@stamhoofd/backend 2.129.2 → 2.130.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.129.2",
+    "version": "2.130.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -57,20 +57,20 @@
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.129.2",
-        "@stamhoofd/backend-i18n": "2.129.2",
-        "@stamhoofd/backend-middleware": "2.129.2",
-        "@stamhoofd/crons": "2.129.2",
-        "@stamhoofd/email": "2.129.2",
-        "@stamhoofd/excel-writer": "2.129.2",
-        "@stamhoofd/logging": "2.129.2",
-        "@stamhoofd/models": "2.129.2",
-        "@stamhoofd/object-differ": "2.129.2",
-        "@stamhoofd/queues": "2.129.2",
-        "@stamhoofd/sql": "2.129.2",
-        "@stamhoofd/structures": "2.129.2",
-        "@stamhoofd/types": "2.129.2",
-        "@stamhoofd/utility": "2.129.2",
+        "@stamhoofd/backend-env": "2.130.0",
+        "@stamhoofd/backend-i18n": "2.130.0",
+        "@stamhoofd/backend-middleware": "2.130.0",
+        "@stamhoofd/crons": "2.130.0",
+        "@stamhoofd/email": "2.130.0",
+        "@stamhoofd/excel-writer": "2.130.0",
+        "@stamhoofd/logging": "2.130.0",
+        "@stamhoofd/models": "2.130.0",
+        "@stamhoofd/object-differ": "2.130.0",
+        "@stamhoofd/queues": "2.130.0",
+        "@stamhoofd/sql": "2.130.0",
+        "@stamhoofd/structures": "2.130.0",
+        "@stamhoofd/types": "2.130.0",
+        "@stamhoofd/utility": "2.130.0",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.129.2",
+        "@stamhoofd/test-utils": "2.130.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "099a48481fdbd3d661793675ab9e2c24a594b130"
+    "gitHead": "b87db6d1a28c82fb12e588f899bcc7dc68d4cd90"
 }

package/src/endpoints/admin/organizations/GetOrganizationsEndpoint.test.ts

@@ -1,7 +1,7 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import type { Organization, Token } from '@stamhoofd/models';
-import { OrganizationFactory, STPackageFactory, UserFactory } from '@stamhoofd/models';
-import { LimitedFilteredRequest, OrganizationMetaData, OrganizationType, PermissionLevel, Permissions, STPackageBundle, type StamhoofdFilter, UmbrellaOrganization } from '@stamhoofd/structures';
+import { DocumentTemplateFactory, OrganizationFactory, STPackageFactory, UserFactory } from '@stamhoofd/models';
+import { DocumentStatus, LimitedFilteredRequest, OrganizationMetaData, OrganizationRecordsConfiguration, OrganizationType, PermissionLevel, Permissions, RecordCategory, RecordSettings, RecordType, STPackageBundle, type StamhoofdFilter, TranslatedString, UmbrellaOrganization } from '@stamhoofd/structures';
 import { Country } from '@stamhoofd/types/Country';
 import { TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
@@ -229,4 +229,326 @@ describe('Endpoint.GetOrganizationsEndpoint', () => {
         expect(await filter({ createdAt: { $gt: anHourAgo } }, adminToken)).toContain(org.id);
         expect(await filter({ createdAt: { $gt: inAnHour } }, adminToken)).not.toContain(org.id);
     });
+
+    // Creates an organization with the given record categories (questionnaires) in its records configuration
+    const createOrganizationWithRecordCategories = async (name: string, recordCategories: RecordCategory[]) => {
+        const meta = OrganizationMetaData.create({
+            type: OrganizationType.Other,
+            umbrellaOrganization: null,
+            defaultEndDate: new Date(),
+            defaultStartDate: new Date(),
+            defaultPrices: [],
+            recordsConfiguration: OrganizationRecordsConfiguration.create({
+                recordCategories,
+            }),
+        });
+        return await new OrganizationFactory({ name, meta }).create();
+    };
+
+    const createTextRecord = (nameValue: string) => {
+        return RecordSettings.create({
+            name: TranslatedString.create(nameValue),
+            type: RecordType.Text,
+        });
+    };
+
+    test('Filters organizations by record category name', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const medicalOrg = await createOrganizationWithRecordCategories('Medical Questionnaire Club', [
+            RecordCategory.create({ name: TranslatedString.create('Medische fiche') }),
+        ]);
+        const consentOrg = await createOrganizationWithRecordCategories('Consent Questionnaire Club', [
+            RecordCategory.create({ name: TranslatedString.create('Toestemmingen') }),
+        ]);
+
+        const results = await filter({ recordCategoryName: { $contains: 'Medische' } }, adminToken);
+        expect(results).toContain(medicalOrg.id);
+        expect(results).not.toContain(consentOrg.id);
+    });
+
+    test('Matches questionnaire name regardless of the language of a translated name', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        // A name that is stored as a multi-language object (not a plain string)
+        const org = await createOrganizationWithRecordCategories('Multilingual Questionnaire Club', [
+            RecordCategory.create({
+                name: TranslatedString.create({ nl: 'Gezondheidsvragen', en: 'Health questions' }),
+            }),
+        ]);
+
+        expect(await filter({ recordCategoryName: { $contains: 'Gezondheidsvragen' } }, adminToken)).toContain(org.id);
+        expect(await filter({ recordCategoryName: { $contains: 'Health questions' } }, adminToken)).toContain(org.id);
+    });
+
+    test('Does not match a record name or child category name when filtering on record category name', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const org = await createOrganizationWithRecordCategories('Precise Questionnaire Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Algemeen'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Subcategorie'),
+                        records: [createTextRecord('Bloedgroep')],
+                    }),
+                ],
+            }),
+        ]);
+
+        // The top-level questionnaire name matches
+        expect(await filter({ recordCategoryName: { $contains: 'Algemeen' } }, adminToken)).toContain(org.id);
+        // A child category name is not a questionnaire
+        expect(await filter({ recordCategoryName: { $contains: 'Subcategorie' } }, adminToken)).not.toContain(org.id);
+        // A record name is not a questionnaire
+        expect(await filter({ recordCategoryName: { $contains: 'Bloedgroep' } }, adminToken)).not.toContain(org.id);
+    });
+
+    test('Filters organizations by a record name in a top-level record categories', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const org = await createOrganizationWithRecordCategories('Direct Question Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Algemeen'),
+                records: [createTextRecord('Bloedgroep')],
+            }),
+        ]);
+        const otherOrg = await createOrganizationWithRecordCategories('Other Question Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Algemeen'),
+                records: [createTextRecord('Schoenmaat')],
+            }),
+        ]);
+
+        const results = await filter({ recordName: { $contains: 'Bloedgroep' } }, adminToken);
+        expect(results).toContain(org.id);
+        expect(results).not.toContain(otherOrg.id);
+    });
+
+    test('Filters organizations by a record name nested in deep child categories', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        // Category -> child -> child -> child, with the record at the deepest level
+        const org = await createOrganizationWithRecordCategories('Deeply Nested Question Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Niveau 0'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Niveau 1'),
+                        childCategories: [
+                            RecordCategory.create({
+                                name: TranslatedString.create('Niveau 2'),
+                                childCategories: [
+                                    RecordCategory.create({
+                                        name: TranslatedString.create('Niveau 3'),
+                                        records: [createTextRecord('Diepe vraag')],
+                                    }),
+                                ],
+                            }),
+                        ],
+                    }),
+                ],
+            }),
+        ]);
+
+        const noMatchOrg = await createOrganizationWithRecordCategories('Shallow Question Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Niveau 0'),
+                records: [createTextRecord('Oppervlakkige vraag')],
+            }),
+        ]);
+
+        const results = await filter({ recordName: { $contains: 'Diepe vraag' } }, adminToken);
+        expect(results).toContain(org.id);
+        expect(results).not.toContain(noMatchOrg.id);
+    });
+
+    test('Filters organizations by a child (sub)category name', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const org = await createOrganizationWithRecordCategories('Child Category Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Algemeen'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Medische subcategorie'),
+                        records: [createTextRecord('Bloedgroep')],
+                    }),
+                ],
+            }),
+        ]);
+        const otherOrg = await createOrganizationWithRecordCategories('Other Child Category Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Algemeen'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Sportieve subcategorie'),
+                        records: [createTextRecord('Bloedgroep')],
+                    }),
+                ],
+            }),
+        ]);
+
+        const results = await filter({ recordChildCategoryName: { $contains: 'Medische subcategorie' } }, adminToken);
+        expect(results).toContain(org.id);
+        expect(results).not.toContain(otherOrg.id);
+    });
+
+    test('Does not match a top-level questionnaire name or record name when filtering on child category name', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const org = await createOrganizationWithRecordCategories('Precise Child Category Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Bovenliggende naam'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Onderliggende naam'),
+                        records: [createTextRecord('Vraagnaam')],
+                    }),
+                ],
+            }),
+        ]);
+
+        // The child category name matches
+        expect(await filter({ recordChildCategoryName: { $contains: 'Onderliggende naam' } }, adminToken)).toContain(org.id);
+        // A top-level questionnaire name is not a child category
+        expect(await filter({ recordChildCategoryName: { $contains: 'Bovenliggende naam' } }, adminToken)).not.toContain(org.id);
+        // A record name is not a child category
+        expect(await filter({ recordChildCategoryName: { $contains: 'Vraagnaam' } }, adminToken)).not.toContain(org.id);
+    });
+
+    test('Filters organizations by a child category name nested in deep child categories', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        // Category -> child -> child -> child, with the matching child category at the deepest level
+        const org = await createOrganizationWithRecordCategories('Deeply Nested Child Category Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Niveau 0'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Niveau 1'),
+                        childCategories: [
+                            RecordCategory.create({
+                                name: TranslatedString.create('Niveau 2'),
+                                childCategories: [
+                                    RecordCategory.create({
+                                        name: TranslatedString.create('Diepe subcategorie'),
+                                        records: [createTextRecord('Diepe vraag')],
+                                    }),
+                                ],
+                            }),
+                        ],
+                    }),
+                ],
+            }),
+        ]);
+
+        const noMatchOrg = await createOrganizationWithRecordCategories('Shallow Child Category Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Niveau 0'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Oppervlakkige subcategorie'),
+                    }),
+                ],
+            }),
+        ]);
+
+        const results = await filter({ recordChildCategoryName: { $contains: 'Diepe subcategorie' } }, adminToken);
+        expect(results).toContain(org.id);
+        expect(results).not.toContain(noMatchOrg.id);
+    });
+
+    test('Filters organizations by document template type', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const fiscalOrg = await new OrganizationFactory({ name: 'Fiscal Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: fiscalOrg.id, type: 'fiscal' }).create();
+
+        const participationOrg = await new OrganizationFactory({ name: 'Participation Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: participationOrg.id, type: 'participation' }).create();
+
+        const results = await filter({ documentTemplates: { $elemMatch: { type: { $in: ['fiscal'] } } } }, adminToken);
+        expect(results).toContain(fiscalOrg.id);
+        expect(results).not.toContain(participationOrg.id);
+    });
+
+    test('Filters organizations by document template year', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const org2024 = await new OrganizationFactory({ name: 'Document Year 2024 Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: org2024.id, year: 2024 }).create();
+
+        const org2023 = await new OrganizationFactory({ name: 'Document Year 2023 Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: org2023.id, year: 2023 }).create();
+
+        const results = await filter({ documentTemplates: { $elemMatch: { year: { $eq: 2024 } } } }, adminToken);
+        expect(results).toContain(org2024.id);
+        expect(results).not.toContain(org2023.id);
+    });
+
+    test('Filters organizations by document template status', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const publishedOrg = await new OrganizationFactory({ name: 'Published Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: publishedOrg.id, status: DocumentStatus.Published }).create();
+
+        const draftOrg = await new OrganizationFactory({ name: 'Draft Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: draftOrg.id, status: DocumentStatus.Draft }).create();
+
+        const results = await filter({ documentTemplates: { $elemMatch: { status: { $in: [DocumentStatus.Published] } } } }, adminToken);
+        expect(results).toContain(publishedOrg.id);
+        expect(results).not.toContain(draftOrg.id);
+    });
+
+    test('Filters organizations by document template isLocked', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const lockedOrg = await new OrganizationFactory({ name: 'Locked Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: lockedOrg.id, isLocked: true }).create();
+
+        const unlockedOrg = await new OrganizationFactory({ name: 'Unlocked Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: unlockedOrg.id, isLocked: false }).create();
+
+        const results = await filter({ documentTemplates: { $elemMatch: { isLocked: { $eq: true } } } }, adminToken);
+        expect(results).toContain(lockedOrg.id);
+        expect(results).not.toContain(unlockedOrg.id);
+    });
+
+    test('Filters organizations by document template updatesEnabled', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const noUpdatesOrg = await new OrganizationFactory({ name: 'No Updates Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: noUpdatesOrg.id, updatesEnabled: false }).create();
+
+        const updatesOrg = await new OrganizationFactory({ name: 'Updates Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: updatesOrg.id, updatesEnabled: true }).create();
+
+        const results = await filter({ documentTemplates: { $elemMatch: { updatesEnabled: { $eq: false } } } }, adminToken);
+        expect(results).toContain(noUpdatesOrg.id);
+        expect(results).not.toContain(updatesOrg.id);
+    });
+
+    test('Combines multiple document template conditions in a single $elemMatch', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const matchOrg = await new OrganizationFactory({ name: 'Matching Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: matchOrg.id, type: 'fiscal', year: 2025, status: DocumentStatus.Published }).create();
+
+        // Same org, but the conditions are split over two different templates: should not match a single-template $elemMatch
+        const splitOrg = await new OrganizationFactory({ name: 'Split Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: splitOrg.id, type: 'fiscal', year: 2020, status: DocumentStatus.Published }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: splitOrg.id, type: 'participation', year: 2025, status: DocumentStatus.Published }).create();
+
+        const results = await filter({
+            documentTemplates: {
+                $elemMatch: {
+                    type: { $in: ['fiscal'] },
+                    year: { $eq: 2025 },
+                },
+            },
+        }, adminToken);
+        expect(results).toContain(matchOrg.id);
+        expect(results).not.toContain(splitOrg.id);
+    });
 });

package/src/endpoints/global/members/GetMembersEndpoint.ts

@@ -44,8 +44,11 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
         const organization = Context.organization;
         let scopeFilter: StamhoofdFilter | undefined = undefined;
 
-        // First do a quick validation of the groups, so that prevents the backend from having to add a scope filter
-        if (!Context.auth.canAccessAllPlatformMembers(permissionLevel) && !await validateGroupFilter({ filter: q.filter, permissionLevel, key: 'registrations' })) {
+        if (organization && STAMHOOFD.userMode === 'organization' && await Context.auth.hasFullAccess(organization.id)) {
+            // Don't add any scoping. Organization id filter is added automatically.
+        } else if (!Context.auth.canAccessAllPlatformMembers(permissionLevel) && !await validateGroupFilter({ filter: q.filter, permissionLevel, key: 'registrations' })) {
+            // First do a quick validation of the groups, so that prevents the backend from having to add a scope filter
+
             if (!organization) {
                 const tags = Context.auth.getPlatformAccessibleOrganizationTags(permissionLevel);
                 if (tags !== 'all' && tags.length === 0) {
@@ -69,9 +72,7 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                         },
                     };
                 }
-            }
-
-            if (organization) {
+            } else {
                 // Add organization scope filter
                 if (await Context.auth.canAccessAllMembers(organization.id, permissionLevel)) {
                     if (await Context.auth.hasFullAccess(organization.id, permissionLevel)) {

package/src/endpoints/global/registration/GetRegistrationsEndpoint.ts

@@ -159,6 +159,10 @@ export class GetRegistrationsEndpoint extends Endpoint<Params, Query, Body, Resp
             .setMaxExecutionTime(15 * 1000)
             .where('registeredAt', '!=', null);
 
+        if (organization && STAMHOOFD.userMode === 'organization') {
+            query.where('organizationId', organization.id);
+        }
+
         if (scopeFilter) {
             query.where(await compileToSQLFilter(scopeFilter, filterCompilers));
         }

package/src/endpoints/global/registration/RegisterMembersEndpoint.test.ts

@@ -3266,7 +3266,7 @@ describe('Endpoint.RegisterMembers', () => {
 
             // #region act and assert
             await post(body1, organization, token);
-            await expect(post(body2, organization, token)).rejects.toThrow(/No permission to delete this registration/);
+            await expect(post(body2, organization, token)).rejects.toThrow(/Cannot delete inactive registration/);
             // #endregion
         });
     });

package/src/endpoints/organization/dashboard/receivable-balances/ChargeReceivableBalancesEndpoint.ts

@@ -12,6 +12,7 @@ import { PaymentService } from '../../../../services/PaymentService.js';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { PaymentMandateService } from '../../../../services/PaymentMandateService.js';
 import { BalanceItemService } from '../../../../services/BalanceItemService.js';
+import { QueueHandler } from '@stamhoofd/queues';
 
 type Params = Record<string, never>;
 type Query = CountFilteredRequest;
@@ -37,98 +38,116 @@ export class ChargeReceivableBalancesEndpoint extends Endpoint<Params, Query, Bo
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const sellingOrganization = await Context.setOrganizationScope();
         const { user } = await Context.authenticate();
-        const query = await GetReceivableBalancesEndpoint.buildQuery(request.query);
 
-        for await (const cachedBalance of query.all()) {
-            if (cachedBalance.organizationId !== sellingOrganization.id) {
-                throw new SimpleError({
-                    code: 'wrong_organization',
-                    message: 'Cannot charge a cached balance from a different organization',
-                });
-            }
-            // todo
-            const items = await CachedBalance.balanceForObjects(cachedBalance.organizationId, [cachedBalance.objectId], cachedBalance.objectType);
+        if (!await Context.auth.canManageFinances(sellingOrganization.id)) {
+            throw Context.auth.error();
+        }
+        const queueId = 'charge-receivable-balances/' + sellingOrganization.id;
 
-            if (items.length === 0) {
-                console.log('Nothing to charge for', cachedBalance.id);
-                continue;
-            }
+        if (QueueHandler.isRunning(queueId)) {
+            throw new SimpleError({
+                code: 'charge_pending',
+                message: 'Already pending charge',
+                human: $t('%Zbh'),
+            });
+        }
 
-            const map: Map<BalanceItem, number> = new Map();
-            let total = 0;
-            for (const i of items) {
-                map.set(i, i.priceOpen);
-                total += i.priceOpen;
-            }
-            if (total <= 0) {
-                continue;
-            }
+        await QueueHandler.schedule(queueId, async () => {
+            const query = await GetReceivableBalancesEndpoint.buildQuery(request.query);
 
-            let payingOrganization: Organization | null = null;
-            let customerUser: User | null = null;
-            if (cachedBalance.objectType === ReceivableBalanceType.organization) {
-                const p = await Organization.getByID(cachedBalance.objectId);
-                if (!p || !(await Context.auth.hasFullAccess(p))) {
-                    console.error('Unexpected missing paying organization id', cachedBalance);
+            for await (const cachedBalance of query.all()) {
+                if (cachedBalance.organizationId !== sellingOrganization.id) {
+                    throw new SimpleError({
+                        code: 'wrong_organization',
+                        message: 'Cannot charge a cached balance from a different organization',
+                    });
+                }
+                // todo
+                const items = await CachedBalance.balanceForObjects(cachedBalance.organizationId, [cachedBalance.objectId], cachedBalance.objectType);
+
+                if (items.length === 0) {
+                    console.log('Nothing to charge for', cachedBalance.id);
                     continue;
                 }
-                payingOrganization = p;
-            }
 
-            if (cachedBalance.objectType === ReceivableBalanceType.user || cachedBalance.objectType === ReceivableBalanceType.userWithoutMembers) {
-                const p = await User.getByID(cachedBalance.objectId);
-                if (!p || !(Context.auth.checkScope(p.organizationId))) {
-                    console.error('Unexpected missing customer user id', cachedBalance);
+                const map: Map<BalanceItem, number> = new Map();
+                let total = 0;
+                for (const i of items) {
+                    map.set(i, i.priceOpen);
+                    total += i.priceOpen;
+                }
+                if (total <= 0) {
                     continue;
                 }
-                customerUser = p;
-            }
 
-            const mandates = await PaymentMandateService.getMandates({
-                sellingOrganization,
-                user: customerUser,
-                payingOrganization,
-            });
+                let payingOrganization: Organization | null = null;
+                let customerUser: User | null = null;
+                if (cachedBalance.objectType === ReceivableBalanceType.organization) {
+                    const p = await Organization.getByID(cachedBalance.objectId);
+                    if (!p || !(await Context.auth.hasFullAccess(p))) {
+                        console.error('Unexpected missing paying organization id', cachedBalance);
+                        continue;
+                    }
+                    payingOrganization = p;
+                }
 
-            const mandate = mandates.find(m => m.isDefault);
+                if (cachedBalance.objectType === ReceivableBalanceType.user || cachedBalance.objectType === ReceivableBalanceType.userWithoutMembers) {
+                    const p = await User.getByID(cachedBalance.objectId);
+                    if (!p || !(Context.auth.checkScope(p.organizationId))) {
+                        console.error('Unexpected missing customer user id', cachedBalance);
+                        continue;
+                    }
+                    customerUser = p;
+                }
+
+                const mandates = await PaymentMandateService.getMandates({
+                    sellingOrganization,
+                    user: customerUser,
+                    payingOrganization,
+                });
+
+                const mandate = mandates.find(m => m.isDefault);
 
-            if (!mandate) {
+                if (!mandate) {
                 // Not possible
-                console.error('No mandates found for', cachedBalance.id);
-                continue;
-            }
+                    console.error('No mandates found for', cachedBalance.id);
+                    continue;
+                }
 
-            customerUser = customerUser ?? (payingOrganization ? (await payingOrganization.getFullAdmins())[0] : null);
-            const customer = PaymentCustomer.create({
-                firstName: customerUser?.firstName,
-                lastName: customerUser?.lastName,
-                email: customerUser?.email ?? (payingOrganization ? (await payingOrganization.getReplyEmails())[0].email : null),
-                company: payingOrganization?.defaultCompanies[0],
-            });
+                customerUser = customerUser ?? (payingOrganization ? (await payingOrganization.getFullAdmins())[0] : null);
+                const customer = PaymentCustomer.create({
+                    firstName: customerUser?.firstName,
+                    lastName: customerUser?.lastName,
+                    email: customerUser?.email ?? (payingOrganization ? (await payingOrganization.getReplyEmails())[0].email : null),
+                    company: payingOrganization?.defaultCompanies[0],
+                });
 
-            await PaymentService.createPayment({
-                balanceItems: map,
-                checkout: {
-                    paymentMethod: PaymentMethod.Unknown,
-                    totalPrice: null,
-                    customer,
-                    cancelUrl: null,
-                    redirectUrl: null,
-                },
-                user: customerUser,
-                adminUserId: user.id,
-                organization: sellingOrganization,
-                payingOrganization,
-                serviceFeeType: 'system',
-                createMandate: null,
-                useMandate: mandate,
-                paymentConfiguration: sellingOrganization.meta.registrationPaymentConfiguration,
-                privatePaymentConfiguration: sellingOrganization.privateMeta.registrationPaymentConfiguration,
-            });
-        }
+                await PaymentService.createPayment({
+                    balanceItems: map,
+                    checkout: {
+                        paymentMethod: PaymentMethod.Unknown,
+                        totalPrice: null,
+                        customer,
+                        cancelUrl: null,
+                        redirectUrl: null,
+                    },
+                    user: customerUser,
+                    adminUserId: user.id,
+                    organization: sellingOrganization,
+                    payingOrganization,
+                    serviceFeeType: 'system',
+                    createMandate: null,
+                    useMandate: mandate,
+                    paymentConfiguration: sellingOrganization.meta.registrationPaymentConfiguration,
+                    privatePaymentConfiguration: sellingOrganization.privateMeta.registrationPaymentConfiguration,
+                });
+
+                // Clear cache while looping, to update the table while we are charging
+                // Make sure the user can refresh data and see the updated cached amounts
+                await BalanceItemService.flushCaches(sellingOrganization.id);
+            }
+        });
 
-        // Make sure the user can refresh data and see the updated cached amounts
-        await BalanceItemService.flushCaches(sellingOrganization.id);
         return new Response(undefined, 201);
     }
 }

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.test.ts

@@ -1,7 +1,7 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import type { Organization } from '@stamhoofd/models';
-import { GroupFactory, OrganizationFactory, OrganizationRegistrationPeriod, OrganizationRegistrationPeriodFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
-import { GroupSettings, Group as GroupStruct, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, PermissionLevel, Permissions, Version } from '@stamhoofd/structures';
+import { Group, GroupFactory, OrganizationFactory, OrganizationRegistrationPeriod, OrganizationRegistrationPeriodFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import { GroupCategory, GroupSettings, Group as GroupStruct, GroupType, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, PermissionLevel, Permissions, TranslatedString, Version } from '@stamhoofd/structures';
 
 import type { PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { PatchableArray } from '@simonbackx/simple-encoding';
@@ -153,6 +153,65 @@ describe('Endpoint.PatchOrganizationRegistrationPeriods', () => {
             expect(response.body).toBeDefined();
         });
 
+        test('should copy groups that reference a waiting list', async () => {
+            const organization = await new OrganizationFactory({ }).create();
+
+            // create period
+            const startDate = new Date(Date.now() + 5 * 24 * 60 * 60 * 1000);
+            const endDate = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000);
+
+            const newPeriod = await new RegistrationPeriodFactory({
+                organization,
+                startDate,
+                endDate,
+            }).create();
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const token = await Token.createToken(user);
+
+            // A waiting list group and a regular group that references it. The regular group is
+            // listed BEFORE the waiting list, reproducing the ordering produced by Group.defaultSort
+            // when duplicating a period (groups with a maxAge sort before waiting lists).
+            const waitingListGroup = GroupStruct.create({
+                type: GroupType.WaitingList,
+                settings: GroupSettings.create({ name: TranslatedString.create('Wachtlijst') }),
+            });
+
+            const regularGroup = GroupStruct.create({
+                type: GroupType.Membership,
+                settings: GroupSettings.create({ name: TranslatedString.create('Kapoenen'), maxAge: 8 }),
+                waitingList: waitingListGroup,
+            });
+
+            const newOrganizationPeriod = OrganizationRegistrationPeriodStruct.create({
+                period: newPeriod.getStructure(),
+            });
+            newOrganizationPeriod.groups.push(regularGroup, waitingListGroup);
+            newOrganizationPeriod.settings.categories = [
+                GroupCategory.create({ id: 'root', groupIds: [regularGroup.id] }),
+            ];
+            newOrganizationPeriod.settings.rootCategoryId = 'root';
+
+            const patch: PatchableArrayAutoEncoder<OrganizationRegistrationPeriodStruct> = new PatchableArray();
+            patch.addPut(newOrganizationPeriod);
+
+            const response = await patchOrganizationRegistrationPeriods({ patch, organization, token });
+            expect(response.body).toBeDefined();
+
+            // Both the regular group and its waiting list should have been created
+            const createdGroups = await Group.getAll(organization.id, newPeriod.id, true, [GroupType.Membership, GroupType.WaitingList]);
+            const regular = createdGroups.find(g => g.id === regularGroup.id);
+            const waitingList = createdGroups.find(g => g.id === waitingListGroup.id);
+
+            expect(waitingList).toBeDefined();
+            expect(regular).toBeDefined();
+            expect(regular!.waitingListId).toBe(waitingListGroup.id);
+        });
+
         test('should not be able to patch groups of other organization', async () => {
             const organization = await new OrganizationFactory({ }).create();
             const otherOrganization = await new OrganizationFactory({ }).create();

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -342,7 +342,20 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
         organizationPeriod.settings = struct.settings;
         await organizationPeriod.save();
 
-        for (const s of struct.groups) {
+        // Create waiting list groups first: a regular group referencing a waiting list requires
+        // that waiting list group to already exist in the same period (see createGroup), otherwise
+        // it fails with 'Waiting list not found' and gets silently skipped below.
+        const sortedGroups = [...struct.groups].sort((a, b) => {
+            if (a.type === GroupType.WaitingList && b.type !== GroupType.WaitingList) {
+                return -1;
+            }
+            if (b.type === GroupType.WaitingList && a.type !== GroupType.WaitingList) {
+                return 1;
+            }
+            return 0;
+        });
+
+        for (const s of sortedGroups) {
             s.settings.registeredMembers = 0;
             s.settings.reservedMembers = 0;
             try {

package/src/helpers/AdminPermissionChecker.ts

@@ -486,9 +486,21 @@ export class AdminPermissionChecker {
      * Note: only checks admin permissions. Users that 'own' this member can also access it but that does not use the AdminPermissionChecker
      */
     async canAccessRegistration(registration: Registration, permissionLevel: PermissionLevel = PermissionLevel.Read, checkMember: boolean | MemberWithUsersRegistrationsAndGroups = true) {
+        const organizationPermissions = await this.getOrganizationPermissions(registration.organizationId);
+
+        if (!organizationPermissions) {
+            return false;
+        }
+
+        if (organizationPermissions.hasAccess(PermissionLevel.Full)) {
+            // Only full permissions; because non-full doesn't have access to other periods
+            return true;
+        }
+
+        // Non full admin logic
         if (registration.deactivatedAt || !registration.registeredAt) {
             if (!checkMember) {
-                // We can't grant access to a member because of a deactivated registration
+                // We can't grant access to a member because of a deactivated registration - unless full permission
                 return false;
             }
 
@@ -499,16 +511,6 @@ export class AdminPermissionChecker {
             }
         }
 
-        const organizationPermissions = await this.getOrganizationPermissions(registration.organizationId);
-
-        if (!organizationPermissions) {
-            return false;
-        }
-
-        if (organizationPermissions.hasAccess(PermissionLevel.Full)) {
-            // Only full permissions; because non-full doesn't have access to other periods
-            return true;
-        }
         const organization = await this.getOrganization(registration.organizationId);
 
         if (registration.periodId !== organization.periodId) {

package/src/helpers/AuthenticatedStructures.ts

@@ -514,6 +514,9 @@ export class AuthenticatedStructures {
         }
 
         for (const member of members) {
+            if (member.organizationId) {
+                organizationIds.push(member.organizationId);
+            }
             for (const registration of member.registrations) {
                 organizationIds.push(registration.organizationId);
             }
@@ -620,14 +623,8 @@ export class AuthenticatedStructures {
                 group: Group;
             })[] = [];
             const userManager = Context.auth.isUserManager(member);
+
             for (const registration of member.registrations) {
-                if (includeContextOrganization || registration.organizationId !== Context.auth.organization?.id) {
-                    const found = organizations.get(registration.id);
-                    if (!found) {
-                        const organization = await Context.auth.getOrganization(registration.organizationId);
-                        organizations.set(organization.id, organization);
-                    }
-                }
                 if (organizations.get(registration.organizationId)?.active || (Context.auth.organization && Context.auth.organization.active && registration.organizationId === Context.auth.organization.id) || await Context.auth.hasFullAccess(registration.organizationId)) {
                     if (
                         !!options?.forAdminCartCalculation
@@ -639,6 +636,7 @@ export class AuthenticatedStructures {
                     }
                 }
             }
+
             member.registrations = filtered;
             const balancesPermission = (!!options?.forAdminCartCalculation) || await Context.auth.hasFinancialMemberAccess(member, PermissionLevel.Read, Context.organization?.id);
 

package/src/migrations/1783342463-remove-platform-uitpas-flag.ts

@@ -0,0 +1,25 @@
+import { Migration } from '@simonbackx/simple-database';
+import { Platform } from '@stamhoofd/models';
+
+export default new Migration(async () => {
+    if (STAMHOOFD.environment === 'test') {
+        console.log('skipped in tests');
+        return;
+    }
+
+    const platform = await Platform.getForEditing();
+
+    if (!platform.config.featureFlags.includes('uitpas')) {
+        console.log('Platform does not have the uitpas feature flag, nothing to migrate');
+        return;
+    }
+
+    // The uitpas (UiTPAS social tariff on webshops) feature flag is now controlled
+    // per organization instead of platform-wide. Remove it from the platform config
+    // so it no longer implicitly enables the feature for every organization.
+    platform.config.featureFlags = platform.config.featureFlags.filter(f => f !== 'uitpas');
+    await platform.save();
+    await Platform.clearCache();
+
+    console.log('Removed the uitpas feature flag from the platform config');
+});

package/src/services/MollieService.ts

@@ -251,7 +251,7 @@ export class MollieService {
             details: PaymentMandateDetails.create({
                 name: ('consumerName' in details ? details.consumerName : details.cardHolder) ?? undefined,
                 cardNumber: 'cardNumber' in details ? details.cardNumber : null,
-                iban: 'consumerAccount' in details ? details.consumerAccount : null,
+                iban: 'consumerAccount' in details ? Formatter.iban(details.consumerAccount) : null,
                 bic: ('consumerBic' in details ? details.consumerBic : undefined),
                 expiryDate: ('cardExpiryDate' in details ? DateTime.fromISO(details.cardExpiryDate, { zone: Formatter.timezone }).toJSDate() : null), // todo: parse date correctly in Brussels timezone!
                 brand: ('cardLabel' in details ? details.cardLabel : null),

package/src/services/SSOService.ts

@@ -61,6 +61,10 @@ export class SSOService {
         this.provider = data.provider;
         this.platform = data.platform;
         this.organization = data.organization ?? null;
+
+        if (STAMHOOFD.userMode === 'platform' && this.organization) {
+            throw new Error('SSO provided by organization disabled in platform mode');
+        }
     }
 
     static async clearExpiredTokensOrFromUser(userId: string | null = null) {
@@ -371,7 +375,7 @@ export class SSOService {
             if (token) {
                 user = await User.getByID(token.userId);
 
-                if (!user) {
+                if (!user || user.organizationId !== (this.organization?.id ?? null)) {
                     throw new SimpleError({
                         code: 'invalid_user',
                         message: 'User not found',

package/src/services/uitpas/searchUitpasEvents.ts

@@ -1,16 +1,27 @@
 import { UitpasEventResponse, UitpasEventsResponse } from '@stamhoofd/structures';
 import { SimpleError } from '@simonbackx/simple-errors';
 
+/* Pick a translated string, prefer 'nl' */
+function pickTranslation(value: unknown): string {
+    if (typeof value !== 'object' || value === null) {
+        return '';
+    }
+    const entries = Object.entries(value as Record<string, unknown>).filter((e): e is [string, string] => typeof e[1] === 'string');
+    if (entries.length === 0) {
+        return '';
+    }
+    const nl = entries.find(([key]) => key === 'nl');
+    return nl ? nl[1] : entries[0][1];
+}
+
 type EventsResponse = {
     totalItems: number;
     itemsPerPage: number;
     member: Array<{
         '@id': string;
-        'name': {
-            nl: string;
-        };
+        'name': Record<string, string>;
         'location': {
-            name: object;
+            name: Record<string, string>;
         };
         'startDate'?: string;
         'endDate'?: string;
@@ -33,10 +44,7 @@ function assertIsEventsResponse(json: unknown): asserts json is EventsResponse {
             || !('@id' in member)
             || typeof member['@id'] !== 'string'
             || !('name' in member)
-            || typeof member.name !== 'object'
-            || member.name === null
-            || !('nl' in member.name)
-            || typeof member.name.nl !== 'string'
+            || pickTranslation(member.name) === ''
             || !('location' in member)
             || typeof member.location !== 'object'
             || member.location === null
@@ -111,6 +119,10 @@ export async function searchUitpasEvents(clientId: string, uitpasOrganizerId: st
         });
     });
 
+    return parseUitpasEventsResponse(json);
+}
+
+export function parseUitpasEventsResponse(json: unknown): UitpasEventsResponse {
     assertIsEventsResponse(json);
     const eventsResponse = new UitpasEventsResponse();
     eventsResponse.totalItems = json.totalItems;
@@ -118,16 +130,8 @@ export async function searchUitpasEvents(clientId: string, uitpasOrganizerId: st
     eventsResponse.member = json.member.map((member) => {
         const event = new UitpasEventResponse();
         event.url = member['@id'];
-        event.name = member.name.nl;
-        const locationName = member.location.name as Record<string, string>;
-        const entrs = Object.entries(locationName);
-        const hasNl = entrs.find(([key]) => key === 'nl');
-        if (hasNl) {
-            event.location = locationName.nl;
-        } else {
-            const lang = entrs[0];
-            event.location = lang ? lang[1] : '';
-        }
+        event.name = pickTranslation(member.name);
+        event.location = pickTranslation(member.location.name);
         if (member.startDate) {
             event.startDate = new Date(member.startDate);
         }

package/src/sql-filters/organizations.ts

@@ -69,6 +69,58 @@ export const organizationFilterCompilers: SQLFilterDefinitions = {
         type: SQLValueType.JSONArray,
         nullable: false,
     }),
+    recordCategoryName: createColumnFilter({
+        expression: SQL.jsonExtract(SQL.column('organizations', 'meta'), '$.value.recordsConfiguration.recordCategories[*].name'),
+        type: SQLValueType.JSONArray,
+        nullable: true,
+    }),
+    // Name of a child (sub)category in any record category, at any nesting depth
+    recordChildCategoryName: createColumnFilter({
+        expression: SQL.jsonExtract(SQL.column('organizations', 'meta'), '$.value.recordsConfiguration.recordCategories**.childCategories[*].name'),
+        type: SQLValueType.JSONArray,
+        nullable: true,
+    }),
+    recordName: createColumnFilter({
+        expression: SQL.jsonExtract(SQL.column('organizations', 'meta'), '$.value.recordsConfiguration.recordCategories**.records[*].name'),
+        type: SQLValueType.JSONArray,
+        nullable: true,
+    }),
+    documentTemplates: createExistsFilter(
+        SQL.select()
+            .from(SQL.table('document_templates'))
+            .where(
+                SQL.column('document_templates', 'organizationId'),
+                SQL.column('organizations', 'id'),
+            ),
+        {
+            ...baseSQLFilterCompilers,
+            type: createColumnFilter({
+                expression: SQL.jsonExtract(SQL.column('document_templates', 'privateSettings'), '$.value.templateDefinition.type'),
+                type: SQLValueType.JSONString,
+                nullable: true,
+            }),
+            year: createColumnFilter({
+                expression: SQL.column('document_templates', 'year'),
+                type: SQLValueType.Number,
+                nullable: false,
+            }),
+            status: createColumnFilter({
+                expression: SQL.column('document_templates', 'status'),
+                type: SQLValueType.String,
+                nullable: false,
+            }),
+            isLocked: createColumnFilter({
+                expression: SQL.column('document_templates', 'isLocked'),
+                type: SQLValueType.Boolean,
+                nullable: false,
+            }),
+            updatesEnabled: createColumnFilter({
+                expression: SQL.column('document_templates', 'updatesEnabled'),
+                type: SQLValueType.Boolean,
+                nullable: false,
+            }),
+        },
+    ),
     setupSteps: createExistsFilter(
         SQL.select()
             .from(SQL.table('organization_registration_periods'))