@stamhoofd/backend 2.120.6 → 2.122.0

package/src/endpoints/organization/webshops/GetTicketsEndpoint.ts

@@ -1,12 +1,13 @@
-import type { Decoder} from '@simonbackx/simple-encoding';
+import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, field, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { Order, Ticket } from '@stamhoofd/models';
+import { Order, Ticket, Webshop } from '@stamhoofd/models';
 import { TicketOrder, TicketPublic } from '@stamhoofd/structures';
 
 import { Context } from '../../../helpers/Context.js';
+import { WebshopAuthHelper } from './WebshopAuthHelper.js';
 type Params = { id: string };
 
 class Query extends AutoEncoder {
@@ -45,6 +46,14 @@ export class GetTicketsEndpoint extends Endpoint<Params, Query, Body, ResponseBo
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOrganizationScope({ willAuthenticate: false });
+        const webshop = await Webshop.getByID(request.params.id);
+        if (!webshop || webshop.organizationId !== organization.id) {
+            throw new SimpleError({
+                code: 'not_found',
+                message: 'Webshop not found',
+                human: $t(`%FX`),
+            });
+        }
 
         if (request.query.secret) {
             const [ticket] = await Ticket.where({
@@ -61,17 +70,20 @@ export class GetTicketsEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 });
             }
 
+            const order = await Order.getByID(ticket.orderId);
+            if (!order || order.webshopId !== request.params.id || order.organizationId !== organization.id) {
+                console.error('Error: missing order ' + ticket.orderId + ' for ticket ' + ticket.id);
+                throw new SimpleError({
+                    code: 'not_found',
+                    message: 'Ticket not found',
+                    human: $t(`%FZ`),
+                });
+            }
+
+            await WebshopAuthHelper.checkOrderAccess(webshop, order);
+
             if (!request.query.orderId) {
                 // Include item data
-                const order = await Order.getByID(ticket.orderId);
-                if (!order || order.webshopId !== request.params.id) {
-                    console.error('Error: missing order ' + ticket.orderId + ' for ticket ' + ticket.id);
-                    throw new SimpleError({
-                        code: 'not_found',
-                        message: 'Ticket not found',
-                        human: $t(`%FZ`),
-                    });
-                }
 
                 if (ticket.itemId) {
                     const item = order.data.cart.items.find(i => i.id === ticket.itemId);
@@ -91,8 +103,7 @@ export class GetTicketsEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                             items: [item],
                         }),
                     ]);
-                }
-                else {
+                } else {
                     return new Response([
                         TicketPublic.create({
                             ...ticket,
@@ -104,8 +115,7 @@ export class GetTicketsEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             return new Response([
                 TicketOrder.create(ticket),
             ]);
-        }
-        else {
+        } else {
             if (!request.query.orderId) {
                 throw new SimpleError({
                     code: 'not_found',
@@ -119,6 +129,17 @@ export class GetTicketsEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 organizationId: organization.id,
                 deletedAt: null,
             });
+
+            const order = await Order.getByID(request.query.orderId);
+            if (!order || order.webshopId !== request.params.id || order.organizationId !== organization.id) {
+                throw new SimpleError({
+                    code: 'not_found',
+                    message: 'Ticket not found',
+                    human: $t(`%FZ`),
+                });
+            }
+
+            await WebshopAuthHelper.checkOrderAccess(webshop, order);
             return new Response(
                 tickets.map(ticket => TicketOrder.create(ticket)),
             );

package/src/endpoints/organization/webshops/GetWebshopEndpoint.test.ts

@@ -1,8 +1,8 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { OrganizationFactory, Token, UserFactory, WebshopFactory } from '@stamhoofd/models';
-import { PermissionLevel, Permissions } from '@stamhoofd/structures';
+import { PermissionLevel, Permissions, WebshopAuthType, WebshopMetaData } from '@stamhoofd/structures';
 
-import { TestUtils } from '@stamhoofd/test-utils';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { GetWebshopEndpoint } from './GetWebshopEndpoint.js';
 
@@ -43,6 +43,38 @@ describe('Endpoint.GetWebshop', () => {
         expect((response.body as any).privateMeta).toBeUndefined();
     });
 
+    test('Reject anonymous access for required-auth webshop', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const webshop = await new WebshopFactory({
+            organizationId: organization.id,
+            meta: WebshopMetaData.create({
+                authType: WebshopAuthType.Required,
+            }),
+        }).create();
+
+        const r = Request.buildJson('GET', '/webshop/' + webshop.id, organization.getApiHost());
+
+        await expect(testServer.test(endpoint, r)).rejects.toThrow(STExpect.errorWithCode('not_authenticated'));
+    });
+
+    test('Allow signed in user access for required-auth webshop', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({ organization }).create();
+        const token = await Token.createToken(user);
+        const webshop = await new WebshopFactory({
+            organizationId: organization.id,
+            meta: WebshopMetaData.create({
+                authType: WebshopAuthType.Required,
+            }),
+        }).create();
+
+        const r = Request.buildJson('GET', '/webshop/' + webshop.id, organization.getApiHost());
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, r);
+        expect(response.body.id).toEqual(webshop.id);
+    });
+
     test('Get webshop as admin', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({

package/src/endpoints/organization/webshops/GetWebshopEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Webshop } from '@stamhoofd/models';
@@ -6,6 +6,7 @@ import type { PrivateWebshop, Webshop as WebshopStruct } from '@stamhoofd/struct
 
 import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures.js';
 import { Context } from '../../../helpers/Context.js';
+import { WebshopAuthHelper } from './WebshopAuthHelper.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -28,7 +29,6 @@ export class GetWebshopEndpoint extends Endpoint<Params, Query, Body, ResponseBo
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
         await Context.setOptionalOrganizationScope(); // editing webshop from the admin panel -> no scope
-        await Context.optionalAuthenticate();
 
         const webshop = await Webshop.getByID(request.params.id);
         if (!webshop) {
@@ -39,6 +39,8 @@ export class GetWebshopEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             });
         }
 
+        await WebshopAuthHelper.optionalAuthenticateForWebshop(webshop);
+
         return new Response(
             await AuthenticatedStructures.webshop(webshop),
         );

package/src/endpoints/organization/webshops/PlaceOrderEndpoint.test.ts

@@ -1,15 +1,17 @@
 import type { Response } from '@simonbackx/simple-endpoints';
 import { Request } from '@simonbackx/simple-endpoints';
-import type { Organization, StripeAccount, User} from '@stamhoofd/models';
+import type { Organization, StripeAccount, User } from '@stamhoofd/models';
 import { OrganizationFactory, Token, UserFactory, Webshop, WebshopFactory } from '@stamhoofd/models';
-import type { OrderResponse} from '@stamhoofd/structures';
-import { Address, Cart, CartItem, CartItemOption, Customer, Option, OptionMenu, OrderData, PaymentConfiguration, PaymentMethod, PermissionLevel, Permissions, PrivatePaymentConfiguration, Product, ProductPrice, ProductType, SeatingPlan, SeatingPlanRow, SeatingPlanSeat, SeatingPlanSection, TransferSettings, WebshopDeliveryMethod, WebshopMetaData, WebshopOnSiteMethod, WebshopPrivateMetaData, WebshopTakeoutMethod, WebshopTimeSlot } from '@stamhoofd/structures';
+import type { OrderResponse } from '@stamhoofd/structures';
+import { Address, Cart, CartItem, CartItemOption, Customer, Option, OptionMenu, OrderData, PaymentConfiguration, PaymentMethod, PermissionLevel, Permissions, PrivatePaymentConfiguration, Product, ProductPrice, ProductType, SeatingPlan, SeatingPlanRow, SeatingPlanSeat, SeatingPlanSection, TransferSettings, WebshopAuthType, WebshopDeliveryMethod, WebshopMetaData, WebshopOnSiteMethod, WebshopPrivateMetaData, WebshopTakeoutMethod, WebshopTimeSlot } from '@stamhoofd/structures';
+import { STExpect } from '@stamhoofd/test-utils';
 import { Country } from '@stamhoofd/types/Country';
 import sinon from 'sinon';
 
 import { StripeMocker } from '../../../../tests/helpers/StripeMocker.js';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { PatchWebshopOrdersEndpoint } from '../dashboard/webshops/PatchWebshopOrdersEndpoint.js';
+import { GetOrderEndpoint } from './GetOrderEndpoint.js';
 import { PlaceOrderEndpoint } from './PlaceOrderEndpoint.js';
 
 const address = Address.create({
@@ -31,6 +33,7 @@ describe('Endpoint.PlaceOrderEndpoint', () => {
     // Test endpoint
     const endpoint = new PlaceOrderEndpoint();
     const patchWebshopOrdersEndpoint = new PatchWebshopOrdersEndpoint();
+    const getOrderEndpoint = new GetOrderEndpoint();
 
     let organization: Organization;
     let webshop: Webshop;
@@ -328,6 +331,31 @@ describe('Endpoint.PlaceOrderEndpoint', () => {
     });
 
     describe('User authentication', () => {
+        test('Required-auth webshop rejects anonymous orders', async () => {
+            webshop.meta.authType = WebshopAuthType.Required;
+            await webshop.save();
+
+            const orderData = OrderData.create({
+                paymentMethod: PaymentMethod.Unknown,
+                checkoutMethod: onSiteMethod,
+                timeSlot: slot4,
+                cart: Cart.create({
+                    items: [
+                        CartItem.create({
+                            product,
+                            productPrice: freeProductPrice,
+                            amount: 1,
+                        }),
+                    ],
+                }),
+                customer,
+            });
+
+            const r = Request.buildJson('POST', `/webshop/${webshop.id}/order`, organization.getApiHost(), orderData);
+
+            await expect(testServer.test(endpoint, r)).rejects.toThrow(STExpect.errorWithCode('not_authenticated'));
+        });
+
         test('Placing an order with a signed in user overrides the order customer', async () => {
             const user = await new UserFactory({ organization, firstName: 'User', lastName: 'Tester' }).create();
             const token = await Token.createToken(user);
@@ -370,6 +398,49 @@ describe('Endpoint.PlaceOrderEndpoint', () => {
             expect(order.data.customer.lastName).toEqual(user.lastName);
         });
 
+        test('Required-auth webshop order can only be read by owner', async () => {
+            webshop.meta.authType = WebshopAuthType.Required;
+            await webshop.save();
+
+            const user = await new UserFactory({ organization, firstName: 'User', lastName: 'Tester' }).create();
+            const token = await Token.createToken(user);
+            const otherUser = await new UserFactory({ organization }).create();
+            const otherToken = await Token.createToken(otherUser);
+
+            const orderData = OrderData.create({
+                paymentMethod: PaymentMethod.Unknown,
+                checkoutMethod: onSiteMethod,
+                timeSlot: slot4,
+                cart: Cart.create({
+                    items: [
+                        CartItem.create({
+                            product,
+                            productPrice: freeProductPrice,
+                            amount: 1,
+                        }),
+                    ],
+                }),
+                customer,
+            });
+
+            const placeRequest = Request.buildJson('POST', `/webshop/${webshop.id}/order`, organization.getApiHost(), orderData);
+            placeRequest.headers.authorization = 'Bearer ' + token.accessToken;
+            const placeResponse = await testServer.test(endpoint, placeRequest);
+            const order = placeResponse.body.order;
+
+            const anonymousRequest = Request.buildJson('GET', `/webshop/${webshop.id}/order/${order.id}`, organization.getApiHost());
+            await expect(testServer.test(getOrderEndpoint, anonymousRequest)).rejects.toThrow(STExpect.errorWithCode('not_authenticated'));
+
+            const otherUserRequest = Request.buildJson('GET', `/webshop/${webshop.id}/order/${order.id}`, organization.getApiHost());
+            otherUserRequest.headers.authorization = 'Bearer ' + otherToken.accessToken;
+            await expect(testServer.test(getOrderEndpoint, otherUserRequest)).rejects.toThrow(STExpect.errorWithCode('not_found'));
+
+            const ownerRequest = Request.buildJson('GET', `/webshop/${webshop.id}/order/${order.id}`, organization.getApiHost());
+            ownerRequest.headers.authorization = 'Bearer ' + token.accessToken;
+            const ownerResponse = await testServer.test(getOrderEndpoint, ownerRequest);
+            expect(ownerResponse.body.id).toEqual(order.id);
+        });
+
         /**
          * This checks if the authenticated context is passed when multiple orders are executed in a queue
          */

package/src/endpoints/organization/webshops/PlaceOrderEndpoint.ts

@@ -1,21 +1,23 @@
-import { createMollieClient, PaymentMethod as molliePaymentMethod } from '@mollie/api-client';
+import { PaymentMethod as molliePaymentMethod } from '@mollie/api-client';
 import type { Decoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Email } from '@stamhoofd/email';
-import { BalanceItem, BalanceItemPayment, MolliePayment, MollieToken, Order, PayconiqPayment, Payment, RateLimiter, Webshop, WebshopDiscountCode } from '@stamhoofd/models';
+import { BalanceItem, BalanceItemPayment, MolliePayment, Order, PayconiqPayment, Payment, RateLimiter, Webshop, WebshopDiscountCode } from '@stamhoofd/models';
 import { QueueHandler } from '@stamhoofd/queues';
-import { AuditLogSource, BalanceItemRelation, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, OrderData, OrderResponse, Order as OrderStruct, PaymentCustomer, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, Payment as PaymentStruct, TranslatedString, Version, WebshopAuthType, Webshop as WebshopStruct, WebshopTicketType } from '@stamhoofd/structures';
+import { AuditLogSource, BalanceItemRelation, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, OrderData, OrderResponse, Order as OrderStruct, PaymentCustomer, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, Payment as PaymentStruct, TranslatedString, Version, Webshop as WebshopStruct, WebshopTicketType } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 
 import { BuckarooHelper } from '../../../helpers/BuckarooHelper.js';
 import { Context } from '../../../helpers/Context.js';
+import { ServiceFeeHelper } from '../../../helpers/ServiceFeeHelper.js';
 import { StripeHelper } from '../../../helpers/StripeHelper.js';
 import { AuditLogService } from '../../../services/AuditLogService.js';
-import { UitpasService } from '../../../services/uitpas/UitpasService.js';
-import { ServiceFeeHelper } from '../../../helpers/ServiceFeeHelper.js';
+import { MollieService } from '../../../services/MollieService.js';
 import { PaymentService } from '../../../services/PaymentService.js';
+import { UitpasService } from '../../../services/uitpas/UitpasService.js';
+import { WebshopAuthHelper } from './WebshopAuthHelper.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -58,7 +60,6 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOrganizationScope();
-        await Context.optionalAuthenticate();
 
         // Read + validate + update stock in one go, to prevent race conditions
         const { webshop, order } = await QueueHandler.schedule('webshop-stock/' + request.params.id, async () => {
@@ -73,15 +74,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
 
             // const organization = (await Organization.getByID(webshopWithoutOrganization.organizationId))!
             const webshop = webshopWithoutOrganization.setRelation(Webshop.organization, organization);
-
-            if (webshop.meta.authType === WebshopAuthType.Required && !Context.user) {
-                throw new SimpleError({
-                    code: 'not_authenticated',
-                    message: 'Not authenticated',
-                    human: $t(`%w5`),
-                    statusCode: 401,
-                });
-            }
+            await WebshopAuthHelper.optionalAuthenticateForWebshop(webshop);
 
             // For non paid organizations, the limit is 10
             if (!organization.meta.packages.isPaid && STAMHOOFD.environment !== 'test') {
@@ -89,8 +82,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
 
                 try {
                     limiter.track(organization.id, 1);
-                }
-                catch (e) {
+                } catch (e) {
                     Email.sendWebmaster({
                         subject: '[Limiet] Limiet bereikt voor aantal bestellingen',
                         text: 'Beste, \nDe limiet werd bereikt voor het aantal bestellingen per dag. \nVereniging: ' + organization.id + ' (' + organization.name + ')' + '\n\n' + e.message + '\n\nStamhoofd',
@@ -173,14 +165,13 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 // Mark this order as paid
                 await order.markPaid(null, organization, webshop);
                 await order.save();
-            }
-            else {
+            } else {
                 const payment = new Payment();
                 payment.organizationId = organization.id;
                 payment.method = request.body.paymentMethod;
                 payment.status = PaymentStatus.Created;
                 payment.price = totalPrice;
-                PaymentService.round(payment);
+                PaymentService.roundPayment(payment);
                 totalPrice = payment.price;
                 payment.paidAt = null;
                 payment.customer = PaymentCustomer.create({
@@ -191,16 +182,16 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
 
                 // Determine the payment provider
                 // Throws if invalid
-                const { provider, stripeAccount } = await organization.getPaymentProviderFor(payment.method, webshop.privateMeta.paymentConfiguration);
+                const { provider, stripeAccount } = await organization.getPaymentProviderFor(payment.method, null, webshop.privateMeta.paymentConfiguration);
                 payment.provider = provider;
                 payment.stripeAccountId = stripeAccount?.id ?? null;
-                ServiceFeeHelper.setServiceFee(
+                await ServiceFeeHelper.setServiceFee(
                     payment,
                     organization,
                     webshop.meta.ticketType === WebshopTicketType.None ? 'webshop' : 'tickets',
                     order.data.cart.items.flatMap(i => i.calculatedPrices.map(p => p.discountedPrice)),
                 );
-
+                await ServiceFeeHelper.setTransferFee({ payment, organization, stripeAccount });
                 await payment.save();
 
                 // Deprecated field
@@ -210,8 +201,6 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 // Save order to get the id
                 await order.save();
 
-                const balanceItemPayments: (BalanceItemPayment & { balanceItem: BalanceItem })[] = [];
-
                 // Create balance item
                 const balanceItem = new BalanceItem();
                 balanceItem.type = BalanceItemType.Order;
@@ -239,7 +228,6 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 balanceItemPayment.organizationId = organization.id;
                 balanceItemPayment.price = balanceItem.price;
                 await balanceItemPayment.save();
-                balanceItemPayments.push(balanceItemPayment.setRelation(BalanceItemPayment.balanceItem, balanceItem));
 
                 let paymentUrl: string | null = null;
                 let paymentQRCode: string | null = null;
@@ -255,8 +243,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                     balanceItem.status = BalanceItemStatus.Due;
                     await balanceItem.save();
                     await payment.save();
-                }
-                else if (payment.method === PaymentMethod.PointOfSale) {
+                } else if (payment.method === PaymentMethod.PointOfSale) {
                     // Not really paid, but needed to create the tickets if needed
                     await order.markPaid(payment, organization, webshop);
 
@@ -267,8 +254,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                     balanceItem.status = BalanceItemStatus.Due;
                     await balanceItem.save();
                     await payment.save();
-                }
-                else {
+                } else {
                     const cancelUrl = 'https://' + webshop.getHost() + '/payment?id=' + encodeURIComponent(payment.id) + '&cancel=true';
                     const redirectUrl = 'https://' + webshop.getHost() + '/payment?id=' + encodeURIComponent(payment.id);
                     const exchangeUrl = 'https://' + organization.getApiHost() + '/v' + Version + '/payments/' + encodeURIComponent(payment.id) + '?exchange=true';
@@ -287,7 +273,6 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                                 payment: payment.id,
                             },
                             i18n: request.i18n,
-                            lineItems: balanceItemPayments,
                             organization,
                             customer: {
                                 name: order.data.customer.name,
@@ -295,31 +280,28 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                             },
                         });
                         paymentUrl = stripeResult.paymentUrl;
-                    }
-                    else if (payment.provider === PaymentProvider.Mollie) {
+                    } else if (payment.provider === PaymentProvider.Mollie) {
                         // Mollie payment
-                        const token = await MollieToken.getTokenFor(webshop.organizationId);
-                        if (!token) {
+                        const mollieService = await MollieService.create({ sellingOrganization: organization });
+                        if (!mollieService) {
                             throw new SimpleError({
                                 code: '',
                                 message: $t(`%w3`, { method: PaymentMethodHelper.getName(payment.method) }),
                             });
                         }
-                        const profileId = organization.privateMeta.mollieProfile?.id ?? await token.getProfileId(webshop.getHost());
+                        const profileId = await mollieService.getProfileId(webshop.getHost());
                         if (!profileId) {
                             throw new SimpleError({
                                 code: '',
                                 message: $t(`%w4`, { method: PaymentMethodHelper.getName(payment.method) }),
                             });
                         }
-                        const mollieClient = createMollieClient({ accessToken: await token.getAccessToken() });
-                        const locale = Context.i18n.locale.replace('-', '_');
-                        const molliePayment = await mollieClient.payments.create({
+                        const molliePayment = await mollieService.client.payments.create({
                             amount: {
                                 currency: 'EUR',
                                 value: (totalPrice / 10000).toFixed(2), // from 4 decimals to 0 decimals
                             },
-                            method: payment.method == PaymentMethod.Bancontact ? molliePaymentMethod.bancontact : (payment.method == PaymentMethod.iDEAL ? molliePaymentMethod.ideal : molliePaymentMethod.creditcard),
+                            method: payment.method === PaymentMethod.Bancontact ? molliePaymentMethod.bancontact : (payment.method === PaymentMethod.iDEAL ? molliePaymentMethod.ideal : molliePaymentMethod.creditcard),
                             testmode: organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production',
                             profileId,
                             description,
@@ -331,7 +313,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                                 webshop: webshop.id,
                                 payment: payment.id,
                             },
-                            locale: ['en_US', 'en_GB', 'nl_NL', 'nl_BE', 'fr_FR', 'fr_BE', 'de_DE', 'de_AT', 'de_CH', 'es_ES', 'ca_ES', 'pt_PT', 'it_IT', 'nb_NO', 'sv_SE', 'fi_FI', 'da_DK', 'is_IS', 'hu_HU', 'pl_PL', 'lv_LV', 'lt_LT'].includes(locale) ? (locale as any) : null,
+                            locale: mollieService.locale,
                         });
                         console.log(molliePayment);
                         paymentUrl = molliePayment.getCheckoutUrl();
@@ -341,11 +323,9 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                         dbPayment.paymentId = payment.id;
                         dbPayment.mollieId = molliePayment.id;
                         await dbPayment.save();
-                    }
-                    else if (payment.provider == PaymentProvider.Payconiq) {
+                    } else if (payment.provider == PaymentProvider.Payconiq) {
                         ({ paymentUrl, paymentQRCode } = await PayconiqPayment.createPayment(payment, organization, description, redirectUrl, exchangeUrl));
-                    }
-                    else if (payment.provider == PaymentProvider.Buckaroo) {
+                    } else if (payment.provider == PaymentProvider.Buckaroo) {
                         // Increase request timeout because buckaroo is super slow
                         request.request.request?.setTimeout(60 * 1000);
                         const buckaroo = new BuckarooHelper(organization.privateMeta?.buckarooSettings?.key ?? '', organization.privateMeta?.buckarooSettings?.secret ?? '', organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production');
@@ -362,8 +342,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                                 }),
                             });
                         }
-                    }
-                    else {
+                    } else {
                         throw new Error('Unknown payment provider');
                     }
                 }
@@ -374,8 +353,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                     order: OrderStruct.create({ ...order, payment: PaymentStruct.create(payment) }),
                 }));
             }
-        }
-        catch (e) {
+        } catch (e) {
             // Mark order as failed to release stock
             if (order) {
                 await order.deleteOrderBecauseOfCreationError();

package/src/endpoints/organization/webshops/RetrieveUitpasSocialTariffPriceEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { UitpasPriceCheckRequest, UitpasPriceCheckResponse } from '@stamhoofd/structures';
@@ -47,8 +47,7 @@ export class RetrieveUitpasSocialTariffPricesEndpoint extends Endpoint<Params, Q
                     prices: [reducedPrice], // Convert to cents
                 });
                 return new Response(uitpasPriceCheckResponse);
-            }
-            else {
+            } else {
                 // OFFICIAL FLOW with an UiTPAS number
                 // request should include a reduced price (estimate by the frontend)
                 const organization = await Context.setOrganizationScope({ willAuthenticate: false });
@@ -58,8 +57,7 @@ export class RetrieveUitpasSocialTariffPricesEndpoint extends Endpoint<Params, Q
                 });
                 return new Response(uitpasPriceCheckResponse);
             }
-        }
-        else {
+        } else {
             // NON-OFFICIAL FLOW
             // request should include UiTPAS-numbers, reduced price AND base price
             if (request.body.reducedPrice === null) {

package/src/endpoints/organization/webshops/WebshopAuthHelper.ts

@@ -0,0 +1,36 @@
+import { SimpleError } from '@simonbackx/simple-errors';
+import type { Order, Webshop } from '@stamhoofd/models';
+import { WebshopAuthType } from '@stamhoofd/structures';
+
+import { Context } from '../../../helpers/Context.js';
+
+export class WebshopAuthHelper {
+    static async optionalAuthenticateForWebshop(webshop: Webshop) {
+        await Context.optionalAuthenticate();
+
+        if (webshop.meta.authType === WebshopAuthType.Required && !Context.user) {
+            throw new SimpleError({
+                code: 'not_authenticated',
+                message: 'Not authenticated',
+                human: $t(`%w5`),
+                statusCode: 401,
+            });
+        }
+    }
+
+    static async checkOrderAccess(webshop: Webshop, order: Order) {
+        await this.optionalAuthenticateForWebshop(webshop);
+
+        if (webshop.meta.authType !== WebshopAuthType.Required) {
+            return;
+        }
+
+        if (order.userId !== Context.user?.id) {
+            throw new SimpleError({
+                code: 'not_found',
+                message: 'Order not found',
+                human: $t(`%FY`),
+            });
+        }
+    }
+}

package/src/endpoints/system/HealthEndpoint.ts

@@ -1,5 +1,5 @@
 import { ArrayDecoder, AutoEncoder, field, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { CpuService } from '../../services/CpuService.js';

package/src/excel-loaders/balance-items.ts

@@ -1,7 +1,7 @@
 import type { XlsxTransformerColumn } from '@stamhoofd/excel-writer';
 import { XlsxBuiltInNumberFormat } from '@stamhoofd/excel-writer';
 import { BalanceItem } from '@stamhoofd/models';
-import type { BalanceItemWithPayments} from '@stamhoofd/structures';
+import type { BalanceItemWithPayments } from '@stamhoofd/structures';
 import { BalanceItemRelationType, ExcelExportType, getBalanceItemRelationTypeName, getBalanceItemTypeName, PaginatedResponse, PaymentStatus } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { ExportToExcelEndpoint } from '../endpoints/global/files/ExportToExcelEndpoint.js';

package/src/excel-loaders/event-notifications.ts

@@ -1,6 +1,6 @@
 import type { XlsxTransformerSheet } from '@stamhoofd/excel-writer';
 import { XlsxBuiltInNumberFormat } from '@stamhoofd/excel-writer';
-import type { EventNotification, LimitedFilteredRequest} from '@stamhoofd/structures';
+import type { EventNotification, LimitedFilteredRequest } from '@stamhoofd/structures';
 import { EventNotificationStatus, EventNotificationStatusHelper, ExcelExportType, Platform as PlatformStruct } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { GetEventNotificationsEndpoint } from '../endpoints/global/events/GetEventNotificationsEndpoint.js';

package/src/excel-loaders/members.ts

@@ -1,7 +1,7 @@
 import type { XlsxTransformerColumn, XlsxTransformerSheet } from '@stamhoofd/excel-writer';
 import { XlsxBuiltInNumberFormat } from '@stamhoofd/excel-writer';
 import { Platform } from '@stamhoofd/models';
-import type { LimitedFilteredRequest, PlatformMember} from '@stamhoofd/structures';
+import type { LimitedFilteredRequest, PlatformMember } from '@stamhoofd/structures';
 import { ExcelExportType, Gender, GroupType, MembershipStatus, PlatformFamily, Platform as PlatformStruct, UnencodeablePaginatedResponse } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { ExportToExcelEndpoint } from '../endpoints/global/files/ExportToExcelEndpoint.js';

package/src/excel-loaders/organizations.ts

@@ -240,9 +240,9 @@ ExportToExcelEndpoint.loaders.set(ExcelExportType.Organizations, {
         const organizationIds = organizations.results.map(o => o.id);
         const responsibilities = organizationIds.length
             ? await MemberResponsibilityRecord.select()
-                .where('organizationId', organizationIds)
-                .where('endDate', null)
-                .fetch()
+                    .where('organizationId', organizationIds)
+                    .where('endDate', null)
+                    .fetch()
             : [];
 
         // Load groups and members