@stamhoofd/backend 2.138.2 → 2.140.0

package/src/helpers/breakdownRelations.ts

@@ -0,0 +1,48 @@
+import { BalanceItem, Order } from '@stamhoofd/models';
+import type { OrderData } from '@stamhoofd/structures';
+import { BalanceItemPaymentWithPrivatePayment, PrivatePayment } from '@stamhoofd/structures';
+import { Formatter } from '@stamhoofd/utility';
+
+/**
+ * A webshop order is charged as one balance item, so the articles that were ordered are only visible
+ * inside the order itself.
+ */
+export async function loadOrdersForBreakdown(orderIds: (string | null)[]): Promise<Map<string, OrderData>> {
+    const ids = Formatter.uniqueArray(orderIds.flatMap(id => id ? [id] : []));
+
+    if (ids.length === 0) {
+        return new Map();
+    }
+
+    const orders = await Order.getByIDs(...ids);
+    return new Map(orders.map(order => [order.id, order.data]));
+}
+
+/**
+ * The payments that paid for these balance items, per balance item id. A balance item doesn't know how
+ * it was paid, so the payouts it was part of are only visible through its payments (see
+ * PaymentSettlementGroup).
+ */
+export async function loadPaymentsForBreakdown(balanceItemIds: string[]): Promise<Map<string, BalanceItemPaymentWithPrivatePayment[]>> {
+    if (balanceItemIds.length === 0) {
+        return new Map();
+    }
+
+    const { payments, balanceItemPayments } = await BalanceItem.loadPayments(balanceItemIds.map(id => ({ id })));
+    const paymentsById = new Map(payments.map(payment => [payment.id, PrivatePayment.create(payment)]));
+    const result = new Map<string, BalanceItemPaymentWithPrivatePayment[]>();
+
+    for (const balanceItemPayment of balanceItemPayments) {
+        const payment = paymentsById.get(balanceItemPayment.paymentId);
+
+        if (!payment) {
+            continue;
+        }
+
+        const list = result.get(balanceItemPayment.balanceItemId) ?? [];
+        list.push(BalanceItemPaymentWithPrivatePayment.create({ ...balanceItemPayment, payment }));
+        result.set(balanceItemPayment.balanceItemId, list);
+    }
+
+    return result;
+}

package/src/helpers/getNextPageRequest.ts

@@ -0,0 +1,24 @@
+import type { SQLSortDefinitions } from '@stamhoofd/sql';
+import { getSortFilter, LimitedFilteredRequest } from '@stamhoofd/structures';
+
+/**
+ * The request that reads the page after this one, or undefined when this was the last page.
+ *
+ * Pages are walked with a cursor built from the last object of the page instead of an offset, so a page
+ * is never skipped or read twice while the list changes underneath. A cursor that doesn't move past the
+ * one it came from would read the same page forever, so it ends the list instead.
+ */
+export function getNextPageRequest<T>(objects: T[], requestQuery: LimitedFilteredRequest, sorters: SQLSortDefinitions<T>): LimitedFilteredRequest | undefined {
+    if (objects.length < requestQuery.limit) {
+        return undefined;
+    }
+
+    const nextFilter = getSortFilter(objects[objects.length - 1], sorters, requestQuery.sort);
+
+    if (JSON.stringify(nextFilter) === JSON.stringify(requestQuery.pageFilter)) {
+        console.error('Found infinite loading loop for', requestQuery);
+        return undefined;
+    }
+
+    return new LimitedFilteredRequest({ ...requestQuery, pageFilter: nextFilter });
+}

package/src/helpers/streamForBreakdown.test.ts

@@ -0,0 +1,107 @@
+import type { StamhoofdFilter } from '@stamhoofd/structures';
+import { LimitedFilteredRequest } from '@stamhoofd/structures';
+import { v4 as uuidv4 } from 'uuid';
+import { MAX_BREAKDOWN_OBJECTS, streamForBreakdown } from './streamForBreakdown.js';
+
+describe('streamForBreakdown', () => {
+    /**
+     * Hands out pages of numbers, the way an endpoint hands out pages of objects: where to continue is
+     * carried by the request itself, so a page is only skipped or read twice when the caller loses it.
+     */
+    const createFetcher = (totalObjects: number) => {
+        const requests: LimitedFilteredRequest[] = [];
+
+        const fetch = (request: LimitedFilteredRequest) => {
+            requests.push(request);
+
+            const start = (request.pageFilter as { id: { $gt: number } } | null)?.id.$gt ?? 0;
+            const results = Array.from({ length: Math.min(request.limit, Math.max(0, totalObjects - start)) }, (_, index) => start + index);
+            const end = start + results.length;
+
+            return Promise.resolve({
+                results,
+                next: end < totalObjects
+                    ? new LimitedFilteredRequest({
+                            filter: request.filter,
+                            search: request.search,
+                            sort: request.sort,
+                            limit: request.limit,
+                            pageFilter: { id: { $gt: end } },
+                        })
+                    : undefined,
+            });
+        };
+
+        return { fetch, requests };
+    };
+
+    const stream = async (totalObjects: number, selection: { filter?: StamhoofdFilter; search?: string | null } = {}) => {
+        const { fetch, requests } = createFetcher(totalObjects);
+        const handled: number[] = [];
+        const countRequests: { filter: StamhoofdFilter; search: string | null }[] = [];
+
+        await streamForBreakdown<number>({
+            userId: uuidv4(),
+            filter: selection.filter ?? null,
+            search: selection.search ?? null,
+            count: (request) => {
+                countRequests.push({ filter: request.filter, search: request.search });
+                return Promise.resolve(totalObjects);
+            },
+            fetch,
+            handle: (results) => {
+                handled.push(...results);
+            },
+        });
+
+        return { handled, requests, countRequests };
+    };
+
+    test('every object is handed over once, page by page', async () => {
+        const { handled, requests } = await stream(250);
+
+        // No object is read twice or skipped, whatever the pages look like
+        expect(handled).toEqual(Array.from({ length: 250 }, (_, index) => index));
+
+        // Read in pages, sorted so the pages line up
+        expect(requests.length).toBeGreaterThan(1);
+        expect(requests[0].sort.map(s => s.key)).toEqual(['id']);
+    });
+
+    test('the selection is read exactly as it was asked for', async () => {
+        const filter = { status: 'Succeeded' };
+        const { requests, countRequests } = await stream(250, { filter, search: 'Peeters' });
+
+        // Every page reads the same selection, so a page never holds objects the breakdown did not count
+        for (const request of requests) {
+            expect(request.filter).toEqual(filter);
+            expect(request.search).toBe('Peeters');
+        }
+
+        expect(countRequests).toEqual([{ filter, search: 'Peeters' }]);
+    });
+
+    test('an empty selection hands over nothing', async () => {
+        const { handled } = await stream(0);
+        expect(handled).toHaveLength(0);
+    });
+
+    test('a selection that is too large to break down asks the user to narrow it down', async () => {
+        await expect(stream(MAX_BREAKDOWN_OBJECTS + 1)).rejects.toThrow('Too many objects to break down');
+    });
+
+    test('a selection that is too large is refused before it is read', async () => {
+        const { fetch, requests } = createFetcher(MAX_BREAKDOWN_OBJECTS + 1);
+
+        await expect(streamForBreakdown<number>({
+            userId: uuidv4(),
+            filter: null,
+            search: null,
+            count: () => Promise.resolve(MAX_BREAKDOWN_OBJECTS + 1),
+            fetch,
+            handle: () => {},
+        })).rejects.toThrow('Too many objects to break down');
+
+        expect(requests).toHaveLength(0);
+    });
+});

package/src/helpers/streamForBreakdown.ts

@@ -0,0 +1,104 @@
+import { SimpleError } from '@simonbackx/simple-errors';
+import { RateLimiter } from '@stamhoofd/models';
+import { QueueHandler } from '@stamhoofd/queues';
+import type { CountFilteredRequest, IPaginatedResponse, StamhoofdFilter } from '@stamhoofd/structures';
+import { LimitedFilteredRequest, SortItemDirection } from '@stamhoofd/structures';
+import { Formatter } from '@stamhoofd/utility';
+import { fetchToAsyncIterator } from './fetchToAsyncIterator.js';
+
+/**
+ * A breakdown groups the objects one by one instead of in SQL, so the grouping rules are the same ones
+ * the rest of the app uses. That means every object has to be read, which is the same work an Excel
+ * export does.
+ *
+ * They are read page by page and added up right away, so they are never all in memory at once. Above
+ * this many objects a breakdown takes too long to wait for, so we ask the user to narrow down instead.
+ */
+export const MAX_BREAKDOWN_OBJECTS = 10000;
+
+const PAGE_SIZE = 100;
+
+/**
+ * Breakdowns are read-only, but they read a lot. They are protected the same way exports are: a limit
+ * per user, one at a time per user and a maximum number running at the same time.
+ */
+export const breakdownLimiter = new RateLimiter({
+    limits: [
+        {
+            limit: 100,
+            duration: 5 * 60 * 1000,
+        },
+        {
+            limit: 1000,
+            duration: 60 * 1000 * 60 * 24,
+        },
+    ],
+});
+
+/**
+ * Reads every object matching the filter, page by page, and hands each page over to be added up.
+ */
+export async function streamForBreakdown<T>(options: {
+    userId: string;
+    filter: StamhoofdFilter;
+    search: string | null;
+    count: (request: CountFilteredRequest) => Promise<number>;
+    fetch: (request: LimitedFilteredRequest) => Promise<IPaginatedResponse<T[], LimitedFilteredRequest>>;
+    handle: (results: T[]) => Promise<void> | void;
+}): Promise<void> {
+    // Clicking through the tabs of a breakdown would otherwise stack up requests that each block a
+    // connection until the one before it is done
+    if (QueueHandler.isRunning('breakdown-' + options.userId)) {
+        throw new SimpleError({
+            code: 'breakdown_pending',
+            message: 'A breakdown is already running for this user',
+            human: $t('%Zj3'),
+            statusCode: 429,
+        });
+    }
+
+    breakdownLimiter.track(options.userId, 1);
+
+    // One breakdown per user at a time, and never more than 5 for all users together
+    await QueueHandler.schedule('breakdown-' + options.userId, async () => {
+        await QueueHandler.schedule('breakdown', async () => {
+            const request = new LimitedFilteredRequest({
+                filter: options.filter,
+                search: options.search,
+                limit: PAGE_SIZE,
+                sort: [
+                    { key: 'id', order: SortItemDirection.ASC },
+                ],
+            });
+
+            // Asked up front so a selection that is too big costs one query instead of reading it all
+            assertBreakdownSize(await options.count(request));
+
+            let count = 0;
+
+            for await (const results of fetchToAsyncIterator(request, { fetch: options.fetch })) {
+                count += results.length;
+
+                // The selection can still have grown since it was counted
+                assertBreakdownSize(count);
+
+                await options.handle(results);
+            }
+        }, 5);
+    });
+}
+
+function assertBreakdownSize(count: number) {
+    if (count <= MAX_BREAKDOWN_OBJECTS) {
+        return;
+    }
+
+    throw new SimpleError({
+        code: 'too_many_objects',
+        message: 'Too many objects to break down',
+        human: $t('%Ziw', {
+            limit: Formatter.integer(MAX_BREAKDOWN_OBJECTS),
+        }),
+        statusCode: 400,
+    });
+}

package/src/services/DocumentRenderService.test.ts

@@ -1,7 +1,10 @@
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Document, DocumentTemplateFactory, Organization } from '@stamhoofd/models';
-import { Address, DocumentData, DocumentStatus, File, Image, OrganizationMetaData, PlatformConfig, Platform as PlatformStruct, RecordSettings, RecordTextAnswer, RecordType } from '@stamhoofd/structures';
+import { render } from '@stamhoofd/models/helpers/Handlebars.js';
+import type { RecordAnswer } from '@stamhoofd/structures';
+import { Address, DocumentData, DocumentStatus, File, Image, OrganizationMetaData, PlatformConfig, Platform as PlatformStruct, RecordCheckboxAnswer, RecordDateAnswer, RecordPriceAnswer, RecordSettings, RecordTextAnswer, RecordType } from '@stamhoofd/structures';
 import { Country } from '@stamhoofd/types/Country';
+import { Formatter } from '@stamhoofd/utility';
 import { DocumentRenderService } from './DocumentRenderService.js';
 
 function createImage(id: string) {
@@ -66,6 +69,49 @@ function createInvalidFieldAnswers() {
 
 const xmlExport = '<documents>{{#each documents}}<document>{{{this.number}}}</document>{{/each}}</documents>';
 
+/**
+ * The day price row of the participation template (templates/participation.html in the dashboard).
+ */
+const dayPriceTemplate = '{{#if (and registration.showDayPrice (coalesce registration.price registration.priceOriginal 0)) }}'
+    + 'Bedrag per dag: {{ formatPrice (div (coalesce registration.price registration.priceOriginal 0) (coalesce registration.days (days registration.startDate registration.endDate))) round=true }}'
+    + '{{/if}}';
+
+function createParticipationDocument(answers: { showDayPrice: boolean; price?: number | null; priceOriginal?: number | null; startDate?: Date; endDate?: Date }) {
+    const settingsFor = (id: string, type: RecordType) => RecordSettings.create({ id, type });
+
+    const fieldAnswers = new Map<string, RecordAnswer>([
+        ['registration.showDayPrice', RecordCheckboxAnswer.create({
+            settings: settingsFor('registration.showDayPrice', RecordType.Checkbox),
+            selected: answers.showDayPrice,
+        })],
+        ['registration.price', RecordPriceAnswer.create({
+            settings: settingsFor('registration.price', RecordType.Price),
+            value: answers.price ?? null,
+        })],
+        ['registration.priceOriginal', RecordPriceAnswer.create({
+            settings: settingsFor('registration.priceOriginal', RecordType.Price),
+            value: answers.priceOriginal ?? null,
+        })],
+        ['registration.startDate', RecordDateAnswer.create({
+            settings: settingsFor('registration.startDate', RecordType.Date),
+            dateValue: answers.startDate ?? new Date(2024, 6, 1),
+        })],
+        ['registration.endDate', RecordDateAnswer.create({
+            settings: settingsFor('registration.endDate', RecordType.Date),
+            dateValue: answers.endDate ?? new Date(2024, 6, 7),
+        })],
+    ]);
+
+    const document = createDocument();
+    document.data.fieldAnswers = fieldAnswers;
+    return document;
+}
+
+async function renderDayPrice(answers: Parameters<typeof createParticipationDocument>[0]) {
+    const context = DocumentRenderService.buildDocumentContext(createParticipationDocument(answers), createOrganization(), createPlatform({}));
+    return await render(dayPriceTemplate, context);
+}
+
 /**
  * Builds a locked template: a locked template makes buildAll return the documents unchanged, so the
  * numbers set up here are exactly what the renumbering logic gets to see.
@@ -150,6 +196,31 @@ describe('DocumentRenderService', () => {
         });
     });
 
+    describe('day price', () => {
+        // 1 July until 7 July are 7 days, so €25 is rounded to €3,57 per day
+        const dayPriceOf25 = 'Bedrag per dag: ' + Formatter.price(3_5700);
+
+        test('It divides the price by the amount of days, both start and end date included', async () => {
+            await expect(renderDayPrice({ showDayPrice: true, price: 25_0000 })).resolves.toBe(dayPriceOf25);
+        });
+
+        test('It uses the original price when the price itself is hidden on the document', async () => {
+            await expect(renderDayPrice({ showDayPrice: true, price: null, priceOriginal: 25_0000 })).resolves.toBe(dayPriceOf25);
+        });
+
+        test('It prefers the price of the document over the original price', async () => {
+            await expect(renderDayPrice({ showDayPrice: true, price: 14_0000, priceOriginal: 25_0000 })).resolves.toBe('Bedrag per dag: ' + Formatter.price(2_0000));
+        });
+
+        test('It is left out when the checkbox is not selected', async () => {
+            await expect(renderDayPrice({ showDayPrice: false, price: 25_0000 })).resolves.toBe('');
+        });
+
+        test('It is left out when no price is known', async () => {
+            await expect(renderDayPrice({ showDayPrice: true, price: null, priceOriginal: null })).resolves.toBe('');
+        });
+    });
+
     describe('getRenderedHtml', () => {
         test('It returns null and logs when building the context fails', async () => {
             const template = await new DocumentTemplateFactory({ groups: [] }).create();

package/src/services/PasswordForgotService.ts

@@ -1,7 +1,9 @@
 import type { I18n } from '@stamhoofd/backend-i18n';
 import type { Organization } from '@stamhoofd/models';
 import { PasswordToken, Platform, User } from '@stamhoofd/models';
-import { getAppHost } from '@stamhoofd/structures';
+import { EmailTemplateType, getAppHost, Recipient, Replacement } from '@stamhoofd/structures';
+
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 
 /**
  * Builds the password recovery links. Which app the link points to depends on whether the user is an
@@ -17,6 +19,34 @@ export class PasswordForgotService {
         return await this.getPasswordRecoveryUrlForToken(token, organization, i18n, user);
     }
 
+    /**
+     * Create a new password token and email the recovery link to the user. Always sent to the
+     * stored address, never to whatever the request asked for.
+     */
+    static async sendPasswordRecoveryEmail(user: User, organization: Organization | null, i18n: I18n) {
+        const recoveryUrl = await this.getPasswordRecoveryUrl(user, organization, i18n);
+
+        await sendEmailTemplate(organization, {
+            recipients: [
+                Recipient.create({
+                    firstName: user.firstName,
+                    lastName: user.lastName,
+                    email: user.email,
+                    replacements: [
+                        Replacement.create({
+                            token: 'resetUrl',
+                            value: recoveryUrl,
+                        }),
+                    ],
+                }),
+            ],
+            template: {
+                type: EmailTemplateType.ForgotPassword,
+            },
+            type: 'transactional',
+        });
+    }
+
     /**
      * Build the recovery url for an already created password token.
      * Pass the user to avoid an extra query when it is already loaded.

package/src/services/PaymentService.ts

@@ -517,6 +517,14 @@ export class PaymentService {
             }
         }
 
+        // DirectDebit expires after 3 weeks
+        if ((status === PaymentStatus.Pending || status === PaymentStatus.Created) && payment.method === PaymentMethod.DirectDebit) {
+            // If payment is not succeeded after one day, mark as failed
+            if (payment.createdAt < new Date(new Date().getTime() - 60 * 1000 * 60 * 24 * 7 * 3)) {
+                return true;
+            }
+        }
+
         if (STAMHOOFD.environment === 'development') {
             // In development, we expire all direct debits and other paymetns after 1 hour, because they need manual changes
             // otherwise they will remain stuck in the dev environment, poluting the UI
@@ -1349,7 +1357,7 @@ export class PaymentService {
                 const balanceItemPayment = new BalanceItemPayment();
                 balanceItemPayment.balanceItemId = balanceItem.id;
                 balanceItemPayment.paymentId = payment.id;
-                balanceItemPayment.organizationId = organization.id;
+                balanceItemPayment.organizationId = payment.organizationId;
                 balanceItemPayment.price = price;
 
                 await balanceItemPayment.save();

package/src/services/SSOService.ts

@@ -707,7 +707,7 @@ export class SSOServiceWithSession {
                     // enrollment endpoints check this themselves.
                     redirectUri.searchParams.set('oid_mfa_passkeys', user.canUsePasskeys() ? '1' : '0');
                     redirectUri.searchParams.set('s', session.spaState);
-                } else {
+                } else if (requirement.type === 'none') {
                     const token = await Token.createExpiredToken(user);
 
                     if (!token) {
@@ -722,6 +722,19 @@ export class SSOServiceWithSession {
                     const st = new TokenStruct(token);
                     redirectUri.searchParams.set('oid_rt', st.refreshToken);
                     redirectUri.searchParams.set('s', session.spaState);
+                } else if (requirement.type === 'confirm-email') {
+                    // Only password logins reach this: an SSO login is not the credential
+                    // that has to be confirmed. Fail closed rather than fall through to a
+                    // session, which would make this redirect an enrollment bypass.
+                    throw new SimpleError({
+                        code: 'error',
+                        message: 'Email confirmation is not supported for SSO logins',
+                        statusCode: 500,
+                    });
+                } else {
+                    // Compile error when a requirement is added without handling it here.
+                    const unsupported: never = requirement;
+                    throw new Error('Unsupported second factor requirement: ' + JSON.stringify(unsupported));
                 }
             } else if (this.session.reauthenticateAccessToken) {
                 // The provider confirmed the identity of the user that is already signed in,

package/src/sql-filters/balance-item-payments-root.ts

@@ -0,0 +1,48 @@
+import type { SQLFilterDefinitions } from '@stamhoofd/sql';
+import { baseSQLFilterCompilers, createColumnFilter, SQL, SQLValueType } from '@stamhoofd/sql';
+import { balanceItemPaymentsCompilers } from './balance-item-payments.js';
+import { paymentFilterCompilers } from './payments.js';
+
+/**
+ * How a balance item payment is selected when it is queried directly, instead of through the payment or
+ * the balance item it belongs to.
+ *
+ * This is the level at which money that is spread over several payments, or that paid for several
+ * things at once, can be selected exactly: one row is one payment paying one part of one balance item.
+ *
+ * Lives in its own file because it reaches both parents, while balance-item-payments.ts is used inside
+ * a subquery that only joins the balance items.
+ */
+export const balanceItemPaymentRootFilterCompilers: SQLFilterDefinitions = {
+    ...baseSQLFilterCompilers,
+    // id, price and the balance item filters
+    ...balanceItemPaymentsCompilers,
+
+    organizationId: createColumnFilter({
+        expression: SQL.column('balance_item_payments', 'organizationId'),
+        type: SQLValueType.String,
+        nullable: false,
+    }),
+
+    paymentId: createColumnFilter({
+        expression: SQL.column('balance_item_payments', 'paymentId'),
+        type: SQLValueType.String,
+        nullable: false,
+    }),
+
+    balanceItemId: createColumnFilter({
+        expression: SQL.column('balance_item_payments', 'balanceItemId'),
+        type: SQLValueType.String,
+        nullable: false,
+    }),
+
+    createdAt: createColumnFilter({
+        expression: SQL.column('balance_item_payments', 'createdAt'),
+        type: SQLValueType.Datetime,
+        nullable: false,
+    }),
+
+    // The same compilers the payments use, which are qualified with the payments table so they keep
+    // working here: this query joins it instead of selecting from it
+    payment: paymentFilterCompilers,
+};

package/src/sql-filters/balance-items.ts

@@ -1,6 +1,7 @@
 import type { SQLFilterDefinitions } from '@stamhoofd/sql';
 import { baseSQLFilterCompilers, createColumnFilter, createExistsFilter, SQL, SQLValueType } from '@stamhoofd/sql';
 import { BalanceItemRelationType } from '@stamhoofd/structures';
+import { paymentSettlementFilterCompilers } from './payment-settlement.js';
 
 /**
  * Filters on the relations of a balance item (registration group, webshop order and membership type).
@@ -52,6 +53,29 @@ export const balanceItemRelationFilterCompilers: SQLFilterDefinitions = {
         type: SQLValueType.JSONString,
         nullable: true,
     }),
+
+    /**
+     * Filter on the id of any relation, e.g. { relations: { Group: { id: '...' } } }.
+     *
+     * Used to narrow down to one category of a breakdown (see PaymentBreakdown), so every kind of
+     * metadata a balance item carries is filterable without a dedicated compiler per relation.
+     */
+    relations: {
+        ...baseSQLFilterCompilers,
+        ...Object.fromEntries(
+            Object.values(BalanceItemRelationType).map(relationType => [
+                relationType,
+                {
+                    ...baseSQLFilterCompilers,
+                    id: createColumnFilter({
+                        expression: SQL.jsonExtract(SQL.column('balance_items', 'relations'), `$.value.${relationType}.id`),
+                        type: SQLValueType.JSONString,
+                        nullable: true,
+                    }),
+                },
+            ]),
+        ),
+    },
 };
 
 /**
@@ -113,4 +137,35 @@ export const balanceItemFilterCompilers: SQLFilterDefinitions = {
         type: SQLValueType.Number,
         nullable: false,
     }),
+
+    /**
+     * The payments that paid (a part of) this balance item, e.g.
+     * `{ payments: { $elemMatch: { payment: { settlement: { reference: '...' } } } } }`.
+     *
+     * Used to narrow a breakdown down to the balance items that were part of one payout (see
+     * PaymentSettlementGroup): a balance item doesn't know how it was paid, its payments do.
+     */
+    payments: createExistsFilter(
+        SQL.select()
+            .from(SQL.table('balance_item_payments'))
+            .join(
+                SQL.join(SQL.table('payments')).where(
+                    SQL.column('payments', 'id'),
+                    SQL.column('balance_item_payments', 'paymentId'),
+                ),
+            )
+            .where(
+                SQL.column('balance_item_payments', 'balanceItemId'),
+                SQL.column('balance_items', 'id'),
+            ),
+        {
+            ...baseSQLFilterCompilers,
+            price: createColumnFilter({
+                expression: SQL.column('balance_item_payments', 'price'),
+                type: SQLValueType.Number,
+                nullable: false,
+            }),
+            payment: paymentSettlementFilterCompilers,
+        },
+    ),
 };

package/src/sql-filters/orders.ts

@@ -30,13 +30,17 @@ export const orderFilterCompilers: SQLFilterDefinitions = {
         nullable: false,
     }),
     timeSlotEndTime: createColumnFilter({
+        // Stored as a number (minutes since midnight), so it must be typed as a JSON number to allow
+        // numeric comparisons and to match the in-memory filter.
         expression: SQL.jsonExtract(SQL.column('data'), '$.value.timeSlot.endTime'),
-        type: SQLValueType.JSONString,
+        type: SQLValueType.JSONNumber,
         nullable: true,
     }),
     timeSlotStartTime: createColumnFilter({
+        // Stored as a number (minutes since midnight), so it must be typed as a JSON number to allow
+        // numeric comparisons and to match the in-memory filter.
         expression: SQL.jsonExtract(SQL.column('data'), '$.value.timeSlot.startTime'),
-        type: SQLValueType.JSONString,
+        type: SQLValueType.JSONNumber,
         nullable: true,
     }),
     createdAt: createColumnFilter({