@stamhoofd/backend 2.121.0 → 2.122.0

package/src/endpoints/organization/dashboard/webshops/PatchWebshopOrdersEndpoint.ts

@@ -1,6 +1,6 @@
-import type { AutoEncoderPatchType, Data, Decoder, PatchableArrayAutoEncoder} from '@simonbackx/simple-encoding';
+import type { AutoEncoderPatchType, Data, Decoder, PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { ArrayDecoder, PatchableArray, PatchableArrayDecoder, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { BalanceItem, BalanceItemPayment, Order, Payment, Webshop, WebshopCounter } from '@stamhoofd/models';
@@ -65,7 +65,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOrganizationScope();
-        await Context.authenticate();
+        const { user } = await Context.authenticate();
 
         // Fast throw first (more in depth checking for patches later)
         if (!await Context.auth.hasSomeAccess(organization.id)) {
@@ -79,8 +79,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
             for (const p of request.body) {
                 body.addPatch(p);
             }
-        }
-        else {
+        } else {
             body = request.body;
         }
 
@@ -99,12 +98,12 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
 
             const orders = body.getPatches().length > 0
                 ? await Order.where({
-                    webshopId: webshop.id,
-                    id: {
-                        sign: 'IN',
-                        value: body.getPatches().map(o => o.id),
-                    },
-                })
+                        webshopId: webshop.id,
+                        id: {
+                            sign: 'IN',
+                            value: body.getPatches().map(o => o.id),
+                        },
+                    })
                 : [];
 
             // We use a getter because we need to have an up to date webshop struct
@@ -150,8 +149,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                         // Mark this order as paid
                         await order.markPaid(null, organization, webshop);
                         await order.save();
-                    }
-                    else {
+                    } else {
                         const payment = new Payment();
                         payment.organizationId = organization.id;
                         payment.method = struct.data.paymentMethod;
@@ -159,16 +157,17 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                         payment.price = totalPrice;
                         PaymentService.roundPayment(payment);
                         payment.paidAt = null;
+                        payment.adminUserId = user.id;
 
                         // Determine the payment provider (always null because no online payments here)
                         payment.provider = null;
-                        ServiceFeeHelper.setServiceFee(
+                        await ServiceFeeHelper.setServiceFee(
                             payment,
                             organization,
                             webshop.meta.ticketType === WebshopTicketType.None ? 'webshop' : 'tickets',
                             order.data.cart.items.flatMap(i => i.calculatedPrices.map(p => p.discountedPrice)),
                         );
-
+                        await ServiceFeeHelper.setTransferFee({ payment, organization, stripeAccount: null });
                         await payment.save();
 
                         order.paymentId = payment.id;
@@ -209,22 +208,19 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                             await order.markValid(payment, []);
                             await payment.save();
                             await order.save();
-                        }
-                        else if (payment.method === PaymentMethod.PointOfSale) {
+                        } else if (payment.method === PaymentMethod.PointOfSale) {
                             // Not really paid, but needed to create the tickets if needed
                             await order.markPaid(payment, organization, webshop);
                             await payment.save();
                             await order.save();
-                        }
-                        else {
+                        } else {
                             throw new Error('Unsupported payment method');
                         }
 
                         balanceItem.description = order.generateBalanceDescription(webshop);
                         await balanceItem.save();
                     }
-                }
-                catch (e) {
+                } catch (e) {
                     await order.deleteOrderBecauseOfCreationError();
                     throw e;
                 }
@@ -278,8 +274,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                     model.markUpdated();
                     // Cancel payment if still pending
                     await BalanceItem.deleteForDeletedOrders([model.id]);
-                }
-                else {
+                } else {
                     if (previousStatus === OrderStatus.Canceled || previousStatus === OrderStatus.Deleted) {
                         model.markUpdated();
                         // Undo deletion
@@ -300,8 +295,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
 
                         if (model.isDue) {
                             paidItem.status = BalanceItemStatus.Due;
-                        }
-                        else {
+                        } else {
                             paidItem.status = BalanceItemStatus.Canceled;
                         }
                         paidItem.description = model.generateBalanceDescription(webshop);
@@ -310,8 +304,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                         // Zero out the other items
                         const otherItems = items.filter(i => i.id !== paidItem.id);
                         await BalanceItem.deleteItems(otherItems);
-                    }
-                    else if (items.length === 0
+                    } else if (items.length === 0
                         && model.totalToPay > 0) {
                         model.markUpdated();
                         const balanceItem = new BalanceItem();

package/src/endpoints/organization/dashboard/webshops/PatchWebshopTicketsEndpoint.ts

@@ -1,6 +1,6 @@
 import type { AutoEncoderPatchType, Decoder } from '@simonbackx/simple-encoding';
 import { ArrayDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError, SimpleErrors } from '@simonbackx/simple-errors';
 import { Ticket, Token, Webshop } from '@stamhoofd/models';

package/src/endpoints/organization/dashboard/webshops/SearchUitpasEventsEndpoint.ts

@@ -1,7 +1,7 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { UitpasService } from '../../../../services/uitpas/UitpasService.js';
-import type { Decoder} from '@simonbackx/simple-encoding';
+import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, field, StringDecoder } from '@simonbackx/simple-encoding';
 import { Context } from '../../../../helpers/Context.js';
 import type { UitpasEventsResponse } from '@stamhoofd/structures';

package/src/endpoints/organization/dashboard/webshops/VerifyWebshopDomainEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Token, Webshop } from '@stamhoofd/models';
@@ -48,8 +48,7 @@ export class VerifyWebshopDomainEndpoint extends Endpoint<Params, Query, Body, R
             if (webshop.domain !== null) {
                 webshop.privateMeta.dnsRecords = WebshopPrivateMetaData.buildDNSRecords(webshop.domain);
                 await webshop.updateDNSRecords();
-            }
-            else {
+            } else {
                 webshop.privateMeta.dnsRecords = [];
                 webshop.meta.domainActive = false;
             }

package/src/endpoints/organization/dashboard/webshops/WebshopReservedPathSegments.test.ts

@@ -0,0 +1,95 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { OrganizationFactory, Token, UserFactory, Webshop, WebshopFactory } from '@stamhoofd/models';
+import { Permissions, PermissionLevel, PrivateWebshop, WebshopMetaData } from '@stamhoofd/structures';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
+
+import { testServer } from '../../../../../tests/helpers/TestServer.js';
+import { CreateWebshopEndpoint } from './CreateWebshopEndpoint.js';
+import { GetWebshopUriAvailabilityEndpoint } from './GetWebshopUriAvailabilityEndpoint.js';
+import { PatchWebshopEndpoint } from './PatchWebshopEndpoint.js';
+
+describe('Endpoint.WebshopReservedPathSegments', () => {
+    const checkUriEndpoint = new GetWebshopUriAvailabilityEndpoint();
+    const patchEndpoint = new PatchWebshopEndpoint();
+    const createEndpoint = new CreateWebshopEndpoint();
+
+    beforeEach(async () => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
+    async function createAdminContext() {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            organization,
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+        }).create();
+        const token = await Token.createToken(user);
+
+        return { organization, token };
+    }
+
+    test('reserved webshop paths are not available as default URI', async () => {
+        const { organization, token } = await createAdminContext();
+        const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
+
+        const request = Request.get({
+            path: '/webshop/' + webshop.id + '/check-uri',
+            host: organization.getApiHost(),
+            query: {
+                uri: 'tickets',
+            },
+            headers: { authorization: 'Bearer ' + token.accessToken },
+        });
+
+        const response = await testServer.test(checkUriEndpoint, request);
+
+        expect(response.body.available).toBe(false);
+    });
+
+    test('reserved webshop paths cannot be saved as default URI', async () => {
+        const { organization, token } = await createAdminContext();
+        const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
+        const patch = PrivateWebshop.patch({ uri: 'tickets' });
+        const request = Request.buildJson('PATCH', '/webshop/' + webshop.id, organization.getApiHost(), patch);
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+
+        await expect(testServer.test(patchEndpoint, request)).rejects.toThrow(
+            STExpect.simpleError({ code: 'invalid_field', field: 'uri' }),
+        );
+    });
+
+    test('reserved webshop paths cannot be saved as custom domain URI', async () => {
+        const { organization, token } = await createAdminContext();
+        const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
+        webshop.domain = 'shop.example.com';
+        webshop.domainUri = 'valid';
+        await webshop.save();
+
+        const patch = PrivateWebshop.patch({ domainUri: 'tickets' });
+        const request = Request.buildJson('PATCH', '/webshop/' + webshop.id, organization.getApiHost(), patch);
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+
+        await expect(testServer.test(patchEndpoint, request)).rejects.toThrow(
+            STExpect.simpleError({ code: 'invalid_field', field: 'customUrl' }),
+        );
+    });
+
+    test('generated webshop URIs skip reserved webshop paths', async () => {
+        const { organization, token } = await createAdminContext();
+        const body = PrivateWebshop.create({
+            meta: WebshopMetaData.create({
+                name: 'Tickets',
+            }),
+        });
+        const request = Request.buildJson('POST', '/webshop', organization.getApiHost(), body);
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(createEndpoint, request);
+        const webshop = await Webshop.getByID(response.body.id);
+
+        expect(response.body.uri).not.toBe('tickets');
+        expect(webshop?.uri).not.toBe('tickets');
+    });
+});

package/src/endpoints/organization/shared/ExchangePaymentEndpoint.ts

@@ -1,6 +1,6 @@
-import type { Decoder} from '@simonbackx/simple-encoding';
+import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, BooleanDecoder, field } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Order } from '@stamhoofd/models';

package/src/endpoints/organization/shared/GetDocumentHtml.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { signInternal } from '@stamhoofd/backend-env';

package/src/endpoints/organization/shared/GetPaymentEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Payment } from '@stamhoofd/models';

package/src/endpoints/organization/shared/GetUitpasNumberDetailsEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { UitpasNumberDetails, UitpasNumbersGetDetailsRequest } from '@stamhoofd/structures';
 
@@ -53,14 +53,12 @@ export class GetUitpasNumberDetailsEndpoint extends Endpoint<Params, Query, Body
                     uitpasNumber,
                     socialTariff,
                 }));
-            }
-            catch (error) {
+            } catch (error) {
                 if (isSimpleError(error) || isSimpleErrors(error)) {
                     error.addNamespace(i.toString());
                     error.addNamespace('uitpasNumbers');
                     simpleErrors.addError(error);
-                }
-                else {
+                } else {
                     throw error;
                 }
             }

package/src/endpoints/organization/shared/auth/GetOrganizationEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import type { Organization as OrganizationStruct } from '@stamhoofd/structures';
 

package/src/endpoints/organization/webshops/CheckWebshopDiscountCodesEndpoint.ts

@@ -1,11 +1,12 @@
 import { ArrayDecoder, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Webshop, WebshopDiscountCode } from '@stamhoofd/models';
 import type { DiscountCode } from '@stamhoofd/structures';
 
 import { Context } from '../../../helpers/Context.js';
+import { WebshopAuthHelper } from './WebshopAuthHelper.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -39,6 +40,8 @@ export class CheckWebshopDiscountCodesEndpoint extends Endpoint<Params, Query, B
             });
         }
 
+        await WebshopAuthHelper.optionalAuthenticateForWebshop(webshop);
+
         if (request.body.length > 10) {
             // Auto limit
             request.body = request.body.slice(0, 10);

package/src/endpoints/organization/webshops/GetOrderByPaymentEndpoint.ts

@@ -1,12 +1,12 @@
-import { PartialWithoutMethods } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { Order } from '@stamhoofd/models';
+import { Order, Webshop } from '@stamhoofd/models';
 import { Payment } from '@stamhoofd/models';
 import type { Order as OrderStruct } from '@stamhoofd/structures';
 
 import { Context } from '../../../helpers/Context.js';
+import { WebshopAuthHelper } from './WebshopAuthHelper.js';
 type Params = { id: string; paymentId: string };
 type Query = undefined;
 type Body = undefined;
@@ -46,6 +46,17 @@ export class GetOrderByPaymentEndpoint extends Endpoint<Params, Query, Body, Res
             });
         }
 
+        const webshop = await Webshop.getByID(request.params.id);
+        if (!webshop || webshop.organizationId !== organization.id) {
+            throw new SimpleError({
+                code: 'not_found',
+                message: 'Webshop not found',
+                human: $t(`%FX`),
+            });
+        }
+
+        await WebshopAuthHelper.checkOrderAccess(webshop, order);
+
         order.setRelation(Order.payment, payment);
         return new Response(await order.getStructure());
     }

package/src/endpoints/organization/webshops/GetOrderEndpoint.ts

@@ -1,10 +1,11 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { Order } from '@stamhoofd/models';
+import { Order, Webshop } from '@stamhoofd/models';
 import type { Order as OrderStruct } from '@stamhoofd/structures';
 
 import { Context } from '../../../helpers/Context.js';
+import { WebshopAuthHelper } from './WebshopAuthHelper.js';
 type Params = { id: string; orderId: string };
 type Query = undefined;
 type Body = undefined;
@@ -36,6 +37,17 @@ export class GetOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBody
             });
         }
 
+        const webshop = await Webshop.getByID(request.params.id);
+        if (!webshop || webshop.organizationId !== organization.id) {
+            throw new SimpleError({
+                code: 'not_found',
+                message: 'Webshop not found',
+                human: $t(`%FX`),
+            });
+        }
+
+        await WebshopAuthHelper.checkOrderAccess(webshop, order);
+
         return new Response(await order.getStructure());
     }
 }

package/src/endpoints/organization/webshops/GetTicketsEndpoint.ts

@@ -1,12 +1,13 @@
-import type { Decoder} from '@simonbackx/simple-encoding';
+import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, field, StringDecoder } from '@simonbackx/simple-encoding';
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { Order, Ticket } from '@stamhoofd/models';
+import { Order, Ticket, Webshop } from '@stamhoofd/models';
 import { TicketOrder, TicketPublic } from '@stamhoofd/structures';
 
 import { Context } from '../../../helpers/Context.js';
+import { WebshopAuthHelper } from './WebshopAuthHelper.js';
 type Params = { id: string };
 
 class Query extends AutoEncoder {
@@ -45,6 +46,14 @@ export class GetTicketsEndpoint extends Endpoint<Params, Query, Body, ResponseBo
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOrganizationScope({ willAuthenticate: false });
+        const webshop = await Webshop.getByID(request.params.id);
+        if (!webshop || webshop.organizationId !== organization.id) {
+            throw new SimpleError({
+                code: 'not_found',
+                message: 'Webshop not found',
+                human: $t(`%FX`),
+            });
+        }
 
         if (request.query.secret) {
             const [ticket] = await Ticket.where({
@@ -61,17 +70,20 @@ export class GetTicketsEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 });
             }
 
+            const order = await Order.getByID(ticket.orderId);
+            if (!order || order.webshopId !== request.params.id || order.organizationId !== organization.id) {
+                console.error('Error: missing order ' + ticket.orderId + ' for ticket ' + ticket.id);
+                throw new SimpleError({
+                    code: 'not_found',
+                    message: 'Ticket not found',
+                    human: $t(`%FZ`),
+                });
+            }
+
+            await WebshopAuthHelper.checkOrderAccess(webshop, order);
+
             if (!request.query.orderId) {
                 // Include item data
-                const order = await Order.getByID(ticket.orderId);
-                if (!order || order.webshopId !== request.params.id) {
-                    console.error('Error: missing order ' + ticket.orderId + ' for ticket ' + ticket.id);
-                    throw new SimpleError({
-                        code: 'not_found',
-                        message: 'Ticket not found',
-                        human: $t(`%FZ`),
-                    });
-                }
 
                 if (ticket.itemId) {
                     const item = order.data.cart.items.find(i => i.id === ticket.itemId);
@@ -91,8 +103,7 @@ export class GetTicketsEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                             items: [item],
                         }),
                     ]);
-                }
-                else {
+                } else {
                     return new Response([
                         TicketPublic.create({
                             ...ticket,
@@ -104,8 +115,7 @@ export class GetTicketsEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             return new Response([
                 TicketOrder.create(ticket),
             ]);
-        }
-        else {
+        } else {
             if (!request.query.orderId) {
                 throw new SimpleError({
                     code: 'not_found',
@@ -119,6 +129,17 @@ export class GetTicketsEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 organizationId: organization.id,
                 deletedAt: null,
             });
+
+            const order = await Order.getByID(request.query.orderId);
+            if (!order || order.webshopId !== request.params.id || order.organizationId !== organization.id) {
+                throw new SimpleError({
+                    code: 'not_found',
+                    message: 'Ticket not found',
+                    human: $t(`%FZ`),
+                });
+            }
+
+            await WebshopAuthHelper.checkOrderAccess(webshop, order);
             return new Response(
                 tickets.map(ticket => TicketOrder.create(ticket)),
             );

package/src/endpoints/organization/webshops/GetWebshopEndpoint.test.ts

@@ -1,8 +1,8 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { OrganizationFactory, Token, UserFactory, WebshopFactory } from '@stamhoofd/models';
-import { PermissionLevel, Permissions } from '@stamhoofd/structures';
+import { PermissionLevel, Permissions, WebshopAuthType, WebshopMetaData } from '@stamhoofd/structures';
 
-import { TestUtils } from '@stamhoofd/test-utils';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { GetWebshopEndpoint } from './GetWebshopEndpoint.js';
 
@@ -43,6 +43,38 @@ describe('Endpoint.GetWebshop', () => {
         expect((response.body as any).privateMeta).toBeUndefined();
     });
 
+    test('Reject anonymous access for required-auth webshop', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const webshop = await new WebshopFactory({
+            organizationId: organization.id,
+            meta: WebshopMetaData.create({
+                authType: WebshopAuthType.Required,
+            }),
+        }).create();
+
+        const r = Request.buildJson('GET', '/webshop/' + webshop.id, organization.getApiHost());
+
+        await expect(testServer.test(endpoint, r)).rejects.toThrow(STExpect.errorWithCode('not_authenticated'));
+    });
+
+    test('Allow signed in user access for required-auth webshop', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({ organization }).create();
+        const token = await Token.createToken(user);
+        const webshop = await new WebshopFactory({
+            organizationId: organization.id,
+            meta: WebshopMetaData.create({
+                authType: WebshopAuthType.Required,
+            }),
+        }).create();
+
+        const r = Request.buildJson('GET', '/webshop/' + webshop.id, organization.getApiHost());
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, r);
+        expect(response.body.id).toEqual(webshop.id);
+    });
+
     test('Get webshop as admin', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({

package/src/endpoints/organization/webshops/GetWebshopEndpoint.ts

@@ -1,4 +1,4 @@
-import type { DecodedRequest, Request} from '@simonbackx/simple-endpoints';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Webshop } from '@stamhoofd/models';
@@ -6,6 +6,7 @@ import type { PrivateWebshop, Webshop as WebshopStruct } from '@stamhoofd/struct
 
 import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures.js';
 import { Context } from '../../../helpers/Context.js';
+import { WebshopAuthHelper } from './WebshopAuthHelper.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -28,7 +29,6 @@ export class GetWebshopEndpoint extends Endpoint<Params, Query, Body, ResponseBo
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
         await Context.setOptionalOrganizationScope(); // editing webshop from the admin panel -> no scope
-        await Context.optionalAuthenticate();
 
         const webshop = await Webshop.getByID(request.params.id);
         if (!webshop) {
@@ -39,6 +39,8 @@ export class GetWebshopEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             });
         }
 
+        await WebshopAuthHelper.optionalAuthenticateForWebshop(webshop);
+
         return new Response(
             await AuthenticatedStructures.webshop(webshop),
         );