@stamhoofd/backend 2.124.2 → 2.125.1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.124.2",
+    "version": "2.125.1",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -57,20 +57,20 @@
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.124.2",
-        "@stamhoofd/backend-i18n": "2.124.2",
-        "@stamhoofd/backend-middleware": "2.124.2",
-        "@stamhoofd/crons": "2.124.2",
-        "@stamhoofd/email": "2.124.2",
-        "@stamhoofd/excel-writer": "2.124.2",
-        "@stamhoofd/logging": "2.124.2",
-        "@stamhoofd/models": "2.124.2",
-        "@stamhoofd/object-differ": "2.124.2",
-        "@stamhoofd/queues": "2.124.2",
-        "@stamhoofd/sql": "2.124.2",
-        "@stamhoofd/structures": "2.124.2",
-        "@stamhoofd/types": "2.124.2",
-        "@stamhoofd/utility": "2.124.2",
+        "@stamhoofd/backend-env": "2.125.1",
+        "@stamhoofd/backend-i18n": "2.125.1",
+        "@stamhoofd/backend-middleware": "2.125.1",
+        "@stamhoofd/crons": "2.125.1",
+        "@stamhoofd/email": "2.125.1",
+        "@stamhoofd/excel-writer": "2.125.1",
+        "@stamhoofd/logging": "2.125.1",
+        "@stamhoofd/models": "2.125.1",
+        "@stamhoofd/object-differ": "2.125.1",
+        "@stamhoofd/queues": "2.125.1",
+        "@stamhoofd/sql": "2.125.1",
+        "@stamhoofd/structures": "2.125.1",
+        "@stamhoofd/types": "2.125.1",
+        "@stamhoofd/utility": "2.125.1",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.124.2",
+        "@stamhoofd/test-utils": "2.125.1",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "e45e42edd908f088a0f56b5174ef2a8fbae7a446"
+    "gitHead": "7a5fada26c2b7e4d0cd47cd5f2ee95adceae8391"
 }

package/src/boot.ts

@@ -165,6 +165,7 @@ export const boot = async (options: { killProcess: boolean }) => {
     await import('./excel-loaders/registrations.js');
     await import('./email-recipient-loaders/documents.js');
     await import ('./email-recipient-loaders/payments.js');
+    await import ('./email-recipient-loaders/organizations.js');
 
     productionLog('Opening port...');
     routerServer.listen(STAMHOOFD.PORT ?? 9090);

package/src/crons/balance-emails.ts

@@ -3,8 +3,9 @@ import { CachedBalance, Email, EmailRecipient, Organization, User } from '@stamh
 import type { IterableSQLSelect } from '@stamhoofd/sql';
 import { readDynamicSQLExpression, SQL } from '@stamhoofd/sql';
 import type { OrganizationEmail, StamhoofdFilter } from '@stamhoofd/structures';
-import { EmailRecipientFilter, EmailRecipientFilterType, EmailRecipientSubfilter, EmailTemplateType, ReceivableBalanceType } from '@stamhoofd/structures';
+import { EmailRecipientFilter, EmailRecipientSubfilter, EmailTemplateType, ReceivableBalanceType } from '@stamhoofd/structures';
 import { ContextInstance } from '../helpers/Context.js';
+import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
 
 registerCron('balanceEmails', balanceEmails);
 

package/src/crons/index.ts

@@ -12,3 +12,4 @@ import './members-fees.js';
 import './stripe-invoices.js';
 import './transfer-fees.js';
 import './drip-emails.js';
+import './update-organization-future-events.js';

package/src/crons/update-organization-future-events.ts

@@ -0,0 +1,42 @@
+/**
+ * Recalculate the hasFutureEvents flag for all organizations.
+ *
+ * The flag can go stale over time: an event's end date passes without anyone
+ * touching the organization, so it keeps reporting future events it no longer
+ * has (or vice versa). Recomputing it nightly keeps it accurate.
+ */
+
+import { registerCron } from '@stamhoofd/crons';
+import { Organization } from '@stamhoofd/models';
+
+let lastRunDate: number | null = null;
+
+registerCron('updateOrganizationFutureEvents', updateOrganizationFutureEvents);
+
+function shouldRun() {
+    const now = new Date();
+
+    if (now.getDate() === lastRunDate) {
+        return false;
+    }
+
+    const hour = now.getHours();
+
+    // between 3 and 5 AM - except in development
+    if ((hour < 3 || hour >= 5) && STAMHOOFD.environment !== 'development') {
+        return false;
+    }
+
+    return true;
+}
+
+async function updateOrganizationFutureEvents() {
+    if (!shouldRun()) {
+        return;
+    }
+
+    lastRunDate = new Date().getDate();
+
+    console.log('Updating hasFutureEvents for all organizations...');
+    await Organization.updateFutureEventsForOrganizations('all');
+}

package/src/email-recipient-loaders/documents.ts

@@ -1,8 +1,9 @@
 import { Email, Member } from '@stamhoofd/models';
 import { SQL } from '@stamhoofd/sql';
 import type { LimitedFilteredRequest } from '@stamhoofd/structures';
-import { EmailRecipient, EmailRecipientFilterType, PaginatedResponse, Replacement } from '@stamhoofd/structures';
+import { EmailRecipient, PaginatedResponse, Replacement } from '@stamhoofd/structures';
 import { GetDocumentsEndpoint } from '../endpoints/organization/dashboard/documents/GetDocumentsEndpoint.js';
+import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
 
 async function fetch(query: LimitedFilteredRequest) {
     const result = await GetDocumentsEndpoint.buildData(query);

package/src/email-recipient-loaders/members.ts

@@ -1,8 +1,9 @@
 import { Email } from '@stamhoofd/models';
 import { SQL } from '@stamhoofd/sql';
 import type { EmailRecipient, LimitedFilteredRequest, MembersBlob } from '@stamhoofd/structures';
-import { EmailRecipientFilterType, PaginatedResponse, mergeFilters } from '@stamhoofd/structures';
+import { PaginatedResponse, mergeFilters } from '@stamhoofd/structures';
 import { GetMembersEndpoint } from '../endpoints/global/members/GetMembersEndpoint.js';
+import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
 
 async function getRecipients(result: PaginatedResponse<MembersBlob, LimitedFilteredRequest>, type: 'member' | 'parents' | 'unverified') {
     const recipients: EmailRecipient[] = [];

package/src/email-recipient-loaders/orders.ts

@@ -1,9 +1,10 @@
 import { Email, Webshop } from '@stamhoofd/models';
 import type { EmailRecipient, LimitedFilteredRequest, WebshopPreview } from '@stamhoofd/structures';
-import { EmailRecipientFilterType, mergeFilters, PaginatedResponse } from '@stamhoofd/structures';
+import { mergeFilters, PaginatedResponse } from '@stamhoofd/structures';
 import { GetWebshopOrdersEndpoint } from '../endpoints/organization/dashboard/webshops/GetWebshopOrdersEndpoint.js';
 import { AuthenticatedStructures } from '../helpers/AuthenticatedStructures.js';
 import { Context } from '../helpers/Context.js';
+import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
 
 Email.recipientLoaders.set(EmailRecipientFilterType.Orders, {
     fetch: async (query: LimitedFilteredRequest) => {

package/src/email-recipient-loaders/organizations.ts

@@ -0,0 +1,78 @@
+import type { Organization, User } from '@stamhoofd/models';
+import { Platform } from '@stamhoofd/models';
+import { Email } from '@stamhoofd/models';
+import type { InMemoryFilterDefinitions, LimitedFilteredRequest, StamhoofdFilter, Platform as PlatformStruct } from '@stamhoofd/structures';
+import { baseInMemoryFilterCompilers, compileToInMemoryFilter, createInMemoryFilterCompiler, EmailRecipient, Replacement } from '@stamhoofd/structures';
+import { PaginatedResponse } from '@stamhoofd/structures';
+import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
+import { GetOrganizationsEndpoint } from '../endpoints/admin/organizations/GetOrganizationsEndpoint.js';
+
+function userToFilterableAdmin(user: User, platform: PlatformStruct, organization: Organization) {
+    return {
+        id: user.id,
+        permissions: user.permissions?.forOrganization(organization, platform),
+    };
+}
+const filterableAdminFilterCompilers: InMemoryFilterDefinitions = {
+    ...baseInMemoryFilterCompilers,
+    permissions: createInMemoryFilterCompiler(['permissions'], {
+        ...baseInMemoryFilterCompilers,
+        level: createInMemoryFilterCompiler('level'),
+        accessRights: createInMemoryFilterCompiler('accessRights'),
+    }),
+};
+
+Email.recipientLoaders.set(EmailRecipientFilterType.Organizations, {
+    fetch: fetchRecipients,
+
+    count: async (query: LimitedFilteredRequest, subfilter: StamhoofdFilter | null) => {
+        const q = await GetOrganizationsEndpoint.buildQuery(query);
+        const base = await q.count();
+
+        if (base < 100) {
+            // Do full scan
+            query.limit = 100;
+            const result = await fetchRecipients(query, subfilter);
+            return result.results.length;
+        }
+
+        return base;
+    },
+});
+
+async function fetchRecipients(query: LimitedFilteredRequest, subfilter: StamhoofdFilter | null) {
+    const result = await GetOrganizationsEndpoint.buildModels(query);
+    const compiledFilter = compileToInMemoryFilter(subfilter, filterableAdminFilterCompilers);
+    const platform = await Platform.getSharedStruct();
+
+    // Map recipients to admins
+    const recipients: EmailRecipient[] = [];
+    for (const organization of result.results) {
+        // todo: filter admins
+        const users = await organization.getAdmins();
+        const filteredUsers = users.filter((user) => {
+            const filterable = userToFilterableAdmin(user, platform, organization);
+            return compiledFilter(filterable);
+        });
+
+        recipients.push(
+            ...organization.adminsToRecipients(filteredUsers).map((r) => {
+                return EmailRecipient.create({
+                    ...r,
+                    replacements: [
+                        ...r.replacements,
+                        Replacement.create({
+                            token: 'organizationName',
+                            value: organization.name,
+                        }),
+                    ],
+                });
+            }),
+        );
+    }
+
+    return new PaginatedResponse({
+        results: recipients,
+        next: result.next,
+    });
+}

package/src/email-recipient-loaders/payments.ts

@@ -1,13 +1,14 @@
 import type { RecipientLoader } from '@stamhoofd/models';
-import { BalanceItem, BalanceItemPayment, Email, Member, MemberResponsibilityRecord, Order, Organization, Payment, User, Webshop } from '@stamhoofd/models';
+import { BalanceItem, BalanceItemPayment, Email, Member, MemberResponsibilityRecord, Organization, Payment, User } from '@stamhoofd/models';
 import { compileToSQLFilter, SQL } from '@stamhoofd/sql';
 import type { LimitedFilteredRequest, PaymentGeneral, StamhoofdFilter } from '@stamhoofd/structures';
-import { CountFilteredRequest, EmailRecipient, EmailRecipientFilterType, PaginatedResponse, PaymentMethod } from '@stamhoofd/structures';
+import { CountFilteredRequest, EmailRecipient, PaginatedResponse, PaymentMethod } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { GetPaymentsEndpoint } from '../endpoints/organization/dashboard/payments/GetPaymentsEndpoint.js';
 import { memberResponsibilityRecordFilterCompilers } from '../sql-filters/member-responsibility-records.js';
 import type { ReplacementsOptions } from '../email-replacements/getEmailReplacementsForPayment.js';
 import { buildReplacementOptions, getEmailReplacementsForPayment } from '../email-replacements/getEmailReplacementsForPayment.js';
+import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
 
 type BeforeFetchAllResult = {
     doesIncludePaymentWithoutOrders: boolean;

package/src/email-recipient-loaders/receivable-balances.ts

@@ -1,8 +1,9 @@
 import { CachedBalance, Email } from '@stamhoofd/models';
 import type { LimitedFilteredRequest, StamhoofdFilter } from '@stamhoofd/structures';
-import { BalanceItem as BalanceItemStruct, compileToInMemoryFilter, EmailRecipient, EmailRecipientFilterType, PaginatedResponse, receivableBalanceObjectContactInMemoryFilterCompilers, ReceivableBalanceType, Replacement } from '@stamhoofd/structures';
+import { BalanceItem as BalanceItemStruct, compileToInMemoryFilter, EmailRecipient, PaginatedResponse, receivableBalanceObjectContactInMemoryFilterCompilers, ReceivableBalanceType, Replacement } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { GetReceivableBalancesEndpoint } from '../endpoints/organization/dashboard/receivable-balances/GetReceivableBalancesEndpoint.js';
+import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
 
 async function fetch(query: LimitedFilteredRequest, subfilter: StamhoofdFilter | null) {
     const result = await GetReceivableBalancesEndpoint.buildData(query);

package/src/email-recipient-loaders/registrations.ts

@@ -1,9 +1,10 @@
 import { Email, Member } from '@stamhoofd/models';
 import { SQL } from '@stamhoofd/sql';
 import type { EmailRecipient, LimitedFilteredRequest, RegistrationsBlob } from '@stamhoofd/structures';
-import { EmailRecipientFilterType, PaginatedResponse, mergeFilters } from '@stamhoofd/structures';
+import { PaginatedResponse, mergeFilters } from '@stamhoofd/structures';
 import { GetRegistrationsEndpoint } from '../endpoints/global/registration/GetRegistrationsEndpoint.js';
 import { memberJoin } from '../sql-filters/registrations.js';
+import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
 
 async function getRecipients(result: PaginatedResponse<RegistrationsBlob, LimitedFilteredRequest>, type: 'member' | 'parents' | 'unverified') {
     const recipients: EmailRecipient[] = [];

package/src/endpoints/admin/organizations/GetOrganizationsEndpoint.ts

@@ -5,6 +5,7 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import { Organization } from '@stamhoofd/models';
 import { SQL, applySQLSorter, compileToSQLFilter } from '@stamhoofd/sql';
 import type { CountFilteredRequest, Organization as OrganizationStruct, StamhoofdFilter } from '@stamhoofd/structures';
+import { UnencodeablePaginatedResponse } from '@stamhoofd/structures';
 import { LimitedFilteredRequest, PaginatedResponse, PermissionLevel, assertSort, getSortFilter } from '@stamhoofd/structures';
 
 import type { SQLResultNamespacedRow } from '@simonbackx/simple-database';
@@ -130,7 +131,7 @@ export class GetOrganizationsEndpoint extends Endpoint<Params, Query, Body, Resp
         return query;
     }
 
-    static async buildData(requestQuery: LimitedFilteredRequest): Promise<PaginatedResponse<OrganizationStruct[], LimitedFilteredRequest>> {
+    static async buildModels(requestQuery: LimitedFilteredRequest): Promise<UnencodeablePaginatedResponse<Organization[], LimitedFilteredRequest>> {
         const maxLimit = Context.auth.hasSomePlatformAccess() ? 1000 : 100;
 
         if (requestQuery.limit > maxLimit) {
@@ -187,8 +188,17 @@ export class GetOrganizationsEndpoint extends Endpoint<Params, Query, Body, Resp
             }
         }
 
+        return new UnencodeablePaginatedResponse<Organization[], LimitedFilteredRequest>({
+            results: organizations,
+            next,
+        });
+    }
+
+    static async buildData(requestQuery: LimitedFilteredRequest): Promise<PaginatedResponse<OrganizationStruct[], LimitedFilteredRequest>> {
+        const { results, next } = await this.buildModels(requestQuery);
+
         return new PaginatedResponse<OrganizationStruct[], LimitedFilteredRequest>({
-            results: await AuthenticatedStructures.organizations(organizations),
+            results: await AuthenticatedStructures.organizations(results),
             next,
         });
     }

package/src/endpoints/global/email/ManageEmailAddressEndpoint.ts

@@ -44,10 +44,15 @@ class Body extends AutoEncoder {
 export const unblockLimiter = new RateLimiter({
     limits: [
         {
-            // Max 10 per week
-            limit: 10,
+            // Max 25 per week
+            limit: 25,
             duration: 24 * 60 * 1000 * 60 * 7,
         },
+        {
+            // Max 50 per month
+            limit: 50,
+            duration: 24 * 60 * 1000 * 60 * 30,
+        },
     ],
 });
 
@@ -129,12 +134,16 @@ export class ManageEmailAddressEndpoint extends Endpoint<Params, Query, Body, Re
             for (const email of emails) {
                 const wasBlocked = email.unsubscribedAll || email.unsubscribedMarketing || email.hardBounce || email.markedAsSpam;
 
-                if (email.organizationId === null || (organization && email.organizationId === organization.id)) {
+                if (email.organizationId === null || (organization && email.organizationId !== organization.id)) {
                     if (Context.auth.hasPlatformFullAccess()) {
                         // Only allowed as platform admins
+                        // This is important, otherwise an individual organization can resubscribe to platform emails
                         email.unsubscribedAll = request.body.unsubscribedAll ?? email.unsubscribedAll;
                         email.unsubscribedMarketing = request.body.unsubscribedMarketing ?? email.unsubscribedMarketing;
                     }
+                } else {
+                    email.unsubscribedAll = request.body.unsubscribedAll ?? email.unsubscribedAll;
+                    // unsubscribed marketing not allowed for now
                 }
 
                 email.hardBounce = request.body.hardBounce ?? email.hardBounce;

package/src/endpoints/global/email/PatchEmailEndpoint.test.ts

@@ -2,10 +2,11 @@ import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
 import { Request } from '@simonbackx/simple-endpoints';
 import type { Organization, RegistrationPeriod, User } from '@stamhoofd/models';
 import { Email, EmailRecipient, GroupFactory, MemberFactory, OrganizationFactory, RegistrationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
-import { AccessRight, EmailRecipientFilter, EmailRecipientFilterType, EmailRecipientSubfilter, EmailStatus, Email as EmailStruct, OrganizationEmail, Parent, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions, UserPermissions, Version } from '@stamhoofd/structures';
+import { AccessRight, EmailRecipientFilter, EmailRecipientSubfilter, EmailStatus, Email as EmailStruct, OrganizationEmail, Parent, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions, UserPermissions, Version } from '@stamhoofd/structures';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { PatchEmailEndpoint } from './PatchEmailEndpoint.js';
+import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
 
 // Import recipient loaders to initialize them
 import { Formatter } from '@stamhoofd/utility';

package/src/endpoints/global/events/PatchEventsEndpoint.test.ts

@@ -1,8 +1,9 @@
+import { Database } from '@simonbackx/simple-database';
 import { PatchableArray } from '@simonbackx/simple-encoding';
 import type { Endpoint } from '@simonbackx/simple-endpoints';
 import { Request } from '@simonbackx/simple-endpoints';
-import type { Organization, User } from '@stamhoofd/models';
-import { EventFactory, OrganizationFactory, OrganizationRegistrationPeriodFactory, PlatformEventTypeFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import type { User } from '@stamhoofd/models';
+import { EventFactory, Organization, OrganizationFactory, OrganizationRegistrationPeriodFactory, PlatformEventTypeFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
 import { AccessRight, Event, Group, GroupSettings, GroupType, OrganizationEventType, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions, TranslatedString } from '@stamhoofd/structures';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
@@ -90,6 +91,67 @@ describe('Endpoint.PatchEventsEndpoint', () => {
         });
     });
 
+    describe('hasFutureEvents recomputation', () => {
+        // A global event (organizationId === null) counts towards every organization,
+        // so make sure leftover events from other tests don't influence these assertions.
+        beforeEach(async () => {
+            await Database.delete('DELETE FROM `events`');
+        });
+
+        test('Creating a future event sets hasFutureEvents to true on the organization', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            organization.hasFutureEvents = false;
+            await organization.save();
+
+            const user = await new UserFactory({
+                organization,
+                permissions: minimumUserPermissions,
+            }).create();
+
+            const body: Body = new PatchableArray();
+            body.addPut(Event.create({
+                organizationId: organization.id,
+                typeId: (await new PlatformEventTypeFactory({}).create()).id,
+                name: 'test event',
+                startDate: new Date(Date.now() + 5 * 24 * 60 * 60 * 1000),
+                endDate: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+            }));
+
+            const result = await TestRequest.patch({ body, user, organization });
+            expect(result.status).toBe(200);
+
+            const updated = await Organization.getByID(organization.id, true);
+            expect(updated.hasFutureEvents).toBe(true);
+        });
+
+        test('Creating an event that already ended does not set hasFutureEvents to true', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            organization.hasFutureEvents = false;
+            await organization.save();
+
+            const user = await new UserFactory({
+                organization,
+                permissions: minimumUserPermissions,
+            }).create();
+
+            const body: Body = new PatchableArray();
+            // Ended well before the future-events cutoff (~2 months ago), so it should not count.
+            body.addPut(Event.create({
+                organizationId: organization.id,
+                typeId: (await new PlatformEventTypeFactory({}).create()).id,
+                name: 'test event',
+                startDate: new Date(Date.now() - 100 * 24 * 60 * 60 * 1000),
+                endDate: new Date(Date.now() - 90 * 24 * 60 * 60 * 1000),
+            }));
+
+            const result = await TestRequest.patch({ body, user, organization });
+            expect(result.status).toBe(200);
+
+            const updated = await Organization.getByID(organization.id, true);
+            expect(updated.hasFutureEvents).toBe(false);
+        });
+    });
+
     test('A normal user with write access cannot create a global event', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({

package/src/endpoints/global/events/PatchEventsEndpoint.ts

@@ -149,6 +149,14 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
                 await event.save();
             }
 
+            // Creating an event can only add a future event, so it can only flip
+            // hasFutureEvents from false to true. Only recompute when it is still false.
+            // Best effort only
+            if (eventOrganization && !eventOrganization.hasFutureEvents) {
+                await eventOrganization.updateFutureEvents();
+                await eventOrganization.save();
+            }
+
             events.push(event);
         }
 
@@ -327,6 +335,12 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
             await event.delete();
         }
 
+        if (request.body.getDeletes().length && organization && organization.hasFutureEvents) {
+            // Best effort only
+            await organization.updateFutureEvents();
+            await organization.save();
+        }
+
         const structures = await AuthenticatedStructures.events(events);
         return new Response(
             structures,

package/src/endpoints/organization/dashboard/receivable-balances/GetReceivableBalanceEndpoint.ts

@@ -2,6 +2,7 @@ import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { DetailedReceivableBalance, PaymentStatus, PermissionLevel, ReceivableBalanceType } from '@stamhoofd/structures';
 
+import type { MemberWithUsersAndRegistrations } from '@stamhoofd/models';
 import { BalanceItem, BalanceItemPayment, CachedBalance, Member, MemberUser, Payment, Registration } from '@stamhoofd/models';
 import { Context } from '../../../../helpers/Context.js';
 import { AuthenticatedStructures } from '../../../../helpers/AuthenticatedStructures.js';
@@ -36,20 +37,18 @@ export class GetReceivableBalanceEndpoint extends Endpoint<Params, Query, Body,
         await Context.authenticate();
 
         if (!await Context.auth.canManageFinances(organization.id)) {
-            // Group-level financial access is sufficient for member and registration balance views
-            if (request.params.type === ReceivableBalanceType.member) {
-                const member = await Member.getByIdWithUsersAndRegistrations(request.params.id);
-                if (!member || !await Context.auth.hasFinancialMemberAccess(member, PermissionLevel.Read, organization.id)) {
-                    throw Context.auth.error();
-                }
-            } else if (request.params.type === ReceivableBalanceType.registration) {
+            let member: MemberWithUsersAndRegistrations | null = null;
+            if (request.params.type === ReceivableBalanceType.registration) {
                 const registration = await Registration.select().where('id', request.params.id).first(false);
                 if (!registration) throw Context.auth.error();
-                const member = await Member.getByIdWithUsersAndRegistrations(registration.memberId);
+                member = await Member.getByIdWithUsersAndRegistrations(registration.memberId);
+            } else if (request.params.type === ReceivableBalanceType.member) {
+                member = await Member.getByIdWithUsersAndRegistrations(request.params.id);
                 if (!member || !await Context.auth.hasFinancialMemberAccess(member, PermissionLevel.Read, organization.id)) {
                     throw Context.auth.error();
                 }
-            } else {
+            }
+            if (!member || !await Context.auth.hasFinancialMemberAccess(member, PermissionLevel.Read, organization.id)) {
                 throw Context.auth.error();
             }
         }

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -565,29 +565,16 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             if (patch.waitingList === null) {
                 // delete
                 if (model.waitingListId) {
-                    // for now don't delete, as waiting lists can be shared between multiple groups
-                    // await PatchOrganizationRegistrationPeriodsEndpoint.deleteGroup(model.waitingListId)
                     model.waitingListId = null;
                 }
             } else if (patch.waitingList.isPatch()) {
-                if (!model.waitingListId) {
-                    throw new SimpleError({
-                        code: 'invalid_field',
-                        field: 'waitingList',
-                        message: 'Cannot patch waiting list before it is created',
-                    });
-                }
-                patch.waitingList.id = model.waitingListId;
-                patch.waitingList.type = GroupType.WaitingList;
-                await throwIfUpdateWaitingListPeriodWithMultipleGroups(patch.waitingList.id);
-                await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(patch.waitingList, period, {
-                    allowPatchWaitingListPeriod: shouldUpdatePeriodIds,
-                    isPatchingEvent,
+                throw new SimpleError({
+                    code: 'invalid_field',
+                    field: 'waitingList',
+                    message: 'Cannot patch waitingList',
                 });
             } else {
                 if (model.waitingListId) {
-                    // for now don't delete, as waiting lists can be shared between multiple groups
-                    // await PatchOrganizationRegistrationPeriodsEndpoint.deleteGroup(model.waitingListId)
                     model.waitingListId = null;
                 }
                 patch.waitingList.type = GroupType.WaitingList;
@@ -613,29 +600,13 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
 
                     model.waitingListId = existing.id;
                 } else {
-                    const requiredPeriod = period ?? await RegistrationPeriod.getByID(model.periodId);
-
-                    if (!requiredPeriod) {
-                        throw new Error('Unexpected missing period when creating waiting list');
-                    }
-
-                    if (STAMHOOFD.userMode === 'organization' && requiredPeriod.organizationId !== model.organizationId) {
-                        throw new SimpleError({
-                            code: 'invalid_period',
-                            message: 'Period has different organization id',
-                            statusCode: 400,
-                        });
-                    }
-
-                    const group = await PatchOrganizationRegistrationPeriodsEndpoint.createGroup(
-                        patch.waitingList,
-                        model.organizationId,
-                        requiredPeriod,
-                        {
-                            allowedIds: [patch.waitingList.id],
-                        },
-                    );
-                    model.waitingListId = group.id;
+                    throw new SimpleError({
+                        code: 'invalid_waiting_list',
+                        field: 'waitingList',
+                        message: 'Waiting list not found',
+                        human: $t('%ZZb'),
+                        statusCode: 404,
+                    });
                 }
             }
         } else if (shouldUpdatePeriodIds && model.waitingListId && period) {
@@ -761,16 +732,24 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                     });
                 }
 
+                if (existing.periodId !== model.periodId) {
+                    throw new SimpleError({
+                        code: 'invalid_field',
+                        field: 'waitingList',
+                        message: 'Waiting list group is already used in another period',
+                        human: $t(`%F9`),
+                    });
+                }
+
                 model.waitingListId = existing.id;
             } else {
-                struct.waitingList.type = GroupType.WaitingList;
-                const group = await PatchOrganizationRegistrationPeriodsEndpoint.createGroup(
-                    struct.waitingList,
-                    model.organizationId,
-                    period,
-                    { allowedIds: [struct.waitingList.id] },
-                );
-                model.waitingListId = group.id;
+                throw new SimpleError({
+                    code: 'invalid_waiting_list',
+                    field: 'waitingList',
+                    message: 'Waiting list not found',
+                    human: $t('%ZZb'),
+                    statusCode: 404,
+                });
             }
         }
 

package/src/endpoints/organization/dashboard/webshops/PatchWebshopOrdersEndpoint.ts

@@ -158,6 +158,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                         PaymentService.roundPayment(payment);
                         payment.paidAt = null;
                         payment.adminUserId = user.id;
+                        payment.customer = order.data.customer.toPaymentCustomer();
 
                         // Determine the payment provider (always null because no online payments here)
                         payment.provider = null;

package/src/endpoints/organization/webshops/PlaceOrderEndpoint.test.ts

@@ -1,12 +1,15 @@
+import type { PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
+import { PatchableArray } from '@simonbackx/simple-encoding';
 import type { Response } from '@simonbackx/simple-endpoints';
 import { Request } from '@simonbackx/simple-endpoints';
 import type { Organization, StripeAccount, User } from '@stamhoofd/models';
-import { OrganizationFactory, Token, UserFactory, Webshop, WebshopFactory } from '@stamhoofd/models';
+import { Order, OrganizationFactory, Payment, Token, UserFactory, Webshop, WebshopFactory } from '@stamhoofd/models';
 import type { OrderResponse } from '@stamhoofd/structures';
-import { Address, Cart, CartItem, CartItemOption, Customer, Option, OptionMenu, OrderData, PaymentConfiguration, PaymentMethod, PermissionLevel, Permissions, PrivatePaymentConfiguration, Product, ProductPrice, ProductType, SeatingPlan, SeatingPlanRow, SeatingPlanSeat, SeatingPlanSection, TransferSettings, WebshopAuthType, WebshopDeliveryMethod, WebshopMetaData, WebshopOnSiteMethod, WebshopPrivateMetaData, WebshopTakeoutMethod, WebshopTimeSlot } from '@stamhoofd/structures';
+import { Address, Cart, CartItem, CartItemOption, Customer, Option, OptionMenu, OrderData, PaymentConfiguration, PaymentMethod, PermissionLevel, Permissions, PrivateOrder, PrivatePaymentConfiguration, Product, ProductPrice, ProductType, SeatingPlan, SeatingPlanRow, SeatingPlanSeat, SeatingPlanSection, TransferSettings, WebshopAuthType, WebshopDeliveryMethod, WebshopMetaData, WebshopOnSiteMethod, WebshopPrivateMetaData, WebshopTakeoutMethod, WebshopTimeSlot } from '@stamhoofd/structures';
 import { STExpect } from '@stamhoofd/test-utils';
 import { Country } from '@stamhoofd/types/Country';
 import sinon from 'sinon';
+import { v4 as uuidv4 } from 'uuid';
 
 import { StripeMocker } from '../../../../tests/helpers/StripeMocker.js';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
@@ -518,4 +521,56 @@ describe('Endpoint.PlaceOrderEndpoint', () => {
             }
         });
     });
+
+    describe('Manually created orders', () => {
+        async function createManualOrder(paymentMethod: PaymentMethod): Promise<PrivateOrder> {
+            const orderData = OrderData.create({
+                paymentMethod,
+                checkoutMethod: takeoutMethod,
+                timeSlot: slot1,
+                cart: Cart.create({
+                    items: [
+                        CartItem.create({
+                            product,
+                            productPrice: productPrice1,
+                            amount: 2,
+                        }),
+                    ],
+                }),
+                customer,
+            });
+
+            const patchArray: PatchableArrayAutoEncoder<PrivateOrder> = new PatchableArray();
+            patchArray.addPut(PrivateOrder.create({
+                id: uuidv4(),
+                data: orderData,
+                webshopId: webshop.id,
+            }));
+
+            const r = Request.buildJson('PATCH', `/webshop/${webshop.id}/orders`, organization.getApiHost(), patchArray);
+            r.headers.authorization = 'Bearer ' + token.accessToken;
+
+            const response = await testServer.test(patchWebshopOrdersEndpoint, r);
+            expect(response.body).toHaveLength(1);
+            return response.body[0];
+        }
+
+        test.each([PaymentMethod.Transfer, PaymentMethod.PointOfSale])('Stores the payment customer for a manually added %s order', async (paymentMethod) => {
+            const order = await createManualOrder(paymentMethod);
+
+            // The persisted payment should contain the billing details of the customer
+            const orderModel = (await Order.getByID(order.id))!;
+            expect(orderModel.paymentId).not.toBeNull();
+
+            const payment = (await Payment.getByID(orderModel.paymentId!))!;
+            expect(payment.customer).not.toBeNull();
+            expect(payment.customer!.firstName).toEqual(customer.firstName);
+            expect(payment.customer!.lastName).toEqual(customer.lastName);
+            expect(payment.customer!.email).toEqual(customer.email);
+            expect(payment.customer!.phone).toEqual(customer.phone);
+
+            // The payment customer should match the order's customer billing details
+            expect(payment.customer!.equals(orderModel.data.customer.toPaymentCustomer())).toBe(true);
+        });
+    });
 });

package/src/helpers/AdminPermissionChecker.ts

@@ -702,12 +702,6 @@ export class AdminPermissionChecker {
 
         if (this.user.permissions) {
             // We grant permission for a whole payment when the user has at least permission for a part of that payment.
-            for (const registration of registrations) {
-                if (await this.canAccessRegistration(registration, permissionLevel)) {
-                    return true;
-                }
-            }
-
             const webshopCache: Map<string, Webshop> = new Map();
 
             for (const order of orders) {
@@ -720,6 +714,23 @@ export class AdminPermissionChecker {
                     }
                 }
             }
+
+            for (const registration of registrations) {
+                if (await this.canAccessRegistration(registration, permissionLevel)) {
+                    return true;
+                }
+            }
+
+            const seenMemberIds = new Set<string>();
+
+            for (const balanceItem of balanceItems) {
+                if (!balanceItem.memberId || seenMemberIds.has(balanceItem.memberId)) continue;
+                seenMemberIds.add(balanceItem.memberId);
+                const member = await Member.getByIdWithUsersAndRegistrations(balanceItem.memberId);
+                if (member && await this.hasFinancialMemberAccess(member, permissionLevel)) {
+                    return true;
+                }
+            }
         }
 
         if (permissionLevel === PermissionLevel.Read) {

package/src/helpers/AuthenticatedStructures.ts

@@ -32,10 +32,8 @@ export class AuthenticatedStructures {
         const { balanceItemPayments, balanceItems } = await Payment.loadBalanceItems(payments);
 
         if (checkPermissions) {
-            const { registrations, orders } = await Payment.loadBalanceItemRelations(balanceItems);
-
             // Note: permission checking is moved here for performacne to avoid loading the data multiple times
-            if (!(await Context.optionalAuth?.canAccessBalanceItems(balanceItems, PermissionLevel.Read, { registrations, orders }))) {
+            if (!(await Context.optionalAuth?.canAccessBalanceItems(balanceItems, PermissionLevel.Read))) {
                 throw new SimpleError({
                     code: 'permission_denied',
                     message: 'Permission denied',

package/src/seeds/1782728609-update-organization-future-events.ts

@@ -0,0 +1,11 @@
+import { Migration } from '@simonbackx/simple-database';
+import { Organization } from '@stamhoofd/models';
+
+export default new Migration(async () => {
+    if (STAMHOOFD.environment === 'test') {
+        console.log('skipped in tests');
+        return;
+    }
+
+    await Organization.updateFutureEventsForOrganizations('all');
+});

package/src/seeds/1782737437-fill-order-payment-customer.ts

@@ -0,0 +1,59 @@
+import { Migration } from '@simonbackx/simple-database';
+import { Order, Payment } from '@stamhoofd/models';
+import { Formatter } from '@stamhoofd/utility';
+import { SeedTools } from '../helpers/SeedTools.js';
+
+export default new Migration(async () => {
+    if (STAMHOOFD.environment === 'test') {
+        // The customer is filled in directly when the payment is created (see PatchWebshopOrdersEndpoint),
+        // which is covered by PlaceOrderEndpoint.test.ts.
+        console.log('skipped in tests');
+        return;
+    }
+
+    // Note: unlike 1780915001-fill-payment-customer, there is no platformName guard here.
+    // Manually added webshop orders never stored a payment customer on any platform, so every
+    // platform needs this fix.
+
+    console.log('Start filling in payment customers for orders.');
+
+    let filled = 0;
+
+    const result = await SeedTools.loopBatched({
+        query: Payment.select().where('customer', null),
+        batchSize: 1000,
+        batchAction: async (payments: Payment[]) => {
+            // Load the balance items linked to the payments so we can find their orders in bulk.
+            const { balanceItemPayments, balanceItems } = await Payment.loadBalanceItems(payments);
+
+            const orderIds = Formatter.uniqueArray(balanceItems.map(b => b.orderId).filter((id): id is string => id !== null));
+            const orders = orderIds.length ? await Order.getByIDs(...orderIds) : [];
+
+            for (const payment of payments) {
+                const paymentBalanceItemIds = balanceItemPayments.filter(bip => bip.paymentId === payment.id).map(bip => bip.balanceItemId);
+                const linkedOrderIds = Formatter.uniqueArray(
+                    balanceItems
+                        .filter(b => paymentBalanceItemIds.includes(b.id))
+                        .map(b => b.orderId)
+                        .filter((id): id is string => id !== null),
+                );
+
+                // Only fill in the customer based on a linked order with usable billing details.
+                for (const orderId of linkedOrderIds) {
+                    const order = orders.find(o => o.id === orderId);
+                    if (order && (order.data.customer.email || order.data.customer.name)) {
+                        payment.customer = order.data.customer.toPaymentCustomer();
+                        await payment.save({
+                            skipMarkSaved: true,
+                            skipSendEvents: true,
+                        });
+                        filled++;
+                        break;
+                    }
+                }
+            }
+        },
+    });
+
+    console.log(`Finished filling in order payment customers: set ${filled} of ${result.total} payments.`);
+});

package/src/sql-filters/payments.ts

@@ -1,7 +1,8 @@
 import { Payment } from '@stamhoofd/models';
 import type { SQLFilterDefinitions } from '@stamhoofd/sql';
-import { baseSQLFilterCompilers, createColumnFilter, createExistsFilter, SQL, SQLCast, SQLConcat, SQLJsonUnquote, SQLScalar, SQLValueType } from '@stamhoofd/sql';
+import { baseSQLFilterCompilers, createColumnFilter, createExistsFilter, createJoinedRelationFilter, SQL, SQLCast, SQLConcat, SQLJsonUnquote, SQLScalar, SQLValueType } from '@stamhoofd/sql';
 import { balanceItemPaymentsCompilers } from './balance-item-payments.js';
+import { organizationFilterCompilers } from './organizations.js';
 
 /**
  * Defines how to filter payments in the database from StamhoofdFilter objects
@@ -38,6 +39,10 @@ export const paymentFilterCompilers: SQLFilterDefinitions = {
         type: SQLValueType.String,
         nullable: true,
     }),
+    payingOrganization: createJoinedRelationFilter(
+        SQL.join('organizations').where(SQL.column('organizations', 'id'), SQL.column(Payment.table, 'payingOrganizationId')),
+        organizationFilterCompilers,
+    ),
     invoiceId: createColumnFilter({
         expression: SQL.column('invoiceId'),
         type: SQLValueType.String,