@stamhoofd/backend 2.130.0 → 2.131.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.130.0",
+    "version": "2.131.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -57,20 +57,20 @@
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.130.0",
-        "@stamhoofd/backend-i18n": "2.130.0",
-        "@stamhoofd/backend-middleware": "2.130.0",
-        "@stamhoofd/crons": "2.130.0",
-        "@stamhoofd/email": "2.130.0",
-        "@stamhoofd/excel-writer": "2.130.0",
-        "@stamhoofd/logging": "2.130.0",
-        "@stamhoofd/models": "2.130.0",
-        "@stamhoofd/object-differ": "2.130.0",
-        "@stamhoofd/queues": "2.130.0",
-        "@stamhoofd/sql": "2.130.0",
-        "@stamhoofd/structures": "2.130.0",
-        "@stamhoofd/types": "2.130.0",
-        "@stamhoofd/utility": "2.130.0",
+        "@stamhoofd/backend-env": "2.131.0",
+        "@stamhoofd/backend-i18n": "2.131.0",
+        "@stamhoofd/backend-middleware": "2.131.0",
+        "@stamhoofd/crons": "2.131.0",
+        "@stamhoofd/email": "2.131.0",
+        "@stamhoofd/excel-writer": "2.131.0",
+        "@stamhoofd/logging": "2.131.0",
+        "@stamhoofd/models": "2.131.0",
+        "@stamhoofd/object-differ": "2.131.0",
+        "@stamhoofd/queues": "2.131.0",
+        "@stamhoofd/sql": "2.131.0",
+        "@stamhoofd/structures": "2.131.0",
+        "@stamhoofd/types": "2.131.0",
+        "@stamhoofd/utility": "2.131.0",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.130.0",
+        "@stamhoofd/test-utils": "2.131.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "b87db6d1a28c82fb12e588f899bcc7dc68d4cd90"
+    "gitHead": "51de524c831dac65960440d9a5aabe9cad1feae8"
 }

package/src/crons/index.ts

@@ -11,6 +11,7 @@ import './invoices.js';
 import './service-fees.js';
 import './members-fees.js';
 import './stripe-invoices.js';
+import './stripe-payout-reports.js';
 import './transfer-fees.js';
 import './drip-emails.js';
 import './update-organization-future-events.js';

package/src/crons/stripe-payout-reports.ts

@@ -0,0 +1,69 @@
+import { registerCron } from '@stamhoofd/crons';
+import { Organization, Platform } from '@stamhoofd/models';
+import { Formatter } from '@stamhoofd/utility';
+import { StripePayoutReporter } from '../helpers/StripePayoutReporter.js';
+
+registerCron('stripe-payout-reports', createStripePayoutReports);
+
+let lastStripeReport: Date | null = null;
+
+/**
+ * Sends a monthly report of all Stripe payouts of the previous month, so we can check
+ * whether everything we charged via Stripe application fees was invoiced correctly.
+ */
+async function createStripePayoutReports() {
+    if (STAMHOOFD.environment !== 'production') {
+        return;
+    }
+
+    if (STAMHOOFD.userMode === 'platform') {
+        return;
+    }
+
+    if (STAMHOOFD.STRIPE_CONNECT_METHOD === 'standard') {
+        return;
+    }
+
+    if (new Date().getHours() > 5 || new Date().getHours() < 2) {
+        // Fix for sending emails after deployments
+        return;
+    }
+
+    // Send the report on the 6th day of the month, once
+    const today = new Date();
+    if (today.getDate() !== 6 || (lastStripeReport && Formatter.dateWithoutDay(lastStripeReport) === Formatter.dateWithoutDay(today))) {
+        return;
+    }
+
+    if (!STAMHOOFD.STRIPE_SECRET_KEY) {
+        console.log('No stripe key set');
+        return;
+    }
+
+    const membershipOrganizationId = (await Platform.getShared()).membershipOrganizationId;
+    if (!membershipOrganizationId) {
+        return;
+    }
+
+    const membershipOrganization = await Organization.getByID(membershipOrganizationId, true);
+
+    console.log('Creating Stripe payout report...');
+
+    // Previous month
+    const previousMonthStart = new Date(today.getFullYear(), today.getMonth() - 1, 1);
+    const end = new Date(new Date(today.getFullYear(), today.getMonth(), 1).getTime() - 1000);
+
+    const reporter = new StripePayoutReporter({
+        secretKey: STAMHOOFD.STRIPE_SECRET_KEY,
+        sellingOrganization: membershipOrganization,
+    });
+
+    await reporter.build(previousMonthStart, end);
+    await reporter.sendEmail({
+        to: [{ email: 'simon@stamhoofd.be' }],
+        // Only send the report to the extra (accounting) recipients when it is complete and valid
+        extraRecipientsWhenValid: (STAMHOOFD.STRIPE_PAYOUT_REPORT_EMAILS ?? []).map(email => ({ email })),
+    });
+
+    lastStripeReport = new Date();
+}

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.test.ts

@@ -156,7 +156,9 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             }).create();
 
             const memberToPatch = await new MemberFactory({
-                firstName: 'otherName',
+                // A typo of the existing member's first name, so correcting it (below) is allowed
+                // and still triggers the duplicate detection
+                firstName: firstName + 'n',
                 lastName,
                 birthDay,
                 generateData: true,
@@ -618,7 +620,8 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             const patch = MemberWithRegistrationsBlob.patch({
                 id: member.id,
                 details: MemberDetails.patch({
-                    firstName: 'Changed',
+                    // Changing the last name is always allowed; it proves the registration grants write access
+                    lastName: 'Changed',
                 }),
             });
             arr.addPatch(patch);
@@ -639,7 +642,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             expect(response.body.members.length).toBe(1);
             const memberStruct = response.body.members[0];
             expect(memberStruct.details).toMatchObject({
-                firstName: 'Changed',
+                lastName: 'Changed',
             });
         });
 
@@ -801,6 +804,74 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
         });
     });
 
+    describe('Name and birth date changes', () => {
+        test('A non-full admin cannot drastically change the first name of a member', async () => {
+            const organization = await new OrganizationFactory({}).create();
+
+            const group = await new GroupFactory({ organization }).create();
+            const resources = new Map();
+            resources.set(
+                PermissionsResourceType.Groups, new Map([[
+                    group.id,
+                    ResourcePermissions.create({ level: PermissionLevel.Write }),
+                ]]),
+            );
+
+            const user = await new UserFactory({
+                permissions: Permissions.create({ level: PermissionLevel.None, resources }),
+                organization,
+            }).create();
+
+            const member = await new MemberFactory({ firstName, lastName, birthDay, generateData: false }).create();
+            await new RegistrationFactory({ member, group }).create();
+
+            const token = await Token.createToken(user);
+
+            const arr: Body = new PatchableArray();
+            arr.addPatch(MemberWithRegistrationsBlob.patch({
+                id: member.id,
+                details: MemberDetails.patch({ firstName: 'Michael' }),
+            }));
+
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+            await expect(testServer.test(endpoint, request))
+                .rejects
+                .toThrow(STExpect.errorWithCode('not_allowed'));
+        });
+
+        test('A full admin can drastically change the name and birth date of a member', async () => {
+            const organization = await new OrganizationFactory({}).create();
+
+            const user = await new UserFactory({
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+                organization,
+            }).create();
+
+            const member = await new MemberFactory({ firstName, lastName, birthDay, generateData: false }).create();
+            await new RegistrationFactory({ member, organization }).create();
+
+            const token = await Token.createToken(user);
+
+            const base = member.details.birthDay!;
+            const newBirthDay = new Date(base.getFullYear() + 5, base.getMonth() + 4, base.getDate() + 6);
+
+            const arr: Body = new PatchableArray();
+            arr.addPatch(MemberWithRegistrationsBlob.patch({
+                id: member.id,
+                details: MemberDetails.patch({ firstName: 'Michael', birthDay: newBirthDay }),
+            }));
+
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+            const response = await testServer.test(endpoint, request);
+
+            expect(response.status).toBe(200);
+            expect(response.body.members[0].details.firstName).toBe('Michael');
+            expect(response.body.members[0].details.birthDay?.getFullYear()).toBe(base.getFullYear() + 5);
+        });
+    });
+
     describe('Record answers', () => {
         test('An admin can set records of its own organization', async () => {
             const commentsRecord = RecordSettings.create({

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.ts

@@ -23,6 +23,7 @@ import { MemberNumberService } from '../../../services/MemberNumberService.js';
 import { PlatformMembershipService } from '../../../services/PlatformMembershipService.js';
 import { RegistrationService } from '../../../services/RegistrationService.js';
 import { shouldCheckIfMemberIsDuplicateForPatch } from './shouldCheckIfMemberIsDuplicate.js';
+import { throwIfDrasticMemberDetailsChange } from './throwIfDrasticMemberDetailsChange.js';
 import { mergeTwoMembers } from '../../../helpers/MemberMerger.js';
 
 type Params = Record<string, never>;
@@ -212,6 +213,11 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
 
                 shouldCheckDuplicate = shouldCheckIfMemberIsDuplicateForPatch(patch, originalDetails);
 
+                // Only full-permission admins may drastically change the name or birth date of an existing member
+                if (!await Context.auth.canAccessMember(member, PermissionLevel.Full)) {
+                    throwIfDrasticMemberDetailsChange(patch.details, originalDetails);
+                }
+
                 const wasReduced = member.details.shouldApplyReducedPrice;
 
                 const originalReviewTimes = member.details.reviewTimes;

package/src/endpoints/global/members/throwIfDrasticMemberDetailsChange.test.ts

@@ -0,0 +1,96 @@
+import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
+import { isSimpleError } from '@simonbackx/simple-errors';
+import { MemberDetails } from '@stamhoofd/structures';
+import { throwIfDrasticMemberDetailsChange } from './throwIfDrasticMemberDetailsChange.js';
+
+/**
+ * Runs the check and returns the thrown SimpleError (as { code, field }), or null when nothing was thrown.
+ */
+function runCheck(patch: AutoEncoderPatchType<MemberDetails>, original: MemberDetails): { code: string; field?: string } | null {
+    try {
+        throwIfDrasticMemberDetailsChange(patch, original);
+        return null;
+    } catch (e) {
+        if (isSimpleError(e)) {
+            return { code: e.code, field: e.field };
+        }
+        throw e;
+    }
+}
+
+describe('throwIfDrasticMemberDetailsChange', () => {
+    const original = MemberDetails.create({
+        firstName: 'Thomas',
+        lastName: 'Peeters',
+        birthDay: new Date(2010, 4, 15), // 15 May 2010
+    });
+
+    describe('First name', () => {
+        test('An unchanged first name is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ firstName: 'Thomas' }), original)).toBeNull();
+        });
+
+        test('A case-only change is allowed (normalized)', () => {
+            expect(runCheck(MemberDetails.patch({ firstName: 'thomas' }), original)).toBeNull();
+        });
+
+        test('Fixing a typo is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ firstName: 'Tomas' }), original)).toBeNull();
+        });
+
+        test('A short name with a single typo is allowed', () => {
+            const jan = MemberDetails.create({ firstName: 'Jan', lastName: 'Peeters', birthDay: new Date(2010, 4, 15) });
+            expect(runCheck(MemberDetails.patch({ firstName: 'Jana' }), jan)).toBeNull();
+        });
+
+        test('Completely changing the first name is not allowed', () => {
+            expect(runCheck(MemberDetails.patch({ firstName: 'Wannes' }), original)).toMatchObject({ code: 'not_allowed', field: 'firstName' });
+        });
+
+        test('Swapping a short first name for a different one is not allowed', () => {
+            const jan = MemberDetails.create({ firstName: 'Jan', lastName: 'Peeters', birthDay: new Date(2010, 4, 15) });
+            expect(runCheck(MemberDetails.patch({ firstName: 'Tom' }), jan)).toMatchObject({ code: 'not_allowed', field: 'firstName' });
+        });
+    });
+
+    describe('Last name', () => {
+        test('Completely changing the last name is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ lastName: 'Janssens' }), original)).toBeNull();
+        });
+    });
+
+    describe('Birth date', () => {
+        test('Changing only the year is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ birthDay: new Date(2011, 4, 15) }), original)).toBeNull();
+        });
+
+        test('Changing only the day is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ birthDay: new Date(2010, 4, 16) }), original)).toBeNull();
+        });
+
+        test('Changing only the month is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ birthDay: new Date(2010, 5, 15) }), original)).toBeNull();
+        });
+
+        test('Changing two components is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ birthDay: new Date(2010, 5, 16) }), original)).toBeNull();
+        });
+
+        test('Changing day, month and year all at once is not allowed', () => {
+            expect(runCheck(MemberDetails.patch({ birthDay: new Date(2012, 7, 20) }), original)).toMatchObject({ code: 'not_allowed', field: 'birthDay' });
+        });
+
+        test('Setting a birth date for the first time is allowed', () => {
+            const noBirthDay = MemberDetails.create({ firstName: 'Thomas', lastName: 'Peeters', birthDay: null });
+            expect(runCheck(MemberDetails.patch({ birthDay: new Date(2012, 7, 20) }), noBirthDay)).toBeNull();
+        });
+
+        test('Clearing the birth date is allowed', () => {
+            expect(runCheck(MemberDetails.patch({ birthDay: null }), original)).toBeNull();
+        });
+    });
+
+    test('An unrelated patch is allowed', () => {
+        expect(runCheck(MemberDetails.patch({ email: 'someone@example.com' }), original)).toBeNull();
+    });
+});

package/src/endpoints/global/members/throwIfDrasticMemberDetailsChange.ts

@@ -0,0 +1,58 @@
+import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
+import { SimpleError } from '@simonbackx/simple-errors';
+import type { MemberDetails } from '@stamhoofd/structures';
+import { StringCompare } from '@stamhoofd/utility';
+
+/**
+ * Prevents non platform-admins from drastically changing the identity of an existing member.
+ *
+ * Fully overwriting the name or birth date of a member can be abused to 'merge' a member into
+ * another one (e.g. a parent changing the data of one child so it becomes identical to a sibling),
+ * which is hard to undo afterwards.
+ *
+ * Allowed changes (that do NOT throw):
+ * - Fixing a typo in the first name (small edit distance)
+ * - Changing the last name (fully allowed, e.g. after a marriage or a spelling correction)
+ * - A small correction to the birth date: changing the day, month or year, but not all three at once
+ *
+ * Platform admins with full access are not restricted; callers should only run this check when the
+ * user does not have platform full access.
+ */
+export function throwIfDrasticMemberDetailsChange(patch: MemberDetails | AutoEncoderPatchType<MemberDetails>, originalDetails: MemberDetails) {
+    // First name: only allow typo-level corrections. A completely different first name is not allowed.
+    if (patch.firstName !== undefined && patch.firstName !== originalDetails.firstName) {
+        const typoCount = StringCompare.typoCount(originalDetails.firstName, patch.firstName);
+
+        // Allow a change of at most ~40% of the (shortest) name, with a minimum of one character,
+        // so short names can still have a typo corrected.
+        const maxTypos = Math.max(1, Math.floor(0.4 * Math.min(originalDetails.firstName.length, patch.firstName.length)));
+
+        if (typoCount > maxTypos) {
+            throw new SimpleError({
+                code: 'not_allowed',
+                message: 'Drastic first name change is not allowed',
+                human: $t(`%Zbq`),
+                field: 'firstName',
+            });
+        }
+    }
+
+    // Birth date: only allow a small correction. Changing the day, month and year all at once is not allowed.
+    const originalBirthDay = originalDetails.birthDay;
+    const newBirthDay = patch.birthDay;
+
+    if (newBirthDay !== undefined && newBirthDay !== null && originalBirthDay !== null) {
+        const dayChanged = newBirthDay.getDate() !== originalBirthDay.getDate();
+        const monthChanged = newBirthDay.getMonth() !== originalBirthDay.getMonth();
+        const yearChanged = newBirthDay.getFullYear() !== originalBirthDay.getFullYear();
+
+        if (dayChanged && monthChanged && yearChanged) {
+            throw new SimpleError({
+                code: 'not_allowed',
+                message: 'Drastic birth date change is not allowed',
+                human: $t(`%Zbr`),
+                field: 'birthDay',
+            });
+        }
+    }
+}

package/src/endpoints/global/registration/PatchUserMembersEndpoint.test.ts

@@ -1,4 +1,5 @@
 import { Database } from '@simonbackx/simple-database';
+import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
 import { PatchableArray, PatchMap } from '@simonbackx/simple-encoding';
 import type { Endpoint } from '@simonbackx/simple-endpoints';
 import { Request } from '@simonbackx/simple-endpoints';
@@ -1198,4 +1199,71 @@ describe('Endpoint.PatchUserMembersEndpoint', () => {
             });
         });
     });
+
+    describe('Name and birth date changes', () => {
+        async function createOwnedMember() {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({}).create();
+            const member = await new MemberFactory({
+                firstName,
+                lastName,
+                birthDay,
+                generateData: false,
+                // Give user access to this member
+                user,
+            }).create();
+            const token = await Token.createToken(user);
+            return { organization, user, member, token };
+        }
+
+        async function patchMember(organization: Awaited<ReturnType<typeof createOwnedMember>>['organization'], token: Awaited<ReturnType<typeof createOwnedMember>>['token'], memberId: string, details: AutoEncoderPatchType<MemberDetails>) {
+            const arr: Body = new PatchableArray();
+            arr.addPatch(MemberWithRegistrationsBlob.patch({
+                id: memberId,
+                details,
+            }));
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+            return await testServer.test(endpoint, request);
+        }
+
+        test('A user cannot drastically change the first name of their member', async () => {
+            const { organization, member, token } = await createOwnedMember();
+            await expect(patchMember(organization, token, member.id, MemberDetails.patch({ firstName: 'Michael' })))
+                .rejects
+                .toThrow(STExpect.errorWithCode('not_allowed'));
+        });
+
+        test('A user can fix a typo in the first name', async () => {
+            const { organization, member, token } = await createOwnedMember();
+            const response = await patchMember(organization, token, member.id, MemberDetails.patch({ firstName: 'Jon' }));
+            expect(response.status).toBe(200);
+            expect(response.body.members[0].details.firstName).toBe('Jon');
+        });
+
+        test('A user can change the last name', async () => {
+            const { organization, member, token } = await createOwnedMember();
+            const response = await patchMember(organization, token, member.id, MemberDetails.patch({ lastName: 'Smith' }));
+            expect(response.status).toBe(200);
+            expect(response.body.members[0].details.lastName).toBe('Smith');
+        });
+
+        test('A user cannot change the day, month and year of the birth date all at once', async () => {
+            const { organization, member, token } = await createOwnedMember();
+            const base = member.details.birthDay!;
+            const newBirthDay = new Date(base.getFullYear() + 2, base.getMonth() + 3, base.getDate() + 5);
+            await expect(patchMember(organization, token, member.id, MemberDetails.patch({ birthDay: newBirthDay })))
+                .rejects
+                .toThrow(STExpect.errorWithCode('not_allowed'));
+        });
+
+        test('A user can correct a single part of the birth date', async () => {
+            const { organization, member, token } = await createOwnedMember();
+            const base = member.details.birthDay!;
+            const newBirthDay = new Date(base.getFullYear() + 1, base.getMonth(), base.getDate());
+            const response = await patchMember(organization, token, member.id, MemberDetails.patch({ birthDay: newBirthDay }));
+            expect(response.status).toBe(200);
+            expect(response.body.members[0].details.birthDay?.getFullYear()).toBe(base.getFullYear() + 1);
+        });
+    });
 });

package/src/endpoints/global/registration/PatchUserMembersEndpoint.ts

@@ -6,7 +6,7 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import type { Group, Registration } from '@stamhoofd/models';
 import { Document, Member, RateLimiter } from '@stamhoofd/models';
 import type { MemberDetails, MembersBlob } from '@stamhoofd/structures';
-import { BooleanStatus, MemberWithRegistrationsBlob } from '@stamhoofd/structures';
+import { BooleanStatus, MemberWithRegistrationsBlob, PermissionLevel } from '@stamhoofd/structures';
 
 import type { OneToManyRelation } from '@simonbackx/simple-database';
 import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures.js';
@@ -15,6 +15,7 @@ import { MemberUserSyncer } from '../../../helpers/MemberUserSyncer.js';
 import { didUitpasReviewChange, updateMemberDetailsUitpasNumber, updateMemberDetailsUitpasNumberForPatch } from '../../../helpers/updateMemberDetailsUitpasNumber.js';
 import { PatchOrganizationMembersEndpoint } from '../../global/members/PatchOrganizationMembersEndpoint.js';
 import { shouldCheckIfMemberIsDuplicateForPatch } from '../members/shouldCheckIfMemberIsDuplicate.js';
+import { throwIfDrasticMemberDetailsChange } from '../members/throwIfDrasticMemberDetailsChange.js';
 type Params = Record<string, never>;
 type Query = undefined;
 type Body = PatchableArrayAutoEncoder<MemberWithRegistrationsBlob>;
@@ -109,6 +110,11 @@ export class PatchUserMembersEndpoint extends Endpoint<Params, Query, Body, Resp
 
                 shouldCheckDuplicate = shouldCheckIfMemberIsDuplicateForPatch(struct, member.details);
 
+                // Only full-permission admins may drastically change the name or birth date of an existing member
+                if (!await Context.auth.canAccessMember(member, PermissionLevel.Full)) {
+                    throwIfDrasticMemberDetailsChange(struct.details, member.details);
+                }
+
                 const previousUitpasNumber = member.details.uitpasNumberDetails?.uitpasNumber ?? null;
 
                 const originalReviewTimes = member.details.reviewTimes;

package/src/endpoints/global/registration/RegisterMembersEndpoint.test.ts

@@ -2,8 +2,8 @@ import { PatchMap } from '@simonbackx/simple-encoding';
 import { Request } from '@simonbackx/simple-endpoints';
 import { EmailMocker } from '@stamhoofd/email';
 import type { MemberWithUsersRegistrationsAndGroups, Organization, RegistrationPeriod } from '@stamhoofd/models';
-import { BalanceItemFactory, Group, GroupFactory, Member, MemberFactory, OrganizationFactory, OrganizationRegistrationPeriodFactory, Registration, RegistrationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
-import { AccessRight, BalanceItemCartItem, BalanceItemStatus, BalanceItemType, BooleanStatus, Company, GroupOption, GroupOptionMenu, IDRegisterCart, IDRegisterCheckout, IDRegisterItem, OrganizationPackages, PaymentCustomer, PaymentMethod, PermissionLevel, Permissions, PermissionsResourceType, ReduceablePrice, RegisterItemOption, ResourcePermissions, STPackageStatus, STPackageType, UitpasNumberDetails, UitpasSocialTariff, UitpasSocialTariffStatus, UserPermissions, Version } from '@stamhoofd/structures';
+import { BalanceItem, BalanceItemFactory, Group, GroupFactory, Member, MemberFactory, OrganizationFactory, OrganizationRegistrationPeriodFactory, Registration, RegistrationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import { AccessRight, BalanceItemCartItem, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, BooleanStatus, Company, GroupOption, GroupOptionMenu, IDRegisterCart, IDRegisterCheckout, IDRegisterItem, OrganizationPackages, PaymentCustomer, PaymentMethod, PermissionLevel, Permissions, PermissionsResourceType, ReduceablePrice, RegisterItemOption, ResourcePermissions, STPackageStatus, STPackageType, UitpasNumberDetails, UitpasSocialTariff, UitpasSocialTariffStatus, UserPermissions, Version } from '@stamhoofd/structures';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { v4 as uuidv4 } from 'uuid';
 import { assertBalances } from '../../../../tests/assertions/assertBalances.js';
@@ -460,6 +460,47 @@ describe('Endpoint.RegisterMembers', () => {
                 .toThrow(STExpect.simpleError({ code: 'already_registered' }));
         });
 
+        test('Sets the registration period relation on created balance items', async () => {
+            const { organization, group, groupPrice, token, member } = await initData();
+
+            const body = IDRegisterCheckout.create({
+                cart: IDRegisterCart.create({
+                    items: [
+                        IDRegisterItem.create({
+                            id: uuidv4(),
+                            replaceRegistrationIds: [],
+                            options: [],
+                            groupPrice,
+                            organizationId: organization.id,
+                            groupId: group.id,
+                            memberId: member.id,
+                        }),
+                    ],
+                    balanceItems: [],
+                    deleteRegistrationIds: [],
+                }),
+                administrationFee: 0,
+                freeContribution: 0,
+                paymentMethod: PaymentMethod.PointOfSale,
+                totalPrice: 25_0000,
+                customer: null,
+            });
+
+            const response = await post(body, organization, token);
+            expect(response.body.registrations.length).toBe(1);
+
+            const registrationId = response.body.registrations[0].id;
+            const balanceItems = await BalanceItem.where({ registrationId });
+            expect(balanceItems.length).toBeGreaterThan(0);
+
+            for (const balanceItem of balanceItems) {
+                const relation = balanceItem.relations.get(BalanceItemRelationType.RegistrationPeriod);
+                expect(relation).toBeDefined();
+                expect(relation?.id).toBe(period.id);
+                expect(relation?.name.toString()).toBe(period.getBaseStructure().name);
+            }
+        });
+
         test('Should fail if duplicate registration in cart', async () => {
             const { organization, group, groupPrice, token, member } = await initData();