@stamhoofd/backend 2.120.5 → 2.121.0

package/src/services/PaymentService.ts

@@ -1,19 +1,26 @@
-import { createMollieClient, PaymentMethod as molliePaymentMethod, PaymentStatus as MolliePaymentStatus } from '@mollie/api-client';
-import { SimpleError } from '@simonbackx/simple-errors';
-import type { BalanceItem, Member, User } from '@stamhoofd/models';
+import { createMollieClient, PaymentStatus as MolliePaymentStatus } from '@mollie/api-client';
+import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
+import type { Member, User } from '@stamhoofd/models';
+import { BalanceItem } from '@stamhoofd/models';
 import { BalanceItemPayment, Group, MolliePayment, MollieToken, Organization, PayconiqPayment, Payment, sendEmailTemplate } from '@stamhoofd/models';
 import { QueueHandler } from '@stamhoofd/queues';
-import type { Checkoutable, PaymentConfiguration } from '@stamhoofd/structures';
-import { AuditLogSource, BalanceItemType, EmailTemplateType, PaymentCustomer, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, PaymentType, Recipient, VATExcemptReason, Version } from '@stamhoofd/structures';
+import type { Checkoutable, PaymentConfiguration, PrivatePaymentConfiguration } from '@stamhoofd/structures';
+import { AuditLogSource, BalanceItemPaymentDetailed, BalanceItemType, EmailTemplateType, Invoice, PaymentCustomer, PaymentGeneral, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, PaymentType, Recipient, VATExcemptReason, Version } from '@stamhoofd/structures';
+import type { PaymentMandate } from '@stamhoofd/structures/PaymentMandate.js';
+import { PaymentMandateStatus, PaymentMandateType } from '@stamhoofd/structures/PaymentMandate.js';
 import { Formatter } from '@stamhoofd/utility';
 import { buildReplacementOptions, getEmailReplacementsForPayment } from '../email-replacements/getEmailReplacementsForPayment.js';
 import { BuckarooHelper } from '../helpers/BuckarooHelper.js';
 import { Context } from '../helpers/Context.js';
 import { ServiceFeeHelper } from '../helpers/ServiceFeeHelper.js';
 import { StripeHelper } from '../helpers/StripeHelper.js';
+import { ViesHelper } from '../helpers/ViesHelper.js';
 import { AuditLogService } from './AuditLogService.js';
 import { BalanceItemPaymentService } from './BalanceItemPaymentService.js';
 import { BalanceItemService } from './BalanceItemService.js';
+import { MollieService } from './MollieService.js';
+import { PaymentMandateService } from './PaymentMandateService.js';
+import type { CreateMandateSettings } from '@stamhoofd/structures/checkout/CreateMandateSettings.js';
 
 export class PaymentService {
     static async handlePaymentStatusUpdate(payment: Payment, organization: Organization, status: PaymentStatus) {
@@ -21,6 +28,14 @@ export class PaymentService {
             return;
         }
 
+        if (status === PaymentStatus.Failed && payment.invoiceId) {
+            throw new SimpleError({
+                code: 'cannot_fail',
+                message: 'A payment that has been invoiced cannot be marked as failed. Instead create a separate chargeback payment with a negative amount.',
+                human: $t('%1RI')
+            })
+        }
+
         await AuditLogService.setContext({ fallbackUserId: payment.payingUserId, source: AuditLogSource.Payment, fallbackOrganizationId: payment.organizationId }, async () => {
             if (status === PaymentStatus.Succeeded) {
                 payment.status = PaymentStatus.Succeeded;
@@ -43,6 +58,15 @@ export class PaymentService {
                     // Flush caches so data is up to date in response
                     await BalanceItemService.flushCaches(organization.id);
                 });
+
+                // It is possible the mandate succeeds immediately, in which case we might
+                // need to save it as the default payment method
+                if (payment.status === PaymentStatus.Succeeded) {
+                    await this.saveMandateIfNeeded({
+                        payment,
+                        sellingOrganization: organization,
+                    })
+                }
                 return;
             }
 
@@ -110,6 +134,25 @@ export class PaymentService {
         });
     }
 
+    static async saveMandateIfNeeded({payment, sellingOrganization}: {payment: Payment, sellingOrganization: Organization}) {
+        // Save as default
+        if (payment.createMandate && payment.createMandate.saveAsDefault) {
+            if (payment.mandateId && payment.status === PaymentStatus.Succeeded) {
+                try {
+                    await PaymentMandateService.setDefaultMandate({
+                        mandateId: payment.mandateId,
+                        payingOrganizationId: payment.payingOrganizationId,
+                        sellingOrganization,
+                        payingUserId: payment.payingUserId
+                    })
+                } catch (e) {
+                    // Ignore as setting the payment status is more important
+                    console.error(e);
+                }
+            }
+        }
+    }
+
     /**
      * ID of payment is needed because of race conditions (need to fetch payment in a race condition save queue)
      */
@@ -129,11 +172,15 @@ export class PaymentService {
                     return;
                 }
 
-                const organization = org ?? await Organization.getByID(payment.organizationId);
+                const organization = org && org.id === payment.organizationId ? org : await Organization.getByID(payment.organizationId);
                 if (!organization) {
                     console.error('Organization not found for payment', payment.id);
                     return;
                 }
+                if (org && org.id !== payment.organizationId && org.id !== payment.payingOrganizationId) {
+                    console.error('Non-matching organization found for payment', payment.id, 'org', org.id);
+                    return;
+                }
 
                 const testMode = organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production';
 
@@ -158,89 +205,36 @@ export class PaymentService {
                         }
                     }
                     else if (payment.provider === PaymentProvider.Mollie) {
-                        // check status via mollie
-                        const molliePayments = await MolliePayment.where({ paymentId: payment.id }, { limit: 1 });
-                        if (molliePayments.length === 1) {
-                            const molliePayment = molliePayments[0];
-                            // check status
-                            const token = await MollieToken.getTokenFor(organization.id);
-
-                            if (token) {
-                                try {
-                                    const mollieClient = createMollieClient({ accessToken: await token.getAccessToken() });
-                                    let mollieData = await mollieClient.payments.get(molliePayment.mollieId, {
-                                        testmode: organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production',
-                                    });
-
-                                    console.log(mollieData); // log to log files to check issues
-
-                                    const details = mollieData.details as any;
-                                    if (details?.consumerName) {
-                                        payment.ibanName = details.consumerName;
-                                    }
-                                    if (details?.consumerAccount) {
-                                        payment.iban = details.consumerAccount;
-                                    }
-                                    if (details?.cardHolder) {
-                                        payment.ibanName = details.cardHolder;
-                                    }
-                                    if (details?.cardNumber) {
-                                        payment.iban = 'xxxx xxxx xxxx ' + details.cardNumber;
-                                    }
-
-                                    if (mollieData.status === MolliePaymentStatus.paid) {
-                                        await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Succeeded);
-                                    }
-                                    else if (mollieData.status === MolliePaymentStatus.failed || mollieData.status === MolliePaymentStatus.expired || mollieData.status === MolliePaymentStatus.canceled) {
-                                        await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
-                                    }
-                                    else if ((cancel || this.shouldTryToCancel(payment.status, payment)) && mollieData.isCancelable) {
-                                        console.log('Cancelling Mollie payment on request', payment.id);
-                                        mollieData = await mollieClient.payments.cancel(molliePayment.mollieId);
-
-                                        if (mollieData.status === MolliePaymentStatus.paid) {
-                                            await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Succeeded);
-                                        }
-                                        else if (mollieData.status === MolliePaymentStatus.failed || mollieData.status === MolliePaymentStatus.expired || mollieData.status === MolliePaymentStatus.canceled) {
-                                            await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
-                                        }
-                                        else if (this.isManualExpired(payment.status, payment)) {
-                                            // Mollie still returning pending after 1 day: mark as failed
-                                            console.error('Manually marking Mollie payment as expired', payment.id);
-                                            await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
-                                        }
-                                    }
-                                    else if (this.isManualExpired(payment.status, payment)) {
-                                        // Mollie still returning pending after 1 day: mark as failed
-                                        console.error('Manually marking Mollie payment as expired', payment.id);
-                                        await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
-                                    }
-                                }
-                                catch (e) {
-                                    console.error('Payment check failed Mollie', payment.id, e);
-                                    if (this.isManualExpired(payment.status, payment)) {
-                                        console.error('Manually marking Mollie payment as expired', payment.id);
-                                        await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
-                                    }
+                        try {
+                            const mollieClient = await MollieService.create({
+                                sellingOrganization: organization
+                            }); 
+                            if (mollieClient) {
+                                let {status} = await mollieClient.getStatus(payment, cancel || this.shouldTryToCancel(payment.status, payment));
+
+                                if (this.isManualExpired(status, payment)) {
+                                    console.error('Manually marking Mollie payment as expired', payment.id);
+                                    status = PaymentStatus.Failed;
                                 }
-                            }
-                            else {
-                                console.warn('Mollie payment is missing for organization ' + organization.id + ' while checking payment status...');
 
+                                await this.handlePaymentStatusUpdate(payment, organization, status);
+                            } else {
+                                console.error('Missing Mollie Credentials for payment', payment.id);
                                 if (this.isManualExpired(payment.status, payment)) {
-                                    console.error('Manually marking payment without mollie token as expired', payment.id);
+                                    console.error('Manually marking Mollie payment as expired', payment.id);
                                     await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
                                 }
                             }
-                        }
-                        else {
+
+                        } catch (e) {
+                            console.error('Payment check failed Mollie', payment.id, e);
                             if (this.isManualExpired(payment.status, payment)) {
-                                console.error('Manually marking payment without mollie payments as expired', payment.id);
+                                console.error('Manually marking Mollie payment as expired', payment.id);
                                 await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
                             }
                         }
                     }
-                    else if (payment.provider == PaymentProvider.Buckaroo) {
+                    else if (payment.provider === PaymentProvider.Buckaroo) {
                         const helper = new BuckarooHelper(organization.privateMeta.buckarooSettings?.key ?? '', organization.privateMeta.buckarooSettings?.secret ?? '', organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production');
                         try {
                             let status = await helper.getStatus(payment);
@@ -311,7 +305,7 @@ export class PaymentService {
                 else {
                     // Do a manual update if needed
                     if (payment.status === PaymentStatus.Succeeded) {
-                        if (payment.provider === PaymentProvider.Stripe) {
+                        if ( (payment.provider === PaymentProvider.Mollie && STAMHOOFD.environment === 'development')) {
                             // Update the status
                             await StripeHelper.getStatus(payment, false, testMode);
                         }
@@ -329,6 +323,18 @@ export class PaymentService {
                 return true;
             }
         }
+
+        if (STAMHOOFD.environment === 'development') {
+            // In development, we expire all direct debits and other paymetns after 1 hour, because they need manual changes
+            // otherwise they will remain stuck in the dev environment, poluting the UI
+            if ((status === PaymentStatus.Pending || status === PaymentStatus.Created)) {
+                // If payment is not succeeded after one day, mark as failed
+                if (payment.createdAt < new Date(new Date().getTime() - 60 * 1000 * 60)) {
+                    return true;
+                }
+            }
+        }
+
         return false;
     }
 
@@ -336,7 +342,7 @@ export class PaymentService {
      * Try to cancel a payment that is still pending
      */
     static shouldTryToCancel(status: PaymentStatus, payment: Payment): boolean {
-        if ((status === PaymentStatus.Pending || status === PaymentStatus.Created) && payment.method !== PaymentMethod.DirectDebit) {
+        if ((status === PaymentStatus.Pending || status === PaymentStatus.Created) && (payment.method !== PaymentMethod.DirectDebit || STAMHOOFD.environment === 'development')) {
             let timeout = STAMHOOFD.environment === 'development' ? 60 * 1000 * 2 : 60 * 1000 * 30;
 
             // If payconiq and not yet 'identified' (scanned), cancel after 5 minutes
@@ -356,39 +362,45 @@ export class PaymentService {
      * we'll need to round the payment to 1 cent. That can cause issues in the financial statements because
      * the total amount of balances does not match the total amount received/paid.
      *
-     * To fix that, we create an extra balance item with the difference. So the rounding always matches.
-     *
-     * TODO: update this method to generate a virtual invoice and use the price of the invoice instead of the rounded payment price, so we don't get differences in calculation
+     * To fix that, we create an extra roundingAmount with the difference. So the rounding always matches.
      */
-    static round(payment: Payment) {
-        const amount = payment.price;
-        const rounded = Payment.roundPrice(payment.price);
+    static roundPayment(payment: Payment) {
+        // Calculate total price of the balance items
+        // this fixes issus when the method is called multiple times
+        // should be subtracted, not added
+        const balanceItemsTotalPrice = payment.price - payment.roundingAmount;
+
+        const {roundingAmount, price} = this.round(balanceItemsTotalPrice);
+        payment.roundingAmount = roundingAmount;
+        payment.price = price;
+    }
+
+    static round(amount: number) {
+        const rounded = Payment.roundPrice(amount);
         const difference = rounded - amount;
 
         if (difference === 0) {
-            return;
+            return {
+                price: amount,
+                roundingAmount: 0
+            };
         }
 
         if (difference > 100 || difference < -100) {
-            throw new Error('Unexpected rounding difference of ' + difference + ' for payment ' + payment.id);
+            throw new Error('Unexpected rounding difference of ' + difference + ' for price ' + amount.toString());
         }
 
-        payment.roundingAmount = difference;
-
-        // Change payment total price
-        payment.price += difference;
+        return {
+            price: amount + difference,
+            roundingAmount: difference
+        }
     }
 
-    static async createPayment({ balanceItems, organization, user, members, checkout, payingOrganization, serviceFeeType }: {
+    static calculateTotalPrice({ balanceItems, organization, members}: {
         balanceItems: Map<BalanceItem, number>;
         organization: Organization;
-        user: User;
         members?: Member[];
-        checkout: Pick<Checkoutable<never>, 'paymentMethod' | 'totalPrice' | 'customer' | 'cancelUrl' | 'redirectUrl'>;
-        payingOrganization?: Organization | null;
-        serviceFeeType: 'webshop' | 'members' | 'tickets' | 'system';
     }) {
-        // Calculate total price to pay
         let totalPrice = 0;
         const names: {
             firstName: string;
@@ -437,44 +449,55 @@ export class PaymentService {
                 });
             }
         }
+        const { price, roundingAmount } = this.round(totalPrice);
 
-        if (totalPrice < 0) {
-            // todo: try to make it non-negative by reducing some balance items
+        if (price < 0) {
             throw new SimpleError({
                 code: 'negative_price',
                 message: $t(`%vl`),
             });
         }
 
-        if (checkout.totalPrice !== null && totalPrice !== checkout.totalPrice) {
-            // Changed!
+        return { hasNegative, price, roundingAmount, names }
+    }
+
+    static validateTotalPrice({ price, roundingAmount, checkout}: {
+        price: number, // already rounded
+        roundingAmount: number,
+        checkout: Pick<Checkoutable<never>, 'totalPrice'>;
+    }) {
+        // total price without rounding
+        const balanceItemsPrice = price - roundingAmount; 
+
+        // also accept rounding that might have happend in the frontend and that was correct
+        if (checkout.totalPrice !== null && checkout.totalPrice !== balanceItemsPrice && checkout.totalPrice !== price) { 
             throw new SimpleError({
                 code: 'changed_price',
-                message: $t(`%vk`, { total: Formatter.price(totalPrice) }),
+                message: $t(`%vk`, { total: Formatter.price(price) }),
             });
         }
+    }
 
-        const payment = new Payment();
-
-        // Who will receive this money?
-        payment.organizationId = organization.id;
-
-        // Who paid
-        payment.payingUserId = user.id;
-        payment.payingOrganizationId = payingOrganization?.id ?? null;
-
+    static async validateCustomer({ price, hasNegative, user, checkout, payingOrganization}: {
+        price: number,
+        hasNegative: boolean,
+        user: User | null;
+        checkout: Pick<Checkoutable<never>, 'customer'>;
+        payingOrganization?: Organization | null;
+    }) {
         // Fill in customer default value
-        payment.customer = PaymentCustomer.create({
-            firstName: user.firstName,
-            lastName: user.lastName,
-            email: user.email,
+        const customer = PaymentCustomer.create({
+            firstName: user?.firstName,
+            lastName: user?.lastName,
+            email: user?.email,
+            phone: checkout.customer?.phone
         });
 
         // Use structured transfer description prefix
         let prefix = '';
 
         if (payingOrganization) {
-            if (totalPrice !== 0 || hasNegative || checkout.customer) {
+            if (price !== 0 || hasNegative || checkout.customer) {
                 if (!checkout.customer) {
                     throw new SimpleError({
                         code: 'missing_fields',
@@ -503,7 +526,14 @@ export class PaymentService {
                     });
                 }
 
-                payment.customer.company = foundCompany;
+                if (!checkout.customer.company.equals(foundCompany)) {
+                    throw new SimpleError({
+                        code: 'invalid_data',
+                        message: 'Cannot change company data. Please save the company data to the paying organization meta data before using it.'
+                    });
+                }
+
+                customer.company = foundCompany;
 
                 const orgNumber = parseInt(payingOrganization.uri);
 
@@ -514,36 +544,171 @@ export class PaymentService {
             else {
                 // Zero amount payment (without refunds) without specifying a company will just use the default company to link to the payment
                 // It doesn't really matter since the price is zero and we won't invoice it.
-                const company = payingOrganization.meta.companies[0];
+                const company = this.getDefaultCompanyForOrganization(payingOrganization);
                 if (company) {
-                    payment.customer.company = company;
+                    customer.company = company;
                 }
             }
+        } else {
+            if (checkout.customer && checkout.customer.company) {
+                customer.company = checkout.customer.company.clone()
+                await ViesHelper.checkCompany(checkout.customer.company, customer.company);
+            }
         }
 
-        // Validate VAT rates for this customer
-        await this.validateVATRates({ customer: payment.customer, organization, balanceItems });
+        if (price !== 0 && customer.company?.VATNumber !== checkout.customer?.company?.VATNumber) {
+            // Security check: because previous validation and generation might have used the VATNumber from the checkout
+            throw new SimpleError({
+                code: 'changed_VAT_number',
+                message: 'Unexpected VAT number change'
+            })
+        }
 
-        payment.status = PaymentStatus.Created;
-        payment.paidAt = null;
-        payment.price = totalPrice;
-        PaymentService.round(payment);
-        totalPrice = payment.price;
+        return { customer, prefix };
+    }
 
-        if (totalPrice === 0) {
-            payment.status = PaymentStatus.Succeeded;
-            payment.paidAt = new Date();
+    static async createProForma({ balanceItems, organization, user, members, checkout, payingOrganization}: {
+        balanceItems: Map<BalanceItem, number>;
+        organization: Organization;
+        user: User;
+        members?: Member[];
+        checkout: Pick<Checkoutable<never>, 'totalPrice' | 'customer' | 'cancelUrl' | 'redirectUrl'>;
+        payingOrganization?: Organization | null;
+    }) {
+        // Calculate total price to pay
+        const { price, hasNegative, roundingAmount } = PaymentService.calculateTotalPrice({ balanceItems, organization, members })
+        PaymentService.validateTotalPrice({ price, roundingAmount, checkout })
+
+        const { customer, } = await PaymentService.validateCustomer({ user, checkout, payingOrganization, price, hasNegative })
+        const { seller } = PaymentService.validateVATRates({ customer, organization, balanceItems });
+        
+        // Create invoice instead from fictive PaymentGeneral
+        const fakePaymentGeneral = PaymentGeneral.create({
+            id: 'pro-forma',
+            price,
+            customer,
+            method: PaymentMethod.Unknown,
+            balanceItemPayments: [...balanceItems.entries()].map(([balanceItem, price]) => {
+                return BalanceItemPaymentDetailed.create({
+                    id: 'pro-forma-' + balanceItem.id,
+                    balanceItem: balanceItem.getStructure(),
+                    price
+                })
+            })
+        })
+
+        let invoice: Invoice | null = null;
+
+        try {
+             invoice = Invoice.create({
+                seller,
+                customer,
+                payments: [fakePaymentGeneral],
+            });
+            invoice.buildFromPayments();
+        } catch (e) {
+            if ((isSimpleError(e) || isSimpleErrors(e)) && e.hasCode('balance_item_without_vat_percentage')) {
+                // ok
+                // Missing VAT that prevents invoice from being created
+            } else {
+                throw e;
+            }
+        }
+
+        return {
+            invoice,
+            payment: fakePaymentGeneral
+        }
+    }
+
+    static async registerChargeback(payment: Payment, amount: number) {
+        if (amount !== payment.price) {
+            // Creates issues to know what balance item was paid and what was not.
+            throw new Error('Cannot register chargeback with different amount than the payment for payment ' + payment.id)
+        }
+        const balanceItemPayments = await BalanceItemPayment.select().where('paymentId', payment.id).fetch()
+        const items = await BalanceItem.getByIDs(...Formatter.uniqueArray(balanceItemPayments.map(b => b.balanceItemId)))
+
+         // Done validation
+        const chargeback = new Payment();
+
+        // Who will receive this money?
+        chargeback.organizationId = payment.organizationId!;
+
+        // Who paid
+        chargeback.payingUserId = payment.payingUserId
+        chargeback.payingOrganizationId = payment.payingOrganizationId
+        chargeback.customer = payment.customer;
+
+        chargeback.status = PaymentStatus.Succeeded;
+        chargeback.paidAt = new Date();
+        chargeback.price = -payment.price;
+        chargeback.roundingAmount = -payment.roundingAmount;
+        chargeback.method = payment.method;
+        chargeback.type = PaymentType.Chargeback;
+
+        chargeback.provider = payment.provider;
+        chargeback.stripeAccountId = payment.stripeAccountId
+
+        await chargeback.save();
+
+
+        for (const original of balanceItemPayments) {
+            // Create one balance item payment to pay it in one payment
+            const balanceItemPayment = new BalanceItemPayment();
+            balanceItemPayment.balanceItemId = original.balanceItemId
+            balanceItemPayment.paymentId = chargeback.id;
+            balanceItemPayment.organizationId = chargeback.organizationId;
+            balanceItemPayment.price = -original.price;
+            await balanceItemPayment.save();
         }
 
-        // Validate payment method after customer is defined
-        const paymentConfiguration = organization.meta.registrationPaymentConfiguration;
-        const privatePaymentConfiguration = organization.privateMeta.registrationPaymentConfiguration;
+        // Update cached balance items pending amount (only created balance items, because those are involved in the payment)
+        await BalanceItemService.updatePaidAndPending(items);
+
+        return chargeback;
+    }
+
+    static async createPayment({ balanceItems, organization, user, members, checkout, payingOrganization, serviceFeeType, createMandate, useMandate, paymentConfiguration, privatePaymentConfiguration}: {
+        balanceItems: Map<BalanceItem, number>;
+        organization: Organization;
+        user: User | null;
+        members?: Member[];
+        checkout: Pick<Checkoutable<never>, 'paymentMethod' | 'totalPrice' | 'customer' | 'cancelUrl' | 'redirectUrl'>;
+        payingOrganization?: Organization | null;
+        serviceFeeType: 'webshop' | 'members' | 'tickets' | 'system';
+        createMandate: CreateMandateSettings | null,
+        useMandate: PaymentMandate | null,
+        paymentConfiguration: PaymentConfiguration,
+        privatePaymentConfiguration: PrivatePaymentConfiguration,
+    }) {
+        if (balanceItems.size === 0) {
+            return null;
+        }
 
-        payment.method = checkout.paymentMethod ?? PaymentMethod.Unknown;
-        await this.validatePaymentMethod({ payment, balanceItems, paymentConfiguration });
+        // Calculate total price to pay
+        const { price, roundingAmount, hasNegative, names } = this.calculateTotalPrice({ balanceItems, organization, members })
+        PaymentService.validateTotalPrice({ price, roundingAmount, checkout })
+
+        const { customer, prefix } = await this.validateCustomer({ user, checkout, payingOrganization, price, hasNegative })
+        this.validateVATRates({ customer, organization, balanceItems });
+        
+        const {method, type, mandate} = await this.validatePaymentMethod({ 
+            method: checkout.paymentMethod ?? PaymentMethod.Unknown,
+            mandate: useMandate,
+            createMandate: !!createMandate,
+            customer,
+            price,
+            hasNegative,
+            balanceItems, 
+            paymentConfiguration,
+            user,
+            payingOrganization: payingOrganization ?? null,
+            sellingOrganization: organization
+        });
 
-        // Validate URL's for online payments before saving the payment
-        if ((payment.method !== PaymentMethod.Transfer && payment.method !== PaymentMethod.PointOfSale && payment.method !== PaymentMethod.Unknown) && (!checkout.redirectUrl || !checkout.cancelUrl)) {
+        // Check URL's set fro online payments
+        if ((method !== PaymentMethod.Transfer && method !== PaymentMethod.PointOfSale && method !== PaymentMethod.Unknown) && (!checkout.redirectUrl || !checkout.cancelUrl) && !mandate) {
             throw new SimpleError({
                 code: 'missing_fields',
                 message: 'redirectUrl or cancelUrl is missing and is required for non-zero online payments',
@@ -551,6 +716,47 @@ export class PaymentService {
             });
         }
 
+        // Determine the payment provider (throws if invalid)
+        const { provider, stripeAccount } = await organization.getPaymentProviderFor(method, mandate, privatePaymentConfiguration);
+
+        if (createMandate && !mandate) {
+            if (provider !== PaymentProvider.Mollie) {
+                throw new SimpleError({
+                    code: 'cannot_create_mandate_for_provider',
+                    message: 'Saving a payment method is not yet supported for this payment method',
+                    human: $t('%1U0')
+                })
+            }
+        }
+
+        // Done validation
+        const payment = new Payment();
+
+        // Who will receive this money?
+        payment.organizationId = organization.id;
+
+        // Who paid
+        payment.payingUserId = !payingOrganization ? (user?.id ?? null) : null;
+        payment.payingOrganizationId = payingOrganization?.id ?? null;
+        payment.customer = customer;
+
+        payment.status = PaymentStatus.Created;
+        payment.paidAt = null;
+        payment.price = price;
+        payment.roundingAmount = roundingAmount;
+        payment.method = method;
+        payment.type = type;
+        payment.createMandate = createMandate
+
+        if (price === 0) {
+            payment.status = PaymentStatus.Succeeded;
+            payment.paidAt = new Date();
+        }
+
+        payment.provider = provider;
+        payment.stripeAccountId = stripeAccount?.id ?? null;
+        ServiceFeeHelper.setServiceFee(payment, organization, serviceFeeType, [...balanceItems.entries()].map(([_, p]) => p));
+
         // Add transfer description
         if (payment.method === PaymentMethod.Transfer) {
             // remark: we cannot add the lastnames, these will get added in the frontend when it is decrypted
@@ -571,27 +777,19 @@ export class PaymentService {
                 {
                     name: groupedNames,
                     naam: groupedNames,
-                    email: user.email,
+                    email: customer.email ?? user?.email ?? '',
                     prefix,
                 },
             );
         }
 
-        // Determine the payment provider
-        // Throws if invalid
-        const { provider, stripeAccount } = await organization.getPaymentProviderFor(payment.method, privatePaymentConfiguration);
-        payment.provider = provider;
-        payment.stripeAccountId = stripeAccount?.id ?? null;
-        ServiceFeeHelper.setServiceFee(payment, organization, serviceFeeType, [...balanceItems.entries()].map(([_, p]) => p));
-
         await payment.save();
+
+        // Create online payment and balance item payments
         let paymentUrl: string | null = null;
         let paymentQRCode: string | null = null;
         const description = organization.name + ' ' + payment.id;
 
-        // Create balance item payments
-        const balanceItemPayments: (BalanceItemPayment & { balanceItem: BalanceItem })[] = [];
-
         try {
             for (const [balanceItem, price] of balanceItems) {
                 // Create one balance item payment to pay it in one payment
@@ -600,16 +798,18 @@ export class PaymentService {
                 balanceItemPayment.paymentId = payment.id;
                 balanceItemPayment.organizationId = organization.id;
                 balanceItemPayment.price = price;
-                await balanceItemPayment.save();
 
-                balanceItemPayments.push(balanceItemPayment.setRelation(BalanceItemPayment.balanceItem, balanceItem));
+                await balanceItemPayment.save();
             }
 
+            // Update cached balance items pending amount (only created balance items, because those are involved in the payment)
+            await BalanceItemService.updatePaidAndPending([...balanceItems.keys()]);
+
             // Update balance items
             if (payment.method === PaymentMethod.Transfer) {
                 // Send a small reminder email
                 try {
-                    await this.sendTransferEmail(user, organization, payment);
+                    await this.sendTransferEmail(customer, user?.id ?? null, organization, payment);
                 }
                 catch (e) {
                     console.error('Failed to send transfer email');
@@ -617,25 +817,36 @@ export class PaymentService {
                 }
             }
             else if (payment.method !== PaymentMethod.PointOfSale && payment.method !== PaymentMethod.Unknown) {
-                if (!checkout.redirectUrl || !checkout.cancelUrl) {
+                if ((!checkout.redirectUrl || !checkout.cancelUrl) && !mandate) {
                     throw new Error('Should have been caught earlier');
                 }
 
-                const _redirectUrl = new URL(checkout.redirectUrl);
+                const _redirectUrl = new URL(checkout.redirectUrl ?? ('https://' + STAMHOOFD.domains.dashboard));
                 _redirectUrl.searchParams.set('paymentId', payment.id);
-                _redirectUrl.searchParams.set('organizationId', organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
+                _redirectUrl.searchParams.set('organizationId', payment.payingOrganizationId ?? organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
 
-                const _cancelUrl = new URL(checkout.cancelUrl);
+                const _cancelUrl = new URL(checkout.cancelUrl?? ('https://' + STAMHOOFD.domains.dashboard));
                 _cancelUrl.searchParams.set('paymentId', payment.id);
                 _cancelUrl.searchParams.set('cancel', 'true');
-                _cancelUrl.searchParams.set('organizationId', organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
+                _cancelUrl.searchParams.set('organizationId', payment.payingOrganizationId ?? organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
 
                 const redirectUrl = _redirectUrl.href;
                 const cancelUrl = _cancelUrl.href;
 
                 const webhookUrl = 'https://' + organization.getApiHost() + '/v' + Version + '/payments/' + encodeURIComponent(payment.id) + '?exchange=true';
-
+                
                 if (payment.provider === PaymentProvider.Stripe) {
+                    if (createMandate || mandate) {
+                        // Already checked, but for security
+                        throw new Error('Unsupported')
+                    }
+                    if (!customer.email) {
+                        throw new SimpleError({
+                            code: 'missing_email',
+                            message: 'Email address is required for online payments via Stripe',
+                            human: $t('%1SJ')
+                        })
+                    }
                     const stripeResult = await StripeHelper.createPayment({
                         payment,
                         stripeAccount,
@@ -644,65 +855,51 @@ export class PaymentService {
                         statementDescriptor: organization.name,
                         metadata: {
                             organization: organization.id,
-                            user: user.id,
+                            user: user?.id,
                             payment: payment.id,
                         },
                         i18n: Context.i18n,
-                        lineItems: balanceItemPayments,
                         organization,
                         customer: {
-                            name: user.name ?? names[0]?.name ?? $t(`%Gr`),
-                            email: user.email,
+                            name: customer.name ?? names[0]?.name ?? $t(`%Gr`),
+                            email: customer.email,
                         },
                     });
                     paymentUrl = stripeResult.paymentUrl;
                 }
                 else if (payment.provider === PaymentProvider.Mollie) {
-                    // Mollie payment
-                    const token = await MollieToken.getTokenFor(organization.id);
-                    if (!token) {
-                        throw new SimpleError({
-                            code: '',
-                            message: $t(`%w3`, { method: PaymentMethodHelper.getName(payment.method) }),
-                        });
-                    }
-                    const profileId = organization.privateMeta.mollieProfile?.id ?? await token.getProfileId(organization.getHost());
-                    if (!profileId) {
-                        throw new SimpleError({
-                            code: '',
-                            message: $t(`%w4`, { method: PaymentMethodHelper.getName(payment.method) }),
-                        });
-                    }
-                    const mollieClient = createMollieClient({ accessToken: await token.getAccessToken() });
-                    const locale = Context.i18n.locale.replace('-', '_');
-                    const molliePayment = await mollieClient.payments.create({
-                        amount: {
-                            currency: 'EUR',
-                            value: (totalPrice / 100).toFixed(2),
-                        },
-                        method: payment.method == PaymentMethod.Bancontact ? molliePaymentMethod.bancontact : (payment.method == PaymentMethod.iDEAL ? molliePaymentMethod.ideal : molliePaymentMethod.creditcard),
-                        testmode: organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production',
-                        profileId,
-                        description,
+                    const mollieResult = await MollieService.createPayment({
+                        payment,
                         redirectUrl,
+                        cancelUrl,
                         webhookUrl,
+                        description,
                         metadata: {
-                            paymentId: payment.id,
+                            organization: organization.id,
+                            user: user?.id,
+                            payment: payment.id,
                         },
-                        locale: ['en_US', 'en_GB', 'nl_NL', 'nl_BE', 'fr_FR', 'fr_BE', 'de_DE', 'de_AT', 'de_CH', 'es_ES', 'ca_ES', 'pt_PT', 'it_IT', 'nb_NO', 'sv_SE', 'fi_FI', 'da_DK', 'is_IS', 'hu_HU', 'pl_PL', 'lv_LV', 'lt_LT'].includes(locale) ? (locale as any) : null,
+                        sellingOrganization: organization,
+                        payingOrganization: payingOrganization ?? null,
+                        user,
+                        customer,
+                        mandate,
                     });
-                    paymentUrl = molliePayment.getCheckoutUrl();
-
-                    // Save payment
-                    const dbPayment = new MolliePayment();
-                    dbPayment.paymentId = payment.id;
-                    dbPayment.mollieId = molliePayment.id;
-                    await dbPayment.save();
+                    paymentUrl = mollieResult.paymentUrl;
                 }
                 else if (payment.provider === PaymentProvider.Payconiq) {
+                    if (createMandate || mandate) {
+                        // Already checked, but for security
+                        throw new Error('Unsupported')
+                    }
                     ({ paymentUrl, paymentQRCode } = await PayconiqPayment.createPayment(payment, organization, description, redirectUrl, webhookUrl));
                 }
                 else if (payment.provider === PaymentProvider.Buckaroo) {
+                    if (createMandate || mandate) {
+                        // Already checked, but for security
+                        throw new Error('Unsupported')
+                    }
+
                     // Increase request timeout because buckaroo is super slow (in development)
                     Context.request.request?.setTimeout(60 * 1000);
                     const buckaroo = new BuckarooHelper(organization.privateMeta?.buckarooSettings?.key ?? '', organization.privateMeta?.buckarooSettings?.secret ?? '', organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production');
@@ -725,8 +922,15 @@ export class PaymentService {
             throw e;
         }
 
-        // Mark valid if needed
-        if (payment.method === PaymentMethod.Transfer || payment.method === PaymentMethod.PointOfSale || payment.method === PaymentMethod.Unknown) {
+        // TypeScript thinks status cannot change to Failed, but it can.
+        if (payment.status === PaymentStatus.Succeeded || (payment.status as PaymentStatus) === PaymentStatus.Failed) { 
+            // force update
+            const updateTo = payment.status
+            payment.status = PaymentStatus.Created
+            await PaymentService.handlePaymentStatusUpdate(payment, organization, updateTo);
+        }
+        else if (payment.method === PaymentMethod.Transfer || payment.method === PaymentMethod.PointOfSale || payment.method === PaymentMethod.Unknown || (payment.method === PaymentMethod.DirectDebit && mandate)) {
+            // Mark valid (not same as paid) if needed
             let hasBundleDiscount = false;
             for (const [balanceItem] of balanceItems) {
                 // Mark valid
@@ -745,7 +949,6 @@ export class PaymentService {
 
         return {
             payment,
-            balanceItemPayments,
             provider,
             stripeAccount,
             paymentUrl,
@@ -753,7 +956,12 @@ export class PaymentService {
         };
     }
 
-    static async sendTransferEmail(user: User, organization: Organization, payment: Payment) {
+    static async sendTransferEmail(customer: PaymentCustomer, userId: string | null, organization: Organization, payment: Payment) {
+        const email = customer.dynamicEmail;
+        if (!email) {
+            console.warn('Skipped sending transfer email because of missing email address', payment.id)
+            return;
+        }
         const paymentGeneral = await payment.getGeneralStructure();
         const groupIds = paymentGeneral.groupIds;
 
@@ -761,10 +969,10 @@ export class PaymentService {
 
         const recipients = [
             Recipient.create({
-                firstName: user.firstName,
-                lastName: user.lastName,
-                email: user.email,
-                userId: user.id,
+                firstName: customer.firstName,
+                lastName: customer.lastName,
+                email: email,
+                userId,
                 replacements,
             }),
         ];
@@ -786,43 +994,189 @@ export class PaymentService {
         });
     }
 
-    static async validatePaymentMethod({ payment, balanceItems, paymentConfiguration }: { payment: Payment; balanceItems: Map<BalanceItem, number>; paymentConfiguration: PaymentConfiguration }) {
-        if (payment.price === 0) {
+    static async validatePaymentMethod({ 
+        method,
+        customer,
+        price,
+        hasNegative,
+        balanceItems, 
+        paymentConfiguration,
+        mandate,
+        payingOrganization,
+        sellingOrganization,
+        user,
+        createMandate
+    }: { 
+        method: PaymentMethod,
+        customer: PaymentCustomer,
+        price: number,
+        hasNegative: boolean,
+        balanceItems: Map<BalanceItem, number>; 
+        paymentConfiguration: PaymentConfiguration,
+        mandate: PaymentMandate | null,
+        payingOrganization: Organization | null,
+        sellingOrganization: Organization,
+        user: User | null,
+        createMandate: boolean
+    }) {
+        if (price === 0) {
             if (balanceItems.size === 0) {
-                return;
+                throw new Error('Empty payment')
             }
+
+            if (createMandate) {
+                throw new SimpleError({
+                    code: 'cannot_create_mandate_without_payment',
+                    message: 'Cannot create saved payment method without payment of a small amount',
+                    human: $t(`%1Ss`),
+                });
+            }
+
             // Create an egalizing payment
-            payment.method = PaymentMethod.Unknown;
+            if (hasNegative) {
+                return {
+                    method: PaymentMethod.Unknown,
+                    type: PaymentType.Reallocation,
+                    mandate: null
+                }
+            }
+
+            return {
+                // Free purchase
+                method: PaymentMethod.Unknown,
+                type: PaymentType.Payment,
+                mandate: null
+            }
+        }
+
+        if (mandate) {
+            if (!paymentConfiguration.enableMandates) {
+                 throw new SimpleError({
+                    code: 'mandates_disabled',
+                    message: 'Cannot pay with mandate',
+                    human: $t('%1SK')
+                });
+            }
+            
+            // Validate mandate + update payment method based on the mandate
+            if (method !== PaymentMethod.Unknown) {
+                throw new SimpleError({
+                    code: 'invalid_data',
+                    message: 'Cannot combine setting mandate with method'
+                });
+            }
 
-            if ([...balanceItems.values()].find(b => b < 0)) {
-                payment.type = PaymentType.Reallocation;
+            const allMandates = await PaymentMandateService.getMandates({
+                payingOrganization,
+                sellingOrganization,
+                user,
+            });
+
+            const existingMandate = allMandates.find(m => m.id === mandate.id && m.provider === mandate.provider);
+            if (!existingMandate) {
+                throw new SimpleError({
+                    code: 'not_found',
+                    message: 'Mandate not found',
+                    human: $t('%1TQ'),
+                    field: 'mandateId'
+                });
+            }
+
+            if (existingMandate.status !== PaymentMandateStatus.Valid) {
+                throw new SimpleError({
+                    code: 'mandate_not_valid',
+                    message: 'Mandate not valid',
+                    human: $t('%1QA'),
+                    field: 'mandateId'
+                });
             }
+
+            switch (existingMandate.type) {
+                case PaymentMandateType.CreditCard:
+                    return {
+                        mandate: existingMandate,
+                        method: PaymentMethod.CreditCard,
+                        type: PaymentType.Payment
+                    }
+                case PaymentMandateType.DirectDebit:
+                    return {
+                        mandate: existingMandate,
+                        method: PaymentMethod.DirectDebit,
+                        type: PaymentType.Payment
+                    }
+            }
+
+            throw new Error('Unsupported mandate type')
         }
-        else if (payment.method === PaymentMethod.Unknown) {
+
+        if (createMandate) {
+            if (!paymentConfiguration.enableMandates) {
+                 throw new SimpleError({
+                    code: 'mandates_disabled',
+                    message: 'Cannot pay with mandate',
+                    human: $t('%1R1')
+                });
+            }
+        }
+        
+        if (method === PaymentMethod.Unknown) {
             throw new SimpleError({
                 code: 'invalid_data',
                 message: $t(`%vy`),
             });
         }
-        else {
-            // Validate payment method
-            const allowedPaymentMethods = paymentConfiguration.getAvailablePaymentMethods({
-                amount: payment.price,
-                customer: payment.customer,
+
+        // Validate payment method
+        const allowedPaymentMethods = paymentConfiguration.getAvailablePaymentMethods({
+            amount: price,
+            customer: customer,
+            forMandate: createMandate
+        });
+
+        if (!allowedPaymentMethods.includes(method)) {
+            throw new SimpleError({
+                code: 'invalid_payment_method',
+                message: $t(`%vp`),
             });
+        }
 
-            if (!allowedPaymentMethods.includes(payment.method)) {
+        return {
+            method,
+            type: PaymentType.Payment,
+            mandate: null
+        }
+    }
+
+    static getDefaultCompanyForOrganization(sellingOrganization: Organization) {
+        return sellingOrganization.meta.companies[0];
+    }
+
+    static getVATExcempt({ customer, sellingOrganization }: { customer: PaymentCustomer | null; sellingOrganization: Organization; }) {
+        // Validate VAT rates for this customer
+        const seller = this.getDefaultCompanyForOrganization(sellingOrganization)
+        if (seller && seller.VATNumber && seller.address && customer && customer.company) {
+            // B2B validation
+            if (!customer.company.address) {
                 throw new SimpleError({
-                    code: 'invalid_payment_method',
-                    message: $t(`%vp`),
+                    code: 'missing_field',
+                    message: 'Company address missing',
+                    human: $t('%1LH'),
+                    field: 'customer.company.address',
                 });
             }
+
+            // Reverse charged vat applicable?
+            if (customer.company.address.country !== seller.address.country && customer.company.VATNumber) {
+                return VATExcemptReason.IntraCommunity;
+            }
         }
+
+        return null
     }
 
-    static async validateVATRates({ customer, organization, balanceItems }: { customer: PaymentCustomer; organization: Organization; balanceItems: Map<BalanceItem, number> }) {
+    static validateVATRates({ customer, organization, balanceItems }: { customer: PaymentCustomer; organization: Organization; balanceItems: Map<BalanceItem, number> }) {
         // Validate VAT rates for this customer
-        const seller = organization.meta.companies[0];
+        const seller = this.getDefaultCompanyForOrganization(organization)
         if (seller && seller.VATNumber && seller.address && customer.company) {
             // B2B validation
             if (!customer.company.address) {
@@ -835,7 +1189,7 @@ export class PaymentService {
             }
 
             // Reverse charged vat applicable?
-            if (customer.company.address.country !== seller.address.country) {
+            if (customer.company.address.country !== seller.address.country && customer.company.VATNumber) {
                 // Check VAT Exempt is set on each an every balance item with a non-zero price
                 for (const [item] of balanceItems) {
                     if (item.VATExcempt !== VATExcemptReason.IntraCommunity) {
@@ -902,5 +1256,7 @@ export class PaymentService {
                 }
             }
         }
+
+        return {seller}
     }
 };