@stamhoofd/backend 2.134.0 → 2.135.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.134.0",
+    "version": "2.135.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -57,20 +57,20 @@
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.134.0",
-        "@stamhoofd/backend-i18n": "2.134.0",
-        "@stamhoofd/backend-middleware": "2.134.0",
-        "@stamhoofd/crons": "2.134.0",
-        "@stamhoofd/email": "2.134.0",
-        "@stamhoofd/excel-writer": "2.134.0",
-        "@stamhoofd/logging": "2.134.0",
-        "@stamhoofd/models": "2.134.0",
-        "@stamhoofd/object-differ": "2.134.0",
-        "@stamhoofd/queues": "2.134.0",
-        "@stamhoofd/sql": "2.134.0",
-        "@stamhoofd/structures": "2.134.0",
-        "@stamhoofd/types": "2.134.0",
-        "@stamhoofd/utility": "2.134.0",
+        "@stamhoofd/backend-env": "2.135.0",
+        "@stamhoofd/backend-i18n": "2.135.0",
+        "@stamhoofd/backend-middleware": "2.135.0",
+        "@stamhoofd/crons": "2.135.0",
+        "@stamhoofd/email": "2.135.0",
+        "@stamhoofd/excel-writer": "2.135.0",
+        "@stamhoofd/logging": "2.135.0",
+        "@stamhoofd/models": "2.135.0",
+        "@stamhoofd/object-differ": "2.135.0",
+        "@stamhoofd/queues": "2.135.0",
+        "@stamhoofd/sql": "2.135.0",
+        "@stamhoofd/structures": "2.135.0",
+        "@stamhoofd/types": "2.135.0",
+        "@stamhoofd/utility": "2.135.0",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.134.0",
+        "@stamhoofd/test-utils": "2.135.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "42955365bcf0bcfd0815998c1039e23d6ee1d6c6"
+    "gitHead": "df20ecb0e4b10af877d2e37e92e39100afe342e8"
 }

package/src/endpoints/auth/VerifyEmailEndpoint.test.ts

@@ -0,0 +1,154 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { AuditLog, EmailVerificationCode, OrganizationFactory, Token, User, UserFactory } from '@stamhoofd/models';
+import type { Organization } from '@stamhoofd/models';
+import { AuditLogType, PermissionLevel, PermissionRole, Permissions, Token as TokenStruct } from '@stamhoofd/structures';
+import { TestUtils } from '@stamhoofd/test-utils';
+
+import { testServer } from '../../../tests/helpers/TestServer.js';
+import { VerifyEmailEndpoint } from './VerifyEmailEndpoint.js';
+
+describe('Endpoint.VerifyEmail', () => {
+    const endpoint = new VerifyEmailEndpoint();
+
+    beforeEach(() => {
+        TestUtils.setEnvironment('userMode', 'organization');
+    });
+
+    /**
+     * Create a user with permissions for the given organization.
+     */
+    async function createUserWithPermissions(organization: Organization, email: string, permissions?: Permissions) {
+        return await new UserFactory({
+            organization,
+            email,
+            permissions,
+        }).create();
+    }
+
+    /**
+     * Build a verification code for the given user that will change the user's email to `newEmail`
+     * on verification, and run the endpoint with it.
+     */
+    async function verifyEmail(organization: Organization, user: User, newEmail: string) {
+        const code = await EmailVerificationCode.createFor(user, newEmail);
+
+        const request = Request.buildJson('POST', '/verify-email', organization.getApiHost(), {
+            token: code.token,
+            code: code.code,
+        });
+
+        return await testServer.test(endpoint, request);
+    }
+
+    test('merges the permissions of the deleted user into the kept user', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        // The user that keeps existing and changes its email to the other user's email
+        const keptUser = await createUserWithPermissions(organization, 'kept@example.com', Permissions.create({
+            roles: [PermissionRole.create({ id: 'role-a', name: 'Role A' })],
+        }));
+
+        // The user that will be found by its email and merged into (and deleted)
+        const otherUser = await createUserWithPermissions(organization, 'other@example.com', Permissions.create({
+            level: PermissionLevel.Full,
+            roles: [PermissionRole.create({ id: 'role-b', name: 'Role B' })],
+        }));
+
+        const response = await verifyEmail(organization, keptUser, otherUser.email);
+        expect(response.status).toBe(200);
+
+        // The other user is deleted
+        expect(await User.getByID(otherUser.id)).toBeUndefined();
+
+        // The kept user now holds both users' permissions for the organization
+        const refreshed = await User.getByID(keptUser.id);
+        expect(refreshed).toBeDefined();
+        expect(refreshed!.email).toBe('other@example.com');
+
+        const merged = refreshed!.permissions!.organizationPermissions.get(organization.id);
+        expect(merged).toBeDefined();
+        expect(merged!.level).toBe(PermissionLevel.Full);
+        expect(merged!.roles.map(r => r.id).sort()).toEqual(['role-a', 'role-b']);
+    });
+
+    test('adopts the permissions of the deleted user when the kept user has none', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        // The kept user has no permissions
+        const keptUser = await createUserWithPermissions(organization, 'kept@example.com');
+        expect(keptUser.permissions).toBeNull();
+
+        const otherUser = await createUserWithPermissions(organization, 'other@example.com', Permissions.create({
+            roles: [PermissionRole.create({ id: 'role-b', name: 'Role B' })],
+        }));
+
+        const response = await verifyEmail(organization, keptUser, otherUser.email);
+        expect(response.status).toBe(200);
+
+        expect(await User.getByID(otherUser.id)).toBeUndefined();
+
+        const refreshed = await User.getByID(keptUser.id);
+        const merged = refreshed!.permissions?.organizationPermissions.get(organization.id);
+        expect(merged).toBeDefined();
+        expect(merged!.roles.map(r => r.id)).toEqual(['role-b']);
+    });
+
+    test('reassigns audit logs of the deleted user to the kept user', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const keptUser = await createUserWithPermissions(organization, 'kept@example.com');
+        const otherUser = await createUserWithPermissions(organization, 'other@example.com');
+
+        // An audit log performed by the user that will be deleted
+        const auditLog = new AuditLog();
+        auditLog.type = AuditLogType.Unknown;
+        auditLog.userId = otherUser.id;
+        auditLog.organizationId = organization.id;
+        auditLog.description = 'Performed by the other user';
+        await auditLog.save();
+
+        const response = await verifyEmail(organization, keptUser, otherUser.email);
+        expect(response.status).toBe(200);
+
+        expect(await User.getByID(otherUser.id)).toBeUndefined();
+
+        // The audit log is now attributed to the kept user
+        const refreshedLog = await AuditLog.getByID(auditLog.id);
+        expect(refreshedLog).toBeDefined();
+        expect(refreshedLog!.userId).toBe(keptUser.id);
+    });
+
+    test('verifies the email and returns a valid token when merging without throwing', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const keptUser = await createUserWithPermissions(organization, 'kept@example.com', Permissions.create({
+            roles: [PermissionRole.create({ id: 'role-a', name: 'Role A' })],
+        }));
+        const otherUser = await createUserWithPermissions(organization, 'other@example.com', Permissions.create({
+            roles: [PermissionRole.create({ id: 'role-b', name: 'Role B' })],
+        }));
+
+        // Also add an audit log to exercise all merge branches together
+        const auditLog = new AuditLog();
+        auditLog.type = AuditLogType.Unknown;
+        auditLog.userId = otherUser.id;
+        auditLog.organizationId = organization.id;
+        await auditLog.save();
+
+        const response = await verifyEmail(organization, keptUser, otherUser.email);
+
+        expect(response.body).toBeInstanceOf(TokenStruct);
+        if (!(response.body instanceof TokenStruct)) {
+            throw new Error('Expected TokenStruct');
+        }
+
+        // The returned token belongs to the kept user
+        const token = await Token.getByAccessToken(response.body.accessToken);
+        expect(token).toBeDefined();
+        expect(token!.user.id).toBe(keptUser.id);
+
+        const refreshed = await User.getByID(keptUser.id);
+        expect(refreshed!.verified).toBe(true);
+        expect(refreshed!.email).toBe('other@example.com');
+    });
+});

package/src/endpoints/auth/VerifyEmailEndpoint.ts

@@ -6,6 +6,7 @@ import { EmailVerificationCode, Token, User } from '@stamhoofd/models';
 import { Token as TokenStruct, VerifyEmailRequest } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context.js';
+import { BalanceItemService } from '../../services/BalanceItemService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -77,6 +78,9 @@ export class VerifyEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
             if (other) {
                 // Delete the other user, but merge data
                 await user.merge(other);
+                if (user.organizationId) {
+                    BalanceItemService.scheduleUserUpdate(user.organizationId, user.id);
+                }
             }
 
             // change user email

package/src/endpoints/global/members/GetMembersEndpoint.test.ts

@@ -1,8 +1,9 @@
 import type { Endpoint } from '@simonbackx/simple-endpoints';
 import { Request } from '@simonbackx/simple-endpoints';
-import type { RegistrationPeriod } from '@stamhoofd/models';
+import type { MemberWithUsersRegistrationsAndGroups, RegistrationPeriod } from '@stamhoofd/models';
 import { EventFactory, GroupFactory, MemberFactory, OrganizationFactory, RecordCategoryFactory, RegistrationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
-import { AccessRight, EventMeta, GroupType, LimitedFilteredRequest, NamedObject, PermissionLevel, PermissionRoleDetailed, Permissions, PermissionsResourceType, RecordAnswer, RecordTextAnswer, RecordType, ResourcePermissions } from '@stamhoofd/structures';
+import type { SortList } from '@stamhoofd/structures';
+import { AccessRight, EventMeta, GroupType, LimitedFilteredRequest, NamedObject, PermissionLevel, PermissionRoleDetailed, Permissions, PermissionsResourceType, RecordAnswer, RecordTextAnswer, RecordType, ResourcePermissions, SortItemDirection } from '@stamhoofd/structures';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { GetMembersEndpoint } from './GetMembersEndpoint.js';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
@@ -1959,4 +1960,225 @@ describe('Endpoint.GetMembersEndpoint', () => {
             ]);
         });
     });
+
+    describe('Sorting', () => {
+        // Deliberately not in chronological order, so a passing test cannot be explained by insertion order
+        const january = new Date(Date.UTC(2023, 0, 10, 8, 30, 0));
+        const february = new Date(Date.UTC(2023, 1, 1, 0, 0, 0));
+        const march = new Date(Date.UTC(2023, 2, 5, 12, 0, 0));
+        const may = new Date(Date.UTC(2023, 4, 15, 16, 45, 0));
+        const june = new Date(Date.UTC(2023, 5, 20, 22, 15, 0));
+
+        /**
+         * Creates one member per passed value, all registered in the same group of a new organization,
+         * and returns an admin with full access to that organization.
+         */
+        async function setupMembers(lastRegisteredAtValues: (Date | null)[]) {
+            const organization = await new OrganizationFactory({ period }).create();
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }).create();
+
+            const token = await Token.createToken(user);
+            const group = await new GroupFactory({ organization, period }).create();
+
+            const members: MemberWithUsersRegistrationsAndGroups[] = [];
+
+            for (const lastRegisteredAt of lastRegisteredAtValues) {
+                const member = await new MemberFactory({}).create();
+                await new RegistrationFactory({ member, group }).create();
+
+                // The registration factory does not maintain lastRegisteredAt (only RegistrationService does),
+                // so we set it explicitly to get deterministic values - including legacy members that never got one.
+                member.lastRegisteredAt = lastRegisteredAt;
+                await member.save();
+
+                members.push(member);
+            }
+
+            return { host: organization.getApiHost(), token, members };
+        }
+
+        /**
+         * Requests every page by following the 'next' request the endpoint returns, exactly like the frontend does.
+         * That next request is built from the sorter's getValue, so this covers the full sort + pagination flow:
+         * getValue -> page filter -> encoded in the query -> decoded -> compiled back to SQL.
+         *
+         * Returns the ids of all members across all pages, in the order they were received.
+         */
+        async function fetchAllPages({ host, token, sort, limit }: { host: string; token: Token; sort: SortList; limit: number }) {
+            const ids: string[] = [];
+            let query: LimitedFilteredRequest | undefined = new LimitedFilteredRequest({ sort, limit });
+            let pages = 0;
+
+            while (query) {
+                const request = Request.get({
+                    path: baseUrl,
+                    host,
+                    query,
+                    headers: {
+                        authorization: 'Bearer ' + token.accessToken,
+                    },
+                });
+
+                const response = await testServer.test(endpoint, request);
+                expect(response.status).toBe(200);
+
+                ids.push(...response.body.results.members.map(m => m.id));
+                query = response.body.next;
+                pages += 1;
+
+                if (pages > 10) {
+                    throw new Error('Pagination did not terminate');
+                }
+            }
+
+            return ids;
+        }
+
+        test('Members are sorted by lastRegisteredAt ascending across all pages', async () => {
+            const { host, token, members } = await setupMembers([march, january, june, february, may]);
+            const [marchMember, januaryMember, juneMember, februaryMember, mayMember] = members;
+
+            // A limit lower than the total forces the endpoint to build a next page filter from getValue
+            const ids = await fetchAllPages({
+                host,
+                token,
+                sort: [{ key: 'lastRegisteredAt', order: SortItemDirection.ASC }],
+                limit: 2,
+            });
+
+            expect(ids).toEqual([
+                januaryMember.id,
+                februaryMember.id,
+                marchMember.id,
+                mayMember.id,
+                juneMember.id,
+            ]);
+        });
+
+        test('Members are sorted by lastRegisteredAt descending across all pages', async () => {
+            const { host, token, members } = await setupMembers([march, january, june, february, may]);
+            const [marchMember, januaryMember, juneMember, februaryMember, mayMember] = members;
+
+            const ids = await fetchAllPages({
+                host,
+                token,
+                sort: [{ key: 'lastRegisteredAt', order: SortItemDirection.DESC }],
+                limit: 2,
+            });
+
+            expect(ids).toEqual([
+                juneMember.id,
+                mayMember.id,
+                marchMember.id,
+                februaryMember.id,
+                januaryMember.id,
+            ]);
+        });
+
+        test('Members without a lastRegisteredAt are sorted first when ascending', async () => {
+            const { host, token, members } = await setupMembers([march, null, january]);
+            const [marchMember, neverRegisteredMember, januaryMember] = members;
+
+            // A limit of 1 puts the page boundary right after the member without a lastRegisteredAt,
+            // so the next page filter is built from a null value.
+            const ids = await fetchAllPages({
+                host,
+                token,
+                sort: [{ key: 'lastRegisteredAt', order: SortItemDirection.ASC }],
+                limit: 1,
+            });
+
+            expect(ids).toEqual([
+                neverRegisteredMember.id,
+                januaryMember.id,
+                marchMember.id,
+            ]);
+        });
+
+        test('Members without a lastRegisteredAt are sorted last when descending', async () => {
+            const { host, token, members } = await setupMembers([march, null, january]);
+            const [marchMember, neverRegisteredMember, januaryMember] = members;
+
+            const ids = await fetchAllPages({
+                host,
+                token,
+                sort: [{ key: 'lastRegisteredAt', order: SortItemDirection.DESC }],
+                limit: 1,
+            });
+
+            expect(ids).toEqual([
+                marchMember.id,
+                januaryMember.id,
+                neverRegisteredMember.id,
+            ]);
+        });
+
+        test('The next page filter compares lastRegisteredAt as a UTC datetime string', async () => {
+            const { host, token, members } = await setupMembers([january, february]);
+            const [januaryMember] = members;
+
+            const request = Request.get({
+                path: baseUrl,
+                host,
+                query: new LimitedFilteredRequest({
+                    sort: [{ key: 'lastRegisteredAt', order: SortItemDirection.ASC }],
+                    limit: 1,
+                }),
+                headers: {
+                    authorization: 'Bearer ' + token.accessToken,
+                },
+            });
+
+            const response = await testServer.test(endpoint, request);
+            expect(response.status).toBe(200);
+            expect(response.body.results.members).toHaveLength(1);
+
+            // The value has to be formatted in UTC, because that is how MySQL stores the datetime column.
+            // Comparing against a raw Date or a localized string would shift the page boundary.
+            expect(response.body.next?.pageFilter).toMatchObject({
+                $or: [
+                    { lastRegisteredAt: { $gt: '2023-01-10 08:30:00' } },
+                    {
+                        $and: [
+                            { lastRegisteredAt: '2023-01-10 08:30:00' },
+                            { id: { $gt: januaryMember.id } },
+                        ],
+                    },
+                ],
+            });
+        });
+
+        test('Members are sorted by createdAt across all pages, even if they never registered', async () => {
+            const { host, token, members } = await setupMembers([null, null, null]);
+            const [first, second, third] = members;
+
+            // createdAt keeps an explicitly set value on save
+            first.createdAt = march;
+            second.createdAt = january;
+            third.createdAt = february;
+
+            await first.save();
+            await second.save();
+            await third.save();
+
+            const ids = await fetchAllPages({
+                host,
+                token,
+                sort: [{ key: 'createdAt', order: SortItemDirection.ASC }],
+                limit: 1,
+            });
+
+            expect(ids).toEqual([
+                second.id,
+                third.id,
+                first.id,
+            ]);
+        });
+    });
 });

package/src/endpoints/global/registration/RegisterMembersEndpoint.test.ts

@@ -240,6 +240,53 @@ describe('Endpoint.RegisterMembers', () => {
             ]);
         });
 
+        test('Should pay a balance item that is due soon (dueAt in the near future)', async () => {
+            const { member, user, organization, token } = await initData();
+
+            // Items that are due within 7 days are part of the outstanding balance, so a member
+            // can pay them before their due date.
+            const dueAt = new Date(new Date().getTime() + 3 * 24 * 60 * 60 * 1000);
+
+            const balanceItem1 = await new BalanceItemFactory({
+                organizationId: organization.id,
+                memberId: member.id,
+                userId: user.id,
+                type: BalanceItemType.Registration,
+                amount: 10,
+                unitPrice: 200,
+                dueAt,
+                status: BalanceItemStatus.Due,
+            }).create();
+
+            const body = IDRegisterCheckout.create({
+                cart: IDRegisterCart.create({
+                    items: [],
+                    balanceItems: [
+                        BalanceItemCartItem.create({
+                            item: balanceItem1.getStructure(),
+                            price: 2000,
+                        }),
+                    ],
+                    deleteRegistrationIds: [],
+                }),
+                administrationFee: 0,
+                freeContribution: 0,
+                paymentMethod: PaymentMethod.PointOfSale,
+                totalPrice: 2000,
+                customer: null,
+            });
+
+            const response = await post(body, organization, token);
+
+            // The member really has to pay it: it must be part of the payment
+            expect(response.body.payment).not.toBeNull();
+            expect(response.body.payment!.price).toBe(2000);
+
+            // Point of sale isn't paid right away, but the amount is pending in the payment
+            await balanceItem1.refresh();
+            expect(balanceItem1.pricePending).toBe(2000);
+        });
+
         test('Should fail if balance item deleted', async () => {
             const { member, user, organization, token } = await initData();
 
@@ -960,17 +1007,120 @@ describe('Endpoint.RegisterMembers', () => {
                 // assert
                 expect(response.body).toBeDefined();
                 expect(response.body.registrations.length).toBe(1);
+                // Nothing is due during a trial, but the registration should still be activated
+                // (marked valid) so it is visible in the registration lists and member portal.
+                expect(response.body.registrations[0]).toMatchObject({
+                    registeredAt: expect.any(Date),
+                    deactivatedAt: null,
+                });
+                const dbRegistration = await Registration.getByID(response.body.registrations[0].id);
+                expect(dbRegistration?.registeredAt).not.toBeNull();
+                expect(dbRegistration?.deactivatedAt).toBeNull();
                 const trialUntil = response.body.registrations[0].trialUntil;
                 expect(trialUntil).not.toBeNull();
                 // 2023-05-14
                 expect(trialUntil!.getFullYear()).toBe(2023);
                 expect(trialUntil!.getMonth()).toBe(4);
                 expect(trialUntil!.getDate()).toBe(19);
+
+                // Nothing is paid during the trial, but the balance item should be due (not hidden)
+                // so it is still billed once the trial ends.
+                const balanceItems = await BalanceItem.where({ registrationId: dbRegistration!.id });
+                expect(balanceItems.length).toBe(1);
+                expect(balanceItems[0]).toMatchObject({
+                    status: BalanceItemStatus.Due,
+                    dueAt: dbRegistration!.trialUntil,
+                    pricePaid: 0,
+                });
             } finally {
                 vitest.useRealTimers();
             }
         }, 20_00000);
 
+        test('A trial registration is activated immediately, while a paid registration in the same cart waits for the online payment', async () => {
+            // #region arrange
+            const { member, group, groupPrice, organization, token } = await initData();
+            await initPayconiq({ organization });
+
+            // The trial group also limits its members, so a reservedUntil is set and has to be cleared again
+            group.settings.trialDays = 5;
+            group.settings.maxMembers = 1;
+            await group.save();
+
+            const paidGroup = await new GroupFactory({
+                organization,
+                price: 1500,
+                maxMembers: 1,
+            }).create();
+
+            const body = IDRegisterCheckout.create({
+                cart: IDRegisterCart.create({
+                    items: [
+                        IDRegisterItem.create({
+                            id: uuidv4(),
+                            groupPrice,
+                            organizationId: organization.id,
+                            groupId: group.id,
+                            memberId: member.id,
+                            trial: true,
+                        }),
+                        IDRegisterItem.create({
+                            id: uuidv4(),
+                            groupPrice: paidGroup.settings.prices[0],
+                            organizationId: organization.id,
+                            groupId: paidGroup.id,
+                            memberId: member.id,
+                        }),
+                    ],
+                }),
+                paymentMethod: PaymentMethod.Payconiq,
+                redirectUrl: new URL('https://www.example.com'),
+                cancelUrl: new URL('https://www.example.com'),
+                // Only the non-trial registration has to be paid now
+                totalPrice: 1500,
+            });
+            // #endregion
+
+            // act
+            const response = await post(body, organization, token);
+
+            // assert
+            expect(response.body.registrations.length).toBe(2);
+            expect(response.body.paymentUrl).toMatch(/payconiq-checkout\.test/);
+
+            // The trial is free, so it is activated right away and its reservation is released
+            const trialRegistration = response.body.registrations.find(r => r.group.id === group.id)!;
+            expect(trialRegistration).toMatchObject({
+                registeredAt: expect.any(Date),
+                deactivatedAt: null,
+                reservedUntil: null,
+                trialUntil: expect.any(Date),
+            });
+
+            const trialBalanceItems = await BalanceItem.where({ registrationId: trialRegistration.id });
+            expect(trialBalanceItems.length).toBe(1);
+            expect(trialBalanceItems[0]).toMatchObject({
+                status: BalanceItemStatus.Due,
+                pricePaid: 0,
+            });
+
+            // The paid registration is not activated: it still waits for the online payment
+            const paidRegistration = response.body.registrations.find(r => r.group.id === paidGroup.id)!;
+            expect(paidRegistration).toMatchObject({
+                registeredAt: null,
+                deactivatedAt: null,
+                reservedUntil: expect.any(Date),
+            });
+
+            await group.refresh();
+            expect(group.settings.registeredMembers).toBe(1);
+            expect(group.settings.reservedMembers).toBe(0);
+
+            await paidGroup.refresh();
+            expect(paidGroup.settings.registeredMembers).toBe(0);
+            expect(paidGroup.settings.reservedMembers).toBe(1);
+        });
+
         test('Should update group stock reservations', async () => {
             // #region arrange
             const { organization, group, groupPrice, token, member } = await initData();

package/src/endpoints/global/registration/RegisterMembersEndpoint.ts

@@ -835,9 +835,10 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             const mappedBalanceItems = new Map<BalanceItem, number>();
 
             for (const item of createdBalanceItems) {
-                if (item.dueAt === null) {
-                    mappedBalanceItems.set(item, item.price);
-                }
+                // Items that aren't due yet (the trial period) are not paid now, so they are passed
+                // along with an amount of 0: createPayment keeps them out of the payment itself, but
+                // does mark them due + valid (which activates the registration).
+                mappedBalanceItems.set(item, item.dueAt !== null ? 0 : item.price);
             }
 
             for (const item of checkout.cart.balanceItems) {

package/src/endpoints/organization/dashboard/organization/PatchOrganizationEndpoint.ts

@@ -161,6 +161,8 @@ export class PatchOrganizationEndpoint extends Endpoint<Params, Query, Body, Res
                 }
                 organization.privateMeta.privateKey = request.body.privateMeta.privateKey ?? organization.privateMeta.privateKey;
                 organization.privateMeta.featureFlags = patchObject(organization.privateMeta.featureFlags, request.body.privateMeta.featureFlags);
+                organization.privateMeta.externalSyncData = patchObject(organization.privateMeta.externalSyncData, request.body.privateMeta.externalSyncData);
+                organization.privateMeta.externalGroupNumber = patchObject(organization.privateMeta.externalGroupNumber, request.body.privateMeta.externalGroupNumber);
                 organization.privateMeta.balanceNotificationSettings = patchObject(organization.privateMeta.balanceNotificationSettings, request.body.privateMeta.balanceNotificationSettings);
                 organization.privateMeta.invoiceSettings = patchObject(organization.privateMeta.invoiceSettings, request.body.privateMeta.invoiceSettings);
                 organization.privateMeta.recordAnswers = request.body.privateMeta.recordAnswers.applyTo(organization.privateMeta.recordAnswers);