@stamhoofd/backend 2.101.0 → 2.103.0

package/src/endpoints/global/registration/RegisterMembersEndpoint.ts

@@ -5,7 +5,7 @@ import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Email } from '@stamhoofd/email';
 import { BalanceItem, BalanceItemPayment, CachedBalance, Group, Member, MemberWithRegistrations, MolliePayment, MollieToken, Organization, PayconiqPayment, Payment, Platform, RateLimiter, Registration, User } from '@stamhoofd/models';
-import { BalanceItemRelation, BalanceItemRelationType, BalanceItemStatus, BalanceItem as BalanceItemStruct, BalanceItemType, IDRegisterCheckout, PaymentCustomer, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, Payment as PaymentStruct, PaymentType, PermissionLevel, PlatformFamily, PlatformMember, RegisterItem, RegisterResponse, TranslatedString, Version } from '@stamhoofd/structures';
+import { BalanceItemRelation, BalanceItemRelationType, BalanceItemStatus, BalanceItem as BalanceItemStruct, BalanceItemType, IDRegisterCheckout, PaymentCustomer, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, Payment as PaymentStruct, PaymentType, PermissionLevel, PlatformFamily, PlatformMember, ReceivableBalanceType, RegisterItem, RegisterResponse, TranslatedString, Version } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 
 import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures';
@@ -67,8 +67,25 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
         const organization = await Context.setOrganizationScope();
         const { user } = await Context.authenticate();
 
-        if (request.body.asOrganizationId && request.body.asOrganizationId !== organization.id) {
-            if (!await Context.auth.canManageFinances(request.body.asOrganizationId)) {
+        // Who is going to pay?
+        let whoWillPayNow: 'member' | 'organization' | 'nobody' = 'member'; // if this is set to 'organization', there will also be created separate balance items so the member can pay back the paying organization
+
+        if (request.body.asOrganizationId && request.body.asOrganizationId === organization.id) {
+            // Fast fail
+            if (!await Context.auth.hasSomeAccess(request.body.asOrganizationId)) {
+                throw new SimpleError({
+                    code: 'forbidden',
+                    message: 'No permission to register members manually',
+                    human: $t(`62fe6e39-f6b0-4836-b0f7-dc84d22a81e3`),
+                    statusCode: 403,
+                });
+            }
+
+            // We won't create a payment. The balance will get added to the outstanding amount of the member / already paying organization
+            whoWillPayNow = 'nobody';
+        }
+        else if (request.body.asOrganizationId && request.body.asOrganizationId !== organization.id) {
+            if (!await Context.auth.hasFullAccess(request.body.asOrganizationId)) {
                 throw new SimpleError({
                     code: 'forbidden',
                     message: 'No permission to register as this organization for a different organization',
@@ -76,6 +93,9 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
                     statusCode: 403,
                 });
             }
+
+            // The organization will pay to the organizing organization, and it will get added to the outstanding amount of the member towards the paying organization
+            whoWillPayNow = 'organization';
         }
 
         // For non paid organizations, limit amount of tests
@@ -145,7 +165,10 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
         }
 
         for (const member of members) {
-            if (!await Context.auth.canAccessMember(member, PermissionLevel.Write)) {
+            if (!await Context.auth.canAccessMember(
+                member,
+                request.body.asOrganizationId ? PermissionLevel.Read : PermissionLevel.Write,
+            )) {
                 throw new SimpleError({
                     code: 'forbidden',
                     message: 'No permission to register this member',
@@ -170,7 +193,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             for (const memberId of memberIds) {
                 const familyMembers = (await Member.getFamilyWithRegistrations(memberId));
                 members.push(...familyMembers);
-                const blob = await AuthenticatedStructures.membersBlob(familyMembers, true);
+                const blob = await AuthenticatedStructures.membersBlob(familyMembers, true, undefined, { forAdminCartCalculation: true });
                 const family = PlatformFamily.create(blob, {
                     platform: platformStruct,
                     contextOrganization,
@@ -225,22 +248,18 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
         const totalPrice = checkout.totalPrice;
 
         if (totalPrice !== request.body.totalPrice) {
-            throw new SimpleError({
-                code: 'changed_price',
-                message: $t(`e424d549-2bb8-4103-9a14-ac4063d7d454`, { total: Formatter.price(totalPrice) }),
-            });
-        }
-
-        // Who is going to pay?
-        let whoWillPayNow: 'member' | 'organization' | 'nobody' = 'member'; // if this is set to 'organization', there will also be created separate balance items so the member can pay back the paying organization
-
-        if (request.body.asOrganizationId && request.body.asOrganizationId === organization.id) {
-            // Will get added to the outstanding amount of the member / already paying organization
-            whoWillPayNow = 'nobody';
-        }
-        else if (request.body.asOrganizationId && request.body.asOrganizationId !== organization.id) {
-            // The organization will pay to the organizing organization, and it will get added to the outstanding amount of the member towards the paying organization
-            whoWillPayNow = 'organization';
+            if (whoWillPayNow === 'nobody') {
+                // Safe and important to ignore: we are only updating the outstanding amounts
+                // If we would throw here, that could leak personal data (e.g. that the user uses financial support)
+            }
+            else {
+                // when whoWillPay = organization/member, we should throw or the payment amount could be different / incorrect.
+                // This never leaks information because in this case the user already has full access to the organization (asOrganizationId) or the member
+                throw new SimpleError({
+                    code: 'changed_price',
+                    message: $t(`e424d549-2bb8-4103-9a14-ac4063d7d454`, { total: Formatter.price(totalPrice) }),
+                });
+            }
         }
 
         const registrationMemberRelation = new ManyToOneRelation(Member, 'member');
@@ -315,7 +334,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
                 );
 
                 // Never reuse a registration that has a balance - that means they had a cancellation fee and not all balance items were canceled (we don't want to merge in that state)
-                const balances = await CachedBalance.getForObjects(possibleReuseRegistrations.map(r => r.id), null);
+                const balances = await CachedBalance.getForObjects(possibleReuseRegistrations.map(r => r.id), null, ReceivableBalanceType.registration);
 
                 reuseRegistration = possibleReuseRegistrations.find((r) => {
                     const balance = balances.filter(b => b.objectId === r.id).reduce((a, b) => a + b.amountOpen + b.amountPaid + b.amountPending, 0);
@@ -763,6 +782,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
         }
 
         let paymentUrl: string | null = null;
+        let paymentQRCode: string | null = null;
         let payment: Payment | null = null;
 
         // Delay marking as valid as late as possible so any errors will prevent creating valid balance items
@@ -814,6 +834,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
 
                 if (response) {
                     paymentUrl = response.paymentUrl;
+                    paymentQRCode = response.paymentQRCode;
                     payment = response.payment;
                 }
             }
@@ -841,6 +862,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             members: await AuthenticatedStructures.membersBlob(updatedMembers),
             registrations: registrations.map(r => Member.getRegistrationWithTinyMemberStructure(r)),
             paymentUrl,
+            paymentQRCode,
         }));
     }
 
@@ -1047,6 +1069,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
         const description = $t(`33a926ea-9bc7-444e-becc-c0f2f70e1f0e`) + ' ' + organization.name;
 
         let paymentUrl: string | null = null;
+        let paymentQRCode: string | null = null;
 
         try {
             // Update balance items
@@ -1144,7 +1167,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
                     await dbPayment.save();
                 }
                 else if (payment.provider === PaymentProvider.Payconiq) {
-                    paymentUrl = await PayconiqPayment.createPayment(payment, organization, description, redirectUrl, webhookUrl);
+                    ({ paymentUrl, paymentQRCode } = await PayconiqPayment.createPayment(payment, organization, description, redirectUrl, webhookUrl));
                 }
                 else if (payment.provider == PaymentProvider.Buckaroo) {
                     // Increase request timeout because buckaroo is super slow (in development)
@@ -1175,6 +1198,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             provider,
             stripeAccount,
             paymentUrl,
+            paymentQRCode,
         };
     }
 }

package/src/endpoints/organization/dashboard/billing/GetOrganizationPayableBalanceEndpoint.ts

@@ -1,5 +1,5 @@
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
-import { PayableBalanceCollection } from '@stamhoofd/structures';
+import { PayableBalanceCollection, ReceivableBalanceType } from '@stamhoofd/structures';
 
 import { Context } from '../../../../helpers/Context';
 import { GetUserPayableBalanceEndpoint } from '../../../global/registration/GetUserPayableBalanceEndpoint';
@@ -34,6 +34,6 @@ export class GetOrganizationPayableBalanceEndpoint extends Endpoint<Params, Quer
             throw Context.auth.error();
         }
 
-        return new Response(await GetUserPayableBalanceEndpoint.getBillingStatusForObjects([organization.id], null));
+        return new Response(await GetUserPayableBalanceEndpoint.getBillingStatusForObjects([organization.id], null, ReceivableBalanceType.organization));
     }
 }

package/src/endpoints/organization/dashboard/receivable-balances/GetReceivableBalanceEndpoint.ts

@@ -1,11 +1,12 @@
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
 import { DetailedReceivableBalance, PaymentStatus, ReceivableBalanceType } from '@stamhoofd/structures';
 
-import { BalanceItem, BalanceItemPayment, CachedBalance, Payment } from '@stamhoofd/models';
+import { BalanceItem, BalanceItemPayment, CachedBalance, MemberUser, Payment } from '@stamhoofd/models';
 import { Context } from '../../../../helpers/Context';
 import { AuthenticatedStructures } from '../../../../helpers/AuthenticatedStructures';
 import { SQL } from '@stamhoofd/sql';
 import { BalanceItemService } from '../../../../services/BalanceItemService';
+import { Formatter } from '@stamhoofd/utility';
 
 type Params = { id: string; type: ReceivableBalanceType };
 type Query = undefined;
@@ -38,14 +39,13 @@ export class GetReceivableBalanceEndpoint extends Endpoint<Params, Query, Body,
             throw Context.auth.error();
         }
 
-        // Flush caches (this makes sure that we do a reload in the frontend after a registration or change, we get the newest balances)
-        await BalanceItemService.flushCaches(organization.id);
-
-        const balanceItemModels = await CachedBalance.balanceForObjects(organization.id, [request.params.id], request.params.type, true);
         let paymentModels: Payment[] = [];
 
         switch (request.params.type) {
             case ReceivableBalanceType.organization: {
+                // Force cache updates, because sometimes the cache could be out of date
+                BalanceItemService.scheduleOrganizationUpdate(organization.id, request.params.id);
+
                 paymentModels = await Payment.select()
                     .where('organizationId', organization.id)
                     .andWhere(
@@ -66,6 +66,9 @@ export class GetReceivableBalanceEndpoint extends Endpoint<Params, Query, Body,
             }
 
             case ReceivableBalanceType.member: {
+                // Force cache updates, because sometimes the cache could be out of date
+                BalanceItemService.scheduleMemberUpdate(organization.id, request.params.id);
+
                 paymentModels = await Payment.select()
                     .where('organizationId', organization.id)
                     .join(
@@ -86,7 +89,17 @@ export class GetReceivableBalanceEndpoint extends Endpoint<Params, Query, Body,
             }
 
             case ReceivableBalanceType.user: {
-                paymentModels = await Payment.select()
+                const memberUsers = await MemberUser.select().where('usersId', request.params.id).fetch();
+                const memberIds = Formatter.uniqueArray(memberUsers.map(mu => mu.membersId));
+
+                // Force cache updates, because sometimes the cache could be out of date
+                BalanceItemService.scheduleUserUpdate(organization.id, request.params.id);
+
+                for (const memberId of memberIds) {
+                    BalanceItemService.scheduleMemberUpdate(organization.id, memberId);
+                }
+
+                const q = Payment.select()
                     .where('organizationId', organization.id)
                     .join(
                         SQL.join(BalanceItemPayment.table)
@@ -95,8 +108,44 @@ export class GetReceivableBalanceEndpoint extends Endpoint<Params, Query, Body,
                     .join(
                         SQL.join(BalanceItem.table)
                             .where(SQL.column(BalanceItemPayment.table, 'balanceItemId'), SQL.column(BalanceItem.table, 'id')),
+                    );
+
+                if (memberIds.length === 0) {
+                    q.where(SQL.column(BalanceItem.table, 'userId'), request.params.id);
+                }
+                else {
+                    q.where(
+                        SQL.where(SQL.column(BalanceItem.table, 'userId'), request.params.id)
+                            .or(SQL.column(BalanceItem.table, 'memberId'), memberIds),
+                    );
+                }
+
+                paymentModels = await q
+                    .andWhere(
+                        SQL.whereNot('status', PaymentStatus.Failed),
                     )
-                    .where(SQL.column(BalanceItem.table, 'userId'), request.params.id)
+                    .groupBy(SQL.column(Payment.table, 'id'))
+                    .fetch();
+                break;
+            }
+
+            case ReceivableBalanceType.userWithoutMembers: {
+                // Force cache updates, because sometimes the cache could be out of date
+                BalanceItemService.scheduleUserUpdate(organization.id, request.params.id);
+
+                const q = Payment.select()
+                    .where('organizationId', organization.id)
+                    .join(
+                        SQL.join(BalanceItemPayment.table)
+                            .where(SQL.column(BalanceItemPayment.table, 'paymentId'), SQL.column(Payment.table, 'id')),
+                    )
+                    .join(
+                        SQL.join(BalanceItem.table)
+                            .where(SQL.column(BalanceItemPayment.table, 'balanceItemId'), SQL.column(BalanceItem.table, 'id')),
+                    )
+                    .where(SQL.column(BalanceItem.table, 'userId'), request.params.id);
+
+                paymentModels = await q
                     .andWhere(
                         SQL.whereNot('status', PaymentStatus.Failed),
                     )
@@ -126,10 +175,13 @@ export class GetReceivableBalanceEndpoint extends Endpoint<Params, Query, Body,
             }
         }
 
+        // Flush caches (this makes sure that we do a reload in the frontend after a registration or change, we get the newest balances)
+        await BalanceItemService.flushCaches(organization.id);
+        const balanceItemModels = await CachedBalance.balanceForObjects(organization.id, [request.params.id], request.params.type);
         const balanceItems = await BalanceItem.getStructureWithPayments(balanceItemModels);
         const payments = await AuthenticatedStructures.paymentsGeneral(paymentModels, false);
 
-        const balances = await CachedBalance.getForObjects([request.params.id], organization.id);
+        const balances = await CachedBalance.getForObjects([request.params.id], organization.id, request.params.type);
 
         const created = new CachedBalance();
         created.amountOpen = 0;

package/src/endpoints/organization/dashboard/receivable-balances/GetReceivableBalancesEndpoint.ts

@@ -83,7 +83,12 @@ export class GetReceivableBalancesEndpoint extends Endpoint<Params, Query, Body,
                     },
                     {
                         users: {
-                            $elemMatch: { name: { $contains: q.search } },
+                            $elemMatch: {
+                                $or: {
+                                    name: { $contains: q.search },
+                                    email: { $contains: q.search },
+                                },
+                            },
                         },
                     },
                 ],

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -37,7 +37,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
         const organization = await Context.setOrganizationScope();
         await Context.authenticate();
 
-        if (!await Context.auth.hasFullAccess(organization.id)) {
+        if (!await Context.auth.hasSomeAccess(organization.id)) {
             throw Context.auth.error();
         }
 
@@ -214,6 +214,14 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             for (const groupPut of patch.groups.getPuts()) {
                 shouldUpdateSetupSteps = true;
                 groupPut.put.settings.throwIfInvalidPrices();
+                if (groupPut.put.type === GroupType.EventRegistration) {
+                    throw new SimpleError({
+                        code: 'invalid_group_type',
+                        message: 'Cannot create groups for events via this endpoint',
+                        human: $t(`40dde58e-47fb-4adb-971a-537b16c479d5`),
+                    });
+                }
+
                 const group = await PatchOrganizationRegistrationPeriodsEndpoint.createGroup(groupPut.put, organization.id, period, { allowedIds });
                 deleteUnreachable = true;
                 forceGroupIds.push(group.id);
@@ -528,14 +536,9 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
     static async createGroup(struct: GroupStruct, organizationId: string, period: RegistrationPeriod, options?: { allowedIds?: string[] }): Promise<Group> {
         const allowedIds = options?.allowedIds ?? [];
 
-        if (struct.type === GroupType.Membership || struct.type === GroupType.WaitingList) {
+        if (struct.type !== GroupType.EventRegistration && !allowedIds.includes(struct.id)) {
             if (!await Context.auth.hasFullAccess(organizationId)) {
-                if (allowedIds.includes(struct.id)) {
-                    // Ok
-                }
-                else {
-                    throw Context.auth.error($t(`153a7443-e2d9-4126-8e10-089b54964fb8`));
-                }
+                throw Context.auth.error($t(`153a7443-e2d9-4126-8e10-089b54964fb8`));
             }
         }
         else {
@@ -587,7 +590,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
         model.settings.registeredMembers = 0;
         model.settings.reservedMembers = 0;
 
-        if (!await Context.auth.canAccessGroup(model, PermissionLevel.Full)) {
+        if (struct.type !== GroupType.EventRegistration && !await Context.auth.canAccessGroup(model, PermissionLevel.Full)) {
             // Create a temporary permission role for this user
             const organizationPermissions = user.permissions?.organizationPermissions?.get(organizationId);
             if (!organizationPermissions) {

package/src/endpoints/organization/webshops/PlaceOrderEndpoint.ts

@@ -224,7 +224,8 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 balanceItemPayments.push(balanceItemPayment.setRelation(BalanceItemPayment.balanceItem, balanceItem));
 
                 let paymentUrl: string | null = null;
-                const description = webshop.meta.name + ' - ' + payment.id;
+                let paymentQRCode: string | null = null;
+                const description = webshop.meta.name + ' - ' + organization.name;
 
                 if (payment.method === PaymentMethod.Transfer) {
                     await order.markValid(payment, []);
@@ -324,7 +325,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                         await dbPayment.save();
                     }
                     else if (payment.provider == PaymentProvider.Payconiq) {
-                        paymentUrl = await PayconiqPayment.createPayment(payment, organization, description, redirectUrl, exchangeUrl);
+                        ({ paymentUrl, paymentQRCode } = await PayconiqPayment.createPayment(payment, organization, description, redirectUrl, exchangeUrl));
                     }
                     else if (payment.provider == PaymentProvider.Buckaroo) {
                         // Increase request timeout because buckaroo is super slow
@@ -351,6 +352,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
 
                 return new Response(OrderResponse.create({
                     paymentUrl: paymentUrl,
+                    paymentQRCode,
                     order: OrderStruct.create({ ...order, payment: PaymentStruct.create(payment) }),
                 }));
             }

package/src/excel-loaders/receivable-balances.ts

@@ -1,5 +1,5 @@
 import { XlsxBuiltInNumberFormat, XlsxTransformerColumn, XlsxTransformerConcreteColumn } from '@stamhoofd/excel-writer';
-import { BalanceItemRelationType, BalanceItemWithPayments, DetailedReceivableBalance, ExcelExportType, getBalanceItemRelationTypeName, getBalanceItemStatusName, getBalanceItemTypeName, getReceivableBalanceTypeNameNotTranslated, PaginatedResponse, ReceivableBalance } from '@stamhoofd/structures';
+import { BalanceItemRelationType, BalanceItemWithPayments, DetailedReceivableBalance, ExcelExportType, getBalanceItemRelationTypeName, getBalanceItemStatusName, getBalanceItemTypeName, getReceivableBalanceTypeName, PaginatedResponse, ReceivableBalance } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { ExportToExcelEndpoint } from '../endpoints/global/files/ExportToExcelEndpoint';
 import { GetReceivableBalancesEndpoint } from '../endpoints/organization/dashboard/receivable-balances/GetReceivableBalancesEndpoint';
@@ -287,7 +287,7 @@ function getGeneralColumns(): XlsxTransformerConcreteColumn<ReceivableBalance>[]
             name: $t(`a0dfe596-0670-48bc-a5f3-2c9308c70a17`),
             width: 10,
             getValue: (object: ReceivableBalance) => ({
-                value: getReceivableBalanceTypeNameNotTranslated(object.objectType),
+                value: getReceivableBalanceTypeName(object.objectType),
             }),
         },
     ];

package/src/helpers/AdminPermissionChecker.ts

@@ -1,7 +1,7 @@
 import { AutoEncoderPatchType, PatchMap } from '@simonbackx/simple-encoding';
 import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
 import { BalanceItem, CachedBalance, Document, Email, EmailTemplate, Event, EventNotification, Group, Member, MemberPlatformMembership, MemberWithRegistrations, Order, Organization, OrganizationRegistrationPeriod, Payment, Registration, User, Webshop } from '@stamhoofd/models';
-import { AccessRight, EmailTemplate as EmailTemplateStruct, EventPermissionChecker, FinancialSupportSettings, GroupCategory, GroupStatus, GroupType, MemberWithRegistrationsBlob, PermissionLevel, PermissionsResourceType, Platform as PlatformStruct, RecordSettings, ResourcePermissions } from '@stamhoofd/structures';
+import { AccessRight, EmailTemplate as EmailTemplateStruct, EventPermissionChecker, FinancialSupportSettings, GroupCategory, GroupStatus, GroupType, MemberWithRegistrationsBlob, PermissionLevel, PermissionsResourceType, Platform as PlatformStruct, ReceivableBalanceType, RecordSettings, ResourcePermissions } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { MemberRecordStore } from '../services/MemberRecordStore';
 import { addTemporaryMemberAccess, hasTemporaryMemberAccess } from './TemporaryMemberAccess';
@@ -70,6 +70,7 @@ export class AdminPermissionChecker {
             return await cache;
         }
 
+        console.log('Get group', groupId);
         const promise = Group.select()
             .where('id', groupId)
             .first(false);
@@ -80,6 +81,46 @@ export class AdminPermissionChecker {
         return group;
     }
 
+    async getGroups(groupIds: string[]): Promise<Group[]> {
+        const cached: Group[] = [];
+        const remainingIds: string[] = [];
+
+        for (const groupId of groupIds) {
+            const cache = this.groupsCache.get(groupId);
+            if (cache !== undefined) {
+                const resolved = await cache;
+                if (resolved) {
+                    cached.push(resolved);
+                }
+                else {
+                    // Not found, no need to readd
+                }
+            }
+            else {
+                remainingIds.push(groupId);
+            }
+        }
+
+        if (remainingIds.length > 0) {
+            console.log('Get groups', remainingIds);
+            const promise = Group.select()
+                .where('id', remainingIds)
+                .fetch();
+
+            for (const groupId of remainingIds) {
+                this.groupsCache.set(groupId, promise.then(list => list.find(l => l.id === groupId) ?? null));
+            }
+            const groups = await promise;
+            cached.push(...groups);
+
+            for (const groupId of remainingIds) {
+                this.groupsCache.set(groupId, groups.find(l => l.id === groupId) ?? null);
+            }
+        }
+
+        return cached;
+    }
+
     cacheGroup(group: Group) {
         this.groupsCache.set(group.id, group);
     }
@@ -178,7 +219,7 @@ export class AdminPermissionChecker {
     async canAccessGroup(group: Group, permissionLevel: PermissionLevel = PermissionLevel.Read): Promise<boolean> {
         // Check permissions aren't scoped to a specific organization, and they mismatch
         if (!this.checkScope(group.organizationId)) {
-            return false;
+            // return false;
         }
         const organization = await this.getOrganization(group.organizationId);
 
@@ -246,8 +287,13 @@ export class AdminPermissionChecker {
             return true;
         }
         if (asOrganizationId) {
-            if (group.settings.allowRegistrationsByOrganization) {
-                return await this.hasFullAccess(asOrganizationId);
+            if (group.settings.allowRegistrationsByOrganization && !group.getStructure().closed) {
+                if (group.organizationId !== asOrganizationId) {
+                    return await this.hasFullAccess(asOrganizationId);
+                }
+                else {
+                    return await this.hasSomeAccess(asOrganizationId);
+                }
             }
         }
         return false;
@@ -337,7 +383,7 @@ export class AdminPermissionChecker {
         }
 
         for (const registration of member.registrations) {
-            if (await this.canAccessRegistration(registration, permissionLevel)) {
+            if (await this.canAccessRegistration(registration, permissionLevel, false)) {
                 return true;
             }
         }
@@ -359,7 +405,7 @@ export class AdminPermissionChecker {
      */
     async canDeleteMember(member: MemberWithRegistrations) {
         if (member.registrations.length === 0 && this.isUserManager(member)) {
-            const cachedBalance = await CachedBalance.getForObjects([member.id]);
+            const cachedBalance = await CachedBalance.getForObjects([member.id], null, ReceivableBalanceType.member);
             if (cachedBalance.length === 0 || (cachedBalance[0].amountOpen === 0 && cachedBalance[0].amountPending === 0)) {
                 const platformMemberships = await MemberPlatformMembership.where({ memberId: member.id });
                 if (platformMemberships.length === 0) {
@@ -378,7 +424,7 @@ export class AdminPermissionChecker {
     /**
      * Note: only checks admin permissions. Users that 'own' this member can also access it but that does not use the AdminPermissionChecker
      */
-    async canAccessRegistration(registration: Registration, permissionLevel: PermissionLevel = PermissionLevel.Read) {
+    async canAccessRegistration(registration: Registration, permissionLevel: PermissionLevel = PermissionLevel.Read, checkMember: boolean | MemberWithRegistrations = true) {
         if (registration.deactivatedAt || !registration.registeredAt) {
             // No full access: cannot access deactivated registrations
             return false;
@@ -404,7 +450,7 @@ export class AdminPermissionChecker {
             }
         }
 
-        const group = await this.getGroup(registration.groupId);
+        const group = Registration.group.isLoaded(registration) ? ((registration as any).group as Group) : await this.getGroup(registration.groupId);
         if (!group || group.deletedAt) {
             return false;
         }
@@ -413,6 +459,17 @@ export class AdminPermissionChecker {
             return true;
         }
 
+        if (permissionLevel === PermissionLevel.Read && checkMember && group.settings.implicitlyAllowViewRegistrations) {
+            // We can also view this registration if we have access to the member
+            const members = checkMember === true ? await Member.getBlobByIds(registration.memberId) : [checkMember];
+
+            if (members.length === 1) {
+                if (await this.canAccessMember(members[0], permissionLevel)) {
+                    return true;
+                }
+            }
+        }
+
         return false;
     }
 
@@ -1298,6 +1355,7 @@ export class AdminPermissionChecker {
         }
 
         if (hasTemporaryMemberAccess(this.user.id, member.id, PermissionLevel.Full)) {
+            // You created this member, so temporary can read all records in order to set the member up correctly
             return {
                 canAccess: true,
                 record: record.record,
@@ -1358,7 +1416,7 @@ export class AdminPermissionChecker {
     /**
      * Changes data inline
      */
-    async filterMemberData(member: MemberWithRegistrations, data: MemberWithRegistrationsBlob): Promise<MemberWithRegistrationsBlob> {
+    async filterMemberData(member: MemberWithRegistrations, data: MemberWithRegistrationsBlob, options?: { forAdminCartCalculation?: boolean }): Promise<MemberWithRegistrationsBlob> {
         const cloned = data.clone();
 
         for (const [key, value] of cloned.details.recordAnswers.entries()) {
@@ -1386,7 +1444,7 @@ export class AdminPermissionChecker {
         }
 
         // Has financial read access?
-        if (!await this.hasFinancialMemberAccess(member, PermissionLevel.Read)) {
+        if (!options?.forAdminCartCalculation && !await this.hasFinancialMemberAccess(member, PermissionLevel.Read)) {
             cloned.details.requiresFinancialSupport = null;
             cloned.details.uitpasNumber = null;
             cloned.outstandingBalance = 0;