@stamhoofd/backend 2.120.6 → 2.122.0

package/src/endpoints/global/registration-invitations/PatchRegistrationInvitationsEndpoint.ts

@@ -0,0 +1,167 @@
+import type { AutoEncoderPatchType, Decoder, PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
+import { PatchableArrayDecoder, StringDecoder } from '@simonbackx/simple-encoding';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import type { RegistrationInvitation as RegistrationInvitationStruct } from '@stamhoofd/structures';
+import { GroupType, PermissionLevel, RegistrationInvitationRequest } from '@stamhoofd/structures';
+
+import { SimpleError } from '@simonbackx/simple-errors';
+import { Group, Member, RegistrationInvitation } from '@stamhoofd/models';
+import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures.js';
+import { Context } from '../../../helpers/Context.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = PatchableArrayAutoEncoder<RegistrationInvitationRequest>;
+type ResponseBody = RegistrationInvitationStruct[];
+
+export class PatchRegistrationInvitationsEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    bodyDecoder = new PatchableArrayDecoder(
+        RegistrationInvitationRequest as Decoder<RegistrationInvitationRequest>,
+        RegistrationInvitationRequest.patchType() as Decoder<AutoEncoderPatchType<RegistrationInvitationRequest>>,
+        StringDecoder);
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'PATCH') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/registration-invitations', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        const organization = await Context.setOrganizationScope();
+        await Context.authenticate();
+
+        // Fast throw first (more in depth checking for patches later)
+        if (!await Context.auth.hasSomeAccess(organization.id)) {
+            throw Context.auth.error();
+        }
+
+        const invitations: RegistrationInvitation[] = [];
+        let duplicateCount = 0;
+
+        const puts = request.body.getPuts();
+        for (const { put } of puts) {
+            await this.checkCanCreateRegistrationInvitation(put, organization.id);
+
+            const invitation = new RegistrationInvitation();
+            invitation.id = put.id;
+            invitation.organizationId = organization.id;
+            invitation.groupId = put.groupId;
+            invitation.memberId = put.memberId;
+
+            try {
+                await invitation.save();
+                invitations.push(invitation);
+            } catch (e) {
+                // update if duplicate
+                if (e.code === 'ER_DUP_ENTRY') {
+                    const duplicate = await RegistrationInvitation.select()
+                        .where('groupId', invitation.groupId)
+                        .andWhere('memberId', invitation.memberId)
+                        .first(false);
+
+                    if (duplicate) {
+                        invitations.push(duplicate);
+                    }
+
+                    duplicateCount += 1;
+                    continue;
+                } else {
+                    throw e;
+                }
+            }
+        }
+
+        if (request.body.getPatches().length > 0) {
+            throw new SimpleError({
+                code: 'patch_not_supported',
+                statusCode: 405,
+                message: 'Patching invitations is not supported. Only puts and deletes are supported.',
+            });
+        }
+
+        for (const id of request.body.getDeletes()) {
+            const invitation = await RegistrationInvitation.getByID(id);
+            if (!invitation) {
+                throw new SimpleError({
+                    code: 'not_found',
+                    statusCode: 404,
+                    message: 'Registration invitation not found',
+                });
+            }
+
+            // Anyone with write access to the group can delete invitations for the group
+            const group = await Group.getByID(invitation.groupId);
+
+            if (!group || !await Context.auth.canAccessGroup(group, PermissionLevel.Write)) {
+                throw Context.auth.error($t(`%1UN`));
+            }
+
+            await invitation.delete();
+        }
+
+        // show an error if all puts were duplicates
+        if (puts.length > 0 && puts.length === duplicateCount) {
+            throw new SimpleError({
+                code: 'duplicate_entry',
+                statusCode: 409,
+                message: 'Duplicate entry',
+                human: puts.length === 1 ? $t(`%1RS`) : $t(`%1RP`),
+            });
+        }
+
+        return new Response(
+            await AuthenticatedStructures.registrationInvitations(invitations),
+        );
+    }
+
+    /**
+     * Will throw if not allowed to invite.
+     * @param invitation
+     * @param organizationId id of organization to invite for, should match the organizationId in the invitation
+     */
+    private async checkCanCreateRegistrationInvitation(invitation: RegistrationInvitationRequest, organizationId: string) {
+        const group = await Group.getByID(invitation.groupId);
+
+        if (!group || group.organizationId !== organizationId || !await Context.auth.canAccessGroup(group, PermissionLevel.Write)) {
+            throw Context.auth.error($t(`%1ST`));
+        }
+
+        // cannot invite for waiting list
+        if (group.type === GroupType.WaitingList) {
+            throw new SimpleError({
+                code: 'bad_group',
+                statusCode: 400,
+                message: 'Not allowed to invite for waiting list',
+            });
+        }
+
+        const member = await Member.getByIdWithUsersAndRegistrations(invitation.memberId);
+
+        if (!member
+            // in userMode 'organization' we can only invite members from the same organization
+            || (STAMHOOFD.userMode === 'organization' && member.organizationId !== organizationId)
+            // read access is suficient
+            || !await Context.auth.canAccessMember(member, PermissionLevel.Read)
+        ) {
+            throw Context.auth.error($t(`%1Qv`));
+        }
+
+        // cannot invite if already registered
+        if (member.registrations.some(r => r.groupId === group.id && r.registeredAt !== null && r.deactivatedAt === null)) {
+            throw new SimpleError({
+                code: 'bad_group',
+                statusCode: 400,
+                message: 'The member is already registered for this group',
+                human: $t('%1S2'),
+            });
+        }
+    }
+}

package/src/endpoints/global/registration-periods/GetRegistrationPeriodsCountEndpoint.ts

@@ -0,0 +1,43 @@
+import type { Decoder } from '@simonbackx/simple-encoding';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { CountFilteredRequest, CountResponse } from '@stamhoofd/structures';
+
+import { Context } from '../../../helpers/Context.js';
+import { GetRegistrationPeriodsEndpoint } from './GetRegistrationPeriodsEndpoint.js';
+
+type Params = Record<string, never>;
+type Query = CountFilteredRequest;
+type Body = undefined;
+type ResponseBody = CountResponse;
+
+export class GetRegistrationPeriodsCountEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    queryDecoder = CountFilteredRequest as Decoder<CountFilteredRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'GET') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/registration-periods/count', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setUserOrganizationScope();
+        const query = await GetRegistrationPeriodsEndpoint.buildQuery(request.query);
+
+        const count = await query
+            .count();
+
+        return new Response(
+            CountResponse.create({
+                count,
+            }),
+        );
+    }
+}

package/src/endpoints/global/registration-periods/GetRegistrationPeriodsEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import type { CountFilteredRequest, RegistrationPeriod as RegistrationPeriodStruct, StamhoofdFilter } from '@stamhoofd/structures';
 import { assertSort, getSortFilter, LimitedFilteredRequest, PaginatedResponse } from '@stamhoofd/structures';

package/src/endpoints/global/registration-periods/PatchRegistrationPeriodsEndpoint.ts

@@ -1,11 +1,11 @@
-import type { ConvertArrayToPatchableArray, Decoder, PatchableArrayAutoEncoder} from '@simonbackx/simple-encoding';
+import type { ConvertArrayToPatchableArray, Decoder, PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { PatchableArrayDecoder, StringDecoder, patchObject } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { RegistrationPeriod as RegistrationPeriodStruct } from '@stamhoofd/structures';
 
 import { SimpleError } from '@simonbackx/simple-errors';
-import { Organization, Platform, RegistrationPeriod } from '@stamhoofd/models';
+import { Group, Organization, Platform, RegistrationPeriod } from '@stamhoofd/models';
 import { Context } from '../../../helpers/Context.js';
 import { PeriodHelper } from '../../../helpers/PeriodHelper.js';
 
@@ -69,8 +69,7 @@ export class PatchRegistrationPeriodsEndpoint extends Endpoint<Params, Query, Bo
             if (!await Context.auth.hasFullAccess(organization.id)) {
                 throw Context.auth.error();
             }
-        }
-        else {
+        } else {
             if (!Context.auth.hasPlatformFullAccess()) {
                 throw Context.auth.error();
             }
@@ -172,6 +171,8 @@ export class PatchRegistrationPeriodsEndpoint extends Endpoint<Params, Query, Bo
 
             // Schedule patch of all groups in this period
             PeriodHelper.updateGroupsInPeriod(model).catch(console.error);
+
+            periods.push(model)
         }
 
         for (const id of request.body.getDeletes()) {
@@ -185,6 +186,13 @@ export class PatchRegistrationPeriodsEndpoint extends Endpoint<Params, Query, Bo
                 });
             }
 
+            // Delete all groups in this period
+            const q = Group.delete().where('periodId', model.id);
+            if (organization) {
+                q.where('organizationId', organization.id);
+            }
+            await q;
+
             // Now delete the model
             await model.delete();
             await RegistrationPeriod.updatePreviousNextPeriods(model.organizationId);

package/src/endpoints/global/sso/GetSSOEndpoint.ts

@@ -1,10 +1,9 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { LoginProviderType, OpenIDClientConfiguration } from '@stamhoofd/structures';
 
 import { Context } from '../../../helpers/Context.js';
-import { Platform } from '@stamhoofd/models';
-import type { Decoder} from '@simonbackx/simple-encoding';
+import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, EnumDecoder, field } from '@simonbackx/simple-encoding';
 import { SSOService } from '../../../services/SSOService.js';
 

package/src/endpoints/global/sso/SetSSOEndpoint.ts

@@ -1,5 +1,5 @@
 import type { AutoEncoderPatchType, Decoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { OpenIDClientConfiguration } from '@stamhoofd/structures';
 

package/src/endpoints/global/webshops/GetWebshopFromDomainEndpoint.ts

@@ -1,6 +1,6 @@
-import type { Decoder} from '@simonbackx/simple-encoding';
+import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, field, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Organization } from '@stamhoofd/models';

package/src/endpoints/global/webshops/GetWebshopsEndpoint.test.ts

@@ -383,8 +383,7 @@ describe('Endpoint.GetWebshopsEndpoint', () => {
                 expect(response.status).toBe(200);
                 expect(response.body.results).toHaveLength(1);
                 expect(response.body.results[0].id).toBe(closedWebshop.id);
-            }
-            finally {
+            } finally {
                 await Database.statement('SET collation_connection = DEFAULT');
             }
         });

package/src/endpoints/global/webshops/GetWebshopsEndpoint.ts

@@ -59,8 +59,7 @@ export class GetWebshopsEndpoint extends Endpoint<Params, Query, Body, ResponseB
                 },
             };
             query.where(await compileToSQLFilter(scopeFilter, filterCompilers));
-        }
-        else {
+        } else {
             // Platform context: check platform access
             const tags = Context.auth.getPlatformAccessibleOrganizationTags(PermissionLevel.Read);
 
@@ -124,8 +123,7 @@ export class GetWebshopsEndpoint extends Endpoint<Params, Query, Body, ResponseB
 
         try {
             data = await query.fetch();
-        }
-        catch (error) {
+        } catch (error) {
             if (error.message.includes('ER_QUERY_TIMEOUT')) {
                 throw new SimpleError({
                     code: 'timeout',

package/src/endpoints/organization/dashboard/balance-items/GetBalanceItemEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { BalanceItem } from '@stamhoofd/models';
@@ -20,7 +20,7 @@ export class GetBalanceItemEndpoint extends Endpoint<Params, Query, Body, Respon
 
         const params = Endpoint.parseParameters(request.url, '/balance-items/@id', { id: String });
 
-        if (params) {
+        if (params && params.id !== 'count') {
             return [true, params as Params];
         }
         return [false];

package/src/endpoints/organization/dashboard/balance-items/GetBalanceItemsCountEndpoint.ts

@@ -1,5 +1,5 @@
 import type { Decoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { CountFilteredRequest, CountResponse } from '@stamhoofd/structures';
 

package/src/endpoints/organization/dashboard/balance-items/GetBalanceItemsEndpoint.ts

@@ -1,10 +1,10 @@
 import type { Decoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { BalanceItem } from '@stamhoofd/models';
 import { applySQLSorter, compileToSQLFilter } from '@stamhoofd/sql';
-import type { BalanceItem as BalanceItemStruct, CountFilteredRequest, StamhoofdFilter} from '@stamhoofd/structures';
+import type { BalanceItem as BalanceItemStruct, CountFilteredRequest, StamhoofdFilter } from '@stamhoofd/structures';
 import { LimitedFilteredRequest, PaginatedResponse, assertSort, getSortFilter } from '@stamhoofd/structures';
 
 import { AuthenticatedStructures } from '../../../../helpers/AuthenticatedStructures.js';
@@ -95,8 +95,7 @@ export class GetBalanceItemsEndpoint extends Endpoint<Params, Query, Body, Respo
 
         try {
             balanceItems = await query.fetch();
-        }
-        catch (error) {
+        } catch (error) {
             if (error.message.includes('ER_QUERY_TIMEOUT')) {
                 throw new SimpleError({
                     code: 'timeout',

package/src/endpoints/organization/dashboard/balance-items/PatchBalanceItemsEndpoint.ts

@@ -1,6 +1,6 @@
-import type { AutoEncoderPatchType, Decoder, PatchableArrayAutoEncoder} from '@simonbackx/simple-encoding';
+import type { AutoEncoderPatchType, Decoder, PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { PatchableArrayDecoder, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { BalanceItem, Member, Order, User } from '@stamhoofd/models';
@@ -165,8 +165,7 @@ export class PatchBalanceItemsEndpoint extends Endpoint<Params, Query, Body, Res
                             });
                         }
                         model.memberId = null;
-                    }
-                    else {
+                    } else {
                         model.memberId = (await this.validateMemberId(patch.memberId)).id;
                     }
                 }
@@ -188,10 +187,25 @@ export class PatchBalanceItemsEndpoint extends Endpoint<Params, Query, Body, Res
                 model.unitPrice = patch.unitPrice ?? model.unitPrice;
                 model.amount = patch.amount ?? model.amount;
                 model.dueAt = patch.dueAt === undefined ? model.dueAt : patch.dueAt;
+
+                const VATPercentageBefore = model.VATPercentage;
+                const includedBefore = model.VATIncluded;
+                const excemptBefore = model.VATExcempt;
+
                 model.VATIncluded = patch.VATIncluded === undefined ? model.VATIncluded : patch.VATIncluded;
                 model.VATPercentage = patch.VATPercentage === undefined ? model.VATPercentage : patch.VATPercentage;
                 model.VATExcempt = patch.VATExcempt === undefined ? model.VATExcempt : patch.VATExcempt;
 
+                if (model.priceInvoiced !== 0) {
+                    if (model.VATPercentage !== VATPercentageBefore || model.VATIncluded !== includedBefore || model.VATExcempt !== excemptBefore) {
+                        throw new SimpleError({
+                            code: 'invoiced',
+                            message: 'You cannot change VAT settings of balance items when the balance item has been invoiced',
+                            human: $t('%1Rt'),
+                        });
+                    }
+                }
+
                 if ((patch.dueAt !== undefined || patch.unitPrice !== undefined) && model.dueAt && model.price < 0) {
                     throw new SimpleError({
                         code: 'invalid_price',
@@ -214,8 +228,7 @@ export class PatchBalanceItemsEndpoint extends Endpoint<Params, Query, Body, Res
                     if (model.pricePaid === 0) {
                         model.status = BalanceItemStatus.Hidden;
                     }
-                }
-                else if (patch.status) {
+                } else if (patch.status) {
                     model.status = patch.status;
                 }
 

package/src/endpoints/organization/dashboard/billing/ApplyRegisterCodeEndpoint.test.ts

@@ -0,0 +1,73 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { BalanceItem, OrganizationFactory, RegisterCodeFactory, Token, UserFactory } from '@stamhoofd/models';
+import { PermissionLevel, Permissions } from '@stamhoofd/structures';
+
+import { testServer } from '../../../../../tests/helpers/TestServer.js';
+import { ApplyRegisterCodeEndpoint } from './ApplyRegisterCodeEndpoint.js';
+import { initMembershipOrganization } from '../../../../../tests/init/initMembershipOrganization.js';
+
+describe('Endpoint.ApplyRegisterCodeEndpoint', () => {
+    // Test endpoint
+    const endpoint = new ApplyRegisterCodeEndpoint();
+
+    beforeAll(async () => {
+        await initMembershipOrganization();
+    });
+
+    test('Cannot apply a register code if not platform admin', async () => {
+        const otherOrganization = await new OrganizationFactory({}).create();
+        const code = await new RegisterCodeFactory({ organization: otherOrganization }).create();
+
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({ organization, permissions: Permissions.create({ level: PermissionLevel.Full }) }).create();
+        const token = await Token.createToken(user);
+
+        const r = Request.buildJson(
+            'POST',
+            '/billing/register-code',
+            organization.getApiHost(),
+            {
+                registerCode: code.code,
+            },
+        );
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        await expect(testServer.test(endpoint, r)).rejects.toThrow('You do not have permissions for this action');
+    });
+
+    test('Can apply a register code and apply the discount', async () => {
+        const otherOrganization = await new OrganizationFactory({}).create();
+        const code = await new RegisterCodeFactory({ organization: otherOrganization }).create();
+
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            organization,
+            globalPermissions: Permissions.create({ level: PermissionLevel.Full }),
+            email: 'admin@stamhoofd.be',
+        }).create();
+        const token = await Token.createToken(user);
+
+        const r = Request.buildJson(
+            'POST',
+            '/billing/register-code',
+            organization.getApiHost(),
+            {
+                registerCode: code.code,
+            },
+        );
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, r);
+        expect(response.body).toBeUndefined();
+
+        // Check if this organization has an open register code
+        const credits = await BalanceItem.select().where('payingOrganizationId', organization.id).fetch();
+        expect(credits.length).toBe(1);
+        expect(credits[0].unitPrice).toBe(-code.value);
+
+        // Other not yet applied because no package bought yet
+        // Check if other organization has an open register code
+        const otherCredits = await BalanceItem.select().where('payingOrganizationId', otherOrganization.id).fetch();
+        expect(otherCredits.length).toBe(0);
+    });
+});

package/src/endpoints/organization/dashboard/billing/ApplyRegisterCodeEndpoint.ts

@@ -0,0 +1,89 @@
+import type { Decoder } from '@simonbackx/simple-encoding';
+import { AutoEncoder, field, StringDecoder } from '@simonbackx/simple-encoding';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { Email } from '@stamhoofd/email';
+import { RegisterCode, UsedRegisterCode } from '@stamhoofd/models';
+
+import { Context } from '../../../../helpers/Context.js';
+import { ReferralService } from '../../../../services/ReferralService.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type ResponseBody = undefined;
+
+class Body extends AutoEncoder {
+    @field({ decoder: StringDecoder })
+    registerCode: string;
+}
+
+/**
+ * One endpoint to create, patch and delete groups. Usefull because on organization setup, we need to create multiple groups at once. Also, sometimes we need to link values and update multiple groups at once
+ */
+
+export class ApplyRegisterCodeEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    bodyDecoder = Body as Decoder<Body>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/billing/register-code', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        const organization = await Context.setOrganizationScope();
+        await Context.authenticate();
+
+        if (!Context.auth.hasPlatformFullAccess()) {
+            throw Context.auth.error();
+        }
+
+        let code = request.body.registerCode;
+
+        if (code.startsWith('https:')) {
+            try {
+                const url = new URL(code);
+                const codeParam = url.searchParams.get('code');
+                if (codeParam) {
+                    console.log('Parsed code from URL', codeParam);
+                    code = codeParam;
+                }
+            } catch (e) {
+                console.error('Tried parsing code as URL but failed', code);
+            }
+        }
+
+        const { models, emails } = await ReferralService.markUsed(organization, code);
+
+        for (const model of models) {
+            await model.save();
+        }
+
+        for (const email of emails) {
+            Email.send({
+                ...email,
+                from: Email.getQuickFromEmail(organization.address.country),
+            });
+        }
+
+        if (organization.meta.packages.isPaid) {
+            // Already bought something: apply credit to other organization immediately
+            const code = await UsedRegisterCode.getFor(organization.id);
+            if (code && !code.balanceItemId) {
+                console.log('Rewarding code ' + code.id + ' for payment');
+
+                // Deze code werd nog niet beloond
+                await ReferralService.reward(code);
+            }
+        }
+
+        return new Response(undefined);
+    }
+}

package/src/endpoints/{global → organization/dashboard}/billing/DeactivatePackageEndpoint.ts

@@ -1,10 +1,9 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { STPackage } from '@stamhoofd/models';
 
-import { Context } from '../../../helpers/Context.js';
-import { STPackageService } from '../../../services/STPackageService.js';
+import { Context } from '../../../../helpers/Context.js';
+import { STPackageService } from '../../../../services/STPackageService.js';
 type Params = { id: string };
 type Query = undefined;
 type ResponseBody = undefined;
@@ -53,11 +52,7 @@ export class DeactivatePackageEndpoint extends Endpoint<Params, Query, Body, Res
             });
         }
 
-        // Deactivate
-        pack.removeAt = new Date();
-        pack.removeAt.setTime(pack.removeAt.getTime() - 5_000);
-        await pack.save();
-
+        await STPackageService.deactivatePackage(pack);
         await STPackageService.updateOrganizationPackages(organization.id);
 
         return new Response(undefined);