@stamhoofd/backend 2.129.3 → 2.131.0

package/src/endpoints/global/members/throwIfDrasticMemberDetailsChange.test.ts

@@ -0,0 +1,96 @@
+import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
+import { isSimpleError } from '@simonbackx/simple-errors';
+import { MemberDetails } from '@stamhoofd/structures';
+import { throwIfDrasticMemberDetailsChange } from './throwIfDrasticMemberDetailsChange.js';
+
+/**
+ * Runs the check and returns the thrown SimpleError (as { code, field }), or null when nothing was thrown.
+ */
+function runCheck(patch: AutoEncoderPatchType<MemberDetails>, original: MemberDetails): { code: string; field?: string } | null {
+    try {
+        throwIfDrasticMemberDetailsChange(patch, original);
+        return null;
+    } catch (e) {
+        if (isSimpleError(e)) {
+            return { code: e.code, field: e.field };
+        }
+        throw e;
+    }
+}
+
+describe('throwIfDrasticMemberDetailsChange', () => {
+    const original = MemberDetails.create({
+        firstName: 'Thomas',
+        lastName: 'Peeters',
+        birthDay: new Date(2010, 4, 15), // 15 May 2010
+    });
+
+    describe('First name', () => {
+        test('An unchanged first name is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ firstName: 'Thomas' }), original)).toBeNull();
+        });
+
+        test('A case-only change is allowed (normalized)', () => {
+            expect(runCheck(MemberDetails.patch({ firstName: 'thomas' }), original)).toBeNull();
+        });
+
+        test('Fixing a typo is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ firstName: 'Tomas' }), original)).toBeNull();
+        });
+
+        test('A short name with a single typo is allowed', () => {
+            const jan = MemberDetails.create({ firstName: 'Jan', lastName: 'Peeters', birthDay: new Date(2010, 4, 15) });
+            expect(runCheck(MemberDetails.patch({ firstName: 'Jana' }), jan)).toBeNull();
+        });
+
+        test('Completely changing the first name is not allowed', () => {
+            expect(runCheck(MemberDetails.patch({ firstName: 'Wannes' }), original)).toMatchObject({ code: 'not_allowed', field: 'firstName' });
+        });
+
+        test('Swapping a short first name for a different one is not allowed', () => {
+            const jan = MemberDetails.create({ firstName: 'Jan', lastName: 'Peeters', birthDay: new Date(2010, 4, 15) });
+            expect(runCheck(MemberDetails.patch({ firstName: 'Tom' }), jan)).toMatchObject({ code: 'not_allowed', field: 'firstName' });
+        });
+    });
+
+    describe('Last name', () => {
+        test('Completely changing the last name is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ lastName: 'Janssens' }), original)).toBeNull();
+        });
+    });
+
+    describe('Birth date', () => {
+        test('Changing only the year is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ birthDay: new Date(2011, 4, 15) }), original)).toBeNull();
+        });
+
+        test('Changing only the day is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ birthDay: new Date(2010, 4, 16) }), original)).toBeNull();
+        });
+
+        test('Changing only the month is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ birthDay: new Date(2010, 5, 15) }), original)).toBeNull();
+        });
+
+        test('Changing two components is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ birthDay: new Date(2010, 5, 16) }), original)).toBeNull();
+        });
+
+        test('Changing day, month and year all at once is not allowed', () => {
+            expect(runCheck(MemberDetails.patch({ birthDay: new Date(2012, 7, 20) }), original)).toMatchObject({ code: 'not_allowed', field: 'birthDay' });
+        });
+
+        test('Setting a birth date for the first time is allowed', () => {
+            const noBirthDay = MemberDetails.create({ firstName: 'Thomas', lastName: 'Peeters', birthDay: null });
+            expect(runCheck(MemberDetails.patch({ birthDay: new Date(2012, 7, 20) }), noBirthDay)).toBeNull();
+        });
+
+        test('Clearing the birth date is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ birthDay: null }), original)).toBeNull();
+        });
+    });
+
+    test('An unrelated patch is allowed', () => {
+        expect(runCheck(MemberDetails.patch({ email: 'someone@example.com' }), original)).toBeNull();
+    });
+});

package/src/endpoints/global/members/throwIfDrasticMemberDetailsChange.ts

@@ -0,0 +1,58 @@
+import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
+import { SimpleError } from '@simonbackx/simple-errors';
+import type { MemberDetails } from '@stamhoofd/structures';
+import { StringCompare } from '@stamhoofd/utility';
+
+/**
+ * Prevents non platform-admins from drastically changing the identity of an existing member.
+ *
+ * Fully overwriting the name or birth date of a member can be abused to 'merge' a member into
+ * another one (e.g. a parent changing the data of one child so it becomes identical to a sibling),
+ * which is hard to undo afterwards.
+ *
+ * Allowed changes (that do NOT throw):
+ * - Fixing a typo in the first name (small edit distance)
+ * - Changing the last name (fully allowed, e.g. after a marriage or a spelling correction)
+ * - A small correction to the birth date: changing the day, month or year, but not all three at once
+ *
+ * Platform admins with full access are not restricted; callers should only run this check when the
+ * user does not have platform full access.
+ */
+export function throwIfDrasticMemberDetailsChange(patch: MemberDetails | AutoEncoderPatchType<MemberDetails>, originalDetails: MemberDetails) {
+    // First name: only allow typo-level corrections. A completely different first name is not allowed.
+    if (patch.firstName !== undefined && patch.firstName !== originalDetails.firstName) {
+        const typoCount = StringCompare.typoCount(originalDetails.firstName, patch.firstName);
+
+        // Allow a change of at most ~40% of the (shortest) name, with a minimum of one character,
+        // so short names can still have a typo corrected.
+        const maxTypos = Math.max(1, Math.floor(0.4 * Math.min(originalDetails.firstName.length, patch.firstName.length)));
+
+        if (typoCount > maxTypos) {
+            throw new SimpleError({
+                code: 'not_allowed',
+                message: 'Drastic first name change is not allowed',
+                human: $t(`%Zbq`),
+                field: 'firstName',
+            });
+        }
+    }
+
+    // Birth date: only allow a small correction. Changing the day, month and year all at once is not allowed.
+    const originalBirthDay = originalDetails.birthDay;
+    const newBirthDay = patch.birthDay;
+
+    if (newBirthDay !== undefined && newBirthDay !== null && originalBirthDay !== null) {
+        const dayChanged = newBirthDay.getDate() !== originalBirthDay.getDate();
+        const monthChanged = newBirthDay.getMonth() !== originalBirthDay.getMonth();
+        const yearChanged = newBirthDay.getFullYear() !== originalBirthDay.getFullYear();
+
+        if (dayChanged && monthChanged && yearChanged) {
+            throw new SimpleError({
+                code: 'not_allowed',
+                message: 'Drastic birth date change is not allowed',
+                human: $t(`%Zbr`),
+                field: 'birthDay',
+            });
+        }
+    }
+}

package/src/endpoints/global/registration/PatchUserMembersEndpoint.test.ts

@@ -1,4 +1,5 @@
 import { Database } from '@simonbackx/simple-database';
+import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
 import { PatchableArray, PatchMap } from '@simonbackx/simple-encoding';
 import type { Endpoint } from '@simonbackx/simple-endpoints';
 import { Request } from '@simonbackx/simple-endpoints';
@@ -1198,4 +1199,71 @@ describe('Endpoint.PatchUserMembersEndpoint', () => {
             });
         });
     });
+
+    describe('Name and birth date changes', () => {
+        async function createOwnedMember() {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({}).create();
+            const member = await new MemberFactory({
+                firstName,
+                lastName,
+                birthDay,
+                generateData: false,
+                // Give user access to this member
+                user,
+            }).create();
+            const token = await Token.createToken(user);
+            return { organization, user, member, token };
+        }
+
+        async function patchMember(organization: Awaited<ReturnType<typeof createOwnedMember>>['organization'], token: Awaited<ReturnType<typeof createOwnedMember>>['token'], memberId: string, details: AutoEncoderPatchType<MemberDetails>) {
+            const arr: Body = new PatchableArray();
+            arr.addPatch(MemberWithRegistrationsBlob.patch({
+                id: memberId,
+                details,
+            }));
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+            return await testServer.test(endpoint, request);
+        }
+
+        test('A user cannot drastically change the first name of their member', async () => {
+            const { organization, member, token } = await createOwnedMember();
+            await expect(patchMember(organization, token, member.id, MemberDetails.patch({ firstName: 'Michael' })))
+                .rejects
+                .toThrow(STExpect.errorWithCode('not_allowed'));
+        });
+
+        test('A user can fix a typo in the first name', async () => {
+            const { organization, member, token } = await createOwnedMember();
+            const response = await patchMember(organization, token, member.id, MemberDetails.patch({ firstName: 'Jon' }));
+            expect(response.status).toBe(200);
+            expect(response.body.members[0].details.firstName).toBe('Jon');
+        });
+
+        test('A user can change the last name', async () => {
+            const { organization, member, token } = await createOwnedMember();
+            const response = await patchMember(organization, token, member.id, MemberDetails.patch({ lastName: 'Smith' }));
+            expect(response.status).toBe(200);
+            expect(response.body.members[0].details.lastName).toBe('Smith');
+        });
+
+        test('A user cannot change the day, month and year of the birth date all at once', async () => {
+            const { organization, member, token } = await createOwnedMember();
+            const base = member.details.birthDay!;
+            const newBirthDay = new Date(base.getFullYear() + 2, base.getMonth() + 3, base.getDate() + 5);
+            await expect(patchMember(organization, token, member.id, MemberDetails.patch({ birthDay: newBirthDay })))
+                .rejects
+                .toThrow(STExpect.errorWithCode('not_allowed'));
+        });
+
+        test('A user can correct a single part of the birth date', async () => {
+            const { organization, member, token } = await createOwnedMember();
+            const base = member.details.birthDay!;
+            const newBirthDay = new Date(base.getFullYear() + 1, base.getMonth(), base.getDate());
+            const response = await patchMember(organization, token, member.id, MemberDetails.patch({ birthDay: newBirthDay }));
+            expect(response.status).toBe(200);
+            expect(response.body.members[0].details.birthDay?.getFullYear()).toBe(base.getFullYear() + 1);
+        });
+    });
 });

package/src/endpoints/global/registration/PatchUserMembersEndpoint.ts

@@ -6,7 +6,7 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import type { Group, Registration } from '@stamhoofd/models';
 import { Document, Member, RateLimiter } from '@stamhoofd/models';
 import type { MemberDetails, MembersBlob } from '@stamhoofd/structures';
-import { BooleanStatus, MemberWithRegistrationsBlob } from '@stamhoofd/structures';
+import { BooleanStatus, MemberWithRegistrationsBlob, PermissionLevel } from '@stamhoofd/structures';
 
 import type { OneToManyRelation } from '@simonbackx/simple-database';
 import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures.js';
@@ -15,6 +15,7 @@ import { MemberUserSyncer } from '../../../helpers/MemberUserSyncer.js';
 import { didUitpasReviewChange, updateMemberDetailsUitpasNumber, updateMemberDetailsUitpasNumberForPatch } from '../../../helpers/updateMemberDetailsUitpasNumber.js';
 import { PatchOrganizationMembersEndpoint } from '../../global/members/PatchOrganizationMembersEndpoint.js';
 import { shouldCheckIfMemberIsDuplicateForPatch } from '../members/shouldCheckIfMemberIsDuplicate.js';
+import { throwIfDrasticMemberDetailsChange } from '../members/throwIfDrasticMemberDetailsChange.js';
 type Params = Record<string, never>;
 type Query = undefined;
 type Body = PatchableArrayAutoEncoder<MemberWithRegistrationsBlob>;
@@ -109,6 +110,11 @@ export class PatchUserMembersEndpoint extends Endpoint<Params, Query, Body, Resp
 
                 shouldCheckDuplicate = shouldCheckIfMemberIsDuplicateForPatch(struct, member.details);
 
+                // Only full-permission admins may drastically change the name or birth date of an existing member
+                if (!await Context.auth.canAccessMember(member, PermissionLevel.Full)) {
+                    throwIfDrasticMemberDetailsChange(struct.details, member.details);
+                }
+
                 const previousUitpasNumber = member.details.uitpasNumberDetails?.uitpasNumber ?? null;
 
                 const originalReviewTimes = member.details.reviewTimes;

package/src/endpoints/global/registration/RegisterMembersEndpoint.test.ts

@@ -2,8 +2,8 @@ import { PatchMap } from '@simonbackx/simple-encoding';
 import { Request } from '@simonbackx/simple-endpoints';
 import { EmailMocker } from '@stamhoofd/email';
 import type { MemberWithUsersRegistrationsAndGroups, Organization, RegistrationPeriod } from '@stamhoofd/models';
-import { BalanceItemFactory, Group, GroupFactory, Member, MemberFactory, OrganizationFactory, OrganizationRegistrationPeriodFactory, Registration, RegistrationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
-import { AccessRight, BalanceItemCartItem, BalanceItemStatus, BalanceItemType, BooleanStatus, Company, GroupOption, GroupOptionMenu, IDRegisterCart, IDRegisterCheckout, IDRegisterItem, OrganizationPackages, PaymentCustomer, PaymentMethod, PermissionLevel, Permissions, PermissionsResourceType, ReduceablePrice, RegisterItemOption, ResourcePermissions, STPackageStatus, STPackageType, UitpasNumberDetails, UitpasSocialTariff, UitpasSocialTariffStatus, UserPermissions, Version } from '@stamhoofd/structures';
+import { BalanceItem, BalanceItemFactory, Group, GroupFactory, Member, MemberFactory, OrganizationFactory, OrganizationRegistrationPeriodFactory, Registration, RegistrationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import { AccessRight, BalanceItemCartItem, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, BooleanStatus, Company, GroupOption, GroupOptionMenu, IDRegisterCart, IDRegisterCheckout, IDRegisterItem, OrganizationPackages, PaymentCustomer, PaymentMethod, PermissionLevel, Permissions, PermissionsResourceType, ReduceablePrice, RegisterItemOption, ResourcePermissions, STPackageStatus, STPackageType, UitpasNumberDetails, UitpasSocialTariff, UitpasSocialTariffStatus, UserPermissions, Version } from '@stamhoofd/structures';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { v4 as uuidv4 } from 'uuid';
 import { assertBalances } from '../../../../tests/assertions/assertBalances.js';
@@ -460,6 +460,47 @@ describe('Endpoint.RegisterMembers', () => {
                 .toThrow(STExpect.simpleError({ code: 'already_registered' }));
         });
 
+        test('Sets the registration period relation on created balance items', async () => {
+            const { organization, group, groupPrice, token, member } = await initData();
+
+            const body = IDRegisterCheckout.create({
+                cart: IDRegisterCart.create({
+                    items: [
+                        IDRegisterItem.create({
+                            id: uuidv4(),
+                            replaceRegistrationIds: [],
+                            options: [],
+                            groupPrice,
+                            organizationId: organization.id,
+                            groupId: group.id,
+                            memberId: member.id,
+                        }),
+                    ],
+                    balanceItems: [],
+                    deleteRegistrationIds: [],
+                }),
+                administrationFee: 0,
+                freeContribution: 0,
+                paymentMethod: PaymentMethod.PointOfSale,
+                totalPrice: 25_0000,
+                customer: null,
+            });
+
+            const response = await post(body, organization, token);
+            expect(response.body.registrations.length).toBe(1);
+
+            const registrationId = response.body.registrations[0].id;
+            const balanceItems = await BalanceItem.where({ registrationId });
+            expect(balanceItems.length).toBeGreaterThan(0);
+
+            for (const balanceItem of balanceItems) {
+                const relation = balanceItem.relations.get(BalanceItemRelationType.RegistrationPeriod);
+                expect(relation).toBeDefined();
+                expect(relation?.id).toBe(period.id);
+                expect(relation?.name.toString()).toBe(period.getBaseStructure().name);
+            }
+        });
+
         test('Should fail if duplicate registration in cart', async () => {
             const { organization, group, groupPrice, token, member } = await initData();
 
@@ -3266,7 +3307,7 @@ describe('Endpoint.RegisterMembers', () => {
 
             // #region act and assert
             await post(body1, organization, token);
-            await expect(post(body2, organization, token)).rejects.toThrow(/No permission to delete this registration/);
+            await expect(post(body2, organization, token)).rejects.toThrow(/Cannot delete inactive registration/);
             // #endregion
         });
     });

package/src/endpoints/global/registration/RegisterMembersEndpoint.ts

@@ -5,7 +5,7 @@ import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Email } from '@stamhoofd/email';
 import type { MemberWithUsersRegistrationsAndGroups, Organization, Payment } from '@stamhoofd/models';
-import { BalanceItem, CachedBalance, Group, Member, Platform, RateLimiter, Registration } from '@stamhoofd/models';
+import { BalanceItem, CachedBalance, Group, Member, Platform, RateLimiter, Registration, RegistrationPeriod } from '@stamhoofd/models';
 import type { BalanceItem as BalanceItemStruct, PlatformMember, RegisterItem } from '@stamhoofd/structures';
 import { BalanceItemRelation, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, IDRegisterCheckout, Payment as PaymentStruct, PermissionLevel, PlatformFamily, ReceivableBalanceType, RegisterResponse, TranslatedString } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
@@ -516,7 +516,26 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             deactivatedRegistrationGroupIds.push(existingRegistration.groupId);
         }
 
-        async function createBalanceItem({ registration, skipZero, amount, unitPrice, description, type, relations }: { amount?: number; skipZero?: boolean; registration: { id: string; payingOrganizationId: string | null; memberId: string; trialUntil: Date | null }; unitPrice: number; description: string; relations: Map<BalanceItemRelationType, BalanceItemRelation>; type: BalanceItemType }) {
+        // Cache the registration period relation per periodId, so we only load each period once.
+        const periodRelationCache = new Map<string, BalanceItemRelation | null>();
+        async function getPeriodRelation(periodId: string): Promise<BalanceItemRelation | null> {
+            if (periodRelationCache.has(periodId)) {
+                return periodRelationCache.get(periodId)!;
+            }
+
+            const period = await RegistrationPeriod.getByID(periodId);
+            const relation = period
+                ? BalanceItemRelation.create({
+                        id: period.id,
+                        name: new TranslatedString(period.getBaseStructure().name),
+                    })
+                : null;
+
+            periodRelationCache.set(periodId, relation);
+            return relation;
+        }
+
+        async function createBalanceItem({ registration, periodId, skipZero, amount, unitPrice, description, type, relations }: { amount?: number; skipZero?: boolean; registration: { id: string; payingOrganizationId: string | null; memberId: string; trialUntil: Date | null }; periodId: string; unitPrice: number; description: string; relations: Map<BalanceItemRelationType, BalanceItemRelation>; type: BalanceItemType }) {
             // NOTE: We also need to save zero-price balance items because for online payments, we need to know which registrations to activate after payment
             if (skipZero === true) {
                 if (unitPrice === 0 || amount === 0) {
@@ -524,6 +543,12 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
                 }
             }
 
+            // Add the registration period (working year) relation so it is visible in the item description.
+            const periodRelation = await getPeriodRelation(periodId);
+            if (periodRelation) {
+                relations.set(BalanceItemRelationType.RegistrationPeriod, periodRelation);
+            }
+
             // Create balance item
             const balanceItem = new BalanceItem();
             balanceItem.registrationId = registration.id;
@@ -608,6 +633,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             // Base price
             await createBalanceItem({
                 registration,
+                periodId: item.group.periodId,
                 unitPrice: item.groupPrice.price.forMember(item.member),
                 type: BalanceItemType.Registration,
                 skipZero: false, // Always create at least one balance item for each registration - even when the price is zero
@@ -621,6 +647,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             for (const option of item.options) {
                 await createBalanceItem({
                     registration,
+                    periodId: item.group.periodId,
                     amount: option.amount,
                     unitPrice: option.option.price.forMember(item.member),
                     skipZero: true, // Do not create for zero option prices
@@ -654,6 +681,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
                     // Base price
                     await createBalanceItem({
                         registration,
+                        periodId: item.group.periodId,
                         unitPrice: -discountValue,
                         type: BalanceItemType.RegistrationBundleDiscount,
                         description: discount.name,
@@ -722,6 +750,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
 
                 await createBalanceItem({
                     registration: registration.registration,
+                    periodId: registration.group.periodId,
                     unitPrice: -difference,
                     type: BalanceItemType.RegistrationBundleDiscount,
                     description: discount.name,

package/src/endpoints/organization/dashboard/receivable-balances/ChargeReceivableBalancesEndpoint.ts

@@ -48,7 +48,7 @@ export class ChargeReceivableBalancesEndpoint extends Endpoint<Params, Query, Bo
             throw new SimpleError({
                 code: 'charge_pending',
                 message: 'Already pending charge',
-                human: $t('Er is al een aanrekening bezig, even geduld voor je een tweede aanrekening aanrekend.'),
+                human: $t('%Zbh'),
             });
         }
 

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.test.ts

@@ -1,7 +1,7 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import type { Organization } from '@stamhoofd/models';
-import { GroupFactory, OrganizationFactory, OrganizationRegistrationPeriod, OrganizationRegistrationPeriodFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
-import { GroupSettings, Group as GroupStruct, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, PermissionLevel, Permissions, Version } from '@stamhoofd/structures';
+import { Group, GroupFactory, OrganizationFactory, OrganizationRegistrationPeriod, OrganizationRegistrationPeriodFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import { GroupCategory, GroupSettings, Group as GroupStruct, GroupType, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, PermissionLevel, Permissions, TranslatedString, Version } from '@stamhoofd/structures';
 
 import type { PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { PatchableArray } from '@simonbackx/simple-encoding';
@@ -153,6 +153,65 @@ describe('Endpoint.PatchOrganizationRegistrationPeriods', () => {
             expect(response.body).toBeDefined();
         });
 
+        test('should copy groups that reference a waiting list', async () => {
+            const organization = await new OrganizationFactory({ }).create();
+
+            // create period
+            const startDate = new Date(Date.now() + 5 * 24 * 60 * 60 * 1000);
+            const endDate = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000);
+
+            const newPeriod = await new RegistrationPeriodFactory({
+                organization,
+                startDate,
+                endDate,
+            }).create();
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const token = await Token.createToken(user);
+
+            // A waiting list group and a regular group that references it. The regular group is
+            // listed BEFORE the waiting list, reproducing the ordering produced by Group.defaultSort
+            // when duplicating a period (groups with a maxAge sort before waiting lists).
+            const waitingListGroup = GroupStruct.create({
+                type: GroupType.WaitingList,
+                settings: GroupSettings.create({ name: TranslatedString.create('Wachtlijst') }),
+            });
+
+            const regularGroup = GroupStruct.create({
+                type: GroupType.Membership,
+                settings: GroupSettings.create({ name: TranslatedString.create('Kapoenen'), maxAge: 8 }),
+                waitingList: waitingListGroup,
+            });
+
+            const newOrganizationPeriod = OrganizationRegistrationPeriodStruct.create({
+                period: newPeriod.getStructure(),
+            });
+            newOrganizationPeriod.groups.push(regularGroup, waitingListGroup);
+            newOrganizationPeriod.settings.categories = [
+                GroupCategory.create({ id: 'root', groupIds: [regularGroup.id] }),
+            ];
+            newOrganizationPeriod.settings.rootCategoryId = 'root';
+
+            const patch: PatchableArrayAutoEncoder<OrganizationRegistrationPeriodStruct> = new PatchableArray();
+            patch.addPut(newOrganizationPeriod);
+
+            const response = await patchOrganizationRegistrationPeriods({ patch, organization, token });
+            expect(response.body).toBeDefined();
+
+            // Both the regular group and its waiting list should have been created
+            const createdGroups = await Group.getAll(organization.id, newPeriod.id, true, [GroupType.Membership, GroupType.WaitingList]);
+            const regular = createdGroups.find(g => g.id === regularGroup.id);
+            const waitingList = createdGroups.find(g => g.id === waitingListGroup.id);
+
+            expect(waitingList).toBeDefined();
+            expect(regular).toBeDefined();
+            expect(regular!.waitingListId).toBe(waitingListGroup.id);
+        });
+
         test('should not be able to patch groups of other organization', async () => {
             const organization = await new OrganizationFactory({ }).create();
             const otherOrganization = await new OrganizationFactory({ }).create();

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -342,7 +342,20 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
         organizationPeriod.settings = struct.settings;
         await organizationPeriod.save();
 
-        for (const s of struct.groups) {
+        // Create waiting list groups first: a regular group referencing a waiting list requires
+        // that waiting list group to already exist in the same period (see createGroup), otherwise
+        // it fails with 'Waiting list not found' and gets silently skipped below.
+        const sortedGroups = [...struct.groups].sort((a, b) => {
+            if (a.type === GroupType.WaitingList && b.type !== GroupType.WaitingList) {
+                return -1;
+            }
+            if (b.type === GroupType.WaitingList && a.type !== GroupType.WaitingList) {
+                return 1;
+            }
+            return 0;
+        });
+
+        for (const s of sortedGroups) {
             s.settings.registeredMembers = 0;
             s.settings.reservedMembers = 0;
             try {

package/src/endpoints/organization/dashboard/stripe/GetStripePayoutsExportStatusEndpoint.ts

@@ -0,0 +1,32 @@
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+
+import { PayoutExportStatus, StripePayoutsExportEndpoint } from './StripePayoutsExportEndpoint.js';
+
+type Params = Record<string, never>;
+type Body = undefined;
+type Query = undefined;
+type ResponseBody = PayoutExportStatus[];
+
+export class GetStripePayoutsExportStatusEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'GET') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/stripe/payouts/status', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(_: DecodedRequest<Params, Query, Body>) {
+        await StripePayoutsExportEndpoint.authenticate();
+
+        return new Response(StripePayoutsExportEndpoint.queue.map((item) => {
+            return PayoutExportStatus.create(item);
+        }));
+    }
+}

package/src/endpoints/organization/dashboard/stripe/StripePayoutsExportEndpoint.test.ts

@@ -0,0 +1,103 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { EmailMocker } from '@stamhoofd/email';
+import type { Organization, Token, User } from '@stamhoofd/models';
+import { OrganizationFactory, UserFactory } from '@stamhoofd/models';
+import { Token as TokenModel } from '@stamhoofd/models';
+import { QueueHandler } from '@stamhoofd/queues';
+import { Company } from '@stamhoofd/structures';
+import { STExpect } from '@stamhoofd/test-utils';
+import nock from 'nock';
+
+import { resetNock } from '../../../../../tests/helpers/resetNock.js';
+import { testServer } from '../../../../../tests/helpers/TestServer.js';
+import { initMembershipOrganization } from '../../../../../tests/init/initMembershipOrganization.js';
+import { initPlatformAdmin } from '../../../../../tests/init/initPlatformAdmin.js';
+import { GetStripePayoutsExportStatusEndpoint } from './GetStripePayoutsExportStatusEndpoint.js';
+import { StripePayoutsExportEndpoint } from './StripePayoutsExportEndpoint.js';
+
+describe('Endpoint.StripePayoutsExport', () => {
+    const endpoint = new StripePayoutsExportEndpoint();
+    const statusEndpoint = new GetStripePayoutsExportStatusEndpoint();
+
+    let membershipOrganization: Organization;
+    let admin: User;
+    let adminToken: Token;
+
+    beforeAll(async () => {
+        membershipOrganization = await initMembershipOrganization();
+        membershipOrganization.meta.companies = [
+            Company.create({
+                name: 'Platform BV',
+                companyNumber: '0700000000',
+                VATNumber: 'BE0700000000',
+            }),
+        ];
+        await membershipOrganization.save();
+
+        ({ admin, adminToken } = await initPlatformAdmin());
+    });
+
+    afterEach(() => {
+        resetNock();
+    });
+
+    const post = async (organization: Organization, token: Token) => {
+        const request = Request.buildJson('POST', '/stripe/payouts', organization.getApiHost(), {
+            start: new Date(2026, 2, 1).getTime(),
+            end: new Date(2026, 3, 1).getTime() - 1000,
+        });
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+        return await testServer.test(endpoint, request);
+    };
+
+    const getStatus = async (organization: Organization, token: Token) => {
+        const request = Request.buildJson('GET', '/stripe/payouts/status', organization.getApiHost());
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+        return await testServer.test(statusEndpoint, request);
+    };
+
+    test('A platform admin can export payout reports for the membership organization', async () => {
+        nock('https://api.stripe.com')
+            .get('/v1/payouts')
+            .query(true)
+            .reply(200, { object: 'list', data: [], has_more: false, url: '/v1/payouts' });
+
+        const response = await post(membershipOrganization, adminToken);
+        expect(response.status).toBe(200);
+
+        // Wait for the scheduled report to complete
+        await QueueHandler.awaitAll();
+
+        const emails = await EmailMocker.transactional.getSucceededEmails();
+        const reportEmail = emails.find(e => e.subject.startsWith('Stripe Uitbetalingen'));
+        expect(reportEmail).toBeDefined();
+        expect(reportEmail!.attachments).toHaveLength(1);
+
+        // The report is sent to the user that requested it
+        expect(reportEmail!.to).toContain(admin.email);
+
+        // The queue is empty again
+        const statusResponse = await getStatus(membershipOrganization, adminToken);
+        expect(statusResponse.body).toEqual([]);
+    });
+
+    test('A user without platform full access cannot export payout reports', async () => {
+        const user = await new UserFactory({ organization: membershipOrganization }).create();
+        const token = await TokenModel.createToken(user);
+
+        await expect(post(membershipOrganization, token)).rejects.toThrow(
+            STExpect.simpleError({ code: 'permission_denied' }),
+        );
+        await expect(getStatus(membershipOrganization, token)).rejects.toThrow(
+            STExpect.simpleError({ code: 'permission_denied' }),
+        );
+    });
+
+    test('Payout reports are not available for other organizations', async () => {
+        const otherOrganization = await new OrganizationFactory({}).create();
+
+        await expect(post(otherOrganization, adminToken)).rejects.toThrow(
+            STExpect.simpleError({ code: 'not_available' }),
+        );
+    });
+});