@stamhoofd/backend 2.120.6 → 2.121.0

package/src/endpoints/organization/dashboard/receivable-balances/ChargeReceivableBalancesEndpoint.ts

@@ -0,0 +1,127 @@
+import type { Decoder } from '@simonbackx/simple-encoding';
+import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import {  CountFilteredRequest, CountResponse, PaymentCustomer, PaymentMethod, PermissionLevel, ReceivableBalanceType } from '@stamhoofd/structures';
+
+import { Context } from '../../../../helpers/Context.js';
+import { GetReceivableBalancesEndpoint } from './GetReceivableBalancesEndpoint.js';
+import type { BalanceItem} from '@stamhoofd/models';
+import { Organization, User} from '@stamhoofd/models';
+import { CachedBalance } from '@stamhoofd/models';
+import { PaymentService } from '../../../../services/PaymentService.js';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { PaymentMandateService } from '../../../../services/PaymentMandateService.js';
+import { BalanceItemService } from '../../../../services/BalanceItemService.js';
+
+type Params = Record<string, never>;
+type Query = CountFilteredRequest;
+type Body = undefined;
+type ResponseBody = undefined;
+
+export class ChargeReceivableBalancesEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    queryDecoder = CountFilteredRequest as Decoder<CountFilteredRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/receivable-balances/charge', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        const sellingOrganization = await Context.setOrganizationScope();
+        await Context.authenticate();
+        const query = await GetReceivableBalancesEndpoint.buildQuery(request.query);
+
+        for await (const cachedBalance of query.all()) {
+            if (cachedBalance.organizationId !== sellingOrganization.id) {
+                throw new SimpleError({
+                    code: 'wrong_organization',
+                    message: 'Cannot charge a cached balance from a different organization'
+                })
+            }
+            // todo
+            const items = await CachedBalance.balanceForObjects(cachedBalance.organizationId, [cachedBalance.objectId], cachedBalance.objectType);
+
+            if (items.length === 0) {
+                console.log('Nothing to charge for', cachedBalance.id)
+                continue;
+            }
+
+            const map: Map<BalanceItem, number> = new Map();
+            for (const i of items) {
+                map.set(i, i.priceOpen)
+            }
+            let payingOrganization: Organization | null = null;
+            let user: User | null = null;
+            if (cachedBalance.objectType === ReceivableBalanceType.organization) {
+                const p = await Organization.getByID(cachedBalance.objectId);
+                if (!p || !(await Context.auth.hasFullAccess(p))) {
+                    console.error('Unexpected missing paying organization id', cachedBalance)
+                    continue
+                }
+                payingOrganization = p;
+            }
+
+            if (cachedBalance.objectType === ReceivableBalanceType.user || cachedBalance.objectType === ReceivableBalanceType.userWithoutMembers) {
+                const p = await User.getByID(cachedBalance.objectId);
+                if (!p || !(Context.auth.checkScope(p.organizationId))) {
+                    console.error('Unexpected missing user id', cachedBalance)
+                    continue
+                }
+                user = p
+            }
+
+            const mandates = await PaymentMandateService.getMandates({
+                sellingOrganization,
+                user,
+                payingOrganization
+            });
+
+            const mandate = mandates.find(m => m.isDefault)
+
+            if (!mandate) {
+                // Not possible
+                console.error('No mandates found for', cachedBalance.id)
+                continue;
+            }
+
+            const customerUser = user ?? (payingOrganization ? (await payingOrganization.getFullAdmins())[0] : null)
+            const customer = PaymentCustomer.create({
+                firstName: customerUser?.firstName,
+                lastName: customerUser?.lastName,
+                email: customerUser?.email ?? (payingOrganization ? (await payingOrganization.getReplyEmails())[0].email : null),
+                company: payingOrganization?.defaultCompanies[0]
+            })
+            
+            await PaymentService.createPayment({
+                balanceItems: map,
+                checkout: {
+                    paymentMethod: PaymentMethod.Unknown,
+                    totalPrice: null,
+                    customer,
+                    cancelUrl: null,
+                    redirectUrl: null
+                },
+                user,
+                organization: sellingOrganization,
+                payingOrganization,
+                serviceFeeType: 'system',
+                createMandate: null,
+                useMandate: mandate,
+                paymentConfiguration: sellingOrganization.meta.registrationPaymentConfiguration,
+                privatePaymentConfiguration: sellingOrganization.privateMeta.registrationPaymentConfiguration
+            })
+        }
+
+        // Make sure the user can refresh data and see the updated cached amounts
+        await BalanceItemService.flushCaches(sellingOrganization.id)
+        return new Response(undefined, 201);
+    }
+}

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -1,15 +1,16 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { GroupPrivateSettings, Group as GroupStruct, GroupType, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, PermissionLevel, PermissionsResourceType, ResourcePermissions, Version } from '@stamhoofd/structures';
 
-import type { AutoEncoderPatchType, Decoder, PatchableArrayAutoEncoder} from '@simonbackx/simple-encoding';
+import type { AutoEncoderPatchType, Decoder, PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { PatchableArrayDecoder, StringDecoder } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
-import type { Organization} from '@stamhoofd/models';
-import { Event, Group, OrganizationRegistrationPeriod, Platform, Registration, RegistrationPeriod } from '@stamhoofd/models';
+import type { Organization } from '@stamhoofd/models';
+import { Event, Group, OrganizationRegistrationPeriod, Platform, Registration, RegistrationInvitation, RegistrationPeriod } from '@stamhoofd/models';
 import { SQL } from '@stamhoofd/sql';
 import { AuthenticatedStructures } from '../../../../helpers/AuthenticatedStructures.js';
 import { Context } from '../../../../helpers/Context.js';
+import { RecordAnswerHelper } from '../../../../helpers/RecordAnswerHelper.js';
 import { SetupStepUpdater } from '../../../../helpers/SetupStepUpdater.js';
 
 type Params = Record<string, never>;
@@ -377,6 +378,9 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             event.groupId = null;
             await event.save();
         }
+
+        // delete invitations
+        await RegistrationInvitation.delete().where('groupId', id);
     }
 
     static async patchGroup(struct: AutoEncoderPatchType<GroupStruct>, period?: RegistrationPeriod | null, options: { allowPatchWaitingListPeriod?: boolean; isPatchingEvent?: boolean } = {}) {
@@ -390,6 +394,11 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
 
         if (struct.settings) {
             struct.settings.period = undefined; // Not allowed to patch manually
+
+            if (struct.settings.recordCategories) {
+                RecordAnswerHelper.throwIfPatchOrPutIsInvalid(model.settings.recordCategories, struct.settings.recordCategories);
+            }
+
             model.settings.patchOrPut(struct.settings);
         }
 

package/src/endpoints/organization/dashboard/webshops/PatchWebshopEndpoint.ts

@@ -1,5 +1,5 @@
 import type { AutoEncoderPatchType, Decoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Webshop } from '@stamhoofd/models';
@@ -8,6 +8,7 @@ import { PermissionLevel, PrivateWebshop, WebshopPrivateMetaData } from '@stamho
 import { Formatter } from '@stamhoofd/utility';
 
 import { Context } from '../../../../helpers/Context.js';
+import { RecordAnswerHelper } from '../../../../helpers/RecordAnswerHelper.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -56,6 +57,11 @@ export class PatchWebshopEndpoint extends Endpoint<Params, Query, Body, Response
                 if (request.body.meta.customCode !== undefined && !await Context.auth.hasFullAccess(organization.id)) {
                     throw Context.auth.error($t('%15n'));
                 }
+
+                if (request.body.meta.recordCategories) {
+                    RecordAnswerHelper.throwIfPatchOrPutIsInvalid(webshop.meta.recordCategories, request.body.meta.recordCategories);
+                }
+
                 webshop.meta.patchOrPut(request.body.meta);
             }
 

package/src/endpoints/organization/dashboard/webshops/PatchWebshopOrdersEndpoint.ts

@@ -157,7 +157,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                         payment.method = struct.data.paymentMethod;
                         payment.status = PaymentStatus.Created;
                         payment.price = totalPrice;
-                        PaymentService.round(payment);
+                        PaymentService.roundPayment(payment);
                         payment.paidAt = null;
 
                         // Determine the payment provider (always null because no online payments here)

package/src/endpoints/organization/shared/ExchangePaymentEndpoint.ts

@@ -45,10 +45,8 @@ export class ExchangePaymentEndpoint extends Endpoint<Params, Query, Body, Respo
     }
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
-        const organization = await Context.setOptionalOrganizationScope({ willAuthenticate: false });
-        if (!request.query.exchange) {
-            await Context.optionalAuthenticate();
-        }
+        const organization = await Context.setOptionalOrganizationScope({ willAuthenticate: true }); // will authentiate set to true because we allow exchanges for inactive organizations
+        await Context.optionalAuthenticate();
 
         // Not method on payment because circular references (not supprted in ts)
         const payment = await PaymentService.pollStatus(request.params.id, organization, request.query.cancel);
@@ -63,19 +61,23 @@ export class ExchangePaymentEndpoint extends Endpoint<Params, Query, Body, Respo
             return new Response(undefined);
         }
 
-        // #region skip check permissions if order and created less than hour ago
+        // Skip check permissions if order and created less than hour ago
         let checkPermissions = true;
         const hourAgo = new Date();
-        hourAgo.setHours(-1);
+        hourAgo.setHours(-2);
 
         if (payment.createdAt > hourAgo) {
-            const orders = await Order.where({ paymentId: payment.id }, { limit: 1 });
-            const isOrder = orders[0] !== undefined;
-            if (isOrder) {
-                checkPermissions = false;
+            if (payment.payingOrganizationId) {
+                // B2B payments always required
+                checkPermissions = true;
+            } else {
+                const orders = await Order.where({ paymentId: payment.id }, { limit: 1 });
+                const isOrder = orders[0] !== undefined;
+                if (isOrder) {
+                    checkPermissions = false;
+                }
             }
         }
-        // #endregion
 
         return new Response(
             await AuthenticatedStructures.paymentGeneral(payment, checkPermissions),

package/src/endpoints/organization/webshops/PlaceOrderEndpoint.ts

@@ -1,21 +1,22 @@
-import { createMollieClient, PaymentMethod as molliePaymentMethod } from '@mollie/api-client';
+import { PaymentMethod as molliePaymentMethod } from '@mollie/api-client';
 import type { Decoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Email } from '@stamhoofd/email';
-import { BalanceItem, BalanceItemPayment, MolliePayment, MollieToken, Order, PayconiqPayment, Payment, RateLimiter, Webshop, WebshopDiscountCode } from '@stamhoofd/models';
+import { BalanceItem, BalanceItemPayment, MolliePayment, Order, PayconiqPayment, Payment, RateLimiter, Webshop, WebshopDiscountCode } from '@stamhoofd/models';
 import { QueueHandler } from '@stamhoofd/queues';
 import { AuditLogSource, BalanceItemRelation, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, OrderData, OrderResponse, Order as OrderStruct, PaymentCustomer, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, Payment as PaymentStruct, TranslatedString, Version, WebshopAuthType, Webshop as WebshopStruct, WebshopTicketType } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 
 import { BuckarooHelper } from '../../../helpers/BuckarooHelper.js';
 import { Context } from '../../../helpers/Context.js';
+import { ServiceFeeHelper } from '../../../helpers/ServiceFeeHelper.js';
 import { StripeHelper } from '../../../helpers/StripeHelper.js';
 import { AuditLogService } from '../../../services/AuditLogService.js';
-import { UitpasService } from '../../../services/uitpas/UitpasService.js';
-import { ServiceFeeHelper } from '../../../helpers/ServiceFeeHelper.js';
+import { MollieService } from '../../../services/MollieService.js';
 import { PaymentService } from '../../../services/PaymentService.js';
+import { UitpasService } from '../../../services/uitpas/UitpasService.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -180,7 +181,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 payment.method = request.body.paymentMethod;
                 payment.status = PaymentStatus.Created;
                 payment.price = totalPrice;
-                PaymentService.round(payment);
+                PaymentService.roundPayment(payment);
                 totalPrice = payment.price;
                 payment.paidAt = null;
                 payment.customer = PaymentCustomer.create({
@@ -191,7 +192,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
 
                 // Determine the payment provider
                 // Throws if invalid
-                const { provider, stripeAccount } = await organization.getPaymentProviderFor(payment.method, webshop.privateMeta.paymentConfiguration);
+                const { provider, stripeAccount } = await organization.getPaymentProviderFor(payment.method, null, webshop.privateMeta.paymentConfiguration);
                 payment.provider = provider;
                 payment.stripeAccountId = stripeAccount?.id ?? null;
                 ServiceFeeHelper.setServiceFee(
@@ -210,8 +211,6 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 // Save order to get the id
                 await order.save();
 
-                const balanceItemPayments: (BalanceItemPayment & { balanceItem: BalanceItem })[] = [];
-
                 // Create balance item
                 const balanceItem = new BalanceItem();
                 balanceItem.type = BalanceItemType.Order;
@@ -239,7 +238,6 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 balanceItemPayment.organizationId = organization.id;
                 balanceItemPayment.price = balanceItem.price;
                 await balanceItemPayment.save();
-                balanceItemPayments.push(balanceItemPayment.setRelation(BalanceItemPayment.balanceItem, balanceItem));
 
                 let paymentUrl: string | null = null;
                 let paymentQRCode: string | null = null;
@@ -287,7 +285,6 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                                 payment: payment.id,
                             },
                             i18n: request.i18n,
-                            lineItems: balanceItemPayments,
                             organization,
                             customer: {
                                 name: order.data.customer.name,
@@ -298,28 +295,26 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                     }
                     else if (payment.provider === PaymentProvider.Mollie) {
                         // Mollie payment
-                        const token = await MollieToken.getTokenFor(webshop.organizationId);
-                        if (!token) {
+                        const mollieService = await MollieService.create({sellingOrganization: organization});
+                        if (!mollieService) {
                             throw new SimpleError({
                                 code: '',
                                 message: $t(`%w3`, { method: PaymentMethodHelper.getName(payment.method) }),
                             });
                         }
-                        const profileId = organization.privateMeta.mollieProfile?.id ?? await token.getProfileId(webshop.getHost());
+                        const profileId = await mollieService.getProfileId(webshop.getHost());
                         if (!profileId) {
                             throw new SimpleError({
                                 code: '',
                                 message: $t(`%w4`, { method: PaymentMethodHelper.getName(payment.method) }),
                             });
                         }
-                        const mollieClient = createMollieClient({ accessToken: await token.getAccessToken() });
-                        const locale = Context.i18n.locale.replace('-', '_');
-                        const molliePayment = await mollieClient.payments.create({
+                        const molliePayment = await mollieService.client.payments.create({
                             amount: {
                                 currency: 'EUR',
                                 value: (totalPrice / 10000).toFixed(2), // from 4 decimals to 0 decimals
                             },
-                            method: payment.method == PaymentMethod.Bancontact ? molliePaymentMethod.bancontact : (payment.method == PaymentMethod.iDEAL ? molliePaymentMethod.ideal : molliePaymentMethod.creditcard),
+                            method: payment.method === PaymentMethod.Bancontact ? molliePaymentMethod.bancontact : (payment.method === PaymentMethod.iDEAL ? molliePaymentMethod.ideal : molliePaymentMethod.creditcard),
                             testmode: organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production',
                             profileId,
                             description,
@@ -331,7 +326,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                                 webshop: webshop.id,
                                 payment: payment.id,
                             },
-                            locale: ['en_US', 'en_GB', 'nl_NL', 'nl_BE', 'fr_FR', 'fr_BE', 'de_DE', 'de_AT', 'de_CH', 'es_ES', 'ca_ES', 'pt_PT', 'it_IT', 'nb_NO', 'sv_SE', 'fi_FI', 'da_DK', 'is_IS', 'hu_HU', 'pl_PL', 'lv_LV', 'lt_LT'].includes(locale) ? (locale as any) : null,
+                            locale: mollieService.locale
                         });
                         console.log(molliePayment);
                         paymentUrl = molliePayment.getCheckoutUrl();

package/src/helpers/AdminPermissionChecker.ts

@@ -8,6 +8,8 @@ import { AccessRight, EmailTemplate as EmailTemplateStruct, EventPermissionCheck
 import { Formatter } from '@stamhoofd/utility';
 import type { RecordCacheEntry } from '../services/MemberRecordStore.js';
 import { MemberRecordStore } from '../services/MemberRecordStore.js';
+import { getFinancialSupportSettingsAsync } from './FinancialSupportHelper.js';
+import { RecordAnswerHelper } from './RecordAnswerHelper.js';
 import { addTemporaryMemberAccess, hasTemporaryMemberAccess } from './TemporaryMemberAccess.js';
 
 /**
@@ -1117,7 +1119,7 @@ export class AdminPermissionChecker {
         return false;
     }
 
-    async hasFullAccess(organizationId: string, level = PermissionLevel.Full): Promise<boolean> {
+    async hasFullAccess(organizationId: string | Organization, level = PermissionLevel.Full): Promise<boolean> {
         const organizationPermissions = await this.getOrganizationPermissions(organizationId);
 
         if (!organizationPermissions) {
@@ -1557,7 +1559,7 @@ export class AdminPermissionChecker {
                     cloned.details.recordAnswers.delete(key);
                 }
                 else {
-                    if (value) {
+                    if (value && RecordAnswerHelper.haveTypesSameClass(value.settings.type, record.type)) {
                         // Force update
                         value.settings = record;
                     }
@@ -1731,7 +1733,13 @@ export class AdminPermissionChecker {
         // Has financial write access?
         if (!await this.hasFinancialMemberAccess(member, PermissionLevel.Write)) {
             if (isUserManager && isSetFinancialSupportTrue) {
-                const financialSupportSettings = this.platform.config.financialSupport;
+                const financialSupportSettings = await getFinancialSupportSettingsAsync(this.platform, async () => {
+                    if (member.organizationId) {
+                        return await this.getOrganization(member.organizationId);
+                    }
+                    return null;
+                });
+                
                 const preventSelfAssignment = financialSupportSettings?.preventSelfAssignment === true;
 
                 if (preventSelfAssignment) {

package/src/helpers/AuthenticatedStructures.ts

@@ -1,8 +1,8 @@
 import { SimpleError } from '@simonbackx/simple-errors';
-import type { AuditLog, Document, EventNotification, MemberWithUsersRegistrationsAndGroups, Order, Ticket} from '@stamhoofd/models';
-import { BalanceItem, CachedBalance, Event, Group, Invoice, Member, MemberPlatformMembership, MemberResponsibilityRecord, Organization, OrganizationRegistrationPeriod, Payment, Registration, RegistrationPeriod, User, Webshop } from '@stamhoofd/models';
-import type { PaymentGeneral} from '@stamhoofd/structures';
-import { AuditLogReplacement, AuditLogReplacementType, AuditLog as AuditLogStruct, DetailedReceivableBalance, Document as DocumentStruct, EventNotification as EventNotificationStruct, Event as EventStruct, GenericBalance, Group as GroupStruct, GroupType, InvoicedBalanceItem, InvoiceStruct, MemberPlatformMembership as MemberPlatformMembershipStruct, MembersBlob, MemberWithRegistrationsBlob, NamedObject, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, Organization as OrganizationStruct, PaymentCustomer, PermissionLevel, Platform, PrivateOrder, PrivateWebshop, ReceivableBalanceObject, ReceivableBalanceObjectContact, ReceivableBalance as ReceivableBalanceStruct, ReceivableBalanceType, RegistrationsBlob, RegistrationWithMemberBlob, TicketPrivate, UserWithMembers, WebshopPreview, Webshop as WebshopStruct, BalanceItem as BalanceItemStruct } from '@stamhoofd/structures';
+import type { AuditLog, Document, EventNotification, MemberWithUsersRegistrationsAndGroups, Order, Ticket } from '@stamhoofd/models';
+import { BalanceItem, CachedBalance, Event, Group, Invoice, Member, MemberPlatformMembership, MemberResponsibilityRecord, Organization, OrganizationRegistrationPeriod, Payment, Registration, RegistrationInvitation, RegistrationPeriod, User, Webshop } from '@stamhoofd/models';
+import type { PaymentGeneral } from '@stamhoofd/structures';
+import { AuditLogReplacement, AuditLogReplacementType, AuditLog as AuditLogStruct, BalanceItem as BalanceItemStruct, DetailedReceivableBalance, Document as DocumentStruct, EventNotification as EventNotificationStruct, Event as EventStruct, GenericBalance, Group as GroupStruct, GroupType, InvitationGroupData, InvitationMemberData, InvoicedBalanceItem, InvoiceStruct, MemberPlatformMembership as MemberPlatformMembershipStruct, MemberRegistrationInvitation, MembersBlob, MemberWithRegistrationsBlob, NamedObject, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, Organization as OrganizationStruct, PaymentCustomer, PermissionLevel, Platform, PrivateOrder, PrivateWebshop, ReceivableBalanceObject, ReceivableBalanceObjectContact, ReceivableBalance as ReceivableBalanceStruct, ReceivableBalanceType, RegistrationInvitation as RegistrationInvitationStruct, RegistrationsBlob, RegistrationWithMemberBlob, TicketPrivate, UserWithMembers, WebshopPreview, Webshop as WebshopStruct } from '@stamhoofd/structures';
 import { Sorter } from '@stamhoofd/utility';
 
 import { SQL } from '@stamhoofd/sql';
@@ -34,7 +34,7 @@ export class AuthenticatedStructures {
             const { registrations, orders } = await Payment.loadBalanceItemRelations(balanceItems);
 
             // Note: permission checking is moved here for performacne to avoid loading the data multiple times
-            if (!(await Context.auth.canAccessBalanceItems(balanceItems, PermissionLevel.Read, { registrations, orders }))) {
+            if (!(await Context.optionalAuth?.canAccessBalanceItems(balanceItems, PermissionLevel.Read, { registrations, orders }))) {
                 throw new SimpleError({
                     code: 'permission_denied',
                     message: 'Permission denied',
@@ -43,7 +43,7 @@ export class AuthenticatedStructures {
             }
         }
 
-        const includeSettlements = checkPermissions && !!Context.user && !!Context.user.permissions;
+        const includeSettlements = checkPermissions && !!Context.user && !!Context.user.permissions && payments.every(p => !!Context.optionalAuth?.checkScope(p.organizationId));
 
         const { payingOrganizations } = await Payment.loadPayingOrganizations(payments);
 
@@ -458,6 +458,12 @@ export class AuthenticatedStructures {
                 .where('periodId', relevantPeriodIds)
                 .fetch()
             : [];
+        const registrationInvitations = members.length > 0
+            ? await RegistrationInvitation.select()
+                .where('memberId', members.map(m => m.id))
+                .fetch() : [];
+
+        const memberRegistrationInvitations: Map<string, MemberRegistrationInvitation[]> = registrationInvitations.length > 0 ? await this.memberRegistrationInvitations(registrationInvitations) : new Map();
 
         // Load organizations
         const organizationIds = responsibilities.map(r => r.organizationId)
@@ -663,6 +669,7 @@ export class AuthenticatedStructures {
                 return r.getStructure(group);
             });
             blob.platformMemberships = platformMemberships.filter(r => r.memberId == blob.id).map(r => MemberPlatformMembershipStruct.create(r));
+            blob.registrationInvitations = memberRegistrationInvitations.get(blob.id) ?? [];
         }
 
         return MembersBlob.create({
@@ -1220,4 +1227,85 @@ export class AuthenticatedStructures {
     static async balanceItemsWithPayments(balanceItems: BalanceItem[]) {
         return await BalanceItem.getStructureWithPayments(balanceItems);
     }
+
+    static async memberRegistrationInvitations(invitations: RegistrationInvitation[]): Promise<Map<string, MemberRegistrationInvitation[]>> {
+        const results = new Map<string, MemberRegistrationInvitation[]>();
+        const groups = await Group.getByIDs(...invitations.map(i => i.groupId));
+
+        for (const invitation of invitations) {
+            const group = groups.find(g => g.id === invitation.groupId);
+            if (!group) {
+                throw new SimpleError({
+                    code: 'group_not_found',
+                    message: 'Group not found',
+                    human: $t(`%1SM`),
+                })
+            }
+
+            const result = MemberRegistrationInvitation.create({
+                id: invitation.id,
+                group: InvitationGroupData.create({
+                    id: invitation.groupId,
+                    name: group.settings.name,
+                    type: group.type,
+                    periodId: group.periodId,
+                }),
+                organizationId: invitation.organizationId,
+                createdAt: invitation.createdAt
+            })
+
+            let array = results.get(invitation.memberId);
+            if (!array) {
+                array = [result];
+                results.set(invitation.memberId, array);
+            } else {
+                array.push(result);
+            }
+        }
+
+        return results;
+    }
+
+    static async registrationInvitations(invitations: RegistrationInvitation[]): Promise<RegistrationInvitationStruct[]> {
+        const members = await Member.getByIDs(...invitations.map(i => i.memberId));
+        const groups = await Group.getByIDs(...invitations.map(i => i.groupId));
+
+        return invitations.map((invitation) => {
+            const member = members.find(m => m.id === invitation.memberId);
+            if (!member) {
+                throw new SimpleError({
+                    code: 'member_not_found',
+                    message: 'Member not found',
+                    human: $t(`%EO`),
+                })
+            }
+
+            const group = groups.find(g => g.id === invitation.groupId);
+            if (!group) {
+                throw new SimpleError({
+                    code: 'group_not_found',
+                    message: 'Group not found',
+                    human: $t(`%1SM`),
+                })
+            }
+
+            return RegistrationInvitationStruct.create({
+                id: invitation.id,
+                group: InvitationGroupData.create({
+                    id: group.id,
+                    name: group.settings.name,
+                    type: group.type,
+                    periodId: group.periodId
+                }),
+                organizationId: invitation.organizationId,
+                member: InvitationMemberData.create({
+                    id: member.id,
+                    firstName: member.firstName,
+                    lastName: member.lastName,
+                    birthDay: member.details.birthDay,
+                }),
+                createdAt: invitation.createdAt
+            });
+        });
+    }
 }

package/src/helpers/FinancialSupportHelper.ts

@@ -0,0 +1,21 @@
+import type { Organization, Platform } from '@stamhoofd/models';
+import type { FinancialSupportSettings, Organization as OrganizationStruct, Platform as PlatformStruct } from '@stamhoofd/structures';
+
+/**
+ * Get the financial support settings from the platform if userMode is platform, or from the organization otherwise.
+ * @param platform 
+ * @param getOrganization callback to prevent fetching the organization if not needed
+ * @returns 
+ */
+export async function getFinancialSupportSettingsAsync(platform: Platform | PlatformStruct, getOrganization: () => Promise<Organization | OrganizationStruct | null>): Promise<FinancialSupportSettings | null> {
+    if (STAMHOOFD.userMode === 'platform') {
+        return platform.config.financialSupport;
+    }
+
+    const organization = await getOrganization();
+    if (organization) {
+        return organization.meta.financialSupport;
+    }
+
+    return null;
+}