@stamhoofd/backend 2.120.6 → 2.122.0

package/src/endpoints/organization/dashboard/webshops/GetWebshopUriAvailabilityEndpoint.ts

@@ -1,9 +1,10 @@
-import type { Decoder} from '@simonbackx/simple-encoding';
+import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, field, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { Webshop } from '@stamhoofd/models';
 import { PermissionLevel, WebshopUriAvailabilityResponse } from '@stamhoofd/structures';
+import { isReservedWebshopPathSegment } from '@stamhoofd/utility';
 
 import { Context } from '../../../../helpers/Context.js';
 
@@ -49,6 +50,14 @@ export class GetWebshopUriAvailabilityEndpoint extends Endpoint<Params, Query, B
             throw Context.auth.notFoundOrNoAccess();
         }
 
+        if (isReservedWebshopPathSegment(request.query.uri)) {
+            return new Response(
+                WebshopUriAvailabilityResponse.create({
+                    available: false,
+                }),
+            );
+        }
+
         const q = await Webshop.where({
             uri: request.query.uri,
             id: {

package/src/endpoints/organization/dashboard/webshops/PatchDiscountCodesEndpoint.ts

@@ -1,6 +1,6 @@
-import type { AutoEncoderPatchType, Decoder, PatchableArrayAutoEncoder} from '@simonbackx/simple-encoding';
+import type { AutoEncoderPatchType, Decoder, PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { PatchableArrayDecoder, patchObject, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Webshop, WebshopDiscountCode } from '@stamhoofd/models';
@@ -61,8 +61,7 @@ export class PatchWebshopDiscountCodesEndpoint extends Endpoint<Params, Query, B
 
                 try {
                     await model.save();
-                }
-                catch (e) {
+                } catch (e) {
                     // Duplicate key probably
                     if (e.code && e.code == 'ER_DUP_ENTRY') {
                         throw new SimpleError({
@@ -93,8 +92,7 @@ export class PatchWebshopDiscountCodesEndpoint extends Endpoint<Params, Query, B
 
                 try {
                     await model.save();
-                }
-                catch (e) {
+                } catch (e) {
                     // Duplicate key probably
                     if (e.code && e.code == 'ER_DUP_ENTRY') {
                         throw new SimpleError({

package/src/endpoints/organization/dashboard/webshops/PatchWebshopEndpoint.ts

@@ -1,13 +1,14 @@
 import type { AutoEncoderPatchType, Decoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Webshop } from '@stamhoofd/models';
 import { QueueHandler } from '@stamhoofd/queues';
 import { PermissionLevel, PrivateWebshop, WebshopPrivateMetaData } from '@stamhoofd/structures';
-import { Formatter } from '@stamhoofd/utility';
+import { Formatter, isReservedWebshopPathSegment } from '@stamhoofd/utility';
 
 import { Context } from '../../../../helpers/Context.js';
+import { RecordAnswerHelper } from '../../../../helpers/RecordAnswerHelper.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -56,6 +57,11 @@ export class PatchWebshopEndpoint extends Endpoint<Params, Query, Body, Response
                 if (request.body.meta.customCode !== undefined && !await Context.auth.hasFullAccess(organization.id)) {
                     throw Context.auth.error($t('%15n'));
                 }
+
+                if (request.body.meta.recordCategories) {
+                    RecordAnswerHelper.throwIfPatchOrPutIsInvalid(webshop.meta.recordCategories, request.body.meta.recordCategories);
+                }
+
                 webshop.meta.patchOrPut(request.body.meta);
             }
 
@@ -116,8 +122,7 @@ export class PatchWebshopEndpoint extends Endpoint<Params, Query, Body, Response
                             });
                         }
                     }
-                }
-                else {
+                } else {
                     webshop.domain = null;
                     webshop.privateMeta.dnsRecords = [];
                     webshop.meta.domainActive = false;
@@ -137,6 +142,15 @@ export class PatchWebshopEndpoint extends Endpoint<Params, Query, Body, Response
                         });
                     }
 
+                    if (webshop.domainUri && isReservedWebshopPathSegment(webshop.domainUri)) {
+                        throw new SimpleError({
+                            code: 'invalid_field',
+                            message: 'domainUri is reserved for internal webshop routes',
+                            human: $t("%1a4"),
+                            field: 'customUrl',
+                        });
+                    }
+
                     // Check exists
                     const existing = await Webshop.getByDomain(webshop.domain, webshop.domainUri);
                     if (existing !== undefined) {
@@ -146,8 +160,7 @@ export class PatchWebshopEndpoint extends Endpoint<Params, Query, Body, Response
                             human: $t(`%FP`) + ' ' + existing.meta.name + $t(`%FQ`),
                         });
                     }
-                }
-                else {
+                } else {
                     webshop.domainUri = null;
                 }
             }
@@ -177,6 +190,15 @@ export class PatchWebshopEndpoint extends Endpoint<Params, Query, Body, Response
                     });
                 }
 
+                if (isReservedWebshopPathSegment(request.body.uri)) {
+                    throw new SimpleError({
+                        code: 'invalid_field',
+                        message: 'Uri is reserved for internal webshop routes',
+                        human: $t("%1a4"),
+                        field: 'uri',
+                    });
+                }
+
                 webshop.uri = request.body.uri;
             }
 
@@ -191,8 +213,7 @@ export class PatchWebshopEndpoint extends Endpoint<Params, Query, Body, Response
 
             try {
                 await webshop.save();
-            }
-            catch (e) {
+            } catch (e) {
                 // Duplicate key probably
                 if (e.code && e.code == 'ER_DUP_ENTRY') {
                     throw new SimpleError({

package/src/endpoints/organization/dashboard/webshops/PatchWebshopOrdersEndpoint.ts

@@ -1,6 +1,6 @@
-import type { AutoEncoderPatchType, Data, Decoder, PatchableArrayAutoEncoder} from '@simonbackx/simple-encoding';
+import type { AutoEncoderPatchType, Data, Decoder, PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { ArrayDecoder, PatchableArray, PatchableArrayDecoder, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { BalanceItem, BalanceItemPayment, Order, Payment, Webshop, WebshopCounter } from '@stamhoofd/models';
@@ -65,7 +65,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOrganizationScope();
-        await Context.authenticate();
+        const { user } = await Context.authenticate();
 
         // Fast throw first (more in depth checking for patches later)
         if (!await Context.auth.hasSomeAccess(organization.id)) {
@@ -79,8 +79,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
             for (const p of request.body) {
                 body.addPatch(p);
             }
-        }
-        else {
+        } else {
             body = request.body;
         }
 
@@ -99,12 +98,12 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
 
             const orders = body.getPatches().length > 0
                 ? await Order.where({
-                    webshopId: webshop.id,
-                    id: {
-                        sign: 'IN',
-                        value: body.getPatches().map(o => o.id),
-                    },
-                })
+                        webshopId: webshop.id,
+                        id: {
+                            sign: 'IN',
+                            value: body.getPatches().map(o => o.id),
+                        },
+                    })
                 : [];
 
             // We use a getter because we need to have an up to date webshop struct
@@ -150,25 +149,25 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                         // Mark this order as paid
                         await order.markPaid(null, organization, webshop);
                         await order.save();
-                    }
-                    else {
+                    } else {
                         const payment = new Payment();
                         payment.organizationId = organization.id;
                         payment.method = struct.data.paymentMethod;
                         payment.status = PaymentStatus.Created;
                         payment.price = totalPrice;
-                        PaymentService.round(payment);
+                        PaymentService.roundPayment(payment);
                         payment.paidAt = null;
+                        payment.adminUserId = user.id;
 
                         // Determine the payment provider (always null because no online payments here)
                         payment.provider = null;
-                        ServiceFeeHelper.setServiceFee(
+                        await ServiceFeeHelper.setServiceFee(
                             payment,
                             organization,
                             webshop.meta.ticketType === WebshopTicketType.None ? 'webshop' : 'tickets',
                             order.data.cart.items.flatMap(i => i.calculatedPrices.map(p => p.discountedPrice)),
                         );
-
+                        await ServiceFeeHelper.setTransferFee({ payment, organization, stripeAccount: null });
                         await payment.save();
 
                         order.paymentId = payment.id;
@@ -209,22 +208,19 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                             await order.markValid(payment, []);
                             await payment.save();
                             await order.save();
-                        }
-                        else if (payment.method === PaymentMethod.PointOfSale) {
+                        } else if (payment.method === PaymentMethod.PointOfSale) {
                             // Not really paid, but needed to create the tickets if needed
                             await order.markPaid(payment, organization, webshop);
                             await payment.save();
                             await order.save();
-                        }
-                        else {
+                        } else {
                             throw new Error('Unsupported payment method');
                         }
 
                         balanceItem.description = order.generateBalanceDescription(webshop);
                         await balanceItem.save();
                     }
-                }
-                catch (e) {
+                } catch (e) {
                     await order.deleteOrderBecauseOfCreationError();
                     throw e;
                 }
@@ -278,8 +274,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                     model.markUpdated();
                     // Cancel payment if still pending
                     await BalanceItem.deleteForDeletedOrders([model.id]);
-                }
-                else {
+                } else {
                     if (previousStatus === OrderStatus.Canceled || previousStatus === OrderStatus.Deleted) {
                         model.markUpdated();
                         // Undo deletion
@@ -300,8 +295,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
 
                         if (model.isDue) {
                             paidItem.status = BalanceItemStatus.Due;
-                        }
-                        else {
+                        } else {
                             paidItem.status = BalanceItemStatus.Canceled;
                         }
                         paidItem.description = model.generateBalanceDescription(webshop);
@@ -310,8 +304,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                         // Zero out the other items
                         const otherItems = items.filter(i => i.id !== paidItem.id);
                         await BalanceItem.deleteItems(otherItems);
-                    }
-                    else if (items.length === 0
+                    } else if (items.length === 0
                         && model.totalToPay > 0) {
                         model.markUpdated();
                         const balanceItem = new BalanceItem();

package/src/endpoints/organization/dashboard/webshops/PatchWebshopTicketsEndpoint.ts

@@ -1,6 +1,6 @@
 import type { AutoEncoderPatchType, Decoder } from '@simonbackx/simple-encoding';
 import { ArrayDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError, SimpleErrors } from '@simonbackx/simple-errors';
 import { Ticket, Token, Webshop } from '@stamhoofd/models';

package/src/endpoints/organization/dashboard/webshops/SearchUitpasEventsEndpoint.ts

@@ -1,7 +1,7 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { UitpasService } from '../../../../services/uitpas/UitpasService.js';
-import type { Decoder} from '@simonbackx/simple-encoding';
+import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, field, StringDecoder } from '@simonbackx/simple-encoding';
 import { Context } from '../../../../helpers/Context.js';
 import type { UitpasEventsResponse } from '@stamhoofd/structures';

package/src/endpoints/organization/dashboard/webshops/VerifyWebshopDomainEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Token, Webshop } from '@stamhoofd/models';
@@ -48,8 +48,7 @@ export class VerifyWebshopDomainEndpoint extends Endpoint<Params, Query, Body, R
             if (webshop.domain !== null) {
                 webshop.privateMeta.dnsRecords = WebshopPrivateMetaData.buildDNSRecords(webshop.domain);
                 await webshop.updateDNSRecords();
-            }
-            else {
+            } else {
                 webshop.privateMeta.dnsRecords = [];
                 webshop.meta.domainActive = false;
             }

package/src/endpoints/organization/dashboard/webshops/WebshopReservedPathSegments.test.ts

@@ -0,0 +1,95 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { OrganizationFactory, Token, UserFactory, Webshop, WebshopFactory } from '@stamhoofd/models';
+import { Permissions, PermissionLevel, PrivateWebshop, WebshopMetaData } from '@stamhoofd/structures';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
+
+import { testServer } from '../../../../../tests/helpers/TestServer.js';
+import { CreateWebshopEndpoint } from './CreateWebshopEndpoint.js';
+import { GetWebshopUriAvailabilityEndpoint } from './GetWebshopUriAvailabilityEndpoint.js';
+import { PatchWebshopEndpoint } from './PatchWebshopEndpoint.js';
+
+describe('Endpoint.WebshopReservedPathSegments', () => {
+    const checkUriEndpoint = new GetWebshopUriAvailabilityEndpoint();
+    const patchEndpoint = new PatchWebshopEndpoint();
+    const createEndpoint = new CreateWebshopEndpoint();
+
+    beforeEach(async () => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
+    async function createAdminContext() {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            organization,
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+        }).create();
+        const token = await Token.createToken(user);
+
+        return { organization, token };
+    }
+
+    test('reserved webshop paths are not available as default URI', async () => {
+        const { organization, token } = await createAdminContext();
+        const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
+
+        const request = Request.get({
+            path: '/webshop/' + webshop.id + '/check-uri',
+            host: organization.getApiHost(),
+            query: {
+                uri: 'tickets',
+            },
+            headers: { authorization: 'Bearer ' + token.accessToken },
+        });
+
+        const response = await testServer.test(checkUriEndpoint, request);
+
+        expect(response.body.available).toBe(false);
+    });
+
+    test('reserved webshop paths cannot be saved as default URI', async () => {
+        const { organization, token } = await createAdminContext();
+        const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
+        const patch = PrivateWebshop.patch({ uri: 'tickets' });
+        const request = Request.buildJson('PATCH', '/webshop/' + webshop.id, organization.getApiHost(), patch);
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+
+        await expect(testServer.test(patchEndpoint, request)).rejects.toThrow(
+            STExpect.simpleError({ code: 'invalid_field', field: 'uri' }),
+        );
+    });
+
+    test('reserved webshop paths cannot be saved as custom domain URI', async () => {
+        const { organization, token } = await createAdminContext();
+        const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
+        webshop.domain = 'shop.example.com';
+        webshop.domainUri = 'valid';
+        await webshop.save();
+
+        const patch = PrivateWebshop.patch({ domainUri: 'tickets' });
+        const request = Request.buildJson('PATCH', '/webshop/' + webshop.id, organization.getApiHost(), patch);
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+
+        await expect(testServer.test(patchEndpoint, request)).rejects.toThrow(
+            STExpect.simpleError({ code: 'invalid_field', field: 'customUrl' }),
+        );
+    });
+
+    test('generated webshop URIs skip reserved webshop paths', async () => {
+        const { organization, token } = await createAdminContext();
+        const body = PrivateWebshop.create({
+            meta: WebshopMetaData.create({
+                name: 'Tickets',
+            }),
+        });
+        const request = Request.buildJson('POST', '/webshop', organization.getApiHost(), body);
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(createEndpoint, request);
+        const webshop = await Webshop.getByID(response.body.id);
+
+        expect(response.body.uri).not.toBe('tickets');
+        expect(webshop?.uri).not.toBe('tickets');
+    });
+});

package/src/endpoints/organization/shared/ExchangePaymentEndpoint.ts

@@ -1,6 +1,6 @@
-import type { Decoder} from '@simonbackx/simple-encoding';
+import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, BooleanDecoder, field } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Order } from '@stamhoofd/models';
@@ -45,10 +45,8 @@ export class ExchangePaymentEndpoint extends Endpoint<Params, Query, Body, Respo
     }
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
-        const organization = await Context.setOptionalOrganizationScope({ willAuthenticate: false });
-        if (!request.query.exchange) {
-            await Context.optionalAuthenticate();
-        }
+        const organization = await Context.setOptionalOrganizationScope({ willAuthenticate: true }); // will authentiate set to true because we allow exchanges for inactive organizations
+        await Context.optionalAuthenticate();
 
         // Not method on payment because circular references (not supprted in ts)
         const payment = await PaymentService.pollStatus(request.params.id, organization, request.query.cancel);
@@ -63,19 +61,23 @@ export class ExchangePaymentEndpoint extends Endpoint<Params, Query, Body, Respo
             return new Response(undefined);
         }
 
-        // #region skip check permissions if order and created less than hour ago
+        // Skip check permissions if order and created less than hour ago
         let checkPermissions = true;
         const hourAgo = new Date();
-        hourAgo.setHours(-1);
+        hourAgo.setHours(-2);
 
         if (payment.createdAt > hourAgo) {
-            const orders = await Order.where({ paymentId: payment.id }, { limit: 1 });
-            const isOrder = orders[0] !== undefined;
-            if (isOrder) {
-                checkPermissions = false;
+            if (payment.payingOrganizationId) {
+                // B2B payments always required
+                checkPermissions = true;
+            } else {
+                const orders = await Order.where({ paymentId: payment.id }, { limit: 1 });
+                const isOrder = orders[0] !== undefined;
+                if (isOrder) {
+                    checkPermissions = false;
+                }
             }
         }
-        // #endregion
 
         return new Response(
             await AuthenticatedStructures.paymentGeneral(payment, checkPermissions),

package/src/endpoints/organization/shared/GetDocumentHtml.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { signInternal } from '@stamhoofd/backend-env';

package/src/endpoints/organization/shared/GetPaymentEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Payment } from '@stamhoofd/models';

package/src/endpoints/organization/shared/GetUitpasNumberDetailsEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { UitpasNumberDetails, UitpasNumbersGetDetailsRequest } from '@stamhoofd/structures';
 
@@ -53,14 +53,12 @@ export class GetUitpasNumberDetailsEndpoint extends Endpoint<Params, Query, Body
                     uitpasNumber,
                     socialTariff,
                 }));
-            }
-            catch (error) {
+            } catch (error) {
                 if (isSimpleError(error) || isSimpleErrors(error)) {
                     error.addNamespace(i.toString());
                     error.addNamespace('uitpasNumbers');
                     simpleErrors.addError(error);
-                }
-                else {
+                } else {
                     throw error;
                 }
             }

package/src/endpoints/organization/shared/auth/GetOrganizationEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import type { Organization as OrganizationStruct } from '@stamhoofd/structures';
 

package/src/endpoints/organization/webshops/CheckWebshopDiscountCodesEndpoint.ts

@@ -1,11 +1,12 @@
 import { ArrayDecoder, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Webshop, WebshopDiscountCode } from '@stamhoofd/models';
 import type { DiscountCode } from '@stamhoofd/structures';
 
 import { Context } from '../../../helpers/Context.js';
+import { WebshopAuthHelper } from './WebshopAuthHelper.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -39,6 +40,8 @@ export class CheckWebshopDiscountCodesEndpoint extends Endpoint<Params, Query, B
             });
         }
 
+        await WebshopAuthHelper.optionalAuthenticateForWebshop(webshop);
+
         if (request.body.length > 10) {
             // Auto limit
             request.body = request.body.slice(0, 10);

package/src/endpoints/organization/webshops/GetOrderByPaymentEndpoint.ts

@@ -1,12 +1,12 @@
-import { PartialWithoutMethods } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { Order } from '@stamhoofd/models';
+import { Order, Webshop } from '@stamhoofd/models';
 import { Payment } from '@stamhoofd/models';
 import type { Order as OrderStruct } from '@stamhoofd/structures';
 
 import { Context } from '../../../helpers/Context.js';
+import { WebshopAuthHelper } from './WebshopAuthHelper.js';
 type Params = { id: string; paymentId: string };
 type Query = undefined;
 type Body = undefined;
@@ -46,6 +46,17 @@ export class GetOrderByPaymentEndpoint extends Endpoint<Params, Query, Body, Res
             });
         }
 
+        const webshop = await Webshop.getByID(request.params.id);
+        if (!webshop || webshop.organizationId !== organization.id) {
+            throw new SimpleError({
+                code: 'not_found',
+                message: 'Webshop not found',
+                human: $t(`%FX`),
+            });
+        }
+
+        await WebshopAuthHelper.checkOrderAccess(webshop, order);
+
         order.setRelation(Order.payment, payment);
         return new Response(await order.getStructure());
     }

package/src/endpoints/organization/webshops/GetOrderEndpoint.ts

@@ -1,10 +1,11 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { Order } from '@stamhoofd/models';
+import { Order, Webshop } from '@stamhoofd/models';
 import type { Order as OrderStruct } from '@stamhoofd/structures';
 
 import { Context } from '../../../helpers/Context.js';
+import { WebshopAuthHelper } from './WebshopAuthHelper.js';
 type Params = { id: string; orderId: string };
 type Query = undefined;
 type Body = undefined;
@@ -36,6 +37,17 @@ export class GetOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBody
             });
         }
 
+        const webshop = await Webshop.getByID(request.params.id);
+        if (!webshop || webshop.organizationId !== organization.id) {
+            throw new SimpleError({
+                code: 'not_found',
+                message: 'Webshop not found',
+                human: $t(`%FX`),
+            });
+        }
+
+        await WebshopAuthHelper.checkOrderAccess(webshop, order);
+
         return new Response(await order.getStructure());
     }
 }