@stamhoofd/backend 2.120.6 → 2.122.0

package/src/endpoints/global/members/GetMembersEndpoint.ts

@@ -83,8 +83,7 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                                 },
                             },
                         };
-                    }
-                    else {
+                    } else {
                         // Can only access current period
                         scopeFilter = {
                             registrations: {
@@ -95,8 +94,7 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                             },
                         };
                     }
-                }
-                else {
+                } else {
                     // Check which normal membership groups we have access to and filter on those
                     const groups = await Group.getAll(organization.id, organization.periodId, true, [GroupType.Membership, GroupType.WaitingList]);
                     Context.auth.cacheGroups(groups);
@@ -134,6 +132,10 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 SQL.table('members'),
             );
 
+        if (organization && STAMHOOFD.userMode === 'organization') {
+            query.where('organizationId', organization.id);
+        }
+
         if (scopeFilter) {
             query.where(await compileToSQLFilter(scopeFilter, filterCompilers));
         }
@@ -197,8 +199,7 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                         ],
                     };
                 }
-            }
-            catch (e) {
+            } catch (e) {
                 console.error('Failed to parse phone number', search, e);
             }
         }
@@ -216,8 +217,7 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
         // e-mail or name based searching
         if (searchFilter) {
             // already done
-        }
-        else if (search.includes('@')) {
+        } else if (search.includes('@')) {
             const isCompleteAddress = DataValidator.isEmailValid(search);
 
             // Member email address contains, or member parent contains
@@ -240,8 +240,7 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                     },
                 ],
             } as any as StamhoofdFilter;
-        }
-        else {
+        } else {
             searchFilter = {
                 name: {
                     $contains: search,
@@ -260,8 +259,7 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
 
         try {
             data = await query.fetch();
-        }
-        catch (error) {
+        } catch (error) {
             if (error.message.includes('ER_QUERY_TIMEOUT')) {
                 throw new SimpleError({
                     code: 'timeout',

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.test.ts

@@ -11,6 +11,7 @@ import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { Country } from '@stamhoofd/types/Country';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { initUitpasApi } from '../../../../tests/init/index.js';
+import { UniqueMemberNumberService } from '../../../services/UniqueMemberNumberService.js';
 import { PatchOrganizationMembersEndpoint } from './PatchOrganizationMembersEndpoint.js';
 
 const baseUrl = `/organization/members`;
@@ -30,6 +31,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
     afterEach(async () => {
         // Delete all members (so the duplicate checks work as expected)
         await Database.delete('DELETE FROM `members`');
+        await UniqueMemberNumberService.check();
     });
 
     describe('Duplicate members', () => {
@@ -83,7 +85,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             );
 
             const user = await new UserFactory({
-                permissions: Permissions.create({ level: PermissionLevel.None, resources  }),
+                permissions: Permissions.create({ level: PermissionLevel.None, resources }),
                 organization, // since we are in platform mode, this will only set the permissions for this organization
             }).create();
 
@@ -93,7 +95,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 birthDay,
                 generateData: true,
                 // should be member of the same organization
-                organization
+                organization,
             }).create();
 
             const token = await Token.createToken(user);
@@ -136,7 +138,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             );
 
             const user = await new UserFactory({
-                permissions: Permissions.create({ level: PermissionLevel.None, resources  }),
+                permissions: Permissions.create({ level: PermissionLevel.None, resources }),
                 organization, // since we are in platform mode, this will only set the permissions for this organization
             }).create();
 
@@ -147,7 +149,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 birthDay,
                 generateData: true,
                 // should be member of the same organization
-                organization
+                organization,
             }).create();
 
             const memberToPatch = await new MemberFactory({
@@ -156,7 +158,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 birthDay,
                 generateData: true,
                 // should be member of the same organization
-                organization
+                organization,
             }).create();
 
             // Register this member
@@ -173,8 +175,8 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             const patch = MemberWithRegistrationsBlob.patch({
                 id: memberToPatch.id,
                 details: MemberDetails.patch({
-                    firstName
-                })
+                    firstName,
+                }),
             });
 
             arr.addPatch(patch);
@@ -204,7 +206,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             );
 
             const user = await new UserFactory({
-                permissions: Permissions.create({ level: PermissionLevel.None, resources  }),
+                permissions: Permissions.create({ level: PermissionLevel.None, resources }),
                 organization, // since we are in platform mode, this will only set the permissions for this organization
             }).create();
 
@@ -216,8 +218,8 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 // member of other organization
                 organization: otherOrganization,
                 details: MemberDetails.create({
-                    email: 'existing@test.be'
-                })
+                    email: 'existing@test.be',
+                }),
             }).create();
 
             const token = await Token.createToken(user);
@@ -393,8 +395,9 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             expect(member.details.parents[0]).toEqual(existingMember.details.parents[0]);
         });
 
-        test('Creating a member with duplicate member number throws invalid_field', async () => {
-            TestUtils.setEnvironment('userMode', 'organization');
+        test.skip('Creating a member with duplicate member number throws invalid_field', async () => {
+            TestUtils.setEnvironment('userMode', 'platform');
+            await UniqueMemberNumberService.check();
 
             const organization = await new OrganizationFactory({ }).create();
             const user = await new UserFactory({
@@ -409,6 +412,8 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 generateData: false,
             }).create();
             existingMember.details.memberNumber = 'LID-100';
+            // should have same organization id as new member with same member number
+            existingMember.organizationId = organization.id;
             await existingMember.save();
 
             const token = await Token.createToken(user);
@@ -431,6 +436,47 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 .rejects
                 .toThrow(STExpect.errorWithCode('invalid_field'));
         });
+
+        test('Creating a member with duplicate member number does not invalid_field in organization mode', async () => {
+            TestUtils.setEnvironment('userMode', 'organization');
+            await UniqueMemberNumberService.check();
+
+            const organization = await new OrganizationFactory({ }).create();
+            const user = await new UserFactory({
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+                organization,
+            }).create();
+
+            const existingMember = await new MemberFactory({
+                firstName: 'Existing',
+                lastName: 'Member',
+                birthDay,
+                generateData: false,
+            }).create();
+            existingMember.details.memberNumber = 'LID-100';
+            // should have same organization id as new member with same member number
+            existingMember.organizationId = organization.id;
+            await existingMember.save();
+
+            const token = await Token.createToken(user);
+
+            const arr: Body = new PatchableArray();
+            const put = MemberWithRegistrationsBlob.create({
+                details: MemberDetails.create({
+                    firstName: 'New',
+                    lastName: 'Member',
+                    birthDay: new Date('2015-01-01'),
+                    memberNumber: 'LID-100',
+                }),
+            });
+            arr.addPut(put);
+
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+
+            const response = await testServer.test(endpoint, request);
+            expect(response.body.members[0].details.memberNumber).toEqual('LID-100');
+        });
     });
 
     describe('Permission checking', () => {
@@ -820,6 +866,143 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             });
         });
 
+        test('It is not possible to set a different settings id for a given record', async () => {
+            const commentsRecord = RecordSettings.create({
+                name: TranslatedString.create('Opmerkingen'),
+                externalPermissionLevel: PermissionLevel.Read, // this should be ignored since we are an admin
+            });
+
+            const recordCategory = RecordCategory.create({
+                name: TranslatedString.create('Medische fiche'),
+                records: [
+                    commentsRecord,
+                ],
+            });
+            const organization = await new OrganizationFactory({
+                meta: OrganizationMetaData.create({
+                    recordsConfiguration: OrganizationRecordsConfiguration.create({
+                        recordCategories: [recordCategory],
+                    }),
+                }),
+            }).create();
+
+            const user = await new UserFactory({
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+                organization, // since we are in platform mode, this will only set the permissions for this organization
+            }).create();
+
+            const member = await new MemberFactory({
+                firstName,
+                lastName,
+                birthDay,
+                generateData: false,
+            }).create();
+
+            // Register this member
+            await new RegistrationFactory({
+                member,
+                organization,
+            }).create();
+
+            const token = await Token.createToken(user);
+
+            const recordAnswers = new PatchMap() as PatchAnswers;
+
+            recordAnswers.set(commentsRecord.id, RecordTextAnswer.create({
+                settings: RecordSettings.create({
+                    id: 'malicious',
+                    name: TranslatedString.create('Opmerkingen'),
+                }),
+                value: 'Some comments',
+            }));
+
+            const arr: Body = new PatchableArray();
+            const patch = MemberWithRegistrationsBlob.patch({
+                id: member.id,
+                details: MemberDetails.patch({
+                    recordAnswers,
+                }),
+            });
+            arr.addPatch(patch);
+
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+            await expect(testServer.test(endpoint, request)).rejects.toThrow(
+                STExpect.simpleError({
+                    code: 'invalid_field',
+                    field: 'changes.0.patch.details.recordAnswers.' + commentsRecord.id + '.settings.id',
+                    message: 'Expected record settings id to match map key',
+                }),
+            );
+        });
+
+        test('Cannot change settings via a patch', async () => {
+            // We block this because this coould cause mismatches between the record answer value and record answer settings type
+
+            const commentsRecord = RecordSettings.create({
+                name: TranslatedString.create('Opmerkingen'),
+                externalPermissionLevel: PermissionLevel.Read, // this should be ignored since we are an admin
+            });
+
+            const recordCategory = RecordCategory.create({
+                name: TranslatedString.create('Medische fiche'),
+                records: [
+                    commentsRecord,
+                ],
+            });
+            const organization = await new OrganizationFactory({
+                meta: OrganizationMetaData.create({
+                    recordsConfiguration: OrganizationRecordsConfiguration.create({
+                        recordCategories: [recordCategory],
+                    }),
+                }),
+            }).create();
+
+            const user = await new UserFactory({
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+                organization, // since we are in platform mode, this will only set the permissions for this organization
+            }).create();
+
+            const member = await new MemberFactory({
+                firstName,
+                lastName,
+                birthDay,
+                generateData: false,
+            }).create();
+
+            // Register this member
+            await new RegistrationFactory({
+                member,
+                organization,
+            }).create();
+
+            const token = await Token.createToken(user);
+
+            const recordAnswers = new PatchMap() as PatchAnswers;
+
+            recordAnswers.set(commentsRecord.id, RecordTextAnswer.patch({
+                value: 'Some comments',
+            }));
+
+            const arr: Body = new PatchableArray();
+            const patch = MemberWithRegistrationsBlob.patch({
+                id: member.id,
+                details: MemberDetails.patch({
+                    recordAnswers,
+                }),
+            });
+            arr.addPatch(patch);
+
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+            await expect(testServer.test(endpoint, request)).rejects.toThrow(
+                STExpect.simpleError({
+                    code: 'missing_field',
+                    field: 'changes.0.patch.details.recordAnswers.changes.' + commentsRecord.id,
+                }),
+            );
+        });
+
         test('An admin with read only record category permission cannot set the records in that category', async () => {
             const commentsRecord = RecordSettings.create({
                 name: TranslatedString.create('Opmerkingen'),

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.ts

@@ -5,7 +5,7 @@ import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import type { MemberWithUsersRegistrationsAndGroups, Registration } from '@stamhoofd/models';
-import { AuditLog, BalanceItem, Document, Group, Member, MemberFactory, MemberPlatformMembership, MemberResponsibilityRecord, mergeTwoMembers, Organization, Platform, RateLimiter, RegistrationPeriod, User } from '@stamhoofd/models';
+import { AuditLog, BalanceItem, Document, Group, Member, MemberFactory, MemberPlatformMembership, MemberResponsibilityRecord, Organization, Platform, RateLimiter, RegistrationPeriod, User } from '@stamhoofd/models';
 import type { MemberResponsibility, MembersBlob } from '@stamhoofd/structures';
 import { AuditLogReplacement, AuditLogReplacementType, AuditLogSource, AuditLogType, EmergencyContact, GroupType, MemberDetails, MemberWithRegistrationsBlob, Parent, PermissionLevel, PlatformMembershipTypeBehaviour, SetupStepType } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
@@ -23,6 +23,7 @@ import { MemberNumberService } from '../../../services/MemberNumberService.js';
 import { PlatformMembershipService } from '../../../services/PlatformMembershipService.js';
 import { RegistrationService } from '../../../services/RegistrationService.js';
 import { shouldCheckIfMemberIsDuplicateForPatch } from './shouldCheckIfMemberIsDuplicate.js';
+import { mergeTwoMembers } from '../../../helpers/MemberMerger.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -81,8 +82,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
             if (!await Context.auth.hasSomeAccess(organization.id)) {
                 throw Context.auth.error();
             }
-        }
-        else {
+        } else {
             if (!Context.auth.hasSomePlatformAccess()) {
                 throw Context.auth.error();
             }
@@ -147,8 +147,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
 
             try {
                 await member.save();
-            }
-            catch (error) {
+            } catch (error) {
                 PatchOrganizationMembersEndpoint.throwDuplicateMemberNumberError(error);
             }
             members.push(member);
@@ -217,14 +216,16 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
 
                     // Add new
                     members.push(duplicate);
+
+                    await MemberUserSyncer.onChangeMember(duplicate);
+                    await Document.updateForMember(duplicate);
                     continue;
                 }
             }
 
             try {
                 await member.save();
-            }
-            catch (error) {
+            } catch (error) {
                 PatchOrganizationMembersEndpoint.throwDuplicateMemberNumberError(error);
             }
 
@@ -340,8 +341,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
                         if (registration.periodId !== org.periodId) {
                             return false;
                         }
-                    }
-                    else {
+                    } else {
                         if (registration.periodId !== platform.periodIdIfPlatform) {
                             return false;
                         }
@@ -590,8 +590,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
                         message: 'Overlapping memberships',
                         human: $t(`%1ND`),
                     });
-                }
-                else if (existing) {
+                } else if (existing) {
                     await existing.doDelete();
                 }
 
@@ -601,8 +600,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
                 if (member.details.memberNumber === null) {
                     try {
                         await MemberNumberService.assignMemberNumber(member, membership);
-                    }
-                    catch (error) {
+                    } catch (error) {
                         console.error(`Failed to assign member number for id ${member.id}: ${error.message}`);
                         // If the assignment of the member number fails the membership is not created but the member is registered
                         continue;
@@ -654,8 +652,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
                 if (Context.auth.hasPlatformFullAccess()) {
                     membership.locked = p.locked ?? membership.locked;
                     await membership.save();
-                }
-                else {
+                } else {
                     if (p.locked === true) {
                         throw Context.auth.error($t('%BX'));
                     }
@@ -958,8 +955,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
     private static async checkSecurityCode(member: MemberWithUsersRegistrationsAndGroups, securityCode: string) {
         try {
             securityCodeLimiter.track(member.details.name, 1);
-        }
-        catch (e) {
+        } catch (e) {
             Email.sendWebmaster({
                 subject: $t(`%E9`),
                 text: $t(`%EA`) + ' ' + member.details.name + ' ' + $t(`%1G`) + ' ' + member.id + ')' + '\n\n' + e.message + '\n\nStamhoofd',
@@ -1038,11 +1034,9 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
 
         if ((type === 'put' && await member.isSafeToMergeDuplicateWithoutSecurityCode()) || await Context.auth.canAccessMember(member, PermissionLevel.Write)) {
             console.log('checkSecurityCode: without security code: allowed for ' + member.id);
-        }
-        else if (securityCode) {
-           await this.checkSecurityCode(member, securityCode);
-        }
-        else {
+        } else if (securityCode) {
+            await this.checkSecurityCode(member, securityCode);
+        } else {
             if (type === 'patch') {
                 throw Context.auth.memberNotFoundOrNoAccess();
             }

package/src/endpoints/global/members/helpers/validateGroupFilter.ts

@@ -2,8 +2,9 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import type { StamhoofdFilter, WrapperFilter } from '@stamhoofd/structures';
 import { FilterWrapperMarker, PermissionLevel, unwrapFilter } from '@stamhoofd/structures';
 import { Context } from '../../../../helpers/Context.js';
+import { StamhoofdFilterAccessHelper } from '../../../../helpers/StamhoofdFilterAccessHelper.js';
 
-export async function validateGroupFilter({ filter, permissionLevel, key }: { filter: StamhoofdFilter; permissionLevel: PermissionLevel; key: string | null }) {
+export async function validateGroupFilter({ filter, permissionLevel, key }: { filter: StamhoofdFilter; permissionLevel: PermissionLevel; key: string | null }): Promise<boolean> {
     // Require presence of a filter
     const requiredFilter: WrapperFilter = key
         ? {
@@ -22,39 +23,15 @@ export async function validateGroupFilter({ filter, permissionLevel, key }: { fi
         return false;
     }
 
-    const groupIds = typeof unwrapped.markerValue === 'string'
-        ? [unwrapped.markerValue]
-        : unwrapFilter(unwrapped.markerValue as StamhoofdFilter, {
-            $in: FilterWrapperMarker,
-        })?.markerValue;
-
-    if (!Array.isArray(groupIds)) {
+    if (unwrapped.markerValue === undefined) {
         throw new SimpleError({
             code: 'invalid_field',
             field: 'filter',
-            message: 'You must filter on a group of the organization you are trying to access',
-            human: $t(`%15e`),
+            message: 'Filtering on an undefined list of groups is not supported',
         });
     }
 
-    if (groupIds.length === 0) {
-        throw new SimpleError({
-            code: 'invalid_field',
-            field: 'filter',
-            message: 'Filtering on an empty list of groups is not supported',
-        });
-    }
-
-    for (const groupId of groupIds) {
-        if (typeof groupId !== 'string') {
-            throw new SimpleError({
-                code: 'invalid_field',
-                field: 'filter',
-                message: 'Invalid group ID in filter',
-            });
-        }
-    }
-
+    const groupIds = StamhoofdFilterAccessHelper.getGroupIdsFromFilter(unwrapped.markerValue);
     const groups = await Context.auth.getGroups(groupIds as string[]);
 
     console.log('Fetching members for groups before', groups.map(g => g.settings.name.toString()));
@@ -66,8 +43,7 @@ export async function validateGroupFilter({ filter, permissionLevel, key }: { fi
                     message: 'You do not have access to this group',
                     human: $t(`%15f`, { groupName: group.settings.name }),
                 });
-            }
-            else {
+            } else {
                 // Return false so we add additional scope filters (only view overlap)
                 return false;
             }

package/src/endpoints/global/members/shouldCheckIfMemberIsDuplicate.ts

@@ -1,5 +1,5 @@
 import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
-import type { MemberDetails} from '@stamhoofd/structures';
+import type { MemberDetails } from '@stamhoofd/structures';
 import { MemberWithRegistrationsBlob } from '@stamhoofd/structures';
 
 /**

package/src/endpoints/global/organizations/CheckRegisterCodeEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Organization, RegisterCode } from '@stamhoofd/models';

package/src/endpoints/global/organizations/CreateOrganizationEndpoint.ts

@@ -1,16 +1,24 @@
+import type { Model } from '@simonbackx/simple-database';
 import type { Decoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
+import type { EmailInterfaceBase } from '@stamhoofd/email';
+import { Email } from '@stamhoofd/email';
 import { AuditLog, EmailVerificationCode, Organization, OrganizationRegistrationPeriod, RegistrationPeriod, User } from '@stamhoofd/models';
-import { AuditLogSource, AuditLogType, CreateOrganization, PermissionLevel, Permissions, RegistrationPeriodSettings, SignupResponse, UserPermissions } from '@stamhoofd/structures';
+import { CreateOrganizationResponse } from '@stamhoofd/structures';
+import { AuditLogSource, AuditLogType, CreateOrganization, PermissionLevel, Permissions, SignupResponse, UserPermissions } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
+import { v4 as uuidv4 } from 'uuid';
 import { AuditLogService } from '../../../services/AuditLogService.js';
+import { ReferralService } from '../../../services/ReferralService.js';
+import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures.js';
+import { Context } from '../../../helpers/Context.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
 type Body = CreateOrganization;
-type ResponseBody = SignupResponse;
+type ResponseBody = CreateOrganizationResponse;
 
 export class CreateOrganizationEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
     bodyDecoder = CreateOrganization as Decoder<CreateOrganization>;
@@ -77,9 +85,8 @@ export class CreateOrganizationEndpoint extends Endpoint<Params, Query, Body, Re
         }
 
         // First create the organization
-        // TODO: add some duplicate validation
         const organization = new Organization();
-        organization.id = request.body.organization.id;
+        organization.id = uuidv4();
         organization.name = request.body.organization.name;
 
         organization.uri = uri;
@@ -87,6 +94,16 @@ export class CreateOrganizationEndpoint extends Endpoint<Params, Query, Body, Re
         organization.address = request.body.organization.address;
         organization.privateMeta.acquisitionTypes = request.body.organization.privateMeta?.acquisitionTypes ?? [];
 
+        // Delay save until after organization is saved, but do validations before the organization is saved
+        let registerCodeModels: Model[] = [];
+        let delayEmails: EmailInterfaceBase[] = [];
+
+        if (request.body.registerCode) {
+            const applied = await ReferralService.markUsed(organization, request.body.registerCode);
+            registerCodeModels = applied.models;
+            delayEmails = applied.emails;
+        }
+
         const period = await AuditLogService.setContext({ source: AuditLogSource.System }, async () => {
             const period = new RegistrationPeriod();
             period.configureForNewOrganization();
@@ -98,8 +115,7 @@ export class CreateOrganizationEndpoint extends Endpoint<Params, Query, Body, Re
 
         try {
             await organization.save();
-        }
-        catch (e) {
+        } catch (e) {
             console.error(e);
             throw new SimpleError({
                 code: 'creating_organization',
@@ -136,14 +152,30 @@ export class CreateOrganizationEndpoint extends Endpoint<Params, Query, Body, Re
         user.permissions.organizationPermissions.set(organization.id, Permissions.create({ level: PermissionLevel.Full }));
         await user.save();
 
+        for (const model of registerCodeModels) {
+            await model.save();
+        }
+
         // Correctly assign creation
         await AuditLog.update().where('type', AuditLogType.OrganizationAdded).where('objectId', organization.id).set('userId', user.id).set('source', AuditLogSource.User).update();
 
         const code = await EmailVerificationCode.createFor(user, user.email);
         code.send(user, organization, request.i18n).catch(console.error);
 
-        return new Response(SignupResponse.create({
+        for (const email of delayEmails) {
+            Email.send({
+                from: Email.getQuickFromEmail(organization.address.country),
+                ...email,
+            });
+        }
+
+        // Prepare the response as if we were authenticated
+        await Context.setManualOrganizationScope(organization);
+        await Context.insecurelyAuthenticateAs(user);
+
+        return new Response(CreateOrganizationResponse.create({
             token: code.token,
+            organization: await AuthenticatedStructures.organization(organization),
         }));
     }
 }