@stamhoofd/backend 2.129.3 → 2.131.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.129.3",
+    "version": "2.131.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -57,20 +57,20 @@
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.129.3",
-        "@stamhoofd/backend-i18n": "2.129.3",
-        "@stamhoofd/backend-middleware": "2.129.3",
-        "@stamhoofd/crons": "2.129.3",
-        "@stamhoofd/email": "2.129.3",
-        "@stamhoofd/excel-writer": "2.129.3",
-        "@stamhoofd/logging": "2.129.3",
-        "@stamhoofd/models": "2.129.3",
-        "@stamhoofd/object-differ": "2.129.3",
-        "@stamhoofd/queues": "2.129.3",
-        "@stamhoofd/sql": "2.129.3",
-        "@stamhoofd/structures": "2.129.3",
-        "@stamhoofd/types": "2.129.3",
-        "@stamhoofd/utility": "2.129.3",
+        "@stamhoofd/backend-env": "2.131.0",
+        "@stamhoofd/backend-i18n": "2.131.0",
+        "@stamhoofd/backend-middleware": "2.131.0",
+        "@stamhoofd/crons": "2.131.0",
+        "@stamhoofd/email": "2.131.0",
+        "@stamhoofd/excel-writer": "2.131.0",
+        "@stamhoofd/logging": "2.131.0",
+        "@stamhoofd/models": "2.131.0",
+        "@stamhoofd/object-differ": "2.131.0",
+        "@stamhoofd/queues": "2.131.0",
+        "@stamhoofd/sql": "2.131.0",
+        "@stamhoofd/structures": "2.131.0",
+        "@stamhoofd/types": "2.131.0",
+        "@stamhoofd/utility": "2.131.0",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.129.3",
+        "@stamhoofd/test-utils": "2.131.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "982b7912b141d0149eb2ad89cd2120e073251e66"
+    "gitHead": "51de524c831dac65960440d9a5aabe9cad1feae8"
 }

package/src/crons/index.ts

@@ -11,6 +11,7 @@ import './invoices.js';
 import './service-fees.js';
 import './members-fees.js';
 import './stripe-invoices.js';
+import './stripe-payout-reports.js';
 import './transfer-fees.js';
 import './drip-emails.js';
 import './update-organization-future-events.js';

package/src/crons/stripe-payout-reports.ts

@@ -0,0 +1,69 @@
+import { registerCron } from '@stamhoofd/crons';
+import { Organization, Platform } from '@stamhoofd/models';
+import { Formatter } from '@stamhoofd/utility';
+import { StripePayoutReporter } from '../helpers/StripePayoutReporter.js';
+
+registerCron('stripe-payout-reports', createStripePayoutReports);
+
+let lastStripeReport: Date | null = null;
+
+/**
+ * Sends a monthly report of all Stripe payouts of the previous month, so we can check
+ * whether everything we charged via Stripe application fees was invoiced correctly.
+ */
+async function createStripePayoutReports() {
+    if (STAMHOOFD.environment !== 'production') {
+        return;
+    }
+
+    if (STAMHOOFD.userMode === 'platform') {
+        return;
+    }
+
+    if (STAMHOOFD.STRIPE_CONNECT_METHOD === 'standard') {
+        return;
+    }
+
+    if (new Date().getHours() > 5 || new Date().getHours() < 2) {
+        // Fix for sending emails after deployments
+        return;
+    }
+
+    // Send the report on the 6th day of the month, once
+    const today = new Date();
+    if (today.getDate() !== 6 || (lastStripeReport && Formatter.dateWithoutDay(lastStripeReport) === Formatter.dateWithoutDay(today))) {
+        return;
+    }
+
+    if (!STAMHOOFD.STRIPE_SECRET_KEY) {
+        console.log('No stripe key set');
+        return;
+    }
+
+    const membershipOrganizationId = (await Platform.getShared()).membershipOrganizationId;
+    if (!membershipOrganizationId) {
+        return;
+    }
+
+    const membershipOrganization = await Organization.getByID(membershipOrganizationId, true);
+
+    console.log('Creating Stripe payout report...');
+
+    // Previous month
+    const previousMonthStart = new Date(today.getFullYear(), today.getMonth() - 1, 1);
+    const end = new Date(new Date(today.getFullYear(), today.getMonth(), 1).getTime() - 1000);
+
+    const reporter = new StripePayoutReporter({
+        secretKey: STAMHOOFD.STRIPE_SECRET_KEY,
+        sellingOrganization: membershipOrganization,
+    });
+
+    await reporter.build(previousMonthStart, end);
+    await reporter.sendEmail({
+        to: [{ email: 'simon@stamhoofd.be' }],
+        // Only send the report to the extra (accounting) recipients when it is complete and valid
+        extraRecipientsWhenValid: (STAMHOOFD.STRIPE_PAYOUT_REPORT_EMAILS ?? []).map(email => ({ email })),
+    });
+
+    lastStripeReport = new Date();
+}

package/src/endpoints/admin/organizations/GetOrganizationsEndpoint.test.ts

@@ -1,7 +1,7 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import type { Organization, Token } from '@stamhoofd/models';
-import { OrganizationFactory, STPackageFactory, UserFactory } from '@stamhoofd/models';
-import { LimitedFilteredRequest, OrganizationMetaData, OrganizationType, PermissionLevel, Permissions, STPackageBundle, type StamhoofdFilter, UmbrellaOrganization } from '@stamhoofd/structures';
+import { DocumentTemplateFactory, OrganizationFactory, STPackageFactory, UserFactory } from '@stamhoofd/models';
+import { DocumentStatus, LimitedFilteredRequest, OrganizationMetaData, OrganizationRecordsConfiguration, OrganizationType, PermissionLevel, Permissions, RecordCategory, RecordSettings, RecordType, STPackageBundle, type StamhoofdFilter, TranslatedString, UmbrellaOrganization } from '@stamhoofd/structures';
 import { Country } from '@stamhoofd/types/Country';
 import { TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
@@ -229,4 +229,326 @@ describe('Endpoint.GetOrganizationsEndpoint', () => {
         expect(await filter({ createdAt: { $gt: anHourAgo } }, adminToken)).toContain(org.id);
         expect(await filter({ createdAt: { $gt: inAnHour } }, adminToken)).not.toContain(org.id);
     });
+
+    // Creates an organization with the given record categories (questionnaires) in its records configuration
+    const createOrganizationWithRecordCategories = async (name: string, recordCategories: RecordCategory[]) => {
+        const meta = OrganizationMetaData.create({
+            type: OrganizationType.Other,
+            umbrellaOrganization: null,
+            defaultEndDate: new Date(),
+            defaultStartDate: new Date(),
+            defaultPrices: [],
+            recordsConfiguration: OrganizationRecordsConfiguration.create({
+                recordCategories,
+            }),
+        });
+        return await new OrganizationFactory({ name, meta }).create();
+    };
+
+    const createTextRecord = (nameValue: string) => {
+        return RecordSettings.create({
+            name: TranslatedString.create(nameValue),
+            type: RecordType.Text,
+        });
+    };
+
+    test('Filters organizations by record category name', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const medicalOrg = await createOrganizationWithRecordCategories('Medical Questionnaire Club', [
+            RecordCategory.create({ name: TranslatedString.create('Medische fiche') }),
+        ]);
+        const consentOrg = await createOrganizationWithRecordCategories('Consent Questionnaire Club', [
+            RecordCategory.create({ name: TranslatedString.create('Toestemmingen') }),
+        ]);
+
+        const results = await filter({ recordCategoryName: { $contains: 'Medische' } }, adminToken);
+        expect(results).toContain(medicalOrg.id);
+        expect(results).not.toContain(consentOrg.id);
+    });
+
+    test('Matches questionnaire name regardless of the language of a translated name', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        // A name that is stored as a multi-language object (not a plain string)
+        const org = await createOrganizationWithRecordCategories('Multilingual Questionnaire Club', [
+            RecordCategory.create({
+                name: TranslatedString.create({ nl: 'Gezondheidsvragen', en: 'Health questions' }),
+            }),
+        ]);
+
+        expect(await filter({ recordCategoryName: { $contains: 'Gezondheidsvragen' } }, adminToken)).toContain(org.id);
+        expect(await filter({ recordCategoryName: { $contains: 'Health questions' } }, adminToken)).toContain(org.id);
+    });
+
+    test('Does not match a record name or child category name when filtering on record category name', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const org = await createOrganizationWithRecordCategories('Precise Questionnaire Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Algemeen'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Subcategorie'),
+                        records: [createTextRecord('Bloedgroep')],
+                    }),
+                ],
+            }),
+        ]);
+
+        // The top-level questionnaire name matches
+        expect(await filter({ recordCategoryName: { $contains: 'Algemeen' } }, adminToken)).toContain(org.id);
+        // A child category name is not a questionnaire
+        expect(await filter({ recordCategoryName: { $contains: 'Subcategorie' } }, adminToken)).not.toContain(org.id);
+        // A record name is not a questionnaire
+        expect(await filter({ recordCategoryName: { $contains: 'Bloedgroep' } }, adminToken)).not.toContain(org.id);
+    });
+
+    test('Filters organizations by a record name in a top-level record categories', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const org = await createOrganizationWithRecordCategories('Direct Question Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Algemeen'),
+                records: [createTextRecord('Bloedgroep')],
+            }),
+        ]);
+        const otherOrg = await createOrganizationWithRecordCategories('Other Question Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Algemeen'),
+                records: [createTextRecord('Schoenmaat')],
+            }),
+        ]);
+
+        const results = await filter({ recordName: { $contains: 'Bloedgroep' } }, adminToken);
+        expect(results).toContain(org.id);
+        expect(results).not.toContain(otherOrg.id);
+    });
+
+    test('Filters organizations by a record name nested in deep child categories', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        // Category -> child -> child -> child, with the record at the deepest level
+        const org = await createOrganizationWithRecordCategories('Deeply Nested Question Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Niveau 0'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Niveau 1'),
+                        childCategories: [
+                            RecordCategory.create({
+                                name: TranslatedString.create('Niveau 2'),
+                                childCategories: [
+                                    RecordCategory.create({
+                                        name: TranslatedString.create('Niveau 3'),
+                                        records: [createTextRecord('Diepe vraag')],
+                                    }),
+                                ],
+                            }),
+                        ],
+                    }),
+                ],
+            }),
+        ]);
+
+        const noMatchOrg = await createOrganizationWithRecordCategories('Shallow Question Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Niveau 0'),
+                records: [createTextRecord('Oppervlakkige vraag')],
+            }),
+        ]);
+
+        const results = await filter({ recordName: { $contains: 'Diepe vraag' } }, adminToken);
+        expect(results).toContain(org.id);
+        expect(results).not.toContain(noMatchOrg.id);
+    });
+
+    test('Filters organizations by a child (sub)category name', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const org = await createOrganizationWithRecordCategories('Child Category Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Algemeen'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Medische subcategorie'),
+                        records: [createTextRecord('Bloedgroep')],
+                    }),
+                ],
+            }),
+        ]);
+        const otherOrg = await createOrganizationWithRecordCategories('Other Child Category Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Algemeen'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Sportieve subcategorie'),
+                        records: [createTextRecord('Bloedgroep')],
+                    }),
+                ],
+            }),
+        ]);
+
+        const results = await filter({ recordChildCategoryName: { $contains: 'Medische subcategorie' } }, adminToken);
+        expect(results).toContain(org.id);
+        expect(results).not.toContain(otherOrg.id);
+    });
+
+    test('Does not match a top-level questionnaire name or record name when filtering on child category name', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const org = await createOrganizationWithRecordCategories('Precise Child Category Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Bovenliggende naam'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Onderliggende naam'),
+                        records: [createTextRecord('Vraagnaam')],
+                    }),
+                ],
+            }),
+        ]);
+
+        // The child category name matches
+        expect(await filter({ recordChildCategoryName: { $contains: 'Onderliggende naam' } }, adminToken)).toContain(org.id);
+        // A top-level questionnaire name is not a child category
+        expect(await filter({ recordChildCategoryName: { $contains: 'Bovenliggende naam' } }, adminToken)).not.toContain(org.id);
+        // A record name is not a child category
+        expect(await filter({ recordChildCategoryName: { $contains: 'Vraagnaam' } }, adminToken)).not.toContain(org.id);
+    });
+
+    test('Filters organizations by a child category name nested in deep child categories', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        // Category -> child -> child -> child, with the matching child category at the deepest level
+        const org = await createOrganizationWithRecordCategories('Deeply Nested Child Category Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Niveau 0'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Niveau 1'),
+                        childCategories: [
+                            RecordCategory.create({
+                                name: TranslatedString.create('Niveau 2'),
+                                childCategories: [
+                                    RecordCategory.create({
+                                        name: TranslatedString.create('Diepe subcategorie'),
+                                        records: [createTextRecord('Diepe vraag')],
+                                    }),
+                                ],
+                            }),
+                        ],
+                    }),
+                ],
+            }),
+        ]);
+
+        const noMatchOrg = await createOrganizationWithRecordCategories('Shallow Child Category Club', [
+            RecordCategory.create({
+                name: TranslatedString.create('Niveau 0'),
+                childCategories: [
+                    RecordCategory.create({
+                        name: TranslatedString.create('Oppervlakkige subcategorie'),
+                    }),
+                ],
+            }),
+        ]);
+
+        const results = await filter({ recordChildCategoryName: { $contains: 'Diepe subcategorie' } }, adminToken);
+        expect(results).toContain(org.id);
+        expect(results).not.toContain(noMatchOrg.id);
+    });
+
+    test('Filters organizations by document template type', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const fiscalOrg = await new OrganizationFactory({ name: 'Fiscal Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: fiscalOrg.id, type: 'fiscal' }).create();
+
+        const participationOrg = await new OrganizationFactory({ name: 'Participation Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: participationOrg.id, type: 'participation' }).create();
+
+        const results = await filter({ documentTemplates: { $elemMatch: { type: { $in: ['fiscal'] } } } }, adminToken);
+        expect(results).toContain(fiscalOrg.id);
+        expect(results).not.toContain(participationOrg.id);
+    });
+
+    test('Filters organizations by document template year', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const org2024 = await new OrganizationFactory({ name: 'Document Year 2024 Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: org2024.id, year: 2024 }).create();
+
+        const org2023 = await new OrganizationFactory({ name: 'Document Year 2023 Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: org2023.id, year: 2023 }).create();
+
+        const results = await filter({ documentTemplates: { $elemMatch: { year: { $eq: 2024 } } } }, adminToken);
+        expect(results).toContain(org2024.id);
+        expect(results).not.toContain(org2023.id);
+    });
+
+    test('Filters organizations by document template status', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const publishedOrg = await new OrganizationFactory({ name: 'Published Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: publishedOrg.id, status: DocumentStatus.Published }).create();
+
+        const draftOrg = await new OrganizationFactory({ name: 'Draft Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: draftOrg.id, status: DocumentStatus.Draft }).create();
+
+        const results = await filter({ documentTemplates: { $elemMatch: { status: { $in: [DocumentStatus.Published] } } } }, adminToken);
+        expect(results).toContain(publishedOrg.id);
+        expect(results).not.toContain(draftOrg.id);
+    });
+
+    test('Filters organizations by document template isLocked', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const lockedOrg = await new OrganizationFactory({ name: 'Locked Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: lockedOrg.id, isLocked: true }).create();
+
+        const unlockedOrg = await new OrganizationFactory({ name: 'Unlocked Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: unlockedOrg.id, isLocked: false }).create();
+
+        const results = await filter({ documentTemplates: { $elemMatch: { isLocked: { $eq: true } } } }, adminToken);
+        expect(results).toContain(lockedOrg.id);
+        expect(results).not.toContain(unlockedOrg.id);
+    });
+
+    test('Filters organizations by document template updatesEnabled', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const noUpdatesOrg = await new OrganizationFactory({ name: 'No Updates Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: noUpdatesOrg.id, updatesEnabled: false }).create();
+
+        const updatesOrg = await new OrganizationFactory({ name: 'Updates Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: updatesOrg.id, updatesEnabled: true }).create();
+
+        const results = await filter({ documentTemplates: { $elemMatch: { updatesEnabled: { $eq: false } } } }, adminToken);
+        expect(results).toContain(noUpdatesOrg.id);
+        expect(results).not.toContain(updatesOrg.id);
+    });
+
+    test('Combines multiple document template conditions in a single $elemMatch', async () => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const matchOrg = await new OrganizationFactory({ name: 'Matching Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: matchOrg.id, type: 'fiscal', year: 2025, status: DocumentStatus.Published }).create();
+
+        // Same org, but the conditions are split over two different templates: should not match a single-template $elemMatch
+        const splitOrg = await new OrganizationFactory({ name: 'Split Document Club' }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: splitOrg.id, type: 'fiscal', year: 2020, status: DocumentStatus.Published }).create();
+        await new DocumentTemplateFactory({ groups: [], organizationId: splitOrg.id, type: 'participation', year: 2025, status: DocumentStatus.Published }).create();
+
+        const results = await filter({
+            documentTemplates: {
+                $elemMatch: {
+                    type: { $in: ['fiscal'] },
+                    year: { $eq: 2025 },
+                },
+            },
+        }, adminToken);
+        expect(results).toContain(matchOrg.id);
+        expect(results).not.toContain(splitOrg.id);
+    });
 });

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.test.ts

@@ -156,7 +156,9 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             }).create();
 
             const memberToPatch = await new MemberFactory({
-                firstName: 'otherName',
+                // A typo of the existing member's first name, so correcting it (below) is allowed
+                // and still triggers the duplicate detection
+                firstName: firstName + 'n',
                 lastName,
                 birthDay,
                 generateData: true,
@@ -618,7 +620,8 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             const patch = MemberWithRegistrationsBlob.patch({
                 id: member.id,
                 details: MemberDetails.patch({
-                    firstName: 'Changed',
+                    // Changing the last name is always allowed; it proves the registration grants write access
+                    lastName: 'Changed',
                 }),
             });
             arr.addPatch(patch);
@@ -639,7 +642,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             expect(response.body.members.length).toBe(1);
             const memberStruct = response.body.members[0];
             expect(memberStruct.details).toMatchObject({
-                firstName: 'Changed',
+                lastName: 'Changed',
             });
         });
 
@@ -801,6 +804,74 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
         });
     });
 
+    describe('Name and birth date changes', () => {
+        test('A non-full admin cannot drastically change the first name of a member', async () => {
+            const organization = await new OrganizationFactory({}).create();
+
+            const group = await new GroupFactory({ organization }).create();
+            const resources = new Map();
+            resources.set(
+                PermissionsResourceType.Groups, new Map([[
+                    group.id,
+                    ResourcePermissions.create({ level: PermissionLevel.Write }),
+                ]]),
+            );
+
+            const user = await new UserFactory({
+                permissions: Permissions.create({ level: PermissionLevel.None, resources }),
+                organization,
+            }).create();
+
+            const member = await new MemberFactory({ firstName, lastName, birthDay, generateData: false }).create();
+            await new RegistrationFactory({ member, group }).create();
+
+            const token = await Token.createToken(user);
+
+            const arr: Body = new PatchableArray();
+            arr.addPatch(MemberWithRegistrationsBlob.patch({
+                id: member.id,
+                details: MemberDetails.patch({ firstName: 'Michael' }),
+            }));
+
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+            await expect(testServer.test(endpoint, request))
+                .rejects
+                .toThrow(STExpect.errorWithCode('not_allowed'));
+        });
+
+        test('A full admin can drastically change the name and birth date of a member', async () => {
+            const organization = await new OrganizationFactory({}).create();
+
+            const user = await new UserFactory({
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+                organization,
+            }).create();
+
+            const member = await new MemberFactory({ firstName, lastName, birthDay, generateData: false }).create();
+            await new RegistrationFactory({ member, organization }).create();
+
+            const token = await Token.createToken(user);
+
+            const base = member.details.birthDay!;
+            const newBirthDay = new Date(base.getFullYear() + 5, base.getMonth() + 4, base.getDate() + 6);
+
+            const arr: Body = new PatchableArray();
+            arr.addPatch(MemberWithRegistrationsBlob.patch({
+                id: member.id,
+                details: MemberDetails.patch({ firstName: 'Michael', birthDay: newBirthDay }),
+            }));
+
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+            const response = await testServer.test(endpoint, request);
+
+            expect(response.status).toBe(200);
+            expect(response.body.members[0].details.firstName).toBe('Michael');
+            expect(response.body.members[0].details.birthDay?.getFullYear()).toBe(base.getFullYear() + 5);
+        });
+    });
+
     describe('Record answers', () => {
         test('An admin can set records of its own organization', async () => {
             const commentsRecord = RecordSettings.create({

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.ts

@@ -23,6 +23,7 @@ import { MemberNumberService } from '../../../services/MemberNumberService.js';
 import { PlatformMembershipService } from '../../../services/PlatformMembershipService.js';
 import { RegistrationService } from '../../../services/RegistrationService.js';
 import { shouldCheckIfMemberIsDuplicateForPatch } from './shouldCheckIfMemberIsDuplicate.js';
+import { throwIfDrasticMemberDetailsChange } from './throwIfDrasticMemberDetailsChange.js';
 import { mergeTwoMembers } from '../../../helpers/MemberMerger.js';
 
 type Params = Record<string, never>;
@@ -212,6 +213,11 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
 
                 shouldCheckDuplicate = shouldCheckIfMemberIsDuplicateForPatch(patch, originalDetails);
 
+                // Only full-permission admins may drastically change the name or birth date of an existing member
+                if (!await Context.auth.canAccessMember(member, PermissionLevel.Full)) {
+                    throwIfDrasticMemberDetailsChange(patch.details, originalDetails);
+                }
+
                 const wasReduced = member.details.shouldApplyReducedPrice;
 
                 const originalReviewTimes = member.details.reviewTimes;