@stamhoofd/backend 2.132.0 → 2.133.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.132.0",
+    "version": "2.133.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -57,20 +57,20 @@
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.132.0",
-        "@stamhoofd/backend-i18n": "2.132.0",
-        "@stamhoofd/backend-middleware": "2.132.0",
-        "@stamhoofd/crons": "2.132.0",
-        "@stamhoofd/email": "2.132.0",
-        "@stamhoofd/excel-writer": "2.132.0",
-        "@stamhoofd/logging": "2.132.0",
-        "@stamhoofd/models": "2.132.0",
-        "@stamhoofd/object-differ": "2.132.0",
-        "@stamhoofd/queues": "2.132.0",
-        "@stamhoofd/sql": "2.132.0",
-        "@stamhoofd/structures": "2.132.0",
-        "@stamhoofd/types": "2.132.0",
-        "@stamhoofd/utility": "2.132.0",
+        "@stamhoofd/backend-env": "2.133.0",
+        "@stamhoofd/backend-i18n": "2.133.0",
+        "@stamhoofd/backend-middleware": "2.133.0",
+        "@stamhoofd/crons": "2.133.0",
+        "@stamhoofd/email": "2.133.0",
+        "@stamhoofd/excel-writer": "2.133.0",
+        "@stamhoofd/logging": "2.133.0",
+        "@stamhoofd/models": "2.133.0",
+        "@stamhoofd/object-differ": "2.133.0",
+        "@stamhoofd/queues": "2.133.0",
+        "@stamhoofd/sql": "2.133.0",
+        "@stamhoofd/structures": "2.133.0",
+        "@stamhoofd/types": "2.133.0",
+        "@stamhoofd/utility": "2.133.0",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.132.0",
+        "@stamhoofd/test-utils": "2.133.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "f7143688bb7be0cd9f73c209f4b55c9bacdd59b8"
+    "gitHead": "65d5f0a31f87b8e3b7a23349f08cf7943ef15bda"
 }

package/src/endpoints/admin/organizations/ChargeOrganizationsEndpoint.ts

@@ -58,7 +58,7 @@ export class ChargeOrganizationsEndpoint extends Endpoint<Params, Query, Body, R
                 filter: body.filter,
                 limit: 100,
             }), {
-                fetch: GetOrganizationsEndpoint.buildData,
+                fetch: request => GetOrganizationsEndpoint.buildData(request),
             });
 
             for await (const data of dataGenerator) {

package/src/endpoints/global/groups/GetGroupsEndpoint.ts

@@ -133,7 +133,7 @@ export class GetGroupsEndpoint extends Endpoint<Params, Query, Body, ResponseBod
             }
         }
 
-        const maxLimit = Context.auth.hasSomePlatformAccess() ? 1000 : 100;
+        const maxLimit = Context.optionalAuth?.hasSomePlatformAccess() ? 1000 : 100;
 
         if (request.query.limit > maxLimit) {
             throw new SimpleError({

package/src/endpoints/organization/dashboard/invoices/PatchInvoicesEndpoint.test.ts

@@ -0,0 +1,143 @@
+import type { PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
+import { PatchableArray } from '@simonbackx/simple-encoding';
+import { Request } from '@simonbackx/simple-endpoints';
+import type { Organization, User } from '@stamhoofd/models';
+import { BalanceItem, BalanceItemFactory, Invoice, InvoicedBalanceItem, OrganizationFactory, Payment, Token, UserFactory } from '@stamhoofd/models';
+import type { InvoiceStruct } from '@stamhoofd/structures';
+import { PaymentMethod, PaymentStatus, PermissionLevel, Permissions } from '@stamhoofd/structures';
+import { STExpect } from '@stamhoofd/test-utils';
+import { testServer } from '../../../../../tests/helpers/TestServer.js';
+import { PatchInvoicesEndpoint } from './PatchInvoicesEndpoint.js';
+
+describe('Endpoint.PatchInvoicesEndpoint', () => {
+    const endpoint = new PatchInvoicesEndpoint();
+
+    const createBalanceItem = async ({ organization, unitPrice = 10_00 }: { organization: Organization; unitPrice?: number }) => {
+        return await new BalanceItemFactory({
+            organizationId: organization.id,
+            amount: 1,
+            unitPrice,
+        }).create();
+    };
+
+    const createInvoice = async ({ organization, balanceItemIds, number = '1' }: { organization: Organization; balanceItemIds: string[]; number?: string | null }) => {
+        const invoice = new Invoice();
+        invoice.organizationId = organization.id;
+        invoice.number = number;
+        invoice.invoicedAt = number ? new Date() : null;
+        await invoice.save();
+
+        for (const balanceItemId of balanceItemIds) {
+            const item = new InvoicedBalanceItem();
+            item.organizationId = organization.id;
+            item.invoiceId = invoice.id;
+            item.balanceItemId = balanceItemId;
+            item.name = 'Test item';
+            item.unitPrice = 10_00;
+            item.balanceInvoicedAmount = 10_00;
+            await item.save();
+        }
+
+        // Make sure the invoiced cache of the balance items is up to date, like it would be for a real invoice.
+        await BalanceItem.updateInvoiced(balanceItemIds);
+
+        return invoice;
+    };
+
+    const createPayment = async ({ organization, invoice }: { organization: Organization; invoice: Invoice }) => {
+        const payment = new Payment();
+        payment.organizationId = organization.id;
+        payment.method = PaymentMethod.PointOfSale;
+        payment.status = PaymentStatus.Succeeded;
+        payment.price = 10_00;
+        payment.invoiceId = invoice.id;
+        await payment.save();
+        return payment;
+    };
+
+    const patchInvoices = async ({ body, organization, user }: { body: PatchableArrayAutoEncoder<InvoiceStruct>; organization: Organization; user: User }) => {
+        const token = await Token.createToken(user);
+        const request = Request.buildJson('PATCH', '/invoices', organization.getApiHost(), body);
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+        return await testServer.test<InvoiceStruct[]>(endpoint, request);
+    };
+
+    describe('Deleting invoices', () => {
+        test('deletes the invoice, its invoiced balance items and unlinks the payments', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const balanceItem = await createBalanceItem({ organization });
+            const invoice = await createInvoice({ organization, balanceItemIds: [balanceItem.id] });
+            const payment = await createPayment({ organization, invoice });
+
+            // Sanity check: the balance item is marked as invoiced
+            const before = await BalanceItem.getByID(balanceItem.id);
+            expect(before!.priceInvoiced).toBe(10_00);
+
+            const body = new PatchableArray() as PatchableArrayAutoEncoder<InvoiceStruct>;
+            body.addDelete(invoice.id);
+
+            const response = await patchInvoices({ body, organization, user });
+            expect(response.status).toBe(200);
+
+            // Invoice is gone
+            expect(await Invoice.getByID(invoice.id)).toBeUndefined();
+
+            // Invoiced balance items are cascade deleted
+            const remainingItems = await InvoicedBalanceItem.select().where('invoiceId', invoice.id).fetch();
+            expect(remainingItems).toHaveLength(0);
+
+            // Payment is kept but unlinked
+            const reloadedPayment = await Payment.getByID(payment.id);
+            expect(reloadedPayment).toBeDefined();
+            expect(reloadedPayment!.invoiceId).toBeNull();
+
+            // Invoiced cache of the balance item is recalculated
+            const after = await BalanceItem.getByID(balanceItem.id);
+            expect(after!.priceInvoiced).toBe(0);
+        });
+
+        test('user without full access cannot delete invoices', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({ level: PermissionLevel.Read }),
+            }).create();
+
+            const balanceItem = await createBalanceItem({ organization });
+            const invoice = await createInvoice({ organization, balanceItemIds: [balanceItem.id] });
+
+            const body = new PatchableArray() as PatchableArrayAutoEncoder<InvoiceStruct>;
+            body.addDelete(invoice.id);
+
+            await expect(patchInvoices({ body, organization, user })).rejects.toThrow(STExpect.errorWithCode('permission_denied'));
+
+            // Invoice is untouched
+            expect(await Invoice.getByID(invoice.id)).toBeDefined();
+        });
+
+        test('cannot delete an invoice of another organization', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const otherOrganization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const balanceItem = await createBalanceItem({ organization: otherOrganization });
+            const invoice = await createInvoice({ organization: otherOrganization, balanceItemIds: [balanceItem.id] });
+
+            const body = new PatchableArray() as PatchableArrayAutoEncoder<InvoiceStruct>;
+            body.addDelete(invoice.id);
+
+            await expect(patchInvoices({ body, organization, user })).rejects.toThrow(STExpect.errorWithCode('not_found'));
+
+            // Invoice is untouched
+            expect(await Invoice.getByID(invoice.id)).toBeDefined();
+        });
+    });
+});

package/src/endpoints/organization/dashboard/invoices/PatchInvoicesEndpoint.ts

@@ -6,7 +6,7 @@ import { Invoice as InvoiceStruct } from '@stamhoofd/structures';
 
 import { AuthenticatedStructures } from '../../../../helpers/AuthenticatedStructures.js';
 import { Context } from '../../../../helpers/Context.js';
-import type { Invoice } from '@stamhoofd/models';
+import { Invoice } from '@stamhoofd/models';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { ViesHelper } from '../../../../helpers/ViesHelper.js';
 import { InvoiceService } from '../../../../services/InvoiceService.js';
@@ -57,6 +57,15 @@ export class PatchInvoicesEndpoint extends Endpoint<Params, Query, Body, Respons
             invoices.push(model);
         }
 
+        for (const id of request.body.getDeletes()) {
+            const model = await Invoice.getByID(id);
+            if (!model || model.organizationId !== organization.id) {
+                throw Context.auth.notFoundOrNoAccess($t('%ZcE'));
+            }
+
+            await InvoiceService.delete(model);
+        }
+
         return new Response(
             await AuthenticatedStructures.invoices(invoices, true),
         );

package/src/endpoints/organization/dashboard/organization/PatchOrganizationEndpoint.test.ts

@@ -1,11 +1,13 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import type { Organization, User, Webshop } from '@stamhoofd/models';
 import { GroupFactory, OrganizationFactory, OrganizationRegistrationPeriod, RegistrationPeriodFactory, Token, UserFactory, WebshopFactory } from '@stamhoofd/models';
-import { AccessRight, MemberResponsibility, OrganizationPrivateMetaData, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, Organization as OrganizationStruct, PermissionLevel, PermissionRoleDetailed, PermissionRoleForResponsibility, Permissions, PermissionsResourceType, ResourcePermissions, Version } from '@stamhoofd/structures';
+import { AccessRight, Address, Company, MemberResponsibility, OrganizationMetaData, OrganizationPrivateMetaData, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, Organization as OrganizationStruct, PeppolEndointId, PermissionLevel, PermissionRoleDetailed, PermissionRoleForResponsibility, Permissions, PermissionsResourceType, ResourcePermissions, Version } from '@stamhoofd/structures';
 
 import type { AutoEncoderPatchType, PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { PatchableArray, PatchMap } from '@simonbackx/simple-encoding';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
+import { Country } from '@stamhoofd/types/Country';
+import nock from 'nock';
 import { testServer } from '../../../../../tests/helpers/TestServer.js';
 import { PatchOrganizationEndpoint } from './PatchOrganizationEndpoint.js';
 
@@ -1282,6 +1284,192 @@ describe('Endpoint.PatchOrganization', () => {
         });
     });
 
+    describe('custom PEPPOL endpoint id on companies', () => {
+        const belgianAddress = () => Address.create({
+            street: 'Demostraat',
+            number: '12',
+            city: 'Gent',
+            postalCode: '9000',
+            country: Country.Belgium,
+        });
+
+        function mockDirectoryFound(schemeID: string, id: string, entityName = 'Directory Name') {
+            return nock('https://directory.peppol.eu')
+                .get('/search/1.0/json')
+                .query({ participant: `iso6523-actorid-upis::${schemeID}:${id}` })
+                .reply(200, {
+                    'total-result-count': 1,
+                    matches: [{
+                        participantID: { scheme: 'iso6523-actorid-upis', value: `${schemeID}:${id}` },
+                        entities: [{ name: [{ name: entityName }] }],
+                    }],
+                } as nock.Body);
+        }
+
+        afterEach(() => {
+            nock.cleanAll();
+        });
+
+        const companiesPut = (company: Company): PatchableArrayAutoEncoder<Company> => {
+            const arr: PatchableArrayAutoEncoder<Company> = new PatchableArray();
+            arr.addPut(company);
+            return arr;
+        };
+
+        const companiesPatch = (patch: AutoEncoderPatchType<Company>): PatchableArrayAutoEncoder<Company> => {
+            const arr: PatchableArrayAutoEncoder<Company> = new PatchableArray();
+            arr.addPatch(patch);
+            return arr;
+        };
+
+        test('a normal organization admin cannot add a company with a custom PEPPOL endpoint id', async () => {
+            const scope = mockDirectoryFound('0208', '0123456789');
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ organization, permissions: Permissions.create({ level: PermissionLevel.Full }) }).create();
+            const token = await Token.createToken(user);
+
+            const patch = OrganizationStruct.patch({
+                id: organization.id,
+                meta: OrganizationMetaData.patch({
+                    companies: companiesPut(Company.create({
+                        name: 'Demo Company',
+                        address: belgianAddress(),
+                        customPeppolEndpointId: PeppolEndointId.create({ schemeID: '0208', id: '0123456789' }),
+                    })),
+                }),
+            });
+
+            await expect(patchOrganization({ patch, organization, token })).rejects.toThrow(
+                STExpect.simpleError({ code: 'permission_denied', field: 'customPeppolEndpointId' }),
+            );
+
+            // The directory must not have been contacted: the permission check happens first.
+            expect(scope.isDone()).toBe(false);
+        });
+
+        test('a normal organization admin cannot patch a custom PEPPOL endpoint id onto an existing company', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const company = Company.create({ name: 'Demo Company', address: belgianAddress() });
+            organization.meta.companies = [company];
+            await organization.save();
+
+            const user = await new UserFactory({ organization, permissions: Permissions.create({ level: PermissionLevel.Full }) }).create();
+            const token = await Token.createToken(user);
+
+            const patch = OrganizationStruct.patch({
+                id: organization.id,
+                meta: OrganizationMetaData.patch({
+                    companies: companiesPatch(Company.patch({
+                        id: company.id,
+                        customPeppolEndpointId: PeppolEndointId.create({ schemeID: '0208', id: '0123456789' }),
+                    })),
+                }),
+            });
+
+            await expect(patchOrganization({ patch, organization, token })).rejects.toThrow(
+                STExpect.simpleError({ code: 'permission_denied', field: 'customPeppolEndpointId' }),
+            );
+        });
+
+        test('a platform admin can set a custom PEPPOL endpoint id that is validated against the directory', async () => {
+            const scope = mockDirectoryFound('0088', '5412345000013');
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ globalPermissions: Permissions.create({ level: PermissionLevel.Full }) }).create();
+            const token = await Token.createToken(user);
+
+            const patch = OrganizationStruct.patch({
+                id: organization.id,
+                meta: OrganizationMetaData.patch({
+                    companies: companiesPut(Company.create({
+                        name: 'Demo Company',
+                        address: belgianAddress(),
+                        customPeppolEndpointId: PeppolEndointId.create({ schemeID: '0088', id: '5412345000013' }),
+                    })),
+                }),
+            });
+
+            const response = await patchOrganization({ patch, organization, token });
+
+            expect(scope.isDone()).toBe(true);
+            expect(response.body.meta.companies).toHaveLength(1);
+            expect(response.body.meta.companies[0].customPeppolEndpointId).toMatchObject({
+                schemeID: '0088',
+                id: '5412345000013',
+                // The registered entity name from the directory is stored.
+                entityName: 'Directory Name',
+            });
+        });
+
+        test('a client-supplied entityName is ignored and overwritten by the directory value', async () => {
+            mockDirectoryFound('0088', '5412345000013', 'Directory Name');
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ globalPermissions: Permissions.create({ level: PermissionLevel.Full }) }).create();
+            const token = await Token.createToken(user);
+
+            const patch = OrganizationStruct.patch({
+                id: organization.id,
+                meta: OrganizationMetaData.patch({
+                    companies: companiesPut(Company.create({
+                        name: 'Demo Company',
+                        address: belgianAddress(),
+                        customPeppolEndpointId: PeppolEndointId.create({ schemeID: '0088', id: '5412345000013', entityName: 'Spoofed name' }),
+                    })),
+                }),
+            });
+
+            const response = await patchOrganization({ patch, organization, token });
+
+            expect(response.body.meta.companies[0].customPeppolEndpointId?.entityName).toBe('Directory Name');
+        });
+
+        test('a KBO custom PEPPOL endpoint id that does not match the company number is rejected', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ globalPermissions: Permissions.create({ level: PermissionLevel.Full }) }).create();
+            const token = await Token.createToken(user);
+
+            const patch = OrganizationStruct.patch({
+                id: organization.id,
+                meta: OrganizationMetaData.patch({
+                    companies: companiesPut(Company.create({
+                        name: 'Demo Company',
+                        address: belgianAddress(),
+                        customPeppolEndpointId: PeppolEndointId.create({ schemeID: '0208', id: '9999999999' }),
+                    })),
+                }),
+            });
+
+            await expect(patchOrganization({ patch, organization, token })).rejects.toThrow(
+                STExpect.simpleError({ code: 'invalid_field', field: 'customPeppolEndpointId' }),
+            );
+        });
+
+        test('a platform admin gets an error when the custom PEPPOL endpoint id is unknown to the directory', async () => {
+            nock('https://directory.peppol.eu')
+                .get('/search/1.0/json')
+                .query({ participant: 'iso6523-actorid-upis::0088:5412345000013' })
+                .reply(200, { 'total-result-count': 0, matches: [] } as nock.Body);
+
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ globalPermissions: Permissions.create({ level: PermissionLevel.Full }) }).create();
+            const token = await Token.createToken(user);
+
+            const patch = OrganizationStruct.patch({
+                id: organization.id,
+                meta: OrganizationMetaData.patch({
+                    companies: companiesPut(Company.create({
+                        name: 'Demo Company',
+                        address: belgianAddress(),
+                        customPeppolEndpointId: PeppolEndointId.create({ schemeID: '0088', id: '5412345000013' }),
+                    })),
+                }),
+            });
+
+            await expect(patchOrganization({ patch, organization, token })).rejects.toThrow(
+                STExpect.simpleError({ code: 'invalid_field', field: 'customPeppolEndpointId' }),
+            );
+        });
+    });
+
     describe('userMode organization', () => {
         beforeEach(async () => {
             TestUtils.setEnvironment('userMode', 'organization');

package/src/endpoints/organization/dashboard/organization/PatchOrganizationEndpoint.ts

@@ -660,6 +660,20 @@ export class PatchOrganizationEndpoint extends Endpoint<Params, Query, Body, Res
         return new Response(struct);
     }
 
+    /**
+     * A custom PEPPOL endpoint id may only be set by full platform admins for now.
+     */
+    private requirePeppolPermission() {
+        if (!Context.auth.hasPlatformFullAccess()) {
+            throw new SimpleError({
+                code: 'permission_denied',
+                message: 'Only platform admins can set a custom PEPPOL endpoint id',
+                human: $t('%Zcg'),
+                field: 'customPeppolEndpointId',
+            });
+        }
+    }
+
     async validateCompanies(organization: Organization, companies: PatchableArrayAutoEncoder<Company> | Company[]) {
         if (isPatchableArray(companies)) {
             for (const patch of companies.getPatches()) {
@@ -674,6 +688,10 @@ export class PatchOrganizationEndpoint extends Endpoint<Params, Query, Body, Res
                     });
                 }
 
+                if (patch.customPeppolEndpointId !== undefined) {
+                    this.requirePeppolPermission();
+                }
+
                 // Changed VAT number
                 const prepatched = original.patch(patch);
                 await ViesHelper.checkCompany(prepatched, patch);
@@ -692,6 +710,10 @@ export class PatchOrganizationEndpoint extends Endpoint<Params, Query, Body, Res
                     });
                 }
 
+                if (put.customPeppolEndpointId) {
+                    this.requirePeppolPermission();
+                }
+
                 await ViesHelper.checkCompany(put, put);
             }
         } else {
@@ -705,6 +727,10 @@ export class PatchOrganizationEndpoint extends Endpoint<Params, Query, Body, Res
             }
 
             for (const company of companies) {
+                if (company.customPeppolEndpointId) {
+                    this.requirePeppolPermission();
+                }
+
                 await ViesHelper.checkCompany(company, company);
             }
         }

package/src/endpoints/organization/dashboard/receivable-balances/ChargeReceivableBalancesEndpoint.ts

@@ -6,7 +6,7 @@ import { CountFilteredRequest, CountResponse, PaymentCustomer, PaymentMethod, Pe
 import { Context } from '../../../../helpers/Context.js';
 import { GetReceivableBalancesEndpoint } from './GetReceivableBalancesEndpoint.js';
 import type { BalanceItem } from '@stamhoofd/models';
-import { Organization, User } from '@stamhoofd/models';
+import { Organization, Platform, User } from '@stamhoofd/models';
 import { CachedBalance } from '@stamhoofd/models';
 import { PaymentService } from '../../../../services/PaymentService.js';
 import { SimpleError } from '@simonbackx/simple-errors';
@@ -15,12 +15,12 @@ import { BalanceItemService } from '../../../../services/BalanceItemService.js';
 import { QueueHandler } from '@stamhoofd/queues';
 
 type Params = Record<string, never>;
-type Query = CountFilteredRequest;
-type Body = undefined;
+type Query = undefined;
+type Body = CountFilteredRequest;
 type ResponseBody = undefined;
 
 export class ChargeReceivableBalancesEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
-    queryDecoder = CountFilteredRequest as Decoder<CountFilteredRequest>;
+    bodyDecoder = CountFilteredRequest as Decoder<CountFilteredRequest>;
 
     protected doesMatch(request: Request): [true, Params] | [false] {
         if (request.method !== 'POST') {
@@ -38,6 +38,7 @@ export class ChargeReceivableBalancesEndpoint extends Endpoint<Params, Query, Bo
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const sellingOrganization = await Context.setOrganizationScope();
         const { user } = await Context.authenticate();
+        const platform = await Platform.getShared();
 
         if (!await Context.auth.canManageFinances(sellingOrganization.id)) {
             throw Context.auth.error();
@@ -53,7 +54,7 @@ export class ChargeReceivableBalancesEndpoint extends Endpoint<Params, Query, Bo
         }
 
         await QueueHandler.schedule(queueId, async () => {
-            const query = await GetReceivableBalancesEndpoint.buildQuery(request.query);
+            const query = await GetReceivableBalancesEndpoint.buildQuery(request.body);
 
             for await (const cachedBalance of query.all()) {
                 if (cachedBalance.organizationId !== sellingOrganization.id) {
@@ -80,6 +81,12 @@ export class ChargeReceivableBalancesEndpoint extends Endpoint<Params, Query, Bo
                     continue;
                 }
 
+                if (total <= 4_00_00 && sellingOrganization.id === platform.membershipOrganizationId && STAMHOOFD.userMode === 'organization') {
+                    // Skip too small payments for Stamhoofd
+                    console.error('Skipped charging too small payment for', cachedBalance.objectId, cachedBalance.objectType);
+                    continue;
+                }
+
                 let payingOrganization: Organization | null = null;
                 let customerUser: User | null = null;
                 if (cachedBalance.objectType === ReceivableBalanceType.organization) {

package/src/helpers/StripeInvoicer.ts

@@ -57,10 +57,6 @@ export class ApplicationFeeDetails {
         this.combine(ApplicationFeeDetails.fromStripe(fee));
     }
 
-    remove(fee: Stripe.BalanceTransaction) {
-        this.combine(ApplicationFeeDetails.fromStripe(fee));
-    }
-
     combine(other: ApplicationFeeDetails) {
         this.serviceFee += other.serviceFee;
         this.transferFee += other.transferFee;

package/src/helpers/StripePayoutChecker.ts

@@ -69,13 +69,9 @@ export class StripePayoutChecker {
             payout: payout.id,
             // Via the Application Fee object, we can get the original payment metadata
             expand: ['data.source', 'data.source.application_fee', 'data.source.application_fee.originating_transaction'],
-            // TODO: ALSO DO CARDS! (type: 'charge')
-            // type: 'payment'
         };
 
         for await (const balanceItem of this.stripe.balanceTransactions.list(params)) {
-            // TODO
-
             if (balanceItem.type === 'charge' || balanceItem.type === 'payment') {
                 await this.handleBalanceItem(payout, balanceItem);
             }