@stamhoofd/backend 2.129.2 → 2.129.3

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.129.2",
+    "version": "2.129.3",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -57,20 +57,20 @@
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.129.2",
-        "@stamhoofd/backend-i18n": "2.129.2",
-        "@stamhoofd/backend-middleware": "2.129.2",
-        "@stamhoofd/crons": "2.129.2",
-        "@stamhoofd/email": "2.129.2",
-        "@stamhoofd/excel-writer": "2.129.2",
-        "@stamhoofd/logging": "2.129.2",
-        "@stamhoofd/models": "2.129.2",
-        "@stamhoofd/object-differ": "2.129.2",
-        "@stamhoofd/queues": "2.129.2",
-        "@stamhoofd/sql": "2.129.2",
-        "@stamhoofd/structures": "2.129.2",
-        "@stamhoofd/types": "2.129.2",
-        "@stamhoofd/utility": "2.129.2",
+        "@stamhoofd/backend-env": "2.129.3",
+        "@stamhoofd/backend-i18n": "2.129.3",
+        "@stamhoofd/backend-middleware": "2.129.3",
+        "@stamhoofd/crons": "2.129.3",
+        "@stamhoofd/email": "2.129.3",
+        "@stamhoofd/excel-writer": "2.129.3",
+        "@stamhoofd/logging": "2.129.3",
+        "@stamhoofd/models": "2.129.3",
+        "@stamhoofd/object-differ": "2.129.3",
+        "@stamhoofd/queues": "2.129.3",
+        "@stamhoofd/sql": "2.129.3",
+        "@stamhoofd/structures": "2.129.3",
+        "@stamhoofd/types": "2.129.3",
+        "@stamhoofd/utility": "2.129.3",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.129.2",
+        "@stamhoofd/test-utils": "2.129.3",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "099a48481fdbd3d661793675ab9e2c24a594b130"
+    "gitHead": "982b7912b141d0149eb2ad89cd2120e073251e66"
 }

package/src/endpoints/global/members/GetMembersEndpoint.ts

@@ -44,8 +44,11 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
         const organization = Context.organization;
         let scopeFilter: StamhoofdFilter | undefined = undefined;
 
-        // First do a quick validation of the groups, so that prevents the backend from having to add a scope filter
-        if (!Context.auth.canAccessAllPlatformMembers(permissionLevel) && !await validateGroupFilter({ filter: q.filter, permissionLevel, key: 'registrations' })) {
+        if (organization && STAMHOOFD.userMode === 'organization' && await Context.auth.hasFullAccess(organization.id)) {
+            // Don't add any scoping. Organization id filter is added automatically.
+        } else if (!Context.auth.canAccessAllPlatformMembers(permissionLevel) && !await validateGroupFilter({ filter: q.filter, permissionLevel, key: 'registrations' })) {
+            // First do a quick validation of the groups, so that prevents the backend from having to add a scope filter
+
             if (!organization) {
                 const tags = Context.auth.getPlatformAccessibleOrganizationTags(permissionLevel);
                 if (tags !== 'all' && tags.length === 0) {
@@ -69,9 +72,7 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                         },
                     };
                 }
-            }
-
-            if (organization) {
+            } else {
                 // Add organization scope filter
                 if (await Context.auth.canAccessAllMembers(organization.id, permissionLevel)) {
                     if (await Context.auth.hasFullAccess(organization.id, permissionLevel)) {

package/src/endpoints/global/registration/GetRegistrationsEndpoint.ts

@@ -159,6 +159,10 @@ export class GetRegistrationsEndpoint extends Endpoint<Params, Query, Body, Resp
             .setMaxExecutionTime(15 * 1000)
             .where('registeredAt', '!=', null);
 
+        if (organization && STAMHOOFD.userMode === 'organization') {
+            query.where('organizationId', organization.id);
+        }
+
         if (scopeFilter) {
             query.where(await compileToSQLFilter(scopeFilter, filterCompilers));
         }

package/src/endpoints/organization/dashboard/receivable-balances/ChargeReceivableBalancesEndpoint.ts

@@ -12,6 +12,7 @@ import { PaymentService } from '../../../../services/PaymentService.js';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { PaymentMandateService } from '../../../../services/PaymentMandateService.js';
 import { BalanceItemService } from '../../../../services/BalanceItemService.js';
+import { QueueHandler } from '@stamhoofd/queues';
 
 type Params = Record<string, never>;
 type Query = CountFilteredRequest;
@@ -37,98 +38,116 @@ export class ChargeReceivableBalancesEndpoint extends Endpoint<Params, Query, Bo
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const sellingOrganization = await Context.setOrganizationScope();
         const { user } = await Context.authenticate();
-        const query = await GetReceivableBalancesEndpoint.buildQuery(request.query);
 
-        for await (const cachedBalance of query.all()) {
-            if (cachedBalance.organizationId !== sellingOrganization.id) {
-                throw new SimpleError({
-                    code: 'wrong_organization',
-                    message: 'Cannot charge a cached balance from a different organization',
-                });
-            }
-            // todo
-            const items = await CachedBalance.balanceForObjects(cachedBalance.organizationId, [cachedBalance.objectId], cachedBalance.objectType);
+        if (!await Context.auth.canManageFinances(sellingOrganization.id)) {
+            throw Context.auth.error();
+        }
+        const queueId = 'charge-receivable-balances/' + sellingOrganization.id;
 
-            if (items.length === 0) {
-                console.log('Nothing to charge for', cachedBalance.id);
-                continue;
-            }
+        if (QueueHandler.isRunning(queueId)) {
+            throw new SimpleError({
+                code: 'charge_pending',
+                message: 'Already pending charge',
+                human: $t('Er is al een aanrekening bezig, even geduld voor je een tweede aanrekening aanrekend.'),
+            });
+        }
 
-            const map: Map<BalanceItem, number> = new Map();
-            let total = 0;
-            for (const i of items) {
-                map.set(i, i.priceOpen);
-                total += i.priceOpen;
-            }
-            if (total <= 0) {
-                continue;
-            }
+        await QueueHandler.schedule(queueId, async () => {
+            const query = await GetReceivableBalancesEndpoint.buildQuery(request.query);
 
-            let payingOrganization: Organization | null = null;
-            let customerUser: User | null = null;
-            if (cachedBalance.objectType === ReceivableBalanceType.organization) {
-                const p = await Organization.getByID(cachedBalance.objectId);
-                if (!p || !(await Context.auth.hasFullAccess(p))) {
-                    console.error('Unexpected missing paying organization id', cachedBalance);
+            for await (const cachedBalance of query.all()) {
+                if (cachedBalance.organizationId !== sellingOrganization.id) {
+                    throw new SimpleError({
+                        code: 'wrong_organization',
+                        message: 'Cannot charge a cached balance from a different organization',
+                    });
+                }
+                // todo
+                const items = await CachedBalance.balanceForObjects(cachedBalance.organizationId, [cachedBalance.objectId], cachedBalance.objectType);
+
+                if (items.length === 0) {
+                    console.log('Nothing to charge for', cachedBalance.id);
                     continue;
                 }
-                payingOrganization = p;
-            }
 
-            if (cachedBalance.objectType === ReceivableBalanceType.user || cachedBalance.objectType === ReceivableBalanceType.userWithoutMembers) {
-                const p = await User.getByID(cachedBalance.objectId);
-                if (!p || !(Context.auth.checkScope(p.organizationId))) {
-                    console.error('Unexpected missing customer user id', cachedBalance);
+                const map: Map<BalanceItem, number> = new Map();
+                let total = 0;
+                for (const i of items) {
+                    map.set(i, i.priceOpen);
+                    total += i.priceOpen;
+                }
+                if (total <= 0) {
                     continue;
                 }
-                customerUser = p;
-            }
 
-            const mandates = await PaymentMandateService.getMandates({
-                sellingOrganization,
-                user: customerUser,
-                payingOrganization,
-            });
+                let payingOrganization: Organization | null = null;
+                let customerUser: User | null = null;
+                if (cachedBalance.objectType === ReceivableBalanceType.organization) {
+                    const p = await Organization.getByID(cachedBalance.objectId);
+                    if (!p || !(await Context.auth.hasFullAccess(p))) {
+                        console.error('Unexpected missing paying organization id', cachedBalance);
+                        continue;
+                    }
+                    payingOrganization = p;
+                }
 
-            const mandate = mandates.find(m => m.isDefault);
+                if (cachedBalance.objectType === ReceivableBalanceType.user || cachedBalance.objectType === ReceivableBalanceType.userWithoutMembers) {
+                    const p = await User.getByID(cachedBalance.objectId);
+                    if (!p || !(Context.auth.checkScope(p.organizationId))) {
+                        console.error('Unexpected missing customer user id', cachedBalance);
+                        continue;
+                    }
+                    customerUser = p;
+                }
+
+                const mandates = await PaymentMandateService.getMandates({
+                    sellingOrganization,
+                    user: customerUser,
+                    payingOrganization,
+                });
+
+                const mandate = mandates.find(m => m.isDefault);
 
-            if (!mandate) {
+                if (!mandate) {
                 // Not possible
-                console.error('No mandates found for', cachedBalance.id);
-                continue;
-            }
+                    console.error('No mandates found for', cachedBalance.id);
+                    continue;
+                }
 
-            customerUser = customerUser ?? (payingOrganization ? (await payingOrganization.getFullAdmins())[0] : null);
-            const customer = PaymentCustomer.create({
-                firstName: customerUser?.firstName,
-                lastName: customerUser?.lastName,
-                email: customerUser?.email ?? (payingOrganization ? (await payingOrganization.getReplyEmails())[0].email : null),
-                company: payingOrganization?.defaultCompanies[0],
-            });
+                customerUser = customerUser ?? (payingOrganization ? (await payingOrganization.getFullAdmins())[0] : null);
+                const customer = PaymentCustomer.create({
+                    firstName: customerUser?.firstName,
+                    lastName: customerUser?.lastName,
+                    email: customerUser?.email ?? (payingOrganization ? (await payingOrganization.getReplyEmails())[0].email : null),
+                    company: payingOrganization?.defaultCompanies[0],
+                });
 
-            await PaymentService.createPayment({
-                balanceItems: map,
-                checkout: {
-                    paymentMethod: PaymentMethod.Unknown,
-                    totalPrice: null,
-                    customer,
-                    cancelUrl: null,
-                    redirectUrl: null,
-                },
-                user: customerUser,
-                adminUserId: user.id,
-                organization: sellingOrganization,
-                payingOrganization,
-                serviceFeeType: 'system',
-                createMandate: null,
-                useMandate: mandate,
-                paymentConfiguration: sellingOrganization.meta.registrationPaymentConfiguration,
-                privatePaymentConfiguration: sellingOrganization.privateMeta.registrationPaymentConfiguration,
-            });
-        }
+                await PaymentService.createPayment({
+                    balanceItems: map,
+                    checkout: {
+                        paymentMethod: PaymentMethod.Unknown,
+                        totalPrice: null,
+                        customer,
+                        cancelUrl: null,
+                        redirectUrl: null,
+                    },
+                    user: customerUser,
+                    adminUserId: user.id,
+                    organization: sellingOrganization,
+                    payingOrganization,
+                    serviceFeeType: 'system',
+                    createMandate: null,
+                    useMandate: mandate,
+                    paymentConfiguration: sellingOrganization.meta.registrationPaymentConfiguration,
+                    privatePaymentConfiguration: sellingOrganization.privateMeta.registrationPaymentConfiguration,
+                });
+
+                // Clear cache while looping, to update the table while we are charging
+                // Make sure the user can refresh data and see the updated cached amounts
+                await BalanceItemService.flushCaches(sellingOrganization.id);
+            }
+        });
 
-        // Make sure the user can refresh data and see the updated cached amounts
-        await BalanceItemService.flushCaches(sellingOrganization.id);
         return new Response(undefined, 201);
     }
 }

package/src/helpers/AdminPermissionChecker.ts

@@ -486,9 +486,21 @@ export class AdminPermissionChecker {
      * Note: only checks admin permissions. Users that 'own' this member can also access it but that does not use the AdminPermissionChecker
      */
     async canAccessRegistration(registration: Registration, permissionLevel: PermissionLevel = PermissionLevel.Read, checkMember: boolean | MemberWithUsersRegistrationsAndGroups = true) {
+        const organizationPermissions = await this.getOrganizationPermissions(registration.organizationId);
+
+        if (!organizationPermissions) {
+            return false;
+        }
+
+        if (organizationPermissions.hasAccess(PermissionLevel.Full)) {
+            // Only full permissions; because non-full doesn't have access to other periods
+            return true;
+        }
+
+        // Non full admin logic
         if (registration.deactivatedAt || !registration.registeredAt) {
             if (!checkMember) {
-                // We can't grant access to a member because of a deactivated registration
+                // We can't grant access to a member because of a deactivated registration - unless full permission
                 return false;
             }
 
@@ -499,16 +511,6 @@ export class AdminPermissionChecker {
             }
         }
 
-        const organizationPermissions = await this.getOrganizationPermissions(registration.organizationId);
-
-        if (!organizationPermissions) {
-            return false;
-        }
-
-        if (organizationPermissions.hasAccess(PermissionLevel.Full)) {
-            // Only full permissions; because non-full doesn't have access to other periods
-            return true;
-        }
         const organization = await this.getOrganization(registration.organizationId);
 
         if (registration.periodId !== organization.periodId) {

package/src/services/MollieService.ts

@@ -251,7 +251,7 @@ export class MollieService {
             details: PaymentMandateDetails.create({
                 name: ('consumerName' in details ? details.consumerName : details.cardHolder) ?? undefined,
                 cardNumber: 'cardNumber' in details ? details.cardNumber : null,
-                iban: 'consumerAccount' in details ? details.consumerAccount : null,
+                iban: 'consumerAccount' in details ? Formatter.iban(details.consumerAccount) : null,
                 bic: ('consumerBic' in details ? details.consumerBic : undefined),
                 expiryDate: ('cardExpiryDate' in details ? DateTime.fromISO(details.cardExpiryDate, { zone: Formatter.timezone }).toJSDate() : null), // todo: parse date correctly in Brussels timezone!
                 brand: ('cardLabel' in details ? details.cardLabel : null),

package/src/services/SSOService.ts

@@ -61,6 +61,10 @@ export class SSOService {
         this.provider = data.provider;
         this.platform = data.platform;
         this.organization = data.organization ?? null;
+
+        if (STAMHOOFD.userMode === 'platform' && this.organization) {
+            throw new Error('SSO provided by organization disabled in platform mode');
+        }
     }
 
     static async clearExpiredTokensOrFromUser(userId: string | null = null) {
@@ -371,7 +375,7 @@ export class SSOService {
             if (token) {
                 user = await User.getByID(token.userId);
 
-                if (!user) {
+                if (!user || user.organizationId !== (this.organization?.id ?? null)) {
                     throw new SimpleError({
                         code: 'invalid_user',
                         message: 'User not found',