('when candidate row is not found', () => {
+        it('calls next with 404 error', async() => {
+          const next = expressNextStub();
 
-        expect(pgPoolQuery.getCalls().length).toBe(4);
+          await removeVoteHandler(expressReqStub(), expressResStub(), next);
+
+          expect(next.calledWith(sinon.match.has('status', 404))).toBe(true);
+        });
       });
 
-      it('responds with 204 status', async() => {
-        await removeVoteEventsHandler(options)(expressReqStub, expressResStub);
+      describe('when candidate row is found', () => {
+        const candidateId = 10;
+        beforeEach(() => pollsModel.findCandidate.resolves({ id: candidateId }));
+
+        it('queries db model to check for an existing vote', async() => {
+          await removeVoteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+          expect(pollsModel.findVote.calledWith(voterId, candidateId)).toBe(true);
+        });
+
+        describe('when vote row does not exist', () => {
+          it('calls next with 404 error', async() => {
+            const next = expressNextStub();
+
+            await removeVoteHandler(expressReqStub(), expressResStub(), next);
 
-        expect(expressResStub.sendStatus.calledWith(204)).toBe(true);
+            expect(next.calledWith(sinon.match.has('status', 404))).toBe(true);
+          });
+        });
+
+        describe('when vote row exists', () => {
+          const voteId = 22;
+          beforeEach(() => pollsModel.findVote.resolves({ id: voteId }));
+
+          it('deletes vote from db', async() => {
+            await removeVoteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+            expect(pollsModel.deleteVote.calledWith(voteId)).toBe(true);
+          });
+
+          it('calls res.sendStatus with 204 status', async() => {
+            const res = expressResStub();
+
+            await removeVoteHandler(expressReqStub(), res, expressNextStub());
+
+            expect(res.sendStatus.calledWith(204)).toBe(true);
+          });
+        });
       });
     });
   });
 });
-
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
index 7b346f917e..9e421814f8 100644
--- a/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
@@ -1,110 +1,144 @@
-import pg from 'pg';
 import sinon from 'sinon';
 
-import voteEventsHandler from '@/server-middleware/api/polls/vote';
-
-const fixtures = {
-  db: {
-    voterId: 2,
-    candidateId: 1
-  },
-  reqBody: {
-    voterExternalId: 'keycloak_uuid',
-    candidateExternalId: 'contentful_id'
-  }
-};
-
-const pgPoolQuery = sinon.stub();
-// Stub voter queries
-pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.voters ')),
-  [fixtures.reqBody.voterExternalId]
-)
-  .resolves({ rowCount: 0 });
-pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('INSERT INTO polls.voters ')),
-  [fixtures.reqBody.voterExternalId]
-)
-  .resolves({ rows: [{ id: fixtures.db.voterId }] });
-
-// Stub candidate queries
-pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.candidates ')),
-  [fixtures.reqBody.candidateExternalId]
-)
-  .resolves({ rowCount: 0 });
-pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('INSERT INTO polls.candidates ')),
-  [fixtures.reqBody.candidateExternalId]
-)
-  .resolves({ rows: [{ id: fixtures.db.candidateId }] });
-
-// Stub vote queries
-pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.votes ')),
-  [fixtures.db.voterId, fixtures.db.candidateId]
-)
-  .resolves({ rowCount: 0 });
-pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.trim().startsWith('INSERT INTO polls.votes ')),
-  [fixtures.db.voterId, fixtures.db.candidateId]
-)
-  .resolves({});
-
-const expressReqStub = {
-  body: fixtures.reqBody,
-  get: sinon.spy()
-};
-const expressResStub = {
-  json: sinon.spy(),
-  sendStatus: sinon.spy()
-};
+import { expressReqStub, expressResStub, expressNextStub } from '../../utils.js';
+import voteHandler from '@/server-middleware/api/polls/vote.js';
+import pollsModel from '@/server-middleware/api/polls/model.js';
+import keycloak from '@/server-middleware/api/keycloak.js';
 
 describe('@/server-middleware/api/polls/vote', () => {
-  beforeAll(() => {
-    sinon.replace(pg.Pool.prototype, 'query', pgPoolQuery);
+  beforeEach(() => {
+    sinon.stub(keycloak, 'userId').resolves(null);
+    sinon.stub(pollsModel, 'findVoter').resolves(null);
+    sinon.stub(pollsModel, 'createVoter').resolves({});
+    sinon.stub(pollsModel, 'findCandidate').resolves(null);
+    sinon.stub(pollsModel, 'createCandidate').resolves({});
+    sinon.stub(pollsModel, 'findVote').resolves(null);
+    sinon.stub(pollsModel, 'createVote').resolves({});
   });
-  afterEach(sinon.resetHistory);
-  afterAll(sinon.resetBehavior);
 
-  describe('when not explicitly enabled', () => {
-    const options = {};
+  afterEach(() => {
+    sinon.restore();
+  });
 
-    it('does not query postgres', async() => {
-      await voteEventsHandler(options)(expressReqStub, expressResStub);
+  it('authorizes request via keycloak', async() => {
+    const authorization = 'Bearer token';
+    const headers = { authorization };
 
-      expect(pgPoolQuery.called).toBe(false);
-    });
+    await voteHandler(expressReqStub({ headers }), expressResStub(), expressNextStub());
+
+    expect(keycloak.userId.calledWith(authorization)).toBe(true);
+  });
+
+  describe('when unauthorized', () => {
+    it('calls next with 401 error', async() => {
+      const next = expressNextStub();
 
-    it('responds with 503 status', async() => {
-      await voteEventsHandler(options)(expressReqStub, expressResStub);
+      await voteHandler(expressReqStub(), expressResStub(), next);
 
-      expect(expressResStub.sendStatus.calledWith(503)).toBe(true);
+      expect(next.calledWith(sinon.match.has('status', 401))).toBe(true);
     });
   });
 
-  describe('when explicitly enabled', () => {
-    const options = { enabled: true };
+  describe('when authorized', () => {
+    const keycloakUserId = 'keycloak-uuid';
+    beforeEach(() => keycloak.userId.resolves(keycloakUserId));
+
+    it('queries db model to find voter row for keycloak user id', async() => {
+      await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+      expect(pollsModel.findVoter.calledWith(keycloakUserId)).toBe(true);
+    });
+
+    describe('when voter row is found', () => {
+      const voterId = 17;
+      beforeEach(() => pollsModel.findVoter.resolves({ id: voterId }));
+
+      it('does not create new voter row', async() => {
+        await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+        expect(pollsModel.createVoter.called).toBe(false);
+      });
+    });
+
+    describe('when voter row is not found', () => {
+      it('creates new voter row', async() => {
+        await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+        expect(pollsModel.createVoter.calledWith(keycloakUserId)).toBe(true);
+      });
+    });
+
+    it('queries db model to find candidate row from req params', async() => {
+      const candidateExternalId = 'new-feature';
+      const params = { candidateExternalId };
+      await voteHandler(expressReqStub({ params }), expressResStub(), expressNextStub());
+
+      expect(pollsModel.findCandidate.calledWith(candidateExternalId)).toBe(true);
+    });
+
+    describe('when candidate row is found', () => {
+      const candidateId = 10;
+      beforeEach(() => pollsModel.findCandidate.resolves({ id: candidateId }));
 
-    const expressReqStub = {
-      body: fixtures.reqBody,
-      get: sinon.spy()
-    };
+      it('does not create new candidate row', async() => {
+        await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
 
-    describe('when for voting on behalf of a voter with a valid session', () => {
-      // TODO: authorisation
-      it('runs all postgres queries to vote on the candidate', async() => {
-        await voteEventsHandler(options)(expressReqStub, expressResStub);
+        expect(pollsModel.createCandidate.called).toBe(false);
+      });
+    });
+
+    describe('when candidate row is not found', () => {
+      const candidateExternalId = 'new-feature';
 
-        expect(pgPoolQuery.getCalls().length).toBe(6);
+      it('creates new candidate row', async() => {
+        await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+        expect(pollsModel.createCandidate.calledWith(candidateExternalId)).toBe(false);
       });
+    });
+
+    it('queries db model to check for an existing vote', async() => {
+      const voterId = 17;
+      pollsModel.findVoter.resolves({ id: voterId });
+      const candidateId = 10;
+      pollsModel.findCandidate.resolves({ id: candidateId });
+
+      await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+      expect(pollsModel.findVote.calledWith(voterId, candidateId)).toBe(true);
+    });
+
+    describe('when vote row already exists', () => {
+      beforeEach(() => pollsModel.findVote.resolves({}));
+
+      it('calls next with 409 error', async() => {
+        const next = expressNextStub();
 
-      it('responds with 200 status', async() => {
-        await voteEventsHandler(options)(expressReqStub, expressResStub);
+        await voteHandler(expressReqStub(), expressResStub(), next);
 
-        expect(expressResStub.sendStatus.calledWith(200)).toBe(true);
+        expect(next.calledWith(sinon.match.has('status', 409))).toBe(true);
+      });
+    });
+
+    describe('when vote row does not already exist', () => {
+      it('creates vote in db', async() => {
+        const voterId = 17;
+        pollsModel.findVoter.resolves({ id: voterId });
+        const candidateId = 10;
+        pollsModel.findCandidate.resolves({ id: candidateId });
+
+        await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+        expect(pollsModel.createVote.calledWith(voterId, candidateId)).toBe(true);
+      });
+
+      it('calls res.sendStatus with 204 status', async() => {
+        const res = expressResStub();
+
+        await voteHandler(expressReqStub(), res, expressNextStub());
+
+        expect(res.sendStatus.calledWith(204)).toBe(true);
       });
     });
   });
 });
-
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
index b6de260580..ad6f71abad 100644
--- a/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
@@ -1,63 +1,68 @@
-import pg from 'pg';
 import sinon from 'sinon';
 
-import votesEventsHandler from '@/server-middleware/api/polls/votes';
-
-const fixtures = {
-  db: {
-    voterId: 1
-  },
-  reqQuery: {
-    candidate: ['feature-id-one', 'feature-id-two', 'feature-id-three'],
-    voter: 'keycloak_uuid'
-  }
-};
-
-const pgPoolQuery = sinon.stub();
-pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.startsWith('SELECT id FROM polls.voters ')),
-  [fixtures.reqQuery.voter]
-).resolves({ rowCount: 1, rows: [{ id: fixtures.db.voterId }] });
-
-pgPoolQuery.withArgs(
-  sinon.match((sql) => sql.trim().startsWith('SELECT c.external_id, COUNT(*) AS total, ')),
-  [fixtures.reqQuery.candidate, fixtures.db.voterId]
-).resolves({ rowCount: 1, rows: [{ 'id': 'feature-id-one', 'total': 40, votedByCurrentVoter: 1 }] });
-
-const expressReqStub = {
-  query: fixtures.reqQuery,
-  get: sinon.spy()
-};
-const expressResStub = {
-  json: sinon.spy(),
-  sendStatus: sinon.spy()
-};
+import { expressReqStub, expressResStub, expressNextStub } from '../../utils.js';
+import votesHandler from '@/server-middleware/api/polls/votes.js';
+import pollsModel from '@/server-middleware/api/polls/model.js';
+import keycloak from '@/server-middleware/api/keycloak.js';
 
 describe('@/server-middleware/api/polls/votes', () => {
-  beforeAll(() => {
-    sinon.replace(pg.Pool.prototype, 'query', pgPoolQuery);
+  afterEach(() => {
+    sinon.restore();
   });
-  afterEach(sinon.resetHistory);
-  afterAll(sinon.resetBehavior);
 
-  describe('when there is an external voter ID', () => {
-    describe('when some of the candidates have been voted on', () => {
-      const options = { enabled: true };
+  it('authorizes request via keycloak', async() => {
+    const authorization = 'Bearer token';
+    const headers = { authorization };
+    sinon.stub(keycloak, 'userId').resolves(null);
+    sinon.stub(pollsModel, 'findVoter').resolves(null);
+    sinon.stub(pollsModel, 'findVotes').resolves([]);
 
-      it('queries postgres for the votes', async() => {
-        await votesEventsHandler(options)(expressReqStub, expressResStub);
+    await votesHandler(expressReqStub({ headers }), expressResStub(), expressNextStub());
 
-        expect(pgPoolQuery.getCalls().length).toBe(2);
-      });
+    expect(keycloak.userId.calledWith(authorization)).toBe(true);
+  });
+
+  it('queries db model for authorized voter', async() => {
+    const voterExternalId = 'keycloak uuid';
+    sinon.stub(keycloak, 'userId').resolves(voterExternalId);
+    sinon.stub(pollsModel, 'findVoter').resolves(null);
+    sinon.stub(pollsModel, 'findVotes').resolves([]);
+
+    await votesHandler(expressReqStub(), expressResStub(), expressNextStub());
 
-      it('responds with the view count as json', async() => {
-        await votesEventsHandler(options)(expressReqStub, expressResStub);
-        expect(expressResStub.json.calledWith({ 'feature-id-one': { total: 40, votedByCurrentVoter: 1 } })).toBe(true);
-      });
-    });
+    expect(pollsModel.findVoter.calledWith(voterExternalId)).toBe(true);
   });
 
-  describe('when there is NO external voter ID', () => {
-    // TODO: Add tests for anonymous retrieval
+  it('queries db model for votes on candidates (by voter)', async() => {
+    const candidates = ['new-thing', 'improve-that'];
+    const query = { candidate: 'new-thing,improve-that' };
+    const voterExternalId = 'keycloak uuid';
+    const voterId = 17;
+    sinon.stub(keycloak, 'userId').resolves(voterExternalId);
+    sinon.stub(pollsModel, 'findVoter').resolves({ id: voterId });
+    sinon.stub(pollsModel, 'findVotes').resolves([]);
+
+    await votesHandler(expressReqStub({ query }), expressResStub(), expressNextStub());
+
+    expect(pollsModel.findVotes.calledWith(voterId, candidates)).toBe(true);
+  });
+
+  it('responds with votes data as json', async() => {
+    const votes = [
+      { 'external_id': 'new-thing', total: '10', 'voted_by_current_voter': '0' },
+      { 'external_id': 'improve-that', total: '5', 'voted_by_current_voter': '1' }
+    ];
+    const votesResponse = {
+      'new-thing': { total: '10', votedByCurrentVoter: false },
+      'improve-that': { total: '5', votedByCurrentVoter: true }
+    };
+    sinon.stub(keycloak, 'userId').resolves(null);
+    sinon.stub(pollsModel, 'findVoter').resolves(null);
+    sinon.stub(pollsModel, 'findVotes').resolves(votes);
+    const res = expressResStub();
+
+    await votesHandler(expressReqStub(), res, expressNextStub());
+
+    expect(res.json.calledWith(votesResponse)).toBe(true);
   });
 });
diff --git a/packages/portal/tests/unit/server-middleware/utils.js b/packages/portal/tests/unit/server-middleware/utils.js
new file mode 100644
index 0000000000..cca2d3e4c7
--- /dev/null
+++ b/packages/portal/tests/unit/server-middleware/utils.js
@@ -0,0 +1,17 @@
+import sinon from 'sinon';
+
+export const expressReqStub = (mocks = {}) => ({
+  query: {},
+  headers: {},
+  params: {},
+  get: sinon.spy(),
+  ...mocks
+});
+
+export const expressResStub = (mocks = {}) => ({
+  json: sinon.spy(),
+  sendStatus: sinon.spy(),
+  ...mocks
+});
+
+export const expressNextStub = () => sinon.spy();

From 69f0aca216e7f89fef00d5ef714bb5bc8ad9e27e Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Fri, 23 Aug 2024 13:29:13 +0100
Subject: [PATCH 30/32] fix: keycloak url and import

---
 packages/portal/src/server-middleware/api/index.js    | 4 ++--
 packages/portal/src/server-middleware/api/keycloak.js | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/portal/src/server-middleware/api/index.js b/packages/portal/src/server-middleware/api/index.js
index afbf72ada9..5cfca2cbdd 100644
--- a/packages/portal/src/server-middleware/api/index.js
+++ b/packages/portal/src/server-middleware/api/index.js
@@ -4,7 +4,7 @@ import apm from 'elastic-apm-node';
 
 import logging from '../logging.js';
 import pg from './pg.js';
-import auth from './auth.js';
+import keycloak from './keycloak.js';
 import { errorHandler, forbiddenUnlessOriginAllowed, nuxtRuntimeConfig } from './utils.js';
 
 const app = express();
@@ -14,7 +14,7 @@ app.use(logging);
 
 const runtimeConfig = nuxtRuntimeConfig();
 pg.config = runtimeConfig.postgres;
-auth.config = runtimeConfig.auth.strategies.keycloak;
+keycloak.config = runtimeConfig.auth.strategies.keycloak;
 
 app.use((req, res, next) => {
   if (apm.isStarted())  {
diff --git a/packages/portal/src/server-middleware/api/keycloak.js b/packages/portal/src/server-middleware/api/keycloak.js
index ae105bbfd0..77c193089e 100644
--- a/packages/portal/src/server-middleware/api/keycloak.js
+++ b/packages/portal/src/server-middleware/api/keycloak.js
@@ -6,7 +6,7 @@ export default {
   async userInfo(authorization) {
     const keycloakUserinfoResponse = await axios({
       baseURL: this.config.origin,
-      url: `/auth/realms/${this.config.realm}/protocol/openid-connect/userInfo`,
+      url: `/auth/realms/${this.config.realm}/protocol/openid-connect/userinfo`,
       method: 'get',
       headers: { authorization }
     });

From d3b7777203495884deab9789a6c7e23606fbe3a6 Mon Sep 17 00:00:00 2001
From: Richard Doe <richard.doe@rwdit.net>
Date: Fri, 23 Aug 2024 13:29:25 +0100
Subject: [PATCH 31/32] fix: shared error logging

---
 .../portal/src/server-middleware/api/utils.js | 22 ++++++++++---------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/packages/portal/src/server-middleware/api/utils.js b/packages/portal/src/server-middleware/api/utils.js
index e8c32f9248..53de5664de 100644
--- a/packages/portal/src/server-middleware/api/utils.js
+++ b/packages/portal/src/server-middleware/api/utils.js
@@ -1,22 +1,24 @@
+import apm from 'elastic-apm-node';
 import defu  from 'defu';
 import createHttpError from 'http-errors';
 
 import nuxtConfig from '../../../nuxt.config.js';
 
-export const errorHandler = (err, req, res) => {
-  console.error(err);
+export const errorHandler = (err, req, res, next) => {
+  if (err) {
+    console.error(process.NODE_ENV === 'production' ? err.message : err.stack);
 
-  let status = err.status || 500;
-  let message = err.message;
+    const errorStatus = err.response?.status || err.status || err.statusCode || 500;
+    const message = err.response?.data?.error || err.response?.data?.errorMessage || err.message;
 
-  if (err.response) {
-    status = err.response.status;
-    if (err.response.data.errorMessage) {
-      message = err.response.data.errorMessage;
+    if (apm.isStarted()) {
+      apm.captureError(err, { message, request: req, response: res });
     }
-  }
 
-  res.status(status).set('Content-Type', 'text/plain').send(message);
+    res.status(errorStatus).send(message);
+  } else {
+    next();
+  }
 };
 
 let runtimeConfig;

From e32b788ede69bd6272ef3c85c9b22c8c3dd7836c Mon Sep 17 00:00:00 2001
From: lbiedinger <lutz.biedinger@gmail.com>
Date: Wed, 28 Aug 2024 11:01:36 +0200
Subject: [PATCH 32/32] do NOT respond with error when response is finished

---
 packages/portal/src/server-middleware/api/utils.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/portal/src/server-middleware/api/utils.js b/packages/portal/src/server-middleware/api/utils.js
index 53de5664de..14e9577e00 100644
--- a/packages/portal/src/server-middleware/api/utils.js
+++ b/packages/portal/src/server-middleware/api/utils.js
@@ -15,7 +15,9 @@ export const errorHandler = (err, req, res, next) => {
       apm.captureError(err, { message, request: req, response: res });
     }
 
-    res.status(errorStatus).send(message);
+    if (!res.writableEnded) {
+      res.status(errorStatus).send(message);
+    }
   } else {
     next();
   }