@stamhoofd/backend 2.129.1 → 2.129.3

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.129.1",
+    "version": "2.129.3",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -57,20 +57,20 @@
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.129.1",
-        "@stamhoofd/backend-i18n": "2.129.1",
-        "@stamhoofd/backend-middleware": "2.129.1",
-        "@stamhoofd/crons": "2.129.1",
-        "@stamhoofd/email": "2.129.1",
-        "@stamhoofd/excel-writer": "2.129.1",
-        "@stamhoofd/logging": "2.129.1",
-        "@stamhoofd/models": "2.129.1",
-        "@stamhoofd/object-differ": "2.129.1",
-        "@stamhoofd/queues": "2.129.1",
-        "@stamhoofd/sql": "2.129.1",
-        "@stamhoofd/structures": "2.129.1",
-        "@stamhoofd/types": "2.129.1",
-        "@stamhoofd/utility": "2.129.1",
+        "@stamhoofd/backend-env": "2.129.3",
+        "@stamhoofd/backend-i18n": "2.129.3",
+        "@stamhoofd/backend-middleware": "2.129.3",
+        "@stamhoofd/crons": "2.129.3",
+        "@stamhoofd/email": "2.129.3",
+        "@stamhoofd/excel-writer": "2.129.3",
+        "@stamhoofd/logging": "2.129.3",
+        "@stamhoofd/models": "2.129.3",
+        "@stamhoofd/object-differ": "2.129.3",
+        "@stamhoofd/queues": "2.129.3",
+        "@stamhoofd/sql": "2.129.3",
+        "@stamhoofd/structures": "2.129.3",
+        "@stamhoofd/types": "2.129.3",
+        "@stamhoofd/utility": "2.129.3",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.129.1",
+        "@stamhoofd/test-utils": "2.129.3",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "fed4dfbbbb768c9d57c476b93a3a42dfac6dd69b"
+    "gitHead": "982b7912b141d0149eb2ad89cd2120e073251e66"
 }

package/src/crons/stripe-invoices.ts

@@ -44,6 +44,6 @@ async function createStripeInvoices() {
     const invoicer = new StripeInvoicer({
         secretKey: STAMHOOFD.STRIPE_SECRET_KEY,
     });
-    await invoicer.generateAllInvoices(membershipOrganization, { forceLast: Formatter.dateIso(today) === '2026-07-03' });
+    await invoicer.generateAllInvoices(membershipOrganization, { forceLast: Formatter.dateIso(today) === '2026-07-04' });
     lastStripeInvoice = new Date();
 }

package/src/endpoints/global/members/GetMembersEndpoint.ts

@@ -44,8 +44,11 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
         const organization = Context.organization;
         let scopeFilter: StamhoofdFilter | undefined = undefined;
 
-        // First do a quick validation of the groups, so that prevents the backend from having to add a scope filter
-        if (!Context.auth.canAccessAllPlatformMembers(permissionLevel) && !await validateGroupFilter({ filter: q.filter, permissionLevel, key: 'registrations' })) {
+        if (organization && STAMHOOFD.userMode === 'organization' && await Context.auth.hasFullAccess(organization.id)) {
+            // Don't add any scoping. Organization id filter is added automatically.
+        } else if (!Context.auth.canAccessAllPlatformMembers(permissionLevel) && !await validateGroupFilter({ filter: q.filter, permissionLevel, key: 'registrations' })) {
+            // First do a quick validation of the groups, so that prevents the backend from having to add a scope filter
+
             if (!organization) {
                 const tags = Context.auth.getPlatformAccessibleOrganizationTags(permissionLevel);
                 if (tags !== 'all' && tags.length === 0) {
@@ -69,9 +72,7 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                         },
                     };
                 }
-            }
-
-            if (organization) {
+            } else {
                 // Add organization scope filter
                 if (await Context.auth.canAccessAllMembers(organization.id, permissionLevel)) {
                     if (await Context.auth.hasFullAccess(organization.id, permissionLevel)) {

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.ts

@@ -7,7 +7,7 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import type { MemberWithUsersRegistrationsAndGroups, Registration } from '@stamhoofd/models';
 import { AuditLog, BalanceItem, Document, Group, Member, MemberFactory, MemberPlatformMembership, MemberResponsibilityRecord, Organization, Platform, RateLimiter, RegistrationPeriod, User } from '@stamhoofd/models';
 import type { MemberResponsibility, MembersBlob } from '@stamhoofd/structures';
-import { AuditLogReplacement, AuditLogReplacementType, AuditLogSource, AuditLogType, EmergencyContact, GroupType, MemberDetails, MemberWithRegistrationsBlob, Parent, PermissionLevel, PlatformMembershipTypeBehaviour, SetupStepType } from '@stamhoofd/structures';
+import { AuditLogReplacement, AuditLogReplacementType, AuditLogSource, AuditLogType, BooleanStatus, EmergencyContact, GroupType, MemberDetails, MemberWithRegistrationsBlob, Parent, PermissionLevel, PlatformMembershipTypeBehaviour, SetupStepType } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 
 import { Email } from '@stamhoofd/email';
@@ -1110,6 +1110,15 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
             // Merge data
             // NOTE: We use mergeTwoMembers instead of mergeMultipleMembers, because we should never safe 'member' , because that one does not exist in the database
             await mergeTwoMembers(duplicate, member);
+
+            // Make sure the user keeps access to this member
+            // const user = Context.user;
+
+            // const { userEmails, parentEmails } = MemberUserSyncer.getMemberAccessEmails(duplicate.details);
+            // if (user && !duplicate.details.calculatedParentsHaveAccess && parentEmails.includes(user.email.toLocaleLowerCase()) && !userEmails.includes(user.email.toLocaleLowerCase())) {
+            //    console.log('Setting parents have access to true to maintain access for parent that used security code');
+            //    duplicate.details.parentsHaveAccess = BooleanStatus.create({ value: true });
+            // }
             return duplicate;
         }
     }

package/src/endpoints/global/registration/GetRegistrationsEndpoint.ts

@@ -159,6 +159,10 @@ export class GetRegistrationsEndpoint extends Endpoint<Params, Query, Body, Resp
             .setMaxExecutionTime(15 * 1000)
             .where('registeredAt', '!=', null);
 
+        if (organization && STAMHOOFD.userMode === 'organization') {
+            query.where('organizationId', organization.id);
+        }
+
         if (scopeFilter) {
             query.where(await compileToSQLFilter(scopeFilter, filterCompilers));
         }

package/src/endpoints/organization/dashboard/receivable-balances/ChargeReceivableBalancesEndpoint.ts

@@ -12,6 +12,7 @@ import { PaymentService } from '../../../../services/PaymentService.js';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { PaymentMandateService } from '../../../../services/PaymentMandateService.js';
 import { BalanceItemService } from '../../../../services/BalanceItemService.js';
+import { QueueHandler } from '@stamhoofd/queues';
 
 type Params = Record<string, never>;
 type Query = CountFilteredRequest;
@@ -37,98 +38,116 @@ export class ChargeReceivableBalancesEndpoint extends Endpoint<Params, Query, Bo
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const sellingOrganization = await Context.setOrganizationScope();
         const { user } = await Context.authenticate();
-        const query = await GetReceivableBalancesEndpoint.buildQuery(request.query);
 
-        for await (const cachedBalance of query.all()) {
-            if (cachedBalance.organizationId !== sellingOrganization.id) {
-                throw new SimpleError({
-                    code: 'wrong_organization',
-                    message: 'Cannot charge a cached balance from a different organization',
-                });
-            }
-            // todo
-            const items = await CachedBalance.balanceForObjects(cachedBalance.organizationId, [cachedBalance.objectId], cachedBalance.objectType);
+        if (!await Context.auth.canManageFinances(sellingOrganization.id)) {
+            throw Context.auth.error();
+        }
+        const queueId = 'charge-receivable-balances/' + sellingOrganization.id;
 
-            if (items.length === 0) {
-                console.log('Nothing to charge for', cachedBalance.id);
-                continue;
-            }
+        if (QueueHandler.isRunning(queueId)) {
+            throw new SimpleError({
+                code: 'charge_pending',
+                message: 'Already pending charge',
+                human: $t('Er is al een aanrekening bezig, even geduld voor je een tweede aanrekening aanrekend.'),
+            });
+        }
 
-            const map: Map<BalanceItem, number> = new Map();
-            let total = 0;
-            for (const i of items) {
-                map.set(i, i.priceOpen);
-                total += i.priceOpen;
-            }
-            if (total <= 0) {
-                continue;
-            }
+        await QueueHandler.schedule(queueId, async () => {
+            const query = await GetReceivableBalancesEndpoint.buildQuery(request.query);
 
-            let payingOrganization: Organization | null = null;
-            let customerUser: User | null = null;
-            if (cachedBalance.objectType === ReceivableBalanceType.organization) {
-                const p = await Organization.getByID(cachedBalance.objectId);
-                if (!p || !(await Context.auth.hasFullAccess(p))) {
-                    console.error('Unexpected missing paying organization id', cachedBalance);
+            for await (const cachedBalance of query.all()) {
+                if (cachedBalance.organizationId !== sellingOrganization.id) {
+                    throw new SimpleError({
+                        code: 'wrong_organization',
+                        message: 'Cannot charge a cached balance from a different organization',
+                    });
+                }
+                // todo
+                const items = await CachedBalance.balanceForObjects(cachedBalance.organizationId, [cachedBalance.objectId], cachedBalance.objectType);
+
+                if (items.length === 0) {
+                    console.log('Nothing to charge for', cachedBalance.id);
                     continue;
                 }
-                payingOrganization = p;
-            }
 
-            if (cachedBalance.objectType === ReceivableBalanceType.user || cachedBalance.objectType === ReceivableBalanceType.userWithoutMembers) {
-                const p = await User.getByID(cachedBalance.objectId);
-                if (!p || !(Context.auth.checkScope(p.organizationId))) {
-                    console.error('Unexpected missing customer user id', cachedBalance);
+                const map: Map<BalanceItem, number> = new Map();
+                let total = 0;
+                for (const i of items) {
+                    map.set(i, i.priceOpen);
+                    total += i.priceOpen;
+                }
+                if (total <= 0) {
                     continue;
                 }
-                customerUser = p;
-            }
 
-            const mandates = await PaymentMandateService.getMandates({
-                sellingOrganization,
-                user: customerUser,
-                payingOrganization,
-            });
+                let payingOrganization: Organization | null = null;
+                let customerUser: User | null = null;
+                if (cachedBalance.objectType === ReceivableBalanceType.organization) {
+                    const p = await Organization.getByID(cachedBalance.objectId);
+                    if (!p || !(await Context.auth.hasFullAccess(p))) {
+                        console.error('Unexpected missing paying organization id', cachedBalance);
+                        continue;
+                    }
+                    payingOrganization = p;
+                }
 
-            const mandate = mandates.find(m => m.isDefault);
+                if (cachedBalance.objectType === ReceivableBalanceType.user || cachedBalance.objectType === ReceivableBalanceType.userWithoutMembers) {
+                    const p = await User.getByID(cachedBalance.objectId);
+                    if (!p || !(Context.auth.checkScope(p.organizationId))) {
+                        console.error('Unexpected missing customer user id', cachedBalance);
+                        continue;
+                    }
+                    customerUser = p;
+                }
+
+                const mandates = await PaymentMandateService.getMandates({
+                    sellingOrganization,
+                    user: customerUser,
+                    payingOrganization,
+                });
+
+                const mandate = mandates.find(m => m.isDefault);
 
-            if (!mandate) {
+                if (!mandate) {
                 // Not possible
-                console.error('No mandates found for', cachedBalance.id);
-                continue;
-            }
+                    console.error('No mandates found for', cachedBalance.id);
+                    continue;
+                }
 
-            customerUser = customerUser ?? (payingOrganization ? (await payingOrganization.getFullAdmins())[0] : null);
-            const customer = PaymentCustomer.create({
-                firstName: customerUser?.firstName,
-                lastName: customerUser?.lastName,
-                email: customerUser?.email ?? (payingOrganization ? (await payingOrganization.getReplyEmails())[0].email : null),
-                company: payingOrganization?.defaultCompanies[0],
-            });
+                customerUser = customerUser ?? (payingOrganization ? (await payingOrganization.getFullAdmins())[0] : null);
+                const customer = PaymentCustomer.create({
+                    firstName: customerUser?.firstName,
+                    lastName: customerUser?.lastName,
+                    email: customerUser?.email ?? (payingOrganization ? (await payingOrganization.getReplyEmails())[0].email : null),
+                    company: payingOrganization?.defaultCompanies[0],
+                });
 
-            await PaymentService.createPayment({
-                balanceItems: map,
-                checkout: {
-                    paymentMethod: PaymentMethod.Unknown,
-                    totalPrice: null,
-                    customer,
-                    cancelUrl: null,
-                    redirectUrl: null,
-                },
-                user: customerUser,
-                adminUserId: user.id,
-                organization: sellingOrganization,
-                payingOrganization,
-                serviceFeeType: 'system',
-                createMandate: null,
-                useMandate: mandate,
-                paymentConfiguration: sellingOrganization.meta.registrationPaymentConfiguration,
-                privatePaymentConfiguration: sellingOrganization.privateMeta.registrationPaymentConfiguration,
-            });
-        }
+                await PaymentService.createPayment({
+                    balanceItems: map,
+                    checkout: {
+                        paymentMethod: PaymentMethod.Unknown,
+                        totalPrice: null,
+                        customer,
+                        cancelUrl: null,
+                        redirectUrl: null,
+                    },
+                    user: customerUser,
+                    adminUserId: user.id,
+                    organization: sellingOrganization,
+                    payingOrganization,
+                    serviceFeeType: 'system',
+                    createMandate: null,
+                    useMandate: mandate,
+                    paymentConfiguration: sellingOrganization.meta.registrationPaymentConfiguration,
+                    privatePaymentConfiguration: sellingOrganization.privateMeta.registrationPaymentConfiguration,
+                });
+
+                // Clear cache while looping, to update the table while we are charging
+                // Make sure the user can refresh data and see the updated cached amounts
+                await BalanceItemService.flushCaches(sellingOrganization.id);
+            }
+        });
 
-        // Make sure the user can refresh data and see the updated cached amounts
-        await BalanceItemService.flushCaches(sellingOrganization.id);
         return new Response(undefined, 201);
     }
 }

package/src/helpers/AdminPermissionChecker.ts

@@ -486,9 +486,21 @@ export class AdminPermissionChecker {
      * Note: only checks admin permissions. Users that 'own' this member can also access it but that does not use the AdminPermissionChecker
      */
     async canAccessRegistration(registration: Registration, permissionLevel: PermissionLevel = PermissionLevel.Read, checkMember: boolean | MemberWithUsersRegistrationsAndGroups = true) {
+        const organizationPermissions = await this.getOrganizationPermissions(registration.organizationId);
+
+        if (!organizationPermissions) {
+            return false;
+        }
+
+        if (organizationPermissions.hasAccess(PermissionLevel.Full)) {
+            // Only full permissions; because non-full doesn't have access to other periods
+            return true;
+        }
+
+        // Non full admin logic
         if (registration.deactivatedAt || !registration.registeredAt) {
             if (!checkMember) {
-                // We can't grant access to a member because of a deactivated registration
+                // We can't grant access to a member because of a deactivated registration - unless full permission
                 return false;
             }
 
@@ -499,16 +511,6 @@ export class AdminPermissionChecker {
             }
         }
 
-        const organizationPermissions = await this.getOrganizationPermissions(registration.organizationId);
-
-        if (!organizationPermissions) {
-            return false;
-        }
-
-        if (organizationPermissions.hasAccess(PermissionLevel.Full)) {
-            // Only full permissions; because non-full doesn't have access to other periods
-            return true;
-        }
         const organization = await this.getOrganization(registration.organizationId);
 
         if (registration.periodId !== organization.periodId) {

package/src/helpers/MemberMerger.test.ts

@@ -778,5 +778,139 @@ describe('member merge', () => {
             expect(m1.details.email).toBe('example@example.com');
             expect(m1.details.alternativeEmails).toEqual([]);
         });
+
+        describe('Parents have access get merged', () => {
+            test('False other', () => {
+                const m1 = new Member();
+                const m2 = new Member();
+
+                const base = MemberDetails.create({
+                    email: 'example@example.com',
+                    firstName: 'John',
+                    lastName: 'Doe',
+                });
+
+                const other = MemberDetails.create({
+                    email: 'example@example.com',
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    parentsHaveAccess: BooleanStatus.create({ value: false }),
+                });
+
+                m1.details = base.clone();
+                m2.details = other.clone();
+
+                mergeMemberDetails(m1, m2);
+
+                expect(m1.details.email).toBe('example@example.com');
+                expect(m1.details.parentsHaveAccess?.value).toEqual(false);
+            });
+            test('True other', () => {
+                const m1 = new Member();
+                const m2 = new Member();
+
+                const base = MemberDetails.create({
+                    email: 'example@example.com',
+                    firstName: 'John',
+                    lastName: 'Doe',
+                });
+
+                const other = MemberDetails.create({
+                    email: 'example@example.com',
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    parentsHaveAccess: BooleanStatus.create({ value: true }),
+                });
+
+                m1.details = base.clone();
+                m2.details = other.clone();
+
+                mergeMemberDetails(m1, m2);
+
+                expect(m1.details.email).toBe('example@example.com');
+                expect(m1.details.parentsHaveAccess?.value).toEqual(true);
+            });
+
+            test('Both different other prefer newest other', () => {
+                const m1 = new Member();
+                const m2 = new Member();
+
+                const base = MemberDetails.create({
+                    email: 'example@example.com',
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    parentsHaveAccess: BooleanStatus.create({ value: true, date: new Date(0) }),
+                });
+
+                const other = MemberDetails.create({
+                    email: 'example@example.com',
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    parentsHaveAccess: BooleanStatus.create({ value: false, date: new Date(1) }),
+                });
+
+                m1.details = base.clone();
+                m2.details = other.clone();
+
+                mergeMemberDetails(m1, m2);
+
+                expect(m1.details.email).toBe('example@example.com');
+                expect(m1.details.parentsHaveAccess?.value).toEqual(false);
+            });
+
+            test('Both different other prefer newest base', () => {
+                const m1 = new Member();
+                const m2 = new Member();
+
+                const base = MemberDetails.create({
+                    email: 'example@example.com',
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    parentsHaveAccess: BooleanStatus.create({ value: true, date: new Date(1) }),
+                });
+
+                const other = MemberDetails.create({
+                    email: 'example@example.com',
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    parentsHaveAccess: BooleanStatus.create({ value: false, date: new Date(0) }),
+                });
+
+                m1.details = base.clone();
+                m2.details = other.clone();
+
+                mergeMemberDetails(m1, m2);
+
+                expect(m1.details.email).toBe('example@example.com');
+                expect(m1.details.parentsHaveAccess?.value).toEqual(true);
+            });
+
+            test('Both different other prefer newest base 2', () => {
+                const m1 = new Member();
+                const m2 = new Member();
+
+                const base = MemberDetails.create({
+                    email: 'example@example.com',
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    parentsHaveAccess: BooleanStatus.create({ value: false, date: new Date(1) }),
+                });
+
+                const other = MemberDetails.create({
+                    email: 'example@example.com',
+                    firstName: 'John',
+                    lastName: 'Doe',
+                    parentsHaveAccess: BooleanStatus.create({ value: true, date: new Date(0) }),
+                });
+
+                m1.details = base.clone();
+                m2.details = other.clone();
+
+                mergeMemberDetails(m1, m2);
+
+                expect(m1.details.email).toBe('example@example.com');
+                expect(m1.details.parentsHaveAccess?.value).toEqual(false);
+            });
+        });
     });
 });

package/src/helpers/MemberMerger.ts

@@ -306,6 +306,12 @@ export function mergeMemberDetails(base: Member, other: Member): void {
         'dataPermissions',
     );
 
+    mergeBooleanStatusIfBaseNotSet(
+        baseDetails,
+        otherDetails,
+        'parentsHaveAccess',
+    );
+
     // address
     mergeAddress(baseDetails, otherDetails, baseDetails);
 

package/src/helpers/MemberUserSyncer.test.ts

@@ -693,7 +693,7 @@ describe('Helpers.MemberUserSyncer', () => {
             ]);
         });
 
-        test('Parents are removed if member turns 18', async () => {
+        test.skip('Parents are removed if member turns 18', async () => {
             const member = await new MemberFactory({
                 details: MemberDetails.create({
                     firstName: 'John',

package/src/helpers/MemberUserSyncer.ts

@@ -132,7 +132,8 @@ export class MemberUserSyncerStatic {
                             // This makes sure we don't inherit permissions and aren't counted as 'being' the member
                             await this.linkUser(user.email, member, true);
                         }
-                    } else if (!member.details.calculatedParentsHaveAccess && parentEmails.includes(user.email.toLocaleLowerCase()) && !userEmails.includes(user.email.toLocaleLowerCase())) {
+                    } else if (member.details.parentsHaveAccess?.value === false && parentEmails.includes(user.email.toLocaleLowerCase()) && !userEmails.includes(user.email.toLocaleLowerCase())) {
+                        // Only remove if manually set to false for now
                         await this.unlinkUser(user, member);
                     }
                 }

package/src/services/MollieService.ts

@@ -251,7 +251,7 @@ export class MollieService {
             details: PaymentMandateDetails.create({
                 name: ('consumerName' in details ? details.consumerName : details.cardHolder) ?? undefined,
                 cardNumber: 'cardNumber' in details ? details.cardNumber : null,
-                iban: 'consumerAccount' in details ? details.consumerAccount : null,
+                iban: 'consumerAccount' in details ? Formatter.iban(details.consumerAccount) : null,
                 bic: ('consumerBic' in details ? details.consumerBic : undefined),
                 expiryDate: ('cardExpiryDate' in details ? DateTime.fromISO(details.cardExpiryDate, { zone: Formatter.timezone }).toJSDate() : null), // todo: parse date correctly in Brussels timezone!
                 brand: ('cardLabel' in details ? details.cardLabel : null),

package/src/services/SSOService.ts

@@ -61,6 +61,10 @@ export class SSOService {
         this.provider = data.provider;
         this.platform = data.platform;
         this.organization = data.organization ?? null;
+
+        if (STAMHOOFD.userMode === 'platform' && this.organization) {
+            throw new Error('SSO provided by organization disabled in platform mode');
+        }
     }
 
     static async clearExpiredTokensOrFromUser(userId: string | null = null) {
@@ -371,7 +375,7 @@ export class SSOService {
             if (token) {
                 user = await User.getByID(token.userId);
 
-                if (!user) {
+                if (!user || user.organizationId !== (this.organization?.id ?? null)) {
                     throw new SimpleError({
                         code: 'invalid_user',
                         message: 'User not found',