@stamhoofd/backend 2.125.0 → 2.125.2

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.125.0",
+    "version": "2.125.2",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -57,20 +57,20 @@
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.125.0",
-        "@stamhoofd/backend-i18n": "2.125.0",
-        "@stamhoofd/backend-middleware": "2.125.0",
-        "@stamhoofd/crons": "2.125.0",
-        "@stamhoofd/email": "2.125.0",
-        "@stamhoofd/excel-writer": "2.125.0",
-        "@stamhoofd/logging": "2.125.0",
-        "@stamhoofd/models": "2.125.0",
-        "@stamhoofd/object-differ": "2.125.0",
-        "@stamhoofd/queues": "2.125.0",
-        "@stamhoofd/sql": "2.125.0",
-        "@stamhoofd/structures": "2.125.0",
-        "@stamhoofd/types": "2.125.0",
-        "@stamhoofd/utility": "2.125.0",
+        "@stamhoofd/backend-env": "2.125.2",
+        "@stamhoofd/backend-i18n": "2.125.2",
+        "@stamhoofd/backend-middleware": "2.125.2",
+        "@stamhoofd/crons": "2.125.2",
+        "@stamhoofd/email": "2.125.2",
+        "@stamhoofd/excel-writer": "2.125.2",
+        "@stamhoofd/logging": "2.125.2",
+        "@stamhoofd/models": "2.125.2",
+        "@stamhoofd/object-differ": "2.125.2",
+        "@stamhoofd/queues": "2.125.2",
+        "@stamhoofd/sql": "2.125.2",
+        "@stamhoofd/structures": "2.125.2",
+        "@stamhoofd/types": "2.125.2",
+        "@stamhoofd/utility": "2.125.2",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.125.0",
+        "@stamhoofd/test-utils": "2.125.2",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "8fc26e2a47fee0ff97992a55f80a921880f33077"
+    "gitHead": "bda32cee30660a98c7563c405ce29dc0da7cab65"
 }

package/src/endpoints/organization/dashboard/receivable-balances/GetReceivableBalanceEndpoint.ts

@@ -2,6 +2,7 @@ import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { DetailedReceivableBalance, PaymentStatus, PermissionLevel, ReceivableBalanceType } from '@stamhoofd/structures';
 
+import type { MemberWithUsersAndRegistrations } from '@stamhoofd/models';
 import { BalanceItem, BalanceItemPayment, CachedBalance, Member, MemberUser, Payment, Registration } from '@stamhoofd/models';
 import { Context } from '../../../../helpers/Context.js';
 import { AuthenticatedStructures } from '../../../../helpers/AuthenticatedStructures.js';
@@ -36,20 +37,18 @@ export class GetReceivableBalanceEndpoint extends Endpoint<Params, Query, Body,
         await Context.authenticate();
 
         if (!await Context.auth.canManageFinances(organization.id)) {
-            // Group-level financial access is sufficient for member and registration balance views
-            if (request.params.type === ReceivableBalanceType.member) {
-                const member = await Member.getByIdWithUsersAndRegistrations(request.params.id);
-                if (!member || !await Context.auth.hasFinancialMemberAccess(member, PermissionLevel.Read, organization.id)) {
-                    throw Context.auth.error();
-                }
-            } else if (request.params.type === ReceivableBalanceType.registration) {
+            let member: MemberWithUsersAndRegistrations | null = null;
+            if (request.params.type === ReceivableBalanceType.registration) {
                 const registration = await Registration.select().where('id', request.params.id).first(false);
                 if (!registration) throw Context.auth.error();
-                const member = await Member.getByIdWithUsersAndRegistrations(registration.memberId);
+                member = await Member.getByIdWithUsersAndRegistrations(registration.memberId);
+            } else if (request.params.type === ReceivableBalanceType.member) {
+                member = await Member.getByIdWithUsersAndRegistrations(request.params.id);
                 if (!member || !await Context.auth.hasFinancialMemberAccess(member, PermissionLevel.Read, organization.id)) {
                     throw Context.auth.error();
                 }
-            } else {
+            }
+            if (!member || !await Context.auth.hasFinancialMemberAccess(member, PermissionLevel.Read, organization.id)) {
                 throw Context.auth.error();
             }
         }

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -316,7 +316,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
         }
 
         const maximumStart = 1000 * 60 * 60 * 24 * 31 * 8; // 8 months in advance
-        if (period.startDate > new Date(Date.now() + maximumStart)) {
+        if (period.startDate > new Date(Date.now() + maximumStart) && STAMHOOFD.userMode === 'platform') {
             throw new SimpleError({
                 code: 'invalid_field',
                 message: 'Period start date is too far in the future',
@@ -326,7 +326,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
         }
 
         // Period has ended
-        if (STAMHOOFD.environment !== 'development' && period.endDate < new Date()) {
+        if (STAMHOOFD.environment !== 'development' && period.endDate < new Date() && STAMHOOFD.userMode === 'platform') {
             throw new SimpleError({
                 code: 'invalid_field',
                 message: 'Period has ended',
@@ -565,29 +565,16 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             if (patch.waitingList === null) {
                 // delete
                 if (model.waitingListId) {
-                    // for now don't delete, as waiting lists can be shared between multiple groups
-                    // await PatchOrganizationRegistrationPeriodsEndpoint.deleteGroup(model.waitingListId)
                     model.waitingListId = null;
                 }
             } else if (patch.waitingList.isPatch()) {
-                if (!model.waitingListId) {
-                    throw new SimpleError({
-                        code: 'invalid_field',
-                        field: 'waitingList',
-                        message: 'Cannot patch waiting list before it is created',
-                    });
-                }
-                patch.waitingList.id = model.waitingListId;
-                patch.waitingList.type = GroupType.WaitingList;
-                await throwIfUpdateWaitingListPeriodWithMultipleGroups(patch.waitingList.id);
-                await PatchOrganizationRegistrationPeriodsEndpoint.patchGroup(patch.waitingList, period, {
-                    allowPatchWaitingListPeriod: shouldUpdatePeriodIds,
-                    isPatchingEvent,
+                throw new SimpleError({
+                    code: 'invalid_field',
+                    field: 'waitingList',
+                    message: 'Cannot patch waitingList',
                 });
             } else {
                 if (model.waitingListId) {
-                    // for now don't delete, as waiting lists can be shared between multiple groups
-                    // await PatchOrganizationRegistrationPeriodsEndpoint.deleteGroup(model.waitingListId)
                     model.waitingListId = null;
                 }
                 patch.waitingList.type = GroupType.WaitingList;
@@ -613,29 +600,13 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
 
                     model.waitingListId = existing.id;
                 } else {
-                    const requiredPeriod = period ?? await RegistrationPeriod.getByID(model.periodId);
-
-                    if (!requiredPeriod) {
-                        throw new Error('Unexpected missing period when creating waiting list');
-                    }
-
-                    if (STAMHOOFD.userMode === 'organization' && requiredPeriod.organizationId !== model.organizationId) {
-                        throw new SimpleError({
-                            code: 'invalid_period',
-                            message: 'Period has different organization id',
-                            statusCode: 400,
-                        });
-                    }
-
-                    const group = await PatchOrganizationRegistrationPeriodsEndpoint.createGroup(
-                        patch.waitingList,
-                        model.organizationId,
-                        requiredPeriod,
-                        {
-                            allowedIds: [patch.waitingList.id],
-                        },
-                    );
-                    model.waitingListId = group.id;
+                    throw new SimpleError({
+                        code: 'invalid_waiting_list',
+                        field: 'waitingList',
+                        message: 'Waiting list not found',
+                        human: $t('%ZZb'),
+                        statusCode: 404,
+                    });
                 }
             }
         } else if (shouldUpdatePeriodIds && model.waitingListId && period) {
@@ -761,16 +732,24 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                     });
                 }
 
+                if (existing.periodId !== model.periodId) {
+                    throw new SimpleError({
+                        code: 'invalid_field',
+                        field: 'waitingList',
+                        message: 'Waiting list group is already used in another period',
+                        human: $t(`%F9`),
+                    });
+                }
+
                 model.waitingListId = existing.id;
             } else {
-                struct.waitingList.type = GroupType.WaitingList;
-                const group = await PatchOrganizationRegistrationPeriodsEndpoint.createGroup(
-                    struct.waitingList,
-                    model.organizationId,
-                    period,
-                    { allowedIds: [struct.waitingList.id] },
-                );
-                model.waitingListId = group.id;
+                throw new SimpleError({
+                    code: 'invalid_waiting_list',
+                    field: 'waitingList',
+                    message: 'Waiting list not found',
+                    human: $t('%ZZb'),
+                    statusCode: 404,
+                });
             }
         }
 

package/src/helpers/AdminPermissionChecker.ts

@@ -702,12 +702,6 @@ export class AdminPermissionChecker {
 
         if (this.user.permissions) {
             // We grant permission for a whole payment when the user has at least permission for a part of that payment.
-            for (const registration of registrations) {
-                if (await this.canAccessRegistration(registration, permissionLevel)) {
-                    return true;
-                }
-            }
-
             const webshopCache: Map<string, Webshop> = new Map();
 
             for (const order of orders) {
@@ -720,6 +714,23 @@ export class AdminPermissionChecker {
                     }
                 }
             }
+
+            for (const registration of registrations) {
+                if (await this.canAccessRegistration(registration, permissionLevel)) {
+                    return true;
+                }
+            }
+
+            const seenMemberIds = new Set<string>();
+
+            for (const balanceItem of balanceItems) {
+                if (!balanceItem.memberId || seenMemberIds.has(balanceItem.memberId)) continue;
+                seenMemberIds.add(balanceItem.memberId);
+                const member = await Member.getByIdWithUsersAndRegistrations(balanceItem.memberId);
+                if (member && await this.hasFinancialMemberAccess(member, permissionLevel)) {
+                    return true;
+                }
+            }
         }
 
         if (permissionLevel === PermissionLevel.Read) {
@@ -1188,7 +1199,8 @@ export class AdminPermissionChecker {
             return true;
         }
 
-        if (!await this.canAccessMember(member, level)) {
+        // If you can't read the member, you can't have financial access
+        if (!await this.canAccessMember(member, PermissionLevel.Read)) {
             return false;
         }
 

package/src/helpers/AuthenticatedStructures.ts

@@ -32,10 +32,8 @@ export class AuthenticatedStructures {
         const { balanceItemPayments, balanceItems } = await Payment.loadBalanceItems(payments);
 
         if (checkPermissions) {
-            const { registrations, orders } = await Payment.loadBalanceItemRelations(balanceItems);
-
             // Note: permission checking is moved here for performacne to avoid loading the data multiple times
-            if (!(await Context.optionalAuth?.canAccessBalanceItems(balanceItems, PermissionLevel.Read, { registrations, orders }))) {
+            if (!(await Context.optionalAuth?.canAccessBalanceItems(balanceItems, PermissionLevel.Read))) {
                 throw new SimpleError({
                     code: 'permission_denied',
                     message: 'Permission denied',

package/src/sql-filters/payments.ts

@@ -1,7 +1,8 @@
 import { Payment } from '@stamhoofd/models';
 import type { SQLFilterDefinitions } from '@stamhoofd/sql';
-import { baseSQLFilterCompilers, createColumnFilter, createExistsFilter, SQL, SQLCast, SQLConcat, SQLJsonUnquote, SQLScalar, SQLValueType } from '@stamhoofd/sql';
+import { baseSQLFilterCompilers, createColumnFilter, createExistsFilter, createJoinedRelationFilter, SQL, SQLCast, SQLConcat, SQLJsonUnquote, SQLScalar, SQLValueType } from '@stamhoofd/sql';
 import { balanceItemPaymentsCompilers } from './balance-item-payments.js';
+import { organizationFilterCompilers } from './organizations.js';
 
 /**
  * Defines how to filter payments in the database from StamhoofdFilter objects
@@ -38,6 +39,10 @@ export const paymentFilterCompilers: SQLFilterDefinitions = {
         type: SQLValueType.String,
         nullable: true,
     }),
+    payingOrganization: createJoinedRelationFilter(
+        SQL.join('organizations').where(SQL.column('organizations', 'id'), SQL.column(Payment.table, 'payingOrganizationId')),
+        organizationFilterCompilers,
+    ),
     invoiceId: createColumnFilter({
         expression: SQL.column('invoiceId'),
         type: SQLValueType.String,