@stamhoofd/backend 2.121.0 → 2.122.0

package/src/endpoints/organization/dashboard/registration-periods/GetOrganizationRegistrationPeriodsEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import type { CountFilteredRequest, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, StamhoofdFilter } from '@stamhoofd/structures';
 import { assertSort, getSortFilter, LimitedFilteredRequest, PaginatedResponse } from '@stamhoofd/structures';
@@ -129,8 +129,7 @@ export class GetOrganizationRegistrationPeriodsEndpoint extends Endpoint<Params,
             if (!await Context.auth.hasSomeAccess(organization.id)) {
                 throw Context.auth.error();
             }
-        }
-        else {
+        } else {
             if (!Context.auth.hasPlatformFullAccess()) {
                 throw Context.auth.error();
             }

package/src/endpoints/organization/dashboard/registration-periods/MoveRegistrationPeriods.test.ts

@@ -1,5 +1,5 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import type { Organization, OrganizationRegistrationPeriod, RegistrationPeriod} from '@stamhoofd/models';
+import type { Organization, OrganizationRegistrationPeriod, RegistrationPeriod } from '@stamhoofd/models';
 import { GroupFactory, MemberFactory, OrganizationFactory, OrganizationRegistrationPeriodFactory, Registration, RegistrationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
 import { Group, GroupType, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions, Version } from '@stamhoofd/structures';
 import { PatchOrganizationRegistrationPeriodsEndpoint } from './PatchOrganizationRegistrationPeriodsEndpoint.js';

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.test.ts

@@ -1,5 +1,5 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import type { Organization} from '@stamhoofd/models';
+import type { Organization } from '@stamhoofd/models';
 import { GroupFactory, OrganizationFactory, OrganizationRegistrationPeriod, OrganizationRegistrationPeriodFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
 import { GroupSettings, Group as GroupStruct, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, PermissionLevel, Permissions, Version } from '@stamhoofd/structures';
 

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -115,8 +115,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                     }
                     organizationPeriod.settings = organizationPeriod.settings.patch(patch.settings);
                 }
-            }
-            else {
+            } else {
                 /// Only allow editing category group ids
                 if (patch.settings) {
                     // Only allow adding groups if we have create permissions in a given category group
@@ -184,8 +183,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                         if (locked) {
                             throw Context.auth.error($t(`%F1`));
                         }
-                    }
-                    else if (locked !== categoryAfter.settings.locked) {
+                    } else if (locked !== categoryAfter.settings.locked) {
                         throw Context.auth.error($t(`%F2`));
                     }
 
@@ -349,8 +347,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             s.settings.reservedMembers = 0;
             try {
                 await PatchOrganizationRegistrationPeriodsEndpoint.createGroup(s, organization.id, period);
-            }
-            catch (e) {
+            } catch (e) {
                 // Can happen when a group is no longer valid anymore when duplicating a period
                 console.error('Error creating group', s.id, e);
             }
@@ -458,6 +455,14 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             }
 
             if (shouldUpdatePeriodIds) {
+                if (model.settings.hasBundleDiscounts) {
+                    throw new SimpleError({
+                        code: 'change_period_not_allowed',
+                        message: 'This group cannot be moved to another period because it has bundle discounts.',
+                        human: Context.i18n.$t('%1dG'),
+                    });
+                }
+
                 if (!isPatchingEvent && struct.periodId === undefined) {
                     throw new SimpleError({
                         code: 'invalid_field',
@@ -563,8 +568,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                     // await PatchOrganizationRegistrationPeriodsEndpoint.deleteGroup(model.waitingListId)
                     model.waitingListId = null;
                 }
-            }
-            else if (patch.waitingList.isPatch()) {
+            } else if (patch.waitingList.isPatch()) {
                 if (!model.waitingListId) {
                     throw new SimpleError({
                         code: 'invalid_field',
@@ -579,8 +583,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                     allowPatchWaitingListPeriod: shouldUpdatePeriodIds,
                     isPatchingEvent,
                 });
-            }
-            else {
+            } else {
                 if (model.waitingListId) {
                     // for now don't delete, as waiting lists can be shared between multiple groups
                     // await PatchOrganizationRegistrationPeriodsEndpoint.deleteGroup(model.waitingListId)
@@ -608,8 +611,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                     }
 
                     model.waitingListId = existing.id;
-                }
-                else {
+                } else {
                     const requiredPeriod = period ?? await RegistrationPeriod.getByID(model.periodId);
 
                     if (!requiredPeriod) {
@@ -635,8 +637,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                     model.waitingListId = group.id;
                 }
             }
-        }
-        else if (shouldUpdatePeriodIds && model.waitingListId && period) {
+        } else if (shouldUpdatePeriodIds && model.waitingListId && period) {
             // update waiting list period
             await throwIfUpdateWaitingListPeriodWithMultipleGroups(model.waitingListId);
             await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(
@@ -672,8 +673,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             if (!await Context.auth.hasFullAccess(organizationId)) {
                 throw Context.auth.error($t(`%FA`));
             }
-        }
-        else {
+        } else {
             // For events, permission checking needs to happen outside this method (access to event = access to group)
         }
 
@@ -685,6 +685,8 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             });
         }
 
+        struct.settings.validateName();
+
         if (STAMHOOFD.userMode === 'organization' && (period.organizationId !== organizationId)) {
             throw new SimpleError({
                 code: 'invalid_period',
@@ -759,8 +761,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                 }
 
                 model.waitingListId = existing.id;
-            }
-            else {
+            } else {
                 struct.waitingList.type = GroupType.WaitingList;
                 const group = await PatchOrganizationRegistrationPeriodsEndpoint.createGroup(
                     struct.waitingList,

package/src/endpoints/organization/dashboard/registration-periods/SetupStepReviewEndpoint.ts

@@ -1,9 +1,9 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
-import type { OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct} from '@stamhoofd/structures';
+import type { OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct } from '@stamhoofd/structures';
 import { SetupStepType } from '@stamhoofd/structures';
 
-import type { Decoder} from '@simonbackx/simple-encoding';
+import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, BooleanDecoder, EnumDecoder, field } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { OrganizationRegistrationPeriod } from '@stamhoofd/models';
@@ -71,8 +71,7 @@ export class SetupStepReviewEndpoint extends Endpoint<Params, Query, Body, Respo
                 userId: user.id,
                 userName: user.name ?? '?',
             });
-        }
-        else {
+        } else {
             setupSteps.resetReviewed(stepType);
         }
 

package/src/endpoints/organization/dashboard/stripe/ConnectStripeEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { StripeAccount } from '@stamhoofd/models';

package/src/endpoints/organization/dashboard/stripe/DeleteStripeAccountEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { StripeAccount } from '@stamhoofd/models';
 import { AuditLogType, PermissionLevel } from '@stamhoofd/structures';
@@ -56,8 +56,7 @@ export class DeleteStripeAccountEndpoint extends Endpoint<Params, Query, Body, R
 
         try {
             await stripe.accounts.del(model.accountId);
-        }
-        catch (e) {
+        } catch (e) {
             console.error('Tried deleting account but failed', e);
         }
 

package/src/endpoints/organization/dashboard/stripe/GetStripeAccountLinkEndpoint.ts

@@ -1,6 +1,6 @@
-import type { Decoder} from '@simonbackx/simple-encoding';
+import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, field, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { StripeAccount } from '@stamhoofd/models';

package/src/endpoints/organization/dashboard/stripe/GetStripeAccountsEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { StripeAccount } from '@stamhoofd/models';
 import { PermissionLevel, StripeAccount as StripeAccountStruct } from '@stamhoofd/structures';

package/src/endpoints/organization/dashboard/stripe/GetStripeLoginLinkEndpoint.ts

@@ -1,6 +1,6 @@
-import type { Decoder} from '@simonbackx/simple-encoding';
+import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, field, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { StripeAccount, Token } from '@stamhoofd/models';

package/src/endpoints/organization/dashboard/stripe/UpdateStripeAccountEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { StripeAccount } from '@stamhoofd/models';
 import { AuditLogSource, PermissionLevel, StripeAccount as StripeAccountStruct } from '@stamhoofd/structures';

package/src/endpoints/organization/dashboard/users/CreateApiUserEndpoint.ts

@@ -1,5 +1,5 @@
 import type { Decoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Token, User } from '@stamhoofd/models';

package/src/endpoints/organization/dashboard/users/DeleteUserEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { User } from '@stamhoofd/models';

package/src/endpoints/organization/dashboard/users/GetApiUsersEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Token, User } from '@stamhoofd/models';

package/src/endpoints/organization/dashboard/users/GetOrganizationAdminsEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { User } from '@stamhoofd/models';
 import { OrganizationAdmins } from '@stamhoofd/structures';

package/src/endpoints/organization/dashboard/users/PatchApiUserEndpoint.ts

@@ -1,6 +1,6 @@
-import type { AutoEncoderPatchType, Decoder} from '@simonbackx/simple-encoding';
+import type { AutoEncoderPatchType, Decoder } from '@simonbackx/simple-encoding';
 import { isPatch } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Token, User } from '@stamhoofd/models';
@@ -67,12 +67,10 @@ export class PatchApiUserEndpoint extends Endpoint<Params, Query, Body, Response
                             message: 'Je kan jezelf niet verwijderen als hoofdbeheerder',
                         });
                     }
-                }
-                else {
+                } else {
                     if (editUser.permissions) {
                         editUser.permissions.patchOrPut(request.body.permissions);
-                    }
-                    else {
+                    } else {
                         editUser.permissions = request.body.permissions.isPut() ? request.body.permissions : null;
                     }
 

package/src/endpoints/organization/dashboard/webshops/CreateWebshopEndpoint.ts

@@ -1,10 +1,10 @@
 import type { Decoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError, SimpleErrors } from '@simonbackx/simple-errors';
 import { Webshop } from '@stamhoofd/models';
 import { PermissionLevel, PermissionsResourceType, PrivateWebshop, ResourcePermissions, Version, WebshopPrivateMetaData } from '@stamhoofd/structures';
-import { Formatter } from '@stamhoofd/utility';
+import { Formatter, isReservedWebshopPathSegment } from '@stamhoofd/utility';
 import { v4 as uuidv4 } from 'uuid';
 
 import { Context } from '../../../../helpers/Context.js';
@@ -47,7 +47,7 @@ export class CreateWebshopEndpoint extends Endpoint<Params, Query, Body, Respons
 
         const webshop = new Webshop();
 
-        webshop.id = uuidv4()
+        webshop.id = uuidv4();
         webshop.meta = request.body.meta;
         webshop.meta.domainActive = false;
         webshop.privateMeta = request.body.privateMeta;
@@ -91,8 +91,7 @@ export class CreateWebshopEndpoint extends Endpoint<Params, Query, Body, Respons
                 await this.checkDomainUri(webshop);
                 updateDNS = true;
             }
-        }
-        else {
+        } else {
             if (request.body.domain) {
                 webshop.domain = request.body.domain;
 
@@ -120,17 +119,15 @@ export class CreateWebshopEndpoint extends Endpoint<Params, Query, Body, Respons
         }
 
         let tried = 0;
-        while (webshop.uri.length > 100 || await Webshop.getByURI(webshop.uri) !== undefined) {
+        while (webshop.uri.length > 100 || isReservedWebshopPathSegment(webshop.uri) || await Webshop.getByURI(webshop.uri) !== undefined) {
             console.log('Webshop already exists', webshop.uri);
 
             let suffix = '';
             if (tried < possibleSuffixes.length) {
                 suffix = '-' + possibleSuffixes[tried];
-            }
-            else if (tried > 9) {
+            } else if (tried > 9) {
                 suffix = '-' + Math.floor(Math.random() * 100000);
-            }
-            else {
+            } else {
                 suffix = '-' + (tried - possibleSuffixes.length + 2);
             }
 
@@ -192,16 +189,14 @@ export class CreateWebshopEndpoint extends Endpoint<Params, Query, Body, Respons
         const original = webshop.domainUri ? webshop.domainUri + '-' : '';
         const possibleSuffixes = [new Date().getFullYear().toString()];
         let tried = 0;
-        while (await Webshop.getByDomain(webshop.domain, webshop.domainUri) !== undefined) {
+        while ((webshop.domainUri && isReservedWebshopPathSegment(webshop.domainUri)) || await Webshop.getByDomain(webshop.domain, webshop.domainUri) !== undefined) {
             console.log('Webshop already exists', webshop.domainUri);
 
             if (tried < possibleSuffixes.length) {
                 webshop.domainUri = original + possibleSuffixes[tried];
-            }
-            else if (tried > 9) {
+            } else if (tried > 9) {
                 webshop.domainUri = original + Math.floor(Math.random() * 100000);
-            }
-            else {
+            } else {
                 webshop.domainUri = original + (tried - possibleSuffixes.length + 2);
             }
 

package/src/endpoints/organization/dashboard/webshops/DeleteWebshopEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { BalanceItem, Order, Webshop } from '@stamhoofd/models';
 import { PermissionLevel } from '@stamhoofd/structures';

package/src/endpoints/organization/dashboard/webshops/GetDiscountCodesEndpoint.ts

@@ -1,8 +1,8 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Webshop, WebshopDiscountCode } from '@stamhoofd/models';
-import type { DiscountCode} from '@stamhoofd/structures';
+import type { DiscountCode } from '@stamhoofd/structures';
 import { PermissionLevel } from '@stamhoofd/structures';
 
 import { Context } from '../../../../helpers/Context.js';

package/src/endpoints/organization/dashboard/webshops/GetWebshopOrdersCountEndpoint.ts

@@ -1,5 +1,5 @@
 import type { Decoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { CountFilteredRequest, CountResponse } from '@stamhoofd/structures';
 

package/src/endpoints/organization/dashboard/webshops/GetWebshopOrdersEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import type { CountFilteredRequest, PrivateOrder, StamhoofdFilter } from '@stamhoofd/structures';
 import { assertSort, getOrderSearchFilter, getSortFilter, LimitedFilteredRequest, PaginatedResponse } from '@stamhoofd/structures';

package/src/endpoints/organization/dashboard/webshops/GetWebshopTicketsEndpoint.ts

@@ -1,5 +1,5 @@
 import type { Decoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { Ticket } from '@stamhoofd/models';
 import type { CountFilteredRequest, TicketPrivate } from '@stamhoofd/structures';

package/src/endpoints/organization/dashboard/webshops/GetWebshopUriAvailabilityEndpoint.ts

@@ -1,9 +1,10 @@
-import type { Decoder} from '@simonbackx/simple-encoding';
+import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, field, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { Webshop } from '@stamhoofd/models';
 import { PermissionLevel, WebshopUriAvailabilityResponse } from '@stamhoofd/structures';
+import { isReservedWebshopPathSegment } from '@stamhoofd/utility';
 
 import { Context } from '../../../../helpers/Context.js';
 
@@ -49,6 +50,14 @@ export class GetWebshopUriAvailabilityEndpoint extends Endpoint<Params, Query, B
             throw Context.auth.notFoundOrNoAccess();
         }
 
+        if (isReservedWebshopPathSegment(request.query.uri)) {
+            return new Response(
+                WebshopUriAvailabilityResponse.create({
+                    available: false,
+                }),
+            );
+        }
+
         const q = await Webshop.where({
             uri: request.query.uri,
             id: {

package/src/endpoints/organization/dashboard/webshops/PatchDiscountCodesEndpoint.ts

@@ -1,6 +1,6 @@
-import type { AutoEncoderPatchType, Decoder, PatchableArrayAutoEncoder} from '@simonbackx/simple-encoding';
+import type { AutoEncoderPatchType, Decoder, PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { PatchableArrayDecoder, patchObject, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Webshop, WebshopDiscountCode } from '@stamhoofd/models';
@@ -61,8 +61,7 @@ export class PatchWebshopDiscountCodesEndpoint extends Endpoint<Params, Query, B
 
                 try {
                     await model.save();
-                }
-                catch (e) {
+                } catch (e) {
                     // Duplicate key probably
                     if (e.code && e.code == 'ER_DUP_ENTRY') {
                         throw new SimpleError({
@@ -93,8 +92,7 @@ export class PatchWebshopDiscountCodesEndpoint extends Endpoint<Params, Query, B
 
                 try {
                     await model.save();
-                }
-                catch (e) {
+                } catch (e) {
                     // Duplicate key probably
                     if (e.code && e.code == 'ER_DUP_ENTRY') {
                         throw new SimpleError({

package/src/endpoints/organization/dashboard/webshops/PatchWebshopEndpoint.ts

@@ -5,7 +5,7 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import { Webshop } from '@stamhoofd/models';
 import { QueueHandler } from '@stamhoofd/queues';
 import { PermissionLevel, PrivateWebshop, WebshopPrivateMetaData } from '@stamhoofd/structures';
-import { Formatter } from '@stamhoofd/utility';
+import { Formatter, isReservedWebshopPathSegment } from '@stamhoofd/utility';
 
 import { Context } from '../../../../helpers/Context.js';
 import { RecordAnswerHelper } from '../../../../helpers/RecordAnswerHelper.js';
@@ -122,8 +122,7 @@ export class PatchWebshopEndpoint extends Endpoint<Params, Query, Body, Response
                             });
                         }
                     }
-                }
-                else {
+                } else {
                     webshop.domain = null;
                     webshop.privateMeta.dnsRecords = [];
                     webshop.meta.domainActive = false;
@@ -143,6 +142,15 @@ export class PatchWebshopEndpoint extends Endpoint<Params, Query, Body, Response
                         });
                     }
 
+                    if (webshop.domainUri && isReservedWebshopPathSegment(webshop.domainUri)) {
+                        throw new SimpleError({
+                            code: 'invalid_field',
+                            message: 'domainUri is reserved for internal webshop routes',
+                            human: $t("%1a4"),
+                            field: 'customUrl',
+                        });
+                    }
+
                     // Check exists
                     const existing = await Webshop.getByDomain(webshop.domain, webshop.domainUri);
                     if (existing !== undefined) {
@@ -152,8 +160,7 @@ export class PatchWebshopEndpoint extends Endpoint<Params, Query, Body, Response
                             human: $t(`%FP`) + ' ' + existing.meta.name + $t(`%FQ`),
                         });
                     }
-                }
-                else {
+                } else {
                     webshop.domainUri = null;
                 }
             }
@@ -183,6 +190,15 @@ export class PatchWebshopEndpoint extends Endpoint<Params, Query, Body, Response
                     });
                 }
 
+                if (isReservedWebshopPathSegment(request.body.uri)) {
+                    throw new SimpleError({
+                        code: 'invalid_field',
+                        message: 'Uri is reserved for internal webshop routes',
+                        human: $t("%1a4"),
+                        field: 'uri',
+                    });
+                }
+
                 webshop.uri = request.body.uri;
             }
 
@@ -197,8 +213,7 @@ export class PatchWebshopEndpoint extends Endpoint<Params, Query, Body, Response
 
             try {
                 await webshop.save();
-            }
-            catch (e) {
+            } catch (e) {
                 // Duplicate key probably
                 if (e.code && e.code == 'ER_DUP_ENTRY') {
                     throw new SimpleError({