@stamhoofd/backend 2.136.3 → 2.137.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.136.3",
+    "version": "2.137.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -46,34 +46,34 @@
         "test:reset": "yarn -s build:full && yarn -s test"
     },
     "dependencies": {
-        "@aws-sdk/client-s3": "3.1068.0",
-        "@aws-sdk/client-ses": "3.1068.0",
-        "@aws-sdk/client-sesv2": "3.1068.0",
-        "@aws-sdk/client-sqs": "3.1068.0",
-        "@aws-sdk/s3-request-presigner": "3.1068.0",
+        "@aws-sdk/client-s3": "3.1090.0",
+        "@aws-sdk/client-ses": "3.1090.0",
+        "@aws-sdk/client-sesv2": "3.1090.0",
+        "@aws-sdk/client-sqs": "3.1090.0",
+        "@aws-sdk/s3-request-presigner": "3.1090.0",
         "@bwip-js/node": "4.11.1",
-        "@mollie/api-client": "4.5.0",
+        "@mollie/api-client": "4.6.0",
         "@simonbackx/simple-database": "1.37.1",
         "@simonbackx/simple-encoding": "2.26.11",
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.136.3",
-        "@stamhoofd/backend-i18n": "2.136.3",
-        "@stamhoofd/backend-middleware": "2.136.3",
-        "@stamhoofd/crons": "2.136.3",
-        "@stamhoofd/email": "2.136.3",
-        "@stamhoofd/excel-writer": "2.136.3",
-        "@stamhoofd/logging": "2.136.3",
-        "@stamhoofd/models": "2.136.3",
-        "@stamhoofd/object-differ": "2.136.3",
-        "@stamhoofd/queues": "2.136.3",
-        "@stamhoofd/sql": "2.136.3",
-        "@stamhoofd/structures": "2.136.3",
-        "@stamhoofd/types": "2.136.3",
-        "@stamhoofd/utility": "2.136.3",
+        "@stamhoofd/backend-env": "2.137.0",
+        "@stamhoofd/backend-i18n": "2.137.0",
+        "@stamhoofd/backend-middleware": "2.137.0",
+        "@stamhoofd/crons": "2.137.0",
+        "@stamhoofd/email": "2.137.0",
+        "@stamhoofd/excel-writer": "2.137.0",
+        "@stamhoofd/logging": "2.137.0",
+        "@stamhoofd/models": "2.137.0",
+        "@stamhoofd/object-differ": "2.137.0",
+        "@stamhoofd/queues": "2.137.0",
+        "@stamhoofd/sql": "2.137.0",
+        "@stamhoofd/structures": "2.137.0",
+        "@stamhoofd/types": "2.137.0",
+        "@stamhoofd/utility": "2.137.0",
         "archiver": "7.0.1",
-        "axios": "1.16.0",
+        "axios": "1.18.0",
         "base-x": "3.0.11",
         "chalk": "5.6.2",
         "cookie": "0.7.2",
@@ -86,18 +86,18 @@
         "luxon": "3.7.2",
         "mailparser": "3.9.9",
         "mockdate": "3.0.5",
-        "mysql2": "3.22.5",
+        "mysql2": "3.23.1",
         "node-rsa": "2.0.0",
         "openid-client": "5.7.1",
-        "stripe": "16.12.0"
+        "stripe": "16.12.0",
+        "uuid": "14.0.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.136.3",
+        "@stamhoofd/test-utils": "2.137.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
-        "@types/mysql": "2.15.27",
-        "@types/node": "22.15.34",
+        "@types/node": "22.20.1",
         "@types/uuid": "8.3.4",
         "nock": "14.0.15",
         "qs": "6.15.2",
@@ -108,5 +108,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "ef990c776a392a3857dc81309ca6a0bb4d524f63"
+    "gitHead": "f327bce84bd0c5ca7160e3e71ad03700d520b086"
 }

package/src/audit-logs/GroupLogger.ts

@@ -45,6 +45,10 @@ export const GroupLogger = new ModelLogger(Group, {
                     if (model.settings.eventId) {
                         result.objectId = model.settings.eventId;
                     }
+
+                    if (model.eventId) {
+                        result.objectId = model.eventId;
+                    }
                     break;
                 case AuditLogType.GroupDeleted:
                     // do not log
@@ -75,6 +79,15 @@ export const GroupLogger = new ModelLogger(Group, {
                     })],
                 ]);
             }
+            if (model.eventId) {
+                return new Map([
+                    ['e', AuditLogReplacement.create({
+                        id: model.eventId,
+                        value: model.settings.name.toString(),
+                        type: AuditLogReplacementType.Event,
+                    })],
+                ]);
+            }
             return new Map([
                 ['e', AuditLogReplacement.create({
                     id: model.id,

package/src/endpoints/global/events/PatchEventsEndpoint.ts

@@ -527,7 +527,7 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
             });
         }
 
-        if (existingGroup.settings.eventId !== null && existingGroup.settings.eventId !== event.id) {
+        if (existingGroup.eventId !== null && existingGroup.eventId !== event.id) {
             throw new SimpleError({
                 code: 'invalid_group',
                 message: 'Group is already linked to another event',
@@ -544,7 +544,7 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
             existingGroup.type = GroupType.EventRegistration;
         }
 
-        existingGroup.settings.eventId = event.id;
+        existingGroup.eventId = event.id;
 
         // update group categories
         const period = await RegistrationPeriod.getByID(existingGroup.periodId);
@@ -572,7 +572,7 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
         } catch (e) {
             // reset the group
             existingGroup.type = originalGroupType;
-            existingGroup.settings.eventId = null;
+            existingGroup.eventId = null;
             await existingGroup.save();
 
             // delete the event again if failed to link the group

package/src/endpoints/organization/dashboard/organization/SetOrganizationDomainEndpoint.ts

@@ -54,7 +54,7 @@ export class SetOrganizationDomainEndpoint extends Endpoint<Params, Query, Body,
 
             // Validate domains
 
-            if (request.body.registerDomain !== null && !request.body.registerDomain.match(/^(?:[a-z0-9-]+\.)?[a-z0-9-]+\.[a-z]+$/i)) {
+            if (request.body.registerDomain !== null && !request.body.registerDomain.match(/^(?:[a-z0-9-]+\.)?(?:[a-z0-9-]+\.)?[a-z0-9-]+\.[a-z]+$/i)) {
                 throw new SimpleError({
                     code: 'invalid_domain',
                     message: 'registerDomain is invalid',

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -389,6 +389,12 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             await event.save();
         }
 
+        const groups = await Group.select().where('waitingListId', id).fetch();
+        for (const group of groups) {
+            group.waitingListId = null;
+            await group.save();
+        }
+
         // delete invitations
         await RegistrationInvitation.delete().where('groupId', id);
     }
@@ -574,6 +580,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
         };
 
         const patch = struct;
+        let syncGroupWithEvent = false;
         if (patch.waitingList !== undefined) {
             if (patch.waitingList === null) {
                 // delete
@@ -586,7 +593,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                     field: 'waitingList',
                     message: 'Cannot patch waitingList',
                 });
-            } else {
+            } else if (model.waitingListId !== patch.waitingList.id) {
                 if (model.waitingListId) {
                     model.waitingListId = null;
                 }
@@ -612,6 +619,8 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                     }
 
                     model.waitingListId = existing.id;
+                    existing.eventId = model.eventId;
+                    syncGroupWithEvent = true;
                 } else {
                     throw new SimpleError({
                         code: 'invalid_waiting_list',
@@ -648,6 +657,13 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
         await model.updateOccupancy();
         await model.save();
 
+        if (model.eventId && syncGroupWithEvent) {
+            const event = await Event.getByID(model.eventId);
+            if (event) {
+                await event.syncGroupRequirements(model);
+            }
+        }
+
         return model;
     }
 

package/src/endpoints/organization/webshops/RetrieveUitpasSocialTariffPriceEndpoint.ts

@@ -75,7 +75,8 @@ export class RetrieveUitpasSocialTariffPricesEndpoint extends Endpoint<Params, Q
                     human: $t('%189'),
                 });
             }
-            await UitpasService.checkUitpasNumbers(request.body.uitpasNumbers); // Throws if invalid
+            const organization = await Context.setOrganizationScope({ willAuthenticate: false });
+            await UitpasService.checkUitpasNumbers(organization.id, request.body.uitpasNumbers); // Throws if invalid
             const uitpasPriceCheckResponse = UitpasPriceCheckResponse.create({
                 prices: request.body.uitpasNumbers.map(_ => reducedPrice), // All reduced prices are the same in this non-official flow
             });

package/src/helpers/AuthenticatedStructures.ts

@@ -120,11 +120,15 @@ export class AuthenticatedStructures {
         const structs: GroupStruct[] = [];
         for (const group of groups) {
             const waitingList = waitingLists.find(g => g.id === group.waitingListId) ?? null;
-            const waitingListStruct = waitingList ? GroupStruct.create(waitingList) : null;
+            let waitingListStruct = waitingList ? GroupStruct.create(waitingList) : null;
             if (waitingList && waitingListStruct && !await Context.optionalAuth?.canAccessGroup(waitingList)) {
                 waitingListStruct.privateSettings = null;
             }
 
+            if (waitingListStruct?.deletedAt) {
+                waitingListStruct = null;
+            }
+
             const struct = GroupStruct.create({
                 ...group,
                 waitingList: waitingListStruct,
@@ -163,6 +167,7 @@ export class AuthenticatedStructures {
         const whereWaitingList = SQL.where('organizationId', organizationIds)
             .and('periodId', periodIds)
             .and('type', GroupType.WaitingList)
+            .and('eventId', null)
             .and('deletedAt', null);
 
         if (groupIds.length) {

package/src/helpers/UitpasTokenRepository.ts

@@ -64,12 +64,15 @@ export class UitpasTokenRepository {
     }
 
     /**
-     * organizationId (null means platform) -> UitpasTokenRepository
+     * organizationId (null means platform) -> UitpasTokenRepository or null if no creds are configured for this org/platform
      */
-    static knownTokens: Map<string | null, UitpasTokenRepository> = new Map();
+    private static knownRepos: Map<string | null, UitpasTokenRepository | null> = new Map();
 
-    private static getRepoFromMemory(organizationId: string | null): UitpasTokenRepository | null {
-        return UitpasTokenRepository.knownTokens.get(organizationId) ?? null;
+    /**
+     * @returns null if no creds configured, undefined if not found in memory, UitpasTokenRepository if found in memory
+     */
+    private static getRepoFromMemory(organizationId: string | null): UitpasTokenRepository | undefined | null {
+        return UitpasTokenRepository.knownRepos.get(organizationId);
     }
 
     private static async getModelFromDb(organizationId: string | null) {
@@ -154,9 +157,8 @@ export class UitpasTokenRepository {
         return this.accessToken;
     }
 
-    private static setRepoInMemory(organizationId: string | null, repo: UitpasTokenRepository) {
-        UitpasTokenRepository.knownTokens.set(organizationId, repo);
-        return repo;
+    private static setRepoInMemory(organizationId: string | null, repo: UitpasTokenRepository | null) {
+        UitpasTokenRepository.knownRepos.set(organizationId, repo);
     }
 
     private static async setModelInDb(organizationId: string | null, model: UitpasClientCredential) {
@@ -173,6 +175,17 @@ export class UitpasTokenRepository {
         return model; // return new model
     }
 
+    static async getAccessTokenForWithPlatformFallback(orgId: string, forceRefresh: boolean = false): Promise<string> {
+        try {
+            return await UitpasTokenRepository.getAccessTokenFor(orgId, forceRefresh);
+        } catch (error) {
+            if (error instanceof SimpleError && error.code === 'uitpas_api_not_configured_for_this_organization') {
+                return await UitpasTokenRepository.getAccessTokenFor(null, forceRefresh); // fallback to platform
+            }
+            throw error;
+        }
+    }
+
     /**
      * Get the access token for the organization or platform.
      * @param organizationId the organization ID for which to get the access token. If null, it means the platform.
@@ -180,60 +193,101 @@ export class UitpasTokenRepository {
      * @returns Promise<string> the access token for the organization or platform
      * @throws SimpleError if the token cannot be obtained or the API is not configured
      */
-    static async getAccessTokenFor(organizationId: string | null = null, forceRefresh: boolean = false): Promise<string> {
-        let repo = UitpasTokenRepository.getRepoFromMemory(organizationId);
-        if (repo && repo.accessToken && !forceRefresh && repo.expiresOn > new Date()) {
-            return repo.accessToken;
+    static async getAccessTokenFor(organizationId: string | null, forceRefresh: boolean = false): Promise<string> {
+        const notConfiguredError = new SimpleError({
+            code: 'uitpas_api_not_configured_for_this_organization',
+            message: `UiTPAS api not configured for organization with id ${organizationId}`,
+            human: $t('%1BJ'),
+        });
+
+        const tryFromMemory = (): string | UitpasTokenRepository | undefined => {
+            const cached = UitpasTokenRepository.getRepoFromMemory(organizationId);
+            if (cached === null) {
+                throw notConfiguredError;
+            }
+            if (cached && cached.accessToken && !forceRefresh && cached.expiresOn > new Date()) {
+                return cached.accessToken;
+            }
+            return cached; // not found in memory or expired or no access token or forceRefresh
+        };
+
+        const memoryResult = tryFromMemory();
+        if (typeof memoryResult === 'string') {
+            return memoryResult; // access token found in memory
         }
 
         // Prevent multiple concurrent requests for the same organization, asking for an access token to the UiTPAS API.
         // The queue can only run one at a time for the same organizationId
         return await UitpasTokenRepository.handleInQueue(organizationId, async () => {
             // we re-search for the repo, as another call to this funcion might have added while we we're waiting in the queue
-            repo = UitpasTokenRepository.getRepoFromMemory(organizationId);
-            if (repo && repo.accessToken && !forceRefresh && repo.expiresOn > new Date()) {
-                return repo.accessToken;
+            let repo: UitpasTokenRepository;
+            const memoryResult = tryFromMemory();
+            if (typeof memoryResult === 'string') {
+                return memoryResult; // access token found in memory
             }
-            if (!repo) {
+            if (!memoryResult) {
                 const model = await UitpasTokenRepository.getModelFromDb(organizationId);
                 if (!model) {
-                    throw new SimpleError({
-                        code: 'uitpas_api_not_configured_for_this_organization',
-                        message: `UiTPAS api not configured for organization with id ${organizationId}`,
-                        human: $t('%1BJ'),
-                    });
+                    UitpasTokenRepository.setRepoInMemory(organizationId, null);
+                    throw notConfiguredError;
                 }
-                repo = UitpasTokenRepository.setRepoInMemory(organizationId, new UitpasTokenRepository(model)); // store in memory
+                repo = new UitpasTokenRepository(model);
+                UitpasTokenRepository.setRepoInMemory(organizationId, repo);
+            } else {
+                repo = memoryResult;
             }
             // ask for a new access token
-            return repo.getNewAccessToken();
+            return await repo.getNewAccessToken();
         });
     }
 
-    static async getClientIdFor(organizationId: string | null): Promise<string> {
-        const repo = UitpasTokenRepository.getRepoFromMemory(organizationId);
-        if (!repo) {
-            const model = await UitpasClientCredential.select().where('organizationId', organizationId).first(false);
-            if (!model) {
-                return ''; // no client ID and secret configured
+    static async getClientIdFor(organizationId: string): Promise<string> {
+        const tryFromMemory = (): string | undefined => {
+            const cached = UitpasTokenRepository.getRepoFromMemory(organizationId);
+            if (cached === null) {
+                return '';
+            }
+            if (cached) {
+                return cached.uitpasClientCredential.clientId;
             }
-            return model.clientId; // client ID configured, but not in memory
+        };
+
+        const memoryResult = tryFromMemory();
+        if (typeof memoryResult === 'string') {
+            return memoryResult; // client ID found in memory
         }
-        return repo.uitpasClientCredential.clientId; // client ID configured and in memory
+
+        return await UitpasTokenRepository.handleInQueue(organizationId, async () => {
+            // re-search memory, as another call to this function might have populated it while we were waiting in the queue
+            const memoryResult = tryFromMemory();
+            if (typeof memoryResult === 'string') {
+                return memoryResult; // client ID found in memory
+            }
+            const model = await UitpasTokenRepository.getModelFromDb(organizationId);
+            if (!model) {
+                UitpasTokenRepository.setRepoInMemory(organizationId, null); // remember there are no creds configured
+                return '';
+            }
+            UitpasTokenRepository.setRepoInMemory(organizationId, new UitpasTokenRepository(model)); // store in memory
+            return model.clientId; // client ID configured, now also in memory
+        });
     }
 
     static async clearClientCredentialsFor(organizationId: string | null): Promise<boolean> {
         return await UitpasTokenRepository.handleInQueue(organizationId, async () => {
-            const repo = UitpasTokenRepository.getRepoFromMemory(organizationId);
-            if (repo) {
+            const cached = UitpasTokenRepository.getRepoFromMemory(organizationId);
+            if (cached) {
                 // in memory, thus also in db
-                await repo.uitpasClientCredential.delete(); // remove from db
-                UitpasTokenRepository.knownTokens.delete(organizationId); // remove from memory
+                await cached.uitpasClientCredential.delete(); // remove from db
+                UitpasTokenRepository.setRepoInMemory(organizationId, null); // remove from memory
                 return true;
             }
             // not in memory, maybe in db
             const model = await UitpasTokenRepository.getModelFromDb(organizationId);
             if (model) {
+                if (cached === null) {
+                    console.warn(`Clearing UiTPAS client credentials for organization with id ${organizationId} although it was not in memory, but found in database. This is a bug, memory and database are out of sync.`);
+                }
                 await model.delete(); // remove from database
                 return true;
             }

package/src/seeds/1784795228-groups-event-id.ts

@@ -0,0 +1,35 @@
+import { Migration } from '@simonbackx/simple-database';
+import { Event, Group } from '@stamhoofd/models';
+
+export default new Migration(async () => {
+    if (STAMHOOFD.environment === 'test') {
+        console.log('skipped in tests');
+        return;
+    }
+
+    await setEventIdOnGroups();
+});
+
+export async function setEventIdOnGroups() {
+    let count = 0;
+
+    // Loop all events and link the associated group (and its waiting list) back to the event.
+    for await (const event of Event.select().all()) {
+        if (!event.groupId) {
+            continue;
+        }
+
+        const group = await Group.getByID(event.groupId);
+        if (!group) {
+            continue;
+        }
+
+        if (group.eventId !== event.id) {
+            group.eventId = event.id;
+            await event.syncGroupRequirements(group);
+            count++;
+        }
+    }
+
+    console.log(`Set eventId on ${count} groups`);
+}

package/src/seeds/1784806109-update-cached-outstanding-balance-for-merged-members.ts

@@ -0,0 +1,33 @@
+import { Migration } from '@simonbackx/simple-database';
+import { BalanceItem, CachedBalance, MergedMember } from '@stamhoofd/models';
+import { SQL } from '@stamhoofd/sql';
+import { SeedTools } from '../helpers/SeedTools.js';
+
+export default new Migration(async () => {
+    if (STAMHOOFD.environment === 'test') {
+        console.log('skipped in tests');
+        return;
+    }
+
+    if (STAMHOOFD.platformName === 'stamhoofd') {
+        return;
+    }
+
+    // Loop all members
+    await SeedTools.loop({
+        query: MergedMember.select(),
+        batchSize: 100,
+        action: async (mergedMember) => {
+            const items = await SQL.select('organizationId')
+                .from(BalanceItem.table)
+                .where('memberId', mergedMember.id)
+                .groupBy(SQL.column('organizationId'))
+                .fetch();
+            for (const item of items) {
+                await CachedBalance.updateForMembers(item[BalanceItem.table].organizationId as string, [mergedMember.id]);
+            }
+        },
+    });
+
+    return Promise.resolve();
+});

package/src/services/InvoicePdfService.ts

@@ -5,10 +5,9 @@ import type { Invoice } from '@stamhoofd/models';
 import { Image, InvoicedBalanceItem, Organization, Payment, Platform } from '@stamhoofd/models';
 import { render } from '@stamhoofd/models/helpers/Handlebars.js';
 import type { Address } from '@stamhoofd/structures';
-import { CountryHelper, File, getVATExcemptInvoiceNote, getVATExcemptReasonName, PaymentMethod, PaymentMethodHelper, PaymentStatus } from '@stamhoofd/structures';
+import { CountryHelper, File, getVATExcemptInvoiceNote, getVATExcemptReasonName, PaymentMethod, PaymentMethodHelper, PaymentStatus, Version } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import fs from 'fs/promises';
-import { VERSION } from 'luxon';
 import { v4 as uuidv4 } from 'uuid';
 
 export class InvoicePdfService {
@@ -260,7 +259,7 @@ export class InvoicePdfService {
 
         try {
             // Issue with system trusted CA in development
-            const result = await fetch((STAMHOOFD.environment === 'development' ? 'http://' : 'https://') + STAMHOOFD.domains.rendererApi + '/v' + VERSION + '/html-to-pdf', {
+            const result = await fetch((STAMHOOFD.environment === 'development' ? 'http://' : 'https://') + STAMHOOFD.domains.rendererApi + '/v' + Version + '/html-to-pdf', {
                 method: 'POST',
                 body: form,
                 signal: controller.signal,

package/src/services/SSOService.ts

@@ -287,6 +287,7 @@ export class SSOService {
             httpOnly: true,
             secure: STAMHOOFD.environment !== 'development',
             expires: data.expires,
+            sameSite: 'lax',
         });
     }
 

package/src/services/uitpas/UitpasService.test.ts

@@ -4,19 +4,19 @@ import { UitpasService } from './UitpasService.js';
 describe.skip('UitpasService', () => {
     it('should validate a correct Uitpas number with kansentarief', async () => {
         const validNumbers = ['0900000067513'];
-        await expect(UitpasService.checkUitpasNumbers(validNumbers)).resolves.toBeUndefined();
+        await expect(UitpasService.checkUitpasNumbers('unexisting-org-id', validNumbers)).resolves.toBeUndefined();
     });
 
     it('should throw an error for an invalid Uitpas number', async () => {
         const invalidNumbers = ['1234567890123'];
-        await expect(UitpasService.checkUitpasNumbers(invalidNumbers)).rejects.toThrow(
+        await expect(UitpasService.checkUitpasNumbers('unexisting-org-id', invalidNumbers)).rejects.toThrow(
             STExpect.simpleError({ code: 'unsuccessful_but_expected_response_retrieving_pass_by_uitpas_number' }),
         );
     });
 
     it('should throw an error for a Uitpas number with kansentarief expired', async () => {
         const expiredNumbers = ['0900000058918'];
-        await expect(UitpasService.checkUitpasNumbers(expiredNumbers)).rejects.toThrow(
+        await expect(UitpasService.checkUitpasNumbers('unexisting-org-id', expiredNumbers)).rejects.toThrow(
             STExpect.simpleError({ code: 'uitpas_number_issue' }),
         );
     });

package/src/services/uitpas/UitpasService.ts

@@ -309,7 +309,7 @@ export class UitpasService {
 
     static async searchUitpasOrganizers(name: string): Promise<UitpasOrganizersResponse> {
         // https://docs.publiq.be/docs/uitpas/uitpas-api/reference/operations/list-organizers
-        const access_token = await UitpasTokenRepository.getAccessTokenFor(); // uses platform credentials
+        const access_token = await UitpasTokenRepository.getAccessTokenFor(null); // always use platform credentials
         return await searchUitpasOrganizers(access_token, name);
     }
 
@@ -327,7 +327,7 @@ export class UitpasService {
      * @param organizationId
      * @returns clientId or empty string if not configured
      */
-    static async getClientIdFor(organizationId: string | null): Promise<string> {
+    static async getClientIdFor(organizationId: string): Promise<string> {
         // Get the uitpas client credentials for the organization
         return await UitpasTokenRepository.getClientIdFor(organizationId);
     }
@@ -338,9 +338,9 @@ export class UitpasService {
      * The field of the error will be the index of the uitpas number in the array.
      * @param uitpasNumbers The uitpas numbers to check
      */
-    static async checkUitpasNumbers(uitpasNumbers: string[]) {
+    static async checkUitpasNumbers(organizationId: string, uitpasNumbers: string[]) {
         // https://docs.publiq.be/docs/uitpas/uitpas-api/reference/operations/get-a-pass
-        const access_token = await UitpasTokenRepository.getAccessTokenFor(); // use platform credentials
+        const access_token = await UitpasTokenRepository.getAccessTokenForWithPlatformFallback(organizationId);
         return await checkUitpasNumbers(access_token, uitpasNumbers);
     }
 
@@ -350,7 +350,7 @@ export class UitpasService {
     static async getPassByUitpasNumber(uitpasNumber: string): Promise<GetPassResponse> {
         let access_token!: string;
         try {
-            access_token = await UitpasTokenRepository.getAccessTokenFor(); // use platform credentials
+            access_token = await UitpasTokenRepository.getAccessTokenFor(null); // always use platform credentials (for now)
         } catch (e) {
             if (isSimpleError(e) && e.hasCode('uitpas_api_not_configured_for_platform')) {
                 console.error('UiTPAS API has not been configured for this platform, so defaulting to an unknown status for number ', uitpasNumber);
@@ -387,8 +387,8 @@ export class UitpasService {
     }
 
     static async validateCart(organizationId: string, webshopId: string, cart: Cart, exisitingOrderId?: string): Promise<Cart> {
-        let access_token_org: string | null = null;
-        let access_token_platform: string | null = null;
+        let access_token: string | undefined;
+        const unofficialsToBeChecked: string[][] = [];
         for (const item of cart.items) {
             if (item.uitpasNumbers.length === 0) {
                 continue;
@@ -416,8 +416,8 @@ export class UitpasService {
                     });
                 }
 
-                access_token_org = access_token_org ?? await UitpasTokenRepository.getAccessTokenFor(organizationId);
-                const verified = await getSocialTariffForUitpasNumbers(access_token_org, item.uitpasNumbers.map(p => p.uitpasNumber), basePrice, item.product.uitpasEvent.url);
+                access_token = access_token ?? await UitpasTokenRepository.getAccessTokenFor(organizationId);
+                const verified = await getSocialTariffForUitpasNumbers(access_token, item.uitpasNumbers.map(p => p.uitpasNumber), basePrice, item.product.uitpasEvent.url);
                 if (verified.length < item.uitpasNumbers.length) {
                     throw new SimpleError({
                         code: 'uitpas_social_tariff_price_mismatch',
@@ -441,9 +441,14 @@ export class UitpasService {
                     }
                 }
             } else {
-                // non-official flow
-                access_token_platform = access_token_platform ?? await UitpasTokenRepository.getAccessTokenFor();
-                await checkUitpasNumbers(access_token_platform, item.uitpasNumbers.map(p => p.uitpasNumber));
+                // non-official flow: do all checks after official flows (for maximum token re-usage), but retaining index numbering for error reporting
+                unofficialsToBeChecked.push(item.uitpasNumbers.map(p => p.uitpasNumber));
+            }
+        }
+        if (unofficialsToBeChecked.length > 0) {
+            const token = access_token ?? await UitpasTokenRepository.getAccessTokenForWithPlatformFallback(organizationId);
+            for (const uitpasNumbers of unofficialsToBeChecked) {
+                await checkUitpasNumbers(token, uitpasNumbers);
             }
         }
         return cart;

package/src/services/uitpas/checkPermissionsFor.ts

@@ -74,21 +74,22 @@ export async function checkPermissionsFor(access_token: string, organizationId:
         });
     });
     assertIsPermissionsResponse(json);
-    const neededPermissions = !organizationId
-        ? [{
-                permission: 'PASSES_READ',
-                human: 'Basis UiTPAS informatie ophalen met UiTPAS nummer',
-            }]
-        : [{
-                permission: 'TARIFFS_READ',
-                human: 'Tarieven opvragen',
-            }, {
-                permission: 'TICKETSALES_REGISTER',
-                human: 'Ticketsales registreren',
-            }, {
-                permission: 'TICKETSALES_SEARCH',
-                human: 'Ticketsales zoeken',
-            }];
+    const neededPermissions = [{
+        permission: 'PASSES_READ',
+        human: 'Basis UiTPAS informatie ophalen met UiTPAS nummer',
+    }];
+    if (organizationId) {
+        neededPermissions.push(...[{
+            permission: 'TARIFFS_READ',
+            human: 'Tarieven opvragen',
+        }, {
+            permission: 'TICKETSALES_REGISTER',
+            human: 'Ticketsales registreren',
+        }, {
+            permission: 'TICKETSALES_SEARCH',
+            human: 'Ticketsales zoeken',
+        }]);
+    }
     const item = json.find(item => item.organizer.id === uitpasOrganizerId);
     if (!item) {
         const organizers = Formatter.joinLast(json.map(i => i.organizer.name), ', ', ' ' + $t('%1BM') + ' ');

package/src/sql-filters/groups.ts

@@ -14,6 +14,11 @@ export const groupFilterCompilers: SQLFilterDefinitions = {
         type: SQLValueType.String,
         nullable: false,
     }),
+    eventId: createColumnFilter({
+        expression: SQL.column('eventId'),
+        type: SQLValueType.String,
+        nullable: true,
+    }),
     periodId: createColumnFilter({
         expression: SQL.column('periodId'),
         type: SQLValueType.String,

package/src/seeds/1760702454-update-cached-outstanding-balance-from-items.ts

@@ -1,67 +0,0 @@
-import { Migration } from '@simonbackx/simple-database';
-import { CachedBalance, Member, Organization, Platform, Registration, User } from '@stamhoofd/models';
-import { SeedTools } from '../helpers/SeedTools.js';
-
-export default new Migration(async () => {
-    if (STAMHOOFD.environment === 'test') {
-        console.log('skipped in tests');
-        return;
-    }
-
-    if (STAMHOOFD.platformName !== 'stamhoofd') {
-        return;
-    }
-
-    if (STAMHOOFD.userMode !== 'organization') {
-        return;
-    }
-
-    // Loop all members
-    await SeedTools.loopBatched({
-        query: Organization.select(),
-        // useTransactionPerBatch: true,
-        batchSize: 100,
-        batchAction: async (organizations) => {
-            for (const organization of organizations) {
-                for await (const batch of Member.select('id').where('organizationId', organization.id).limit(1000).allBatched()) {
-                    await CachedBalance.updateForMembers(organization.id, batch.map(m => m.id));
-                }
-
-                for await (const batch of User.select('id').where('organizationId', organization.id).limit(1000).allBatched()) {
-                    await CachedBalance.updateForUsers(organization.id, batch.map(m => m.id));
-                }
-
-                for await (const batch of Registration.select('id').where('organizationId', organization.id).limit(1000).allBatched()) {
-                    await CachedBalance.updateForRegistrations(organization.id, batch.map(m => m.id));
-                }
-            }
-        },
-    });
-
-    const membershipOrganizationId = (await Platform.getShared()).membershipOrganizationId;
-    if (membershipOrganizationId) {
-        const membershipOrganization = await Organization.getByID(membershipOrganizationId, true);
-        await SeedTools.loopBatched({
-            query: Organization.select('id').where('id', '!=', membershipOrganization.id),
-            // useTransactionPerBatch: true,
-            batchSize: 1000,
-            batchAction: async (organizations) => {
-                await CachedBalance.updateForOrganizations(membershipOrganization.id, organizations.map(m => m.id));
-            },
-        });
-    }
-
-    // await logger.setContext({ tags: ['silent-seed', 'seed'] }, async () => {
-    //    for await (const items of BalanceItem.select().limit(10_000).allBatched()) {
-    //        await BalanceItemService.updatePaidAndPending(items);
-    //        await BalanceItemService.flushAll();
-    //
-    //        progressLogger.update(items.length);
-    //    }
-    // });
-
-    // console.log('Updated outstanding balance for ' + progressLogger.total + ' items');
-
-    // Do something here
-    return Promise.resolve();
-});