@stamhoofd/backend 2.133.0 → 2.134.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.133.0",
+    "version": "2.134.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -53,24 +53,24 @@
         "@bwip-js/node": "4.11.1",
         "@mollie/api-client": "4.5.0",
         "@simonbackx/simple-database": "1.37.1",
-        "@simonbackx/simple-encoding": "2.26.10",
+        "@simonbackx/simple-encoding": "2.26.11",
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.133.0",
-        "@stamhoofd/backend-i18n": "2.133.0",
-        "@stamhoofd/backend-middleware": "2.133.0",
-        "@stamhoofd/crons": "2.133.0",
-        "@stamhoofd/email": "2.133.0",
-        "@stamhoofd/excel-writer": "2.133.0",
-        "@stamhoofd/logging": "2.133.0",
-        "@stamhoofd/models": "2.133.0",
-        "@stamhoofd/object-differ": "2.133.0",
-        "@stamhoofd/queues": "2.133.0",
-        "@stamhoofd/sql": "2.133.0",
-        "@stamhoofd/structures": "2.133.0",
-        "@stamhoofd/types": "2.133.0",
-        "@stamhoofd/utility": "2.133.0",
+        "@stamhoofd/backend-env": "2.134.0",
+        "@stamhoofd/backend-i18n": "2.134.0",
+        "@stamhoofd/backend-middleware": "2.134.0",
+        "@stamhoofd/crons": "2.134.0",
+        "@stamhoofd/email": "2.134.0",
+        "@stamhoofd/excel-writer": "2.134.0",
+        "@stamhoofd/logging": "2.134.0",
+        "@stamhoofd/models": "2.134.0",
+        "@stamhoofd/object-differ": "2.134.0",
+        "@stamhoofd/queues": "2.134.0",
+        "@stamhoofd/sql": "2.134.0",
+        "@stamhoofd/structures": "2.134.0",
+        "@stamhoofd/types": "2.134.0",
+        "@stamhoofd/utility": "2.134.0",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.133.0",
+        "@stamhoofd/test-utils": "2.134.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "65d5f0a31f87b8e3b7a23349f08cf7943ef15bda"
+    "gitHead": "42955365bcf0bcfd0815998c1039e23d6ee1d6c6"
 }

package/src/crons/invoices.ts

@@ -52,10 +52,12 @@ async function createInvoicesFor(organization: Organization) {
     const today = Formatter.luxon();
     const startDate = today.day <= 15 ? today.minus({ month: 2 }).startOf('month') : today.minus({ month: 1 }).startOf('month');
 
-    // Don't invoice below 10 euro - unless we reached the timeout date for invoices (end of month + 15 days - 5 days margin)
-    const invoiceLimit = STAMHOOFD.environment === 'development' ? 0 : 10_0000;
+    // Don't invoice below 4 euro - unless we reached the timeout date for invoices (end of month + 15 days - 5 days margin) OR + 15 day offset
+    const invoiceLimit = STAMHOOFD.environment === 'development' ? 0 : 4_0000;
     function getPaymentTimeoutDate(p: Payment) {
-        return Formatter.luxon(p.paidAt ?? p.createdAt).plus({ month: 1 }).set({ day: 10 }).startOf('day').toJSDate();
+        const a = Formatter.luxon(p.paidAt ?? p.createdAt).plus({ month: 1 }).set({ day: 10 }).startOf('day').toJSDate();
+        const b = Formatter.luxon(p.paidAt ?? p.createdAt).plus({ days: 15 }).startOf('day').toJSDate();
+        return new Date(Math.min(a.getTime(), b.getTime()));
     }
 
     console.log('Fetching all payments between ' + Formatter.dateTime(startDate.toJSDate()) + ' and now for ' + organization.name);

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.test.ts

@@ -3,10 +3,10 @@ import type { PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { PatchableArray, PatchMap } from '@simonbackx/simple-encoding';
 import type { Endpoint } from '@simonbackx/simple-endpoints';
 import { Request } from '@simonbackx/simple-endpoints';
-import { GroupFactory, Member, MemberFactory, OrganizationFactory, OrganizationTagFactory, Platform, RegistrationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { GroupFactory, Member, MemberFactory, MemberPlatformMembership, OrganizationFactory, OrganizationTagFactory, Platform, RegistrationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
 import { SQL } from '@stamhoofd/sql';
 import type { PatchAnswers } from '@stamhoofd/structures';
-import { Address, EmergencyContact, MemberDetails, MemberWithRegistrationsBlob, OrganizationMetaData, OrganizationRecordsConfiguration, Parent, PermissionLevel, Permissions, PermissionsResourceType, RecordCategory, RecordSettings, RecordTextAnswer, ResourcePermissions, ReviewTime, ReviewTimes, TranslatedString, UitpasNumberDetails, UitpasSocialTariff, UitpasSocialTariffStatus, Version } from '@stamhoofd/structures';
+import { Address, EmergencyContact, MemberDetails, MemberPlatformMembership as MemberPlatformMembershipStruct, MemberWithRegistrationsBlob, OrganizationMetaData, OrganizationRecordsConfiguration, Parent, PermissionLevel, Permissions, PermissionsResourceType, PlatformMembershipType, PlatformMembershipTypeConfig, RecordCategory, RecordSettings, RecordTextAnswer, ResourcePermissions, ReviewTime, ReviewTimes, TranslatedString, UitpasNumberDetails, UitpasSocialTariff, UitpasSocialTariffStatus, Version } from '@stamhoofd/structures';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { Country } from '@stamhoofd/types/Country';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
@@ -4034,4 +4034,192 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             });
         });
     });
+
+    describe('Overlapping and incompatible platform memberships', () => {
+        // Two non-overlapping halves of the same period (werkjaar).
+        const firstHalf = { startDate: new Date(2024, 0, 1, 0, 0, 0, 0), endDate: new Date(2024, 5, 30, 23, 59, 59, 0) };
+        const secondHalf = { startDate: new Date(2024, 6, 1, 0, 0, 0, 0), endDate: new Date(2024, 11, 31, 23, 59, 59, 0) };
+
+        async function setup({ incompatibleWithB = false, existingRange, putRange, existingLocked = false, existingGenerated = false }: {
+            incompatibleWithB?: boolean;
+            existingRange?: { startDate: Date; endDate: Date };
+            putRange?: { startDate: Date; endDate: Date };
+            existingLocked?: boolean;
+            existingGenerated?: boolean;
+        }) {
+            const period = await new RegistrationPeriodFactory({
+                startDate: new Date(2024, 0, 1, 0, 0, 0, 0),
+                endDate: new Date(2024, 11, 31, 23, 59, 59, 0),
+            }).create();
+
+            const organization = await new OrganizationFactory({ period }).create();
+
+            const typeB = PlatformMembershipType.create({
+                name: 'Type B',
+                periods: new Map([
+                    [period.id, PlatformMembershipTypeConfig.create({
+                        startDate: period.startDate,
+                        endDate: period.endDate,
+                    })],
+                ]),
+            });
+
+            const typeA = PlatformMembershipType.create({
+                name: 'Type A',
+                incompatibleMembershipTypeIds: incompatibleWithB ? [typeB.id] : [],
+                periods: new Map([
+                    [period.id, PlatformMembershipTypeConfig.create({
+                        startDate: period.startDate,
+                        endDate: period.endDate,
+                    })],
+                ]),
+            });
+
+            const platform = await Platform.getForEditing();
+            platform.periodId = period.id;
+            platform.config.membershipTypes = [typeA, typeB];
+            await platform.save();
+
+            const user = await new UserFactory({
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+                organization,
+            }).create();
+            const token = await Token.createToken(user);
+
+            const member = await new MemberFactory({ organization }).create();
+            const group = await new GroupFactory({ organization, period }).create();
+            await new RegistrationFactory({ member, group }).create();
+
+            // The member already has a membership of type B in this period
+            const existing = new MemberPlatformMembership();
+            existing.memberId = member.id;
+            existing.membershipTypeId = typeB.id;
+            existing.organizationId = organization.id;
+            existing.periodId = period.id;
+            existing.startDate = existingRange?.startDate ?? period.startDate;
+            existing.endDate = existingRange?.endDate ?? period.endDate;
+            existing.locked = existingLocked;
+            existing.generated = existingGenerated;
+            await existing.save();
+
+            const arr: Body = new PatchableArray();
+            const memberPatch = MemberWithRegistrationsBlob.patch({ id: member.id });
+            memberPatch.platformMemberships.addPut(MemberPlatformMembershipStruct.create({
+                memberId: member.id,
+                membershipTypeId: typeA.id,
+                organizationId: organization.id,
+                periodId: period.id,
+                startDate: putRange?.startDate ?? period.startDate,
+                endDate: putRange?.endDate ?? period.endDate,
+            }));
+            arr.addPatch(memberPatch);
+
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+
+            return { period, organization, typeA, typeB, member, request };
+        }
+
+        async function getTypeAMemberships(memberId: string, membershipTypeId: string) {
+            return await MemberPlatformMembership.select()
+                .where('memberId', memberId)
+                .where('membershipTypeId', membershipTypeId)
+                .where('deletedAt', null)
+                .fetch();
+        }
+
+        describe('Overlapping memberships of a different type are never allowed', () => {
+            test('Blocks an overlapping membership of an incompatible type', async () => {
+                const { typeA, member, request } = await setup({ incompatibleWithB: true });
+
+                await expect(testServer.test(endpoint, request)).rejects.toThrow(expect.objectContaining({
+                    code: 'invalid_field',
+                    field: 'membershipTypeId',
+                    message: 'Overlapping membership type',
+                }));
+
+                // The overlapping membership was not created
+                expect((await getTypeAMemberships(member.id, typeA.id)).length).toBe(0);
+            });
+
+            test('Blocks an overlapping membership even when the type is not marked incompatible', async () => {
+                const { typeA, member, request } = await setup({ incompatibleWithB: false });
+
+                await expect(testServer.test(endpoint, request)).rejects.toThrow(expect.objectContaining({
+                    code: 'invalid_field',
+                    field: 'membershipTypeId',
+                    message: 'Overlapping membership type',
+                }));
+
+                // The overlapping membership was not created
+                expect((await getTypeAMemberships(member.id, typeA.id)).length).toBe(0);
+            });
+        });
+
+        describe('Non-overlapping memberships in the same period', () => {
+            test('Blocks an incompatible type even when the dates do not overlap', async () => {
+                const { typeA, member, request } = await setup({
+                    incompatibleWithB: true,
+                    existingRange: firstHalf,
+                    putRange: secondHalf,
+                });
+
+                await expect(testServer.test(endpoint, request)).rejects.toThrow(expect.objectContaining({
+                    code: 'invalid_field',
+                    field: 'membershipTypeId',
+                    message: 'Incompatible membership type',
+                }));
+
+                // The incompatible membership was not created
+                expect((await getTypeAMemberships(member.id, typeA.id)).length).toBe(0);
+            });
+
+            test('Allows a compatible type when the dates do not overlap', async () => {
+                const { typeA, member, request } = await setup({
+                    incompatibleWithB: false,
+                    existingRange: firstHalf,
+                    putRange: secondHalf,
+                });
+
+                const result = await testServer.test(endpoint, request);
+                expect(result.status).toBe(200);
+
+                expect((await getTypeAMemberships(member.id, typeA.id)).length).toBe(1);
+            });
+
+            test('Reports a locked incompatible membership with a specific message', async () => {
+                const { typeA, member, request } = await setup({
+                    incompatibleWithB: true,
+                    existingRange: firstHalf,
+                    putRange: secondHalf,
+                    existingLocked: true,
+                });
+
+                await expect(testServer.test(endpoint, request)).rejects.toThrow(expect.objectContaining({
+                    code: 'invalid_field',
+                    field: 'membershipTypeId',
+                    message: 'Incompatible locked membership type',
+                }));
+
+                expect((await getTypeAMemberships(member.id, typeA.id)).length).toBe(0);
+            });
+
+            test('Reports a generated incompatible membership with a specific message', async () => {
+                const { typeA, member, request } = await setup({
+                    incompatibleWithB: true,
+                    existingRange: firstHalf,
+                    putRange: secondHalf,
+                    existingGenerated: true,
+                });
+
+                await expect(testServer.test(endpoint, request)).rejects.toThrow(expect.objectContaining({
+                    code: 'invalid_field',
+                    field: 'membershipTypeId',
+                    message: 'Incompatible generated membership type',
+                }));
+
+                expect((await getTypeAMemberships(member.id, typeA.id)).length).toBe(0);
+            });
+        });
+    });
 });

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.ts

@@ -66,6 +66,25 @@ export const duplicateCheckLimiter = new RateLimiter({
     ],
 });
 
+/**
+ * A where clause that matches memberships whose [startDate, endDate] range overlaps
+ * with the given [startDate, endDate] range.
+ */
+function membershipDateRangeOverlaps(startDate: Date, endDate: Date) {
+    return SQL.where(
+        SQL.where('startDate', SQLWhereSign.LessEqual, startDate)
+            .and('endDate', SQLWhereSign.GreaterEqual, startDate),
+    )
+        .or(
+            SQL.where('startDate', SQLWhereSign.LessEqual, endDate)
+                .and('endDate', SQLWhereSign.GreaterEqual, endDate),
+        )
+        .or(
+            SQL.where('startDate', SQLWhereSign.GreaterEqual, startDate)
+                .and('endDate', SQLWhereSign.LessEqual, endDate),
+        );
+}
+
 /**
  * One endpoint to create, patch and delete members and their registrations and payments
  */
@@ -568,26 +587,65 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
                 // Correct price and dates
                 await membership.calculatePrice(member);
 
+                const incompatible = await MemberPlatformMembership.select()
+                    .where('memberId', member.id)
+                    .whereNot('membershipTypeId', put.membershipTypeId) // same type is checked later and might be auto-deleted
+                    .where('periodId', put.periodId)
+                    .where('deletedAt', null)
+                    .where(membershipDateRangeOverlaps(put.startDate, put.endDate))
+                    .first(false);
+
+                if (incompatible) {
+                    throw new SimpleError({
+                        code: 'invalid_field',
+                        field: 'membershipTypeId',
+                        message: 'Overlapping membership type',
+                        human: $t('%Zd9'),
+                    });
+                }
+
+                // Not overlapping, but in same period.
+                if (membershipType.incompatibleMembershipTypeIds.length > 0) {
+                    const incompatible = await MemberPlatformMembership.select()
+                        .where('memberId', member.id)
+                        .where('membershipTypeId', membershipType.incompatibleMembershipTypeIds)
+                        .where('periodId', put.periodId)
+                        .where('deletedAt', null)
+                        .first(false);
+
+                    if (incompatible) {
+                        if (incompatible.locked) {
+                            throw new SimpleError({
+                                code: 'invalid_field',
+                                field: 'membershipTypeId',
+                                message: 'Incompatible locked membership type',
+                                human: $t('%Zd1'),
+                            });
+                        }
+                        if (incompatible.generated) {
+                            throw new SimpleError({
+                                code: 'invalid_field',
+                                field: 'membershipTypeId',
+                                message: 'Incompatible generated membership type',
+                                human: $t('%Zcx'),
+                            });
+                        }
+                        throw new SimpleError({
+                            code: 'invalid_field',
+                            field: 'membershipTypeId',
+                            message: 'Incompatible membership type',
+                            human: $t('%ZdA'),
+                        });
+                    }
+                }
+
                 // Check duplicate memberships after correcting the dates
                 const existing = await MemberPlatformMembership.select()
                     .where('memberId', member.id)
                     .where('membershipTypeId', put.membershipTypeId)
                     .where('periodId', put.periodId)
                     .where('deletedAt', null)
-                    .where(
-                        SQL.where(
-                            SQL.where('startDate', SQLWhereSign.LessEqual, put.startDate)
-                                .and('endDate', SQLWhereSign.GreaterEqual, put.startDate),
-                        )
-                            .or(
-                                SQL.where('startDate', SQLWhereSign.LessEqual, put.endDate)
-                                    .and('endDate', SQLWhereSign.GreaterEqual, put.endDate),
-                            )
-                            .or(
-                                SQL.where('startDate', SQLWhereSign.GreaterEqual, put.startDate)
-                                    .and('endDate', SQLWhereSign.LessEqual, put.endDate),
-                            ),
-                    )
+                    .where(membershipDateRangeOverlaps(put.startDate, put.endDate))
                     .first(false);
 
                 if (existing && (membershipType.behaviour === PlatformMembershipTypeBehaviour.Days || !existing.generated || existing.locked || existing.price < membership.price)) {

package/src/endpoints/organization/dashboard/balance-items/GetBalanceItemsEndpoint.test.ts

@@ -0,0 +1,183 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import type { Organization, User } from '@stamhoofd/models';
+import { BalanceItemFactory, GroupFactory, MemberFactory, OrderFactory, OrganizationFactory, RegistrationFactory, Token, UserFactory, WebshopFactory } from '@stamhoofd/models';
+import type { BalanceItem as BalanceItemStruct, PaginatedResponse, StamhoofdFilter } from '@stamhoofd/structures';
+import { BalanceItemRelation, BalanceItemRelationType, BalanceItemType, LimitedFilteredRequest, PermissionLevel, Permissions, TranslatedString } from '@stamhoofd/structures';
+import { testServer } from '../../../../../tests/helpers/TestServer.js';
+import { GetBalanceItemsEndpoint } from './GetBalanceItemsEndpoint.js';
+
+describe('Endpoint.GetBalanceItemsEndpoint', () => {
+    const endpoint = new GetBalanceItemsEndpoint();
+
+    const getBalanceItems = async ({ filter, organization, user }: { filter: StamhoofdFilter | null; organization: Organization; user: User }) => {
+        const token = await Token.createToken(user);
+
+        const request = Request.get({
+            path: '/balance-items',
+            host: organization.getApiHost(),
+            query: new LimitedFilteredRequest({
+                filter,
+                limit: 100,
+            }),
+            headers: {
+                authorization: 'Bearer ' + token.accessToken,
+            },
+        });
+
+        return testServer.test<PaginatedResponse<BalanceItemStruct[], LimitedFilteredRequest>>(endpoint, request);
+    };
+
+    const createFinanceUser = async (organization: Organization) => {
+        return await new UserFactory({
+            organization,
+            permissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+    };
+
+    describe('Filtering on the associated webshop', () => {
+        test('only returns balance items linked to an order of the given webshop', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await createFinanceUser(organization);
+
+            const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
+            const otherWebshop = await new WebshopFactory({ organizationId: organization.id }).create();
+
+            const order = await new OrderFactory({ webshop }).create();
+            const otherOrder = await new OrderFactory({ webshop: otherWebshop }).create();
+
+            const matchingItem = await new BalanceItemFactory({
+                organizationId: organization.id,
+                orderId: order.id,
+                type: BalanceItemType.Order,
+                amount: 1,
+                unitPrice: 10_00,
+            }).create();
+
+            // Negative controls: an order of another webshop and an item without an order
+            await new BalanceItemFactory({
+                organizationId: organization.id,
+                orderId: otherOrder.id,
+                type: BalanceItemType.Order,
+                amount: 1,
+                unitPrice: 10_00,
+            }).create();
+            await new BalanceItemFactory({
+                organizationId: organization.id,
+                type: BalanceItemType.Other,
+                amount: 1,
+                unitPrice: 10_00,
+            }).create();
+
+            const response = await getBalanceItems({
+                filter: {
+                    order: {
+                        webshopId: {
+                            $in: [webshop.id],
+                        },
+                    },
+                },
+                organization,
+                user,
+            });
+
+            expect(response.status).toBe(200);
+            expect(response.body.results.map(r => r.id)).toEqual([matchingItem.id]);
+        });
+    });
+
+    describe('Filtering on the associated group', () => {
+        test('only returns balance items linked to a registration of the given group', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await createFinanceUser(organization);
+
+            const member = await new MemberFactory({}).create();
+            const group = await new GroupFactory({ organization }).create();
+            const otherGroup = await new GroupFactory({ organization }).create();
+
+            const registration = await new RegistrationFactory({ member, group }).create();
+            const otherRegistration = await new RegistrationFactory({ member, group: otherGroup }).create();
+
+            const matchingItem = await new BalanceItemFactory({
+                organizationId: organization.id,
+                registrationId: registration.id,
+                type: BalanceItemType.Registration,
+                amount: 1,
+                unitPrice: 10_00,
+            }).create();
+
+            // Negative control: a registration for another group
+            await new BalanceItemFactory({
+                organizationId: organization.id,
+                registrationId: otherRegistration.id,
+                type: BalanceItemType.Registration,
+                amount: 1,
+                unitPrice: 10_00,
+            }).create();
+
+            const response = await getBalanceItems({
+                filter: {
+                    registration: {
+                        groupId: {
+                            $in: [group.id],
+                        },
+                    },
+                },
+                organization,
+                user,
+            });
+
+            expect(response.status).toBe(200);
+            expect(response.body.results.map(r => r.id)).toEqual([matchingItem.id]);
+        });
+    });
+
+    describe('Filtering on the membership type', () => {
+        const createMembershipItem = async ({ organization, membershipTypeId }: { organization: Organization; membershipTypeId: string }) => {
+            return await new BalanceItemFactory({
+                organizationId: organization.id,
+                type: BalanceItemType.PlatformMembership,
+                amount: 1,
+                unitPrice: 10_00,
+                relations: new Map([
+                    [
+                        BalanceItemRelationType.MembershipType,
+                        BalanceItemRelation.create({
+                            id: membershipTypeId,
+                            name: new TranslatedString('Membership type'),
+                        }),
+                    ],
+                ]),
+            }).create();
+        };
+
+        test('only returns balance items whose membership type relation matches', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await createFinanceUser(organization);
+
+            const membershipTypeId = 'membership-type-a';
+            const matchingItem = await createMembershipItem({ organization, membershipTypeId });
+
+            // Negative controls: a different membership type and an item without any relation
+            await createMembershipItem({ organization, membershipTypeId: 'membership-type-b' });
+            await new BalanceItemFactory({
+                organizationId: organization.id,
+                type: BalanceItemType.Other,
+                amount: 1,
+                unitPrice: 10_00,
+            }).create();
+
+            const response = await getBalanceItems({
+                filter: {
+                    membershipType: {
+                        $in: [membershipTypeId],
+                    },
+                },
+                organization,
+                user,
+            });
+
+            expect(response.status).toBe(200);
+            expect(response.body.results.map(r => r.id)).toEqual([matchingItem.id]);
+        });
+    });
+});

package/src/endpoints/organization/dashboard/payments/GetPaymentsEndpoint.test.ts

@@ -0,0 +1,158 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import type { Organization, User } from '@stamhoofd/models';
+import { BalanceItem, BalanceItemFactory, BalanceItemPayment, OrderFactory, OrganizationFactory, Payment, Token, UserFactory, WebshopFactory } from '@stamhoofd/models';
+import type { PaginatedResponse, PaymentGeneral, StamhoofdFilter } from '@stamhoofd/structures';
+import { BalanceItemRelation, BalanceItemRelationType, BalanceItemType, LimitedFilteredRequest, PaymentMethod, PaymentStatus, PermissionLevel, Permissions, TranslatedString } from '@stamhoofd/structures';
+import { testServer } from '../../../../../tests/helpers/TestServer.js';
+import { GetPaymentsEndpoint } from './GetPaymentsEndpoint.js';
+
+// These tests exercise the balance-item filters reused inside the payments query (balanceItemPayments ->
+// balanceItem -> ...), which is the path where balance_items is joined into another query.
+describe('Endpoint.GetPaymentsEndpoint', () => {
+    const endpoint = new GetPaymentsEndpoint();
+
+    const getPayments = async ({ filter, organization, user }: { filter: StamhoofdFilter | null; organization: Organization; user: User }) => {
+        const token = await Token.createToken(user);
+
+        const request = Request.get({
+            path: '/payments',
+            host: organization.getApiHost(),
+            query: new LimitedFilteredRequest({
+                filter,
+                limit: 100,
+            }),
+            headers: {
+                authorization: 'Bearer ' + token.accessToken,
+            },
+        });
+
+        return testServer.test<PaginatedResponse<PaymentGeneral[], LimitedFilteredRequest>>(endpoint, request);
+    };
+
+    const createFinanceUser = async (organization: Organization) => {
+        return await new UserFactory({
+            organization,
+            permissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+    };
+
+    const createPaymentForBalanceItem = async (organization: Organization, balanceItem: BalanceItem) => {
+        const payment = new Payment();
+        payment.method = PaymentMethod.Transfer;
+        payment.status = PaymentStatus.Succeeded;
+        payment.organizationId = organization.id;
+        payment.price = 10_00;
+        await payment.save();
+
+        const balanceItemPayment = new BalanceItemPayment();
+        balanceItemPayment.balanceItemId = balanceItem.id;
+        balanceItemPayment.paymentId = payment.id;
+        balanceItemPayment.price = 10_00;
+        balanceItemPayment.organizationId = organization.id;
+        await balanceItemPayment.save();
+
+        return payment;
+    };
+
+    describe('Filtering on the balance item of a payment', () => {
+        test('only returns payments whose balance item is linked to an order of the given webshop', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await createFinanceUser(organization);
+
+            const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
+            const otherWebshop = await new WebshopFactory({ organizationId: organization.id }).create();
+
+            const order = await new OrderFactory({ webshop }).create();
+            const otherOrder = await new OrderFactory({ webshop: otherWebshop }).create();
+
+            const matchingItem = await new BalanceItemFactory({
+                organizationId: organization.id,
+                orderId: order.id,
+                type: BalanceItemType.Order,
+                amount: 1,
+                unitPrice: 10_00,
+            }).create();
+            const matchingPayment = await createPaymentForBalanceItem(organization, matchingItem);
+
+            // Negative control: a payment for a balance item of another webshop's order
+            const otherItem = await new BalanceItemFactory({
+                organizationId: organization.id,
+                orderId: otherOrder.id,
+                type: BalanceItemType.Order,
+                amount: 1,
+                unitPrice: 10_00,
+            }).create();
+            await createPaymentForBalanceItem(organization, otherItem);
+
+            const response = await getPayments({
+                filter: {
+                    balanceItemPayments: {
+                        $elemMatch: {
+                            balanceItem: {
+                                order: {
+                                    webshopId: {
+                                        $in: [webshop.id],
+                                    },
+                                },
+                            },
+                        },
+                    },
+                },
+                organization,
+                user,
+            });
+
+            expect(response.status).toBe(200);
+            expect(response.body.results.map(r => r.id)).toEqual([matchingPayment.id]);
+        });
+
+        test('only returns payments whose balance item matches the given membership type', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await createFinanceUser(organization);
+
+            const createMembershipItem = async (membershipTypeId: string) => {
+                return await new BalanceItemFactory({
+                    organizationId: organization.id,
+                    type: BalanceItemType.PlatformMembership,
+                    amount: 1,
+                    unitPrice: 10_00,
+                    relations: new Map([
+                        [
+                            BalanceItemRelationType.MembershipType,
+                            BalanceItemRelation.create({
+                                id: membershipTypeId,
+                                name: new TranslatedString('Membership type'),
+                            }),
+                        ],
+                    ]),
+                }).create();
+            };
+
+            const matchingItem = await createMembershipItem('membership-type-a');
+            const matchingPayment = await createPaymentForBalanceItem(organization, matchingItem);
+
+            // Negative control: a payment for a balance item with a different membership type
+            const otherItem = await createMembershipItem('membership-type-b');
+            await createPaymentForBalanceItem(organization, otherItem);
+
+            const response = await getPayments({
+                filter: {
+                    balanceItemPayments: {
+                        $elemMatch: {
+                            balanceItem: {
+                                membershipType: {
+                                    $in: ['membership-type-a'],
+                                },
+                            },
+                        },
+                    },
+                },
+                organization,
+                user,
+            });
+
+            expect(response.status).toBe(200);
+            expect(response.body.results.map(r => r.id)).toEqual([matchingPayment.id]);
+        });
+    });
+});

package/src/helpers/StripeInvoicer.ts

@@ -235,7 +235,7 @@ export class StripeReportInvoicer {
                 sellingOrganization,
                 type: 'services',
             });
-            item.VATIncluded = true;
+            item.VATIncluded = !item.VATExcempt; // Makes sure price with VAT always matches the charged amount
             item.quantity = 1;
             item.unitPrice = applicationFee.serviceFee;
             item.createdAt = new Date();
@@ -265,7 +265,7 @@ export class StripeReportInvoicer {
                 sellingOrganization,
                 type: 'services',
             });
-            item.VATIncluded = true;
+            item.VATIncluded = !item.VATExcempt; // Makes sure price with VAT always matches the charged amount
             item.quantity = 1;
             item.unitPrice = applicationFee.transferFee;
             item.createdAt = new Date();
@@ -276,6 +276,17 @@ export class StripeReportInvoicer {
             balanceItems.push(item);
         }
 
+        let total = 0;
+        for (const balanceItem of balanceItems) {
+            total += balanceItem.priceWithVAT;
+        }
+        if (total !== applicationFee.amount) {
+            throw new SimpleError({
+                code: 'price_mismatched',
+                message: 'The charged amount does not match the total application fee for the payment',
+            });
+        }
+
         const systemUser = await User.getSystem();
 
         // Done validation

package/src/services/uitpas/checkPermissionsFor.ts

@@ -74,7 +74,7 @@ export async function checkPermissionsFor(access_token: string, organizationId:
         });
     });
     assertIsPermissionsResponse(json);
-    const neededPermissions = organizationId
+    const neededPermissions = !organizationId
         ? [{
                 permission: 'PASSES_READ',
                 human: 'Basis UiTPAS informatie ophalen met UiTPAS nummer',

package/src/sql-filters/balance-item-payments.ts

@@ -1,5 +1,6 @@
 import type { SQLFilterDefinitions } from '@stamhoofd/sql';
-import { baseSQLFilterCompilers, createColumnFilter, createExistsFilter, SQL, SQLValueType } from '@stamhoofd/sql';
+import { baseSQLFilterCompilers, createColumnFilter, SQL, SQLValueType } from '@stamhoofd/sql';
+import { balanceItemFilterCompilers } from './balance-items.js';
 
 export const balanceItemPaymentsCompilers: SQLFilterDefinitions = {
     ...baseSQLFilterCompilers,
@@ -13,59 +14,6 @@ export const balanceItemPaymentsCompilers: SQLFilterDefinitions = {
         type: SQLValueType.Number,
         nullable: false,
     }),
-    balanceItem: {
-        ...baseSQLFilterCompilers,
-        id: createColumnFilter({
-            expression: SQL.column('balance_items', 'id'),
-            type: SQLValueType.String,
-            nullable: false,
-        }),
-        description: createColumnFilter({
-            expression: SQL.column('balance_items', 'description'),
-            type: SQLValueType.String,
-            nullable: false,
-        }),
-        payingOrganizationId: createColumnFilter({
-            expression: SQL.column('balance_items', 'payingOrganizationId'),
-            type: SQLValueType.String,
-            nullable: true,
-        }),
-        type: createColumnFilter({
-            expression: SQL.column('balance_items', 'type'),
-            type: SQLValueType.String,
-            nullable: false,
-        }),
-        registration: createExistsFilter(
-            SQL.select()
-                .from(SQL.table('registrations'))
-                .where(
-                    SQL.column('registrations', 'id'),
-                    SQL.column('balance_items', 'registrationId'),
-                ),
-            {
-                ...baseSQLFilterCompilers,
-                groupId: createColumnFilter({
-                    expression: SQL.column('registrations', 'groupId'),
-                    type: SQLValueType.String,
-                    nullable: false,
-                }),
-            },
-        ),
-        order: createExistsFilter(
-            SQL.select()
-                .from(SQL.table('webshop_orders'))
-                .where(
-                    SQL.column('webshop_orders', 'id'),
-                    SQL.column('balance_items', 'orderId'),
-                ),
-            {
-                ...baseSQLFilterCompilers,
-                webshopId: createColumnFilter({
-                    expression: SQL.column('webshop_orders', 'webshopId'),
-                    type: SQLValueType.String,
-                    nullable: false,
-                }),
-            },
-        ),
-    },
+    // Reuse the shared balance item filters (type, webshop, group, membership type, ...)
+    balanceItem: balanceItemFilterCompilers,
 };

package/src/sql-filters/balance-items.ts

@@ -1,56 +1,115 @@
 import type { SQLFilterDefinitions } from '@stamhoofd/sql';
-import { baseSQLFilterCompilers, createColumnFilter, SQL, SQLValueType } from '@stamhoofd/sql';
+import { baseSQLFilterCompilers, createColumnFilter, createExistsFilter, SQL, SQLValueType } from '@stamhoofd/sql';
+import { BalanceItemRelationType } from '@stamhoofd/structures';
+
+/**
+ * Filters on the relations of a balance item (registration group, webshop order and membership type).
+ *
+ * Grouped separately from the plain column filters because these are JOIN/JSON based rather than simple
+ * columns. They are spread into balanceItemFilterCompilers below, which is the single set consumed both
+ * by the direct balance items endpoint and by the balance items nested inside payments (see
+ * balance-item-payments.ts) — so both automatically expose these relation filters.
+ *
+ * All expressions are qualified with the balance_items table so they keep working when balance_items
+ * is joined into another query (e.g. via balance_item_payments).
+ */
+export const balanceItemRelationFilterCompilers: SQLFilterDefinitions = {
+    registration: createExistsFilter(
+        SQL.select()
+            .from(SQL.table('registrations'))
+            .where(
+                SQL.column('registrations', 'id'),
+                SQL.column('balance_items', 'registrationId'),
+            ),
+        {
+            ...baseSQLFilterCompilers,
+            groupId: createColumnFilter({
+                expression: SQL.column('registrations', 'groupId'),
+                type: SQLValueType.String,
+                nullable: false,
+            }),
+        },
+    ),
+    order: createExistsFilter(
+        SQL.select()
+            .from(SQL.table('webshop_orders'))
+            .where(
+                SQL.column('webshop_orders', 'id'),
+                SQL.column('balance_items', 'orderId'),
+            ),
+        {
+            ...baseSQLFilterCompilers,
+            webshopId: createColumnFilter({
+                expression: SQL.column('webshop_orders', 'webshopId'),
+                type: SQLValueType.String,
+                nullable: false,
+            }),
+        },
+    ),
+    // The membership type is only stored inside the relations JSON, so we read its id from there.
+    membershipType: createColumnFilter({
+        expression: SQL.jsonExtract(SQL.column('balance_items', 'relations'), `$.value.${BalanceItemRelationType.MembershipType}.id`),
+        type: SQLValueType.JSONString,
+        nullable: true,
+    }),
+};
 
 /**
  * Defines how to filter balance items in the database from StamhoofdFilter objects
  */
 export const balanceItemFilterCompilers: SQLFilterDefinitions = {
     ...baseSQLFilterCompilers,
+    ...balanceItemRelationFilterCompilers,
     id: createColumnFilter({
-        expression: SQL.column('id'),
+        expression: SQL.column('balance_items', 'id'),
         type: SQLValueType.String,
         nullable: false,
     }),
     organizationId: createColumnFilter({
-        expression: SQL.column('organizationId'),
+        expression: SQL.column('balance_items', 'organizationId'),
         type: SQLValueType.String,
         nullable: false,
     }),
+    payingOrganizationId: createColumnFilter({
+        expression: SQL.column('balance_items', 'payingOrganizationId'),
+        type: SQLValueType.String,
+        nullable: true,
+    }),
     type: createColumnFilter({
-        expression: SQL.column('type'),
+        expression: SQL.column('balance_items', 'type'),
         type: SQLValueType.String,
         nullable: false,
     }),
     status: createColumnFilter({
-        expression: SQL.column('status'),
+        expression: SQL.column('balance_items', 'status'),
         type: SQLValueType.String,
         nullable: false,
     }),
     createdAt: createColumnFilter({
-        expression: SQL.column('createdAt'),
+        expression: SQL.column('balance_items', 'createdAt'),
         type: SQLValueType.Datetime,
         nullable: false,
     }),
     updatedAt: createColumnFilter({
-        expression: SQL.column('updatedAt'),
+        expression: SQL.column('balance_items', 'updatedAt'),
         type: SQLValueType.Datetime,
         nullable: false,
     }),
 
     description: createColumnFilter({
-        expression: SQL.column('description'),
+        expression: SQL.column('balance_items', 'description'),
         type: SQLValueType.String,
         nullable: false,
     }),
 
     priceWithVAT: createColumnFilter({
-        expression: SQL.column('priceTotal'),
+        expression: SQL.column('balance_items', 'priceTotal'),
         type: SQLValueType.Number,
         nullable: false,
     }),
 
     priceOpen: createColumnFilter({
-        expression: SQL.column('priceOpen'),
+        expression: SQL.column('balance_items', 'priceOpen'),
         type: SQLValueType.Number,
         nullable: false,
     }),