@stamhoofd/backend 2.139.0 → 2.140.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.139.0",
+    "version": "2.140.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -65,20 +65,20 @@
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
         "@simplewebauthn/server": "13.3.2",
-        "@stamhoofd/backend-env": "2.139.0",
-        "@stamhoofd/backend-i18n": "2.139.0",
-        "@stamhoofd/backend-middleware": "2.139.0",
-        "@stamhoofd/crons": "2.139.0",
-        "@stamhoofd/email": "2.139.0",
-        "@stamhoofd/excel-writer": "2.139.0",
-        "@stamhoofd/logging": "2.139.0",
-        "@stamhoofd/models": "2.139.0",
-        "@stamhoofd/object-differ": "2.139.0",
-        "@stamhoofd/queues": "2.139.0",
-        "@stamhoofd/sql": "2.139.0",
-        "@stamhoofd/structures": "2.139.0",
-        "@stamhoofd/types": "2.139.0",
-        "@stamhoofd/utility": "2.139.0",
+        "@stamhoofd/backend-env": "2.140.0",
+        "@stamhoofd/backend-i18n": "2.140.0",
+        "@stamhoofd/backend-middleware": "2.140.0",
+        "@stamhoofd/crons": "2.140.0",
+        "@stamhoofd/email": "2.140.0",
+        "@stamhoofd/excel-writer": "2.140.0",
+        "@stamhoofd/logging": "2.140.0",
+        "@stamhoofd/models": "2.140.0",
+        "@stamhoofd/object-differ": "2.140.0",
+        "@stamhoofd/queues": "2.140.0",
+        "@stamhoofd/sql": "2.140.0",
+        "@stamhoofd/structures": "2.140.0",
+        "@stamhoofd/types": "2.140.0",
+        "@stamhoofd/utility": "2.140.0",
         "archiver": "7.0.1",
         "argon2": "0.44.0",
         "axios": "1.18.1",
@@ -102,7 +102,7 @@
         "uuid": "14.0.1"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.139.0",
+        "@stamhoofd/test-utils": "2.140.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.2",
         "@types/mailparser": "3.4.6",
@@ -117,5 +117,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "8c2cb66c10f96ca53aa07c20f410d6b8fa5a3291"
+    "gitHead": "532463b65f5fa152df23744b1f097ca48c2de3a1"
 }

package/src/endpoints/auth/MFA.security.test.ts

@@ -1,7 +1,7 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
 import { EmailVerificationCode, MFARecoveryCode, MFATOTP, MFAToken, Organization, OrganizationFactory, PasswordToken, Token, User, UserFactory, WebauthnCredential } from '@stamhoofd/models';
-import { PermissionLevel, Permissions, Token as TokenStruct } from '@stamhoofd/structures';
+import { NewUser, PermissionLevel, Permissions, Token as TokenStruct } from '@stamhoofd/structures';
 import { TestUtils } from '@stamhoofd/test-utils';
 import crypto from 'crypto';
 import { authenticator } from 'otplib';
@@ -16,6 +16,7 @@ import { DeletePasskeyEndpoint } from './DeletePasskeyEndpoint.js';
 import { DeleteTOTPEndpoint } from './DeleteTOTPEndpoint.js';
 import { GetMFAChallengeEndpoint } from './GetMFAChallengeEndpoint.js';
 import { GetMFAStatusEndpoint } from './GetMFAStatusEndpoint.js';
+import { PatchUserEndpoint } from './PatchUserEndpoint.js';
 import { RegisterPasskeyOptionsEndpoint } from './RegisterPasskeyOptionsEndpoint.js';
 import { SetupTOTPEndpoint } from './SetupTOTPEndpoint.js';
 import { VerifyEmailEndpoint } from './VerifyEmailEndpoint.js';
@@ -508,6 +509,80 @@ describe('MFA security', () => {
         });
     });
 
+    // -----------------------------------------------------------------------
+    // Absorbing someone else's account by taking over their email address
+    // -----------------------------------------------------------------------
+    describe('merging accounts', () => {
+        /**
+         * Verifying an email address that already belongs to another account merges that
+         * account into yours. Reading the victim's mailbox is a single primary credential,
+         * exactly the one a second factor exists to back up, so it must not be enough to
+         * pull an account that has a second factor (and its permissions) into an account
+         * that does not.
+         */
+        async function requestEmailChange(user: User, token: Token, newEmail: string, organization: Organization): Promise<EmailVerificationCode> {
+            const request = Request.patch({
+                path: '/user/' + user.id,
+                host: organization.getApiHost(),
+                headers: { authorization: 'Bearer ' + token.accessToken },
+                body: NewUser.patch({ id: user.id, email: newEmail }),
+            });
+
+            const err = await captureError(testServer.test(new PatchUserEndpoint(), request));
+            expect(err.code).toBe('verify_email');
+
+            const verificationToken = (err.meta as { token: string }).token;
+            const code = await EmailVerificationCode.select().where('token', verificationToken).first(true);
+            expect(code.email).toBe(newEmail);
+            return code;
+        }
+
+        test('taking over the email address of an account with a second factor is refused', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const victim = await new UserFactory({ organization, password, permissions: Permissions.create({ level: PermissionLevel.Full }) }).create();
+            const victimTotp = await addConfirmedTOTP(victim);
+
+            const attacker = await new UserFactory({ organization, password }).create();
+            const attackerToken = await freshToken(attacker);
+
+            const code = await requestEmailChange(attacker, attackerToken, victim.email, organization);
+
+            const err = await captureError(testServer.test(new VerifyEmailEndpoint(), bearer(Request.buildJson('POST', '/verify-email', organization.getApiHost(), { token: code.token, code: code.code }), attackerToken)));
+            expect(err.code).toBe('email_in_use');
+
+            // The victim still owns their account, their permissions and their factor.
+            const storedVictim = await User.getByID(victim.id);
+            expect(storedVictim).toBeDefined();
+            expect(storedVictim!.email).toBe(victim.email);
+            expect(await MFATOTP.getByID(victimTotp.id)).toBeDefined();
+
+            const storedAttacker = await User.getByID(attacker.id);
+            expect(storedAttacker!.email).toBe(attacker.email);
+            expect(storedAttacker!.permissions).toBeNull();
+        });
+
+        test('an account without a second factor can still be merged', async () => {
+            // Merging is a real feature for people who signed up twice. Without a factor,
+            // whoever reads the mailbox could take that account over with a password reset
+            // anyway, so nothing is bypassed here.
+            const organization = await new OrganizationFactory({}).create();
+            const other = await new UserFactory({ organization, password, permissions: Permissions.create({ level: PermissionLevel.Full }) }).create();
+
+            const user = await new UserFactory({ organization, password }).create();
+            const token = await freshToken(user);
+
+            const code = await requestEmailChange(user, token, other.email, organization);
+
+            const response = await testServer.test(new VerifyEmailEndpoint(), bearer(Request.buildJson('POST', '/verify-email', organization.getApiHost(), { token: code.token, code: code.code }), token));
+            expect(response.body).toBeInstanceOf(TokenStruct);
+
+            expect(await User.getByID(other.id)).toBeUndefined();
+            const stored = await User.getByID(user.id);
+            expect(stored!.email).toBe(other.email);
+            expect(stored!.permissions).not.toBeNull();
+        });
+    });
+
     // -----------------------------------------------------------------------
     // Changing the factors of an account ends the sessions the user is not on
     // -----------------------------------------------------------------------

package/src/endpoints/auth/VerifyEmailEndpoint.ts

@@ -82,6 +82,20 @@ export class VerifyEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
             const other = await User.getForAuthentication(user.organizationId, code.email, { allowWithoutAccount: true });
 
             if (other) {
+                // Merging absorbs the other account (its permissions included) and then
+                // deletes it, second factor and all. Reading the mailbox is exactly the
+                // single credential a second factor exists to back up, so an account that
+                // has one may not be taken over this way: nothing in this request proves
+                // the caller can pass it.
+                if (await TwoFactorHelper.userHasFactors(other.id)) {
+                    throw new SimpleError({
+                        code: 'email_in_use',
+                        message: 'This e-mail is already in use by an account with two-factor authentication',
+                        human: $t('%Zis'),
+                        statusCode: 400,
+                    });
+                }
+
                 // Delete the other user, but merge data
                 await user.merge(other);
                 if (user.organizationId) {

package/src/endpoints/organization/dashboard/balance-items/GetBalanceItemBreakdownEndpoint.test.ts

@@ -317,17 +317,17 @@ describe('Endpoint.GetBalanceItemBreakdownEndpoint', () => {
             expect(response.status).toBe(200);
             expect(response.body.bySettlement.map(g => ({ name: g.name.toString(), price: g.price }))).toEqual([
                 { name: '1234567.0312.01', price: 40_00 },
-                { name: $t('In verwerking'), price: 30_00 },
+                { name: $t('%1OL'), price: 30_00 },
                 // Only what was tried sits under the failed payment, the rest was never attempted
-                { name: $t('Mislukte betaling'), price: 20_00 },
-                { name: $t('Openstaand na mislukte poging'), price: 10_00 },
+                { name: $t('%ZjW'), price: 20_00 },
+                { name: $t('%ZjC'), price: 10_00 },
             ]);
 
             // Every part of what was charged ends up in exactly one row
             expect(response.body.bySettlement.reduce((total, g) => total + g.price, 0)).toBe(response.body.price);
 
             // Running the rows through the database gives back the balance items they were added up from
-            for (const name of [$t('Mislukte betaling'), $t('Openstaand na mislukte poging')]) {
+            for (const name of [$t('%ZjW'), $t('%ZjC')]) {
                 const row = response.body.bySettlement.find(g => g.name.toString() === name)!;
                 const exported = await getBreakdown({ organization, user, filter: row.selection!.listFilter });
                 expect(exported.body.balanceItemCount).toBe(1);
@@ -348,19 +348,19 @@ describe('Endpoint.GetBalanceItemBreakdownEndpoint', () => {
             expect(response.status).toBe(200);
             expect(response.body.bySettlement.map(g => ({ name: g.name.toString(), price: g.price }))).toEqual([
                 { name: '1234567.0312.01', price: 50_00 },
-                { name: $t('Terug te betalen'), price: -50_00 },
-                { name: $t('Openstaand'), price: 25_00 },
+                { name: $t('%10b'), price: -50_00 },
+                { name: $t('%1Ni'), price: 25_00 },
             ]);
 
             // A canceled item is not charged anymore, so it doesn't add to what is open
             expect(response.body.bySettlement.reduce((total, g) => total + g.price, 0)).toBe(response.body.price);
 
             // Each row selects exactly the balance items it was added up from
-            const refund = response.body.bySettlement.find(g => g.name.toString() === $t('Terug te betalen'))!;
+            const refund = response.body.bySettlement.find(g => g.name.toString() === $t('%10b'))!;
             const refunded = await getBreakdown({ organization, user, filter: refund.selection!.listFilter });
             expect(refunded.body.balanceItemCount).toBe(1);
 
-            const open = response.body.bySettlement.find(g => g.name.toString() === $t('Openstaand'))!;
+            const open = response.body.bySettlement.find(g => g.name.toString() === $t('%1Ni'))!;
             const stillOpen = await getBreakdown({ organization, user, filter: open.selection!.listFilter });
             expect(stillOpen.body.balanceItemCount).toBe(1);
             expect(stillOpen.body.price).toBe(25_00);
@@ -381,13 +381,13 @@ describe('Endpoint.GetBalanceItemBreakdownEndpoint', () => {
 
             expect(response.status).toBe(200);
             expect(response.body.bySettlement.map(g => ({ name: g.name.toString(), price: g.price }))).toEqual([
-                { name: $t('Mislukte betaling'), price: 100_00 },
+                { name: $t('%ZjW'), price: 100_00 },
                 { name: '1234567.0312.01', price: 40_00 },
-                { name: $t('Openstaand'), price: 25_00 },
+                { name: $t('%1Ni'), price: 25_00 },
             ]);
 
             // Both rows select exactly the balance items they were added up from
-            for (const [name, count] of [[$t('Mislukte betaling'), 1], [$t('Openstaand'), 1]] as [string, number][]) {
+            for (const [name, count] of [[$t('%ZjW'), 1], [$t('%1Ni'), 1]] as [string, number][]) {
                 const row = response.body.bySettlement.find(g => g.name.toString() === name)!;
                 const exported = await getBreakdown({ organization, user, filter: row.selection!.listFilter });
                 expect(exported.body.balanceItemCount).toBe(count);
@@ -405,7 +405,7 @@ describe('Endpoint.GetBalanceItemBreakdownEndpoint', () => {
             await payItem(organization, processing, { price: 25_00, status: PaymentStatus.Pending });
 
             const all = await getBreakdown({ organization, user });
-            const row = all.body.bySettlement.find(g => g.name.toString() === $t('In verwerking'))!;
+            const row = all.body.bySettlement.find(g => g.name.toString() === $t('%1OL'))!;
 
             const narrowed = await getBreakdown({
                 organization,

package/src/endpoints/organization/dashboard/payments/GetPaymentBreakdownEndpoint.test.ts

@@ -367,7 +367,7 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
 
             expect(response.status).toBe(200);
             expect(response.body.byArticle).toHaveLength(1);
-            expect(response.body.byArticle[0].name.toString()).toBe($t('Deels betaalde bestelling'));
+            expect(response.body.byArticle[0].name.toString()).toBe($t('%Zjb'));
             expect(response.body.byArticle[0].price).toBe(1_00);
         });
 
@@ -391,7 +391,7 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
             const response = await getBreakdown({ organization, user });
 
             expect(response.status).toBe(200);
-            expect(response.body.byArticle.map(g => g.name.toString())).toEqual([$t('Gewijzigde bestelling')]);
+            expect(response.body.byArticle.map(g => g.name.toString())).toEqual([$t('%Zik')]);
         });
     });
 
@@ -652,8 +652,8 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
             expect(response.status).toBe(200);
             expect(response.body.bySettlement.map(g => ({ name: g.name.toString(), price: g.price, count: g.count }))).toEqual([
                 { name: '1234567.0312.01', price: 50_00, count: 2 },
-                { name: $t('Nog niet uitbetaald'), price: 30_00, count: 1 },
-                { name: $t('Niet online betaald'), price: 20_00, count: 1 },
+                { name: $t('%Zjn'), price: 30_00, count: 1 },
+                { name: $t('%ZjN'), price: 20_00, count: 1 },
             ]);
         });
 
@@ -717,7 +717,7 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
             await createPayment(organization, { items: [[item, 20_00]], method: PaymentMethod.PointOfSale });
 
             const all = await getBreakdown({ organization, user });
-            const pending = all.body.bySettlement.find(g => g.name.toString() === $t('Nog niet uitbetaald'))!;
+            const pending = all.body.bySettlement.find(g => g.name.toString() === $t('%Zjn'))!;
 
             const exported = await getBreakdown({ organization, user, filter: pending.selection!.filter });
             expect(exported.body.price).toBe(30_00);
@@ -735,7 +735,7 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
             await createPayment(organization, { items: [[item, 10_00]], iban: 'BE68539007547034' });
 
             const all = await getBreakdown({ organization, user });
-            const offline = all.body.bySettlement.find(g => g.name.toString() === $t('Niet online betaald'))!;
+            const offline = all.body.bySettlement.find(g => g.name.toString() === $t('%ZjN'))!;
 
             const exported = await getBreakdown({ organization, user, filter: offline.selection!.filter });
             expect(exported.body.price).toBe(30_00);
@@ -756,9 +756,9 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
             const all = await getBreakdown({ organization, user });
 
             expect(all.body.bySettlement.map(g => ({ name: g.name.toString(), price: g.price }))).toEqual([
-                { name: $t('Nog niet uitbetaald'), price: 40_00 },
+                { name: $t('%Zjn'), price: 40_00 },
                 { name: getPaymentProviderName(PaymentProvider.Buckaroo), price: 25_00 },
-                { name: $t('Niet online betaald'), price: 20_00 },
+                { name: $t('%ZjN'), price: 20_00 },
                 { name: getPaymentProviderName(PaymentProvider.Payconiq), price: 15_00 },
             ]);
 
@@ -812,7 +812,7 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
 
             expect(response.body.byCategory.map(g => ({ name: g.name.toString(), price: g.price }))).toEqual([
                 { name: 'Kapoenen', price: 14_6652 },
-                { name: $t('Afronding'), price: 48 },
+                { name: $t('%1b6'), price: 48 },
             ]);
 
             // Everything the payment is worth is accounted for
@@ -870,12 +870,12 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
 
             expect(response.status).toBe(200);
             expect(response.body.bySettlement.map(g => ({ name: g.name.toString(), price: g.price }))).toEqual([
-                { name: $t('Niet online betaald'), price: 40_00 },
+                { name: $t('%ZjN'), price: 40_00 },
                 { name: PaymentMethodHelper.getNameCapitalized(PaymentMethod.AccountDeductions), price: 10_00 },
             ]);
 
             // Running the rows through the database keeps them apart
-            for (const [name, price] of [[$t('Niet online betaald'), 40_00], [PaymentMethodHelper.getNameCapitalized(PaymentMethod.AccountDeductions), 10_00]] as [string, number][]) {
+            for (const [name, price] of [[$t('%ZjN'), 40_00], [PaymentMethodHelper.getNameCapitalized(PaymentMethod.AccountDeductions), 10_00]] as [string, number][]) {
                 const row = response.body.bySettlement.find(g => g.name.toString() === name)!;
                 const exported = await getBreakdown({ organization, user, filter: row.selection!.listFilter });
                 expect(exported.body.price).toBe(price);

package/src/helpers/TwoFactorHelper.ts

@@ -212,7 +212,7 @@ export class TwoFactorHelper {
             throw new SimpleError({
                 code: 'require_email_confirmation',
                 message: 'Email confirmation required before two-factor authentication setup',
-                human: $t('Je account is beheerder en moet beveiligd worden met tweestapsverificatie, maar je logde al meer dan {days} dagen niet meer in. Bevestig eerst je e-mailadres: we stuurden je een e-mail met een link waarmee je opnieuw toegang krijgt en tweestapsverificatie kan instellen. Kreeg je geen e-mail? Dan kan je ook een nieuwe link aanvragen via wachtwoord vergeten.', { days: INACTIVE_ADMIN_ENROLLMENT_DAYS.toString() }),
+                human: $t('%Zjm', { days: INACTIVE_ADMIN_ENROLLMENT_DAYS.toString() }),
                 statusCode: 403,
             });
         }

package/src/helpers/streamForBreakdown.ts

@@ -52,7 +52,7 @@ export async function streamForBreakdown<T>(options: {
         throw new SimpleError({
             code: 'breakdown_pending',
             message: 'A breakdown is already running for this user',
-            human: $t('Er worden al statistieken berekend, probeer het zo opnieuw.'),
+            human: $t('%Zj3'),
             statusCode: 429,
         });
     }
@@ -96,7 +96,7 @@ function assertBreakdownSize(count: number) {
     throw new SimpleError({
         code: 'too_many_objects',
         message: 'Too many objects to break down',
-        human: $t('Deze selectie bevat meer dan {limit} items, dat zijn er te veel om statistieken van te maken. Kies een kortere periode of verfijn je selectie.', {
+        human: $t('%Ziw', {
             limit: Formatter.integer(MAX_BREAKDOWN_OBJECTS),
         }),
         statusCode: 400,

package/src/services/DocumentRenderService.test.ts

@@ -1,7 +1,10 @@
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Document, DocumentTemplateFactory, Organization } from '@stamhoofd/models';
-import { Address, DocumentData, DocumentStatus, File, Image, OrganizationMetaData, PlatformConfig, Platform as PlatformStruct, RecordSettings, RecordTextAnswer, RecordType } from '@stamhoofd/structures';
+import { render } from '@stamhoofd/models/helpers/Handlebars.js';
+import type { RecordAnswer } from '@stamhoofd/structures';
+import { Address, DocumentData, DocumentStatus, File, Image, OrganizationMetaData, PlatformConfig, Platform as PlatformStruct, RecordCheckboxAnswer, RecordDateAnswer, RecordPriceAnswer, RecordSettings, RecordTextAnswer, RecordType } from '@stamhoofd/structures';
 import { Country } from '@stamhoofd/types/Country';
+import { Formatter } from '@stamhoofd/utility';
 import { DocumentRenderService } from './DocumentRenderService.js';
 
 function createImage(id: string) {
@@ -66,6 +69,49 @@ function createInvalidFieldAnswers() {
 
 const xmlExport = '<documents>{{#each documents}}<document>{{{this.number}}}</document>{{/each}}</documents>';
 
+/**
+ * The day price row of the participation template (templates/participation.html in the dashboard).
+ */
+const dayPriceTemplate = '{{#if (and registration.showDayPrice (coalesce registration.price registration.priceOriginal 0)) }}'
+    + 'Bedrag per dag: {{ formatPrice (div (coalesce registration.price registration.priceOriginal 0) (coalesce registration.days (days registration.startDate registration.endDate))) round=true }}'
+    + '{{/if}}';
+
+function createParticipationDocument(answers: { showDayPrice: boolean; price?: number | null; priceOriginal?: number | null; startDate?: Date; endDate?: Date }) {
+    const settingsFor = (id: string, type: RecordType) => RecordSettings.create({ id, type });
+
+    const fieldAnswers = new Map<string, RecordAnswer>([
+        ['registration.showDayPrice', RecordCheckboxAnswer.create({
+            settings: settingsFor('registration.showDayPrice', RecordType.Checkbox),
+            selected: answers.showDayPrice,
+        })],
+        ['registration.price', RecordPriceAnswer.create({
+            settings: settingsFor('registration.price', RecordType.Price),
+            value: answers.price ?? null,
+        })],
+        ['registration.priceOriginal', RecordPriceAnswer.create({
+            settings: settingsFor('registration.priceOriginal', RecordType.Price),
+            value: answers.priceOriginal ?? null,
+        })],
+        ['registration.startDate', RecordDateAnswer.create({
+            settings: settingsFor('registration.startDate', RecordType.Date),
+            dateValue: answers.startDate ?? new Date(2024, 6, 1),
+        })],
+        ['registration.endDate', RecordDateAnswer.create({
+            settings: settingsFor('registration.endDate', RecordType.Date),
+            dateValue: answers.endDate ?? new Date(2024, 6, 7),
+        })],
+    ]);
+
+    const document = createDocument();
+    document.data.fieldAnswers = fieldAnswers;
+    return document;
+}
+
+async function renderDayPrice(answers: Parameters<typeof createParticipationDocument>[0]) {
+    const context = DocumentRenderService.buildDocumentContext(createParticipationDocument(answers), createOrganization(), createPlatform({}));
+    return await render(dayPriceTemplate, context);
+}
+
 /**
  * Builds a locked template: a locked template makes buildAll return the documents unchanged, so the
  * numbers set up here are exactly what the renumbering logic gets to see.
@@ -150,6 +196,31 @@ describe('DocumentRenderService', () => {
         });
     });
 
+    describe('day price', () => {
+        // 1 July until 7 July are 7 days, so €25 is rounded to €3,57 per day
+        const dayPriceOf25 = 'Bedrag per dag: ' + Formatter.price(3_5700);
+
+        test('It divides the price by the amount of days, both start and end date included', async () => {
+            await expect(renderDayPrice({ showDayPrice: true, price: 25_0000 })).resolves.toBe(dayPriceOf25);
+        });
+
+        test('It uses the original price when the price itself is hidden on the document', async () => {
+            await expect(renderDayPrice({ showDayPrice: true, price: null, priceOriginal: 25_0000 })).resolves.toBe(dayPriceOf25);
+        });
+
+        test('It prefers the price of the document over the original price', async () => {
+            await expect(renderDayPrice({ showDayPrice: true, price: 14_0000, priceOriginal: 25_0000 })).resolves.toBe('Bedrag per dag: ' + Formatter.price(2_0000));
+        });
+
+        test('It is left out when the checkbox is not selected', async () => {
+            await expect(renderDayPrice({ showDayPrice: false, price: 25_0000 })).resolves.toBe('');
+        });
+
+        test('It is left out when no price is known', async () => {
+            await expect(renderDayPrice({ showDayPrice: true, price: null, priceOriginal: null })).resolves.toBe('');
+        });
+    });
+
     describe('getRenderedHtml', () => {
         test('It returns null and logs when building the context fails', async () => {
             const template = await new DocumentTemplateFactory({ groups: [] }).create();

package/src/services/PaymentService.ts

@@ -517,6 +517,14 @@ export class PaymentService {
             }
         }
 
+        // DirectDebit expires after 3 weeks
+        if ((status === PaymentStatus.Pending || status === PaymentStatus.Created) && payment.method === PaymentMethod.DirectDebit) {
+            // If payment is not succeeded after one day, mark as failed
+            if (payment.createdAt < new Date(new Date().getTime() - 60 * 1000 * 60 * 24 * 7 * 3)) {
+                return true;
+            }
+        }
+
         if (STAMHOOFD.environment === 'development') {
             // In development, we expire all direct debits and other paymetns after 1 hour, because they need manual changes
             // otherwise they will remain stuck in the dev environment, poluting the UI

package/src/sql-filters/orders.ts

@@ -30,13 +30,17 @@ export const orderFilterCompilers: SQLFilterDefinitions = {
         nullable: false,
     }),
     timeSlotEndTime: createColumnFilter({
+        // Stored as a number (minutes since midnight), so it must be typed as a JSON number to allow
+        // numeric comparisons and to match the in-memory filter.
         expression: SQL.jsonExtract(SQL.column('data'), '$.value.timeSlot.endTime'),
-        type: SQLValueType.JSONString,
+        type: SQLValueType.JSONNumber,
         nullable: true,
     }),
     timeSlotStartTime: createColumnFilter({
+        // Stored as a number (minutes since midnight), so it must be typed as a JSON number to allow
+        // numeric comparisons and to match the in-memory filter.
         expression: SQL.jsonExtract(SQL.column('data'), '$.value.timeSlot.startTime'),
-        type: SQLValueType.JSONString,
+        type: SQLValueType.JSONNumber,
         nullable: true,
     }),
     createdAt: createColumnFilter({

package/tests/filters/orders.test.ts

@@ -0,0 +1,635 @@
+import { Database } from '@simonbackx/simple-database';
+import type { Organization, Webshop } from '@stamhoofd/models';
+import { BalanceItem, BalanceItemPayment, Order, OrganizationFactory, Payment, WebshopFactory } from '@stamhoofd/models';
+import { compileToSQLFilter, SQL } from '@stamhoofd/sql';
+import type { StamhoofdFilter } from '@stamhoofd/structures';
+import { Address, BalanceItemType, Cart, CartItem, CartItemPrice, CheckoutMethodType, compileToInMemoryFilter, Customer, DiscountCode, OrderData, OrderStatus, PaymentMethod, PaymentStatus, privateOrderWithTicketsFilterCompilers, Product, ProductPrice, RecordCheckboxAnswer, RecordChoice, RecordChooseOneAnswer, RecordDateAnswer, RecordIntegerAnswer, RecordMultipleChoiceAnswer, RecordSettings, RecordTextAnswer, RecordType, WebshopTakeoutMethod, WebshopTimeSlot } from '@stamhoofd/structures';
+import { Country } from '@stamhoofd/types/Country';
+
+import { orderFilterCompilers } from '../../src/sql-filters/orders.js';
+
+/**
+ * These tests pin the in-memory order filters (used in the dashboard on locally cached orders) to the
+ * backend SQL order filters (used by GetWebshopOrdersEndpoint). For every filter, the same StamhoofdFilter
+ * is run through both engines against the exact same set of orders, and both must return the same order ids.
+ *
+ * The in-memory engine runs on the decoded PrivateOrder structures (privateOrderWithTicketsFilterCompilers).
+ * The SQL engine runs a `SELECT * FROM webshop_orders WHERE <filter>` (orderFilterCompilers), the same way
+ * the endpoint builds its query.
+ *
+ * Filters that only exist in one engine are intentionally not covered here (no counterpart to compare to):
+ * - in-memory only: location, openBalance, ticketScanStatus, ticketScannedAt, ticketCount
+ * - SQL only: organizationId, updatedAt, paymentMethod
+ */
+describe('Order filters (in-memory vs backend SQL parity)', () => {
+    let organization: Organization;
+    let webshop: Webshop;
+    let nextNumber = 1;
+
+    beforeAll(async () => {
+        organization = await new OrganizationFactory({}).create();
+        webshop = await new WebshopFactory({ organizationId: organization.id }).create();
+    });
+
+    beforeEach(async () => {
+        // Start every test from an empty order set so the in-memory universe and the SQL universe are identical.
+        await Database.delete('DELETE FROM `balance_item_payments`');
+        await Database.delete('DELETE FROM `payments`');
+        await Database.delete('DELETE FROM `balance_items`');
+        await Database.delete('DELETE FROM `webshop_orders`');
+        nextNumber = 1;
+    });
+
+    // --- order creation helpers ------------------------------------------------------------------------
+
+    const address = () => Address.create({
+        street: 'Demostraat',
+        number: '15',
+        postalCode: '9000',
+        city: 'Gent',
+        country: Country.Belgium,
+    });
+
+    /** A cart item with a fixed, deterministic price so totalPrice/amount are predictable. */
+    function cartItem(options: { productId?: string; productPriceId?: string; amount?: number; unitPrice?: number } = {}) {
+        const amount = options.amount ?? 1;
+        const unitPrice = options.unitPrice ?? 0;
+        return CartItem.create({
+            product: Product.create({ id: options.productId ?? 'product-default' }),
+            productPrice: ProductPrice.create({ id: options.productPriceId ?? 'price-default' }),
+            amount,
+            calculatedPrices: [CartItemPrice.create({ price: unitPrice * amount })],
+        });
+    }
+
+    function orderData(options: {
+        firstName?: string;
+        lastName?: string;
+        email?: string;
+        phone?: string;
+        timeSlot?: WebshopTimeSlot | null;
+        checkoutMethod?: WebshopTakeoutMethod | null;
+        discountCodes?: DiscountCode[];
+        items?: CartItem[];
+        recordAnswers?: Map<string, RecordCheckboxAnswer | RecordTextAnswer | RecordChooseOneAnswer | RecordMultipleChoiceAnswer | RecordDateAnswer | RecordIntegerAnswer>;
+    } = {}): OrderData {
+        return OrderData.create({
+            customer: Customer.create({
+                firstName: options.firstName ?? 'John',
+                lastName: options.lastName ?? 'Doe',
+                email: options.email ?? 'john@example.com',
+                phone: options.phone ?? '+32412345678',
+            }),
+            timeSlot: options.timeSlot ?? null,
+            checkoutMethod: options.checkoutMethod ?? null,
+            discountCodes: options.discountCodes ?? [],
+            cart: Cart.create({ items: options.items ?? [] }),
+            recordAnswers: options.recordAnswers ?? new Map(),
+        });
+    }
+
+    async function createOrder(options: {
+        data?: OrderData;
+        status?: OrderStatus;
+        number?: number | null;
+        validAt?: Date | null;
+        createdAt?: Date;
+    } = {}): Promise<Order> {
+        const order = new Order();
+        order.organizationId = organization.id;
+        order.webshopId = webshop.id;
+        order.data = options.data ?? orderData();
+        order.number = options.number !== undefined ? options.number : nextNumber++;
+        order.status = options.status ?? OrderStatus.Created;
+        order.validAt = options.validAt !== undefined ? options.validAt : new Date();
+        if (options.createdAt) {
+            order.createdAt = options.createdAt;
+        }
+        await order.save();
+        return order;
+    }
+
+    /** Attaches a balance item to an order (needed for amountToPay and to hang payments off). */
+    async function addBalanceItem(order: Order, options: { unitPrice: number; amount?: number; pricePaid?: number }): Promise<BalanceItem> {
+        const balanceItem = new BalanceItem();
+        balanceItem.organizationId = organization.id;
+        balanceItem.orderId = order.id;
+        balanceItem.type = BalanceItemType.Order;
+        balanceItem.amount = options.amount ?? 1;
+        balanceItem.unitPrice = options.unitPrice;
+        balanceItem.pricePaid = options.pricePaid ?? 0;
+        await balanceItem.save();
+        return balanceItem;
+    }
+
+    async function addPayment(balanceItem: BalanceItem, options: {
+        method: PaymentMethod;
+        price: number;
+        status?: PaymentStatus;
+        paidAt?: Date | null;
+        transferDescription?: string | null;
+    }): Promise<Payment> {
+        const payment = new Payment();
+        payment.method = options.method;
+        payment.status = options.status ?? PaymentStatus.Succeeded;
+        payment.organizationId = organization.id;
+        payment.price = options.price;
+        payment.paidAt = options.paidAt ?? null;
+        payment.transferDescription = options.transferDescription ?? null;
+        await payment.save();
+
+        const balanceItemPayment = new BalanceItemPayment();
+        balanceItemPayment.balanceItemId = balanceItem.id;
+        balanceItemPayment.paymentId = payment.id;
+        balanceItemPayment.price = options.price;
+        balanceItemPayment.organizationId = organization.id;
+        await balanceItemPayment.save();
+
+        return payment;
+    }
+
+    // --- parity harness --------------------------------------------------------------------------------
+
+    async function runInMemory(filter: StamhoofdFilter): Promise<string[]> {
+        const orders = await Order.where({ organizationId: organization.id });
+        const structures = await Order.getPrivateStructures(orders);
+        const runner = compileToInMemoryFilter(filter, privateOrderWithTicketsFilterCompilers);
+        return structures.filter(s => s.number !== null && runner(s)).map(s => s.id).sort();
+    }
+
+    async function runSQL(filter: StamhoofdFilter): Promise<string[]> {
+        const query = SQL
+            .select(SQL.wildcard(Order.table))
+            .from(SQL.table(Order.table))
+            // Same base filter as GetWebshopOrdersEndpoint.buildQuery
+            .where(await compileToSQLFilter({ organizationId: organization.id, number: { $neq: null } }, orderFilterCompilers))
+            .where(await compileToSQLFilter(filter, orderFilterCompilers));
+
+        const rows = await query.fetch();
+        return Order.fromRows(rows, Order.table).map(o => o.id).sort();
+    }
+
+    /**
+     * Asserts that both engines return exactly the expected orders. Comparing to an explicit expected set
+     * (instead of only comparing the engines to each other) also guards against both engines being wrong
+     * in the same way, or a filter accidentally matching everything / nothing.
+     */
+    async function expectFilter(filter: StamhoofdFilter, expected: Order[]) {
+        const expectedIds = [...new Set(expected.map(o => o.id))].sort();
+        const inMemoryIds = await runInMemory(filter);
+        const sqlIds = await runSQL(filter);
+
+        expect(inMemoryIds, 'in-memory result should match expected').toEqual(expectedIds);
+        expect(sqlIds, 'backend SQL result should match expected').toEqual(expectedIds);
+    }
+
+    // --- simple columns --------------------------------------------------------------------------------
+
+    describe('id', () => {
+        it('$eq matches a single order', async () => {
+            const a = await createOrder();
+            const b = await createOrder();
+            await expectFilter({ id: { $eq: a.id } }, [a]);
+            await expectFilter({ id: { $eq: b.id } }, [b]);
+        });
+
+        it('$in matches multiple orders', async () => {
+            const a = await createOrder();
+            const b = await createOrder();
+            const c = await createOrder();
+            await expectFilter({ id: { $in: [a.id, c.id] } }, [a, c]);
+        });
+
+        it('$neq excludes a single order', async () => {
+            const a = await createOrder();
+            const b = await createOrder();
+            await expectFilter({ id: { $neq: a.id } }, [b]);
+        });
+    });
+
+    describe('webshopId', () => {
+        it('$eq matches orders of the webshop', async () => {
+            const a = await createOrder();
+            const b = await createOrder();
+            await expectFilter({ webshopId: { $eq: webshop.id } }, [a, b]);
+            await expectFilter({ webshopId: { $eq: 'does-not-exist' } }, []);
+        });
+    });
+
+    describe('status', () => {
+        it('$eq / $in / $neq on the enum', async () => {
+            const created = await createOrder({ status: OrderStatus.Created });
+            const prepared = await createOrder({ status: OrderStatus.Prepared });
+            const completed = await createOrder({ status: OrderStatus.Completed });
+
+            await expectFilter({ status: { $eq: OrderStatus.Created } }, [created]);
+            await expectFilter({ status: { $in: [OrderStatus.Created, OrderStatus.Completed] } }, [created, completed]);
+            await expectFilter({ status: { $neq: OrderStatus.Prepared } }, [created, completed]);
+        });
+    });
+
+    describe('number', () => {
+        it('numeric comparisons', async () => {
+            const a = await createOrder({ number: 10 });
+            const b = await createOrder({ number: 20 });
+            const c = await createOrder({ number: 30 });
+
+            await expectFilter({ number: { $eq: 20 } }, [b]);
+            await expectFilter({ number: { $gt: 15 } }, [b, c]);
+            await expectFilter({ number: { $lt: 25 } }, [a, b]);
+            await expectFilter({ number: { $in: [10, 30] } }, [a, c]);
+        });
+    });
+
+    describe('createdAt', () => {
+        it('date comparisons', async () => {
+            const older = await createOrder({ createdAt: new Date('2023-01-01T12:00:00Z') });
+            const newer = await createOrder({ createdAt: new Date('2024-01-01T12:00:00Z') });
+
+            await expectFilter({ createdAt: { $lt: new Date('2023-06-01T00:00:00Z') } }, [older]);
+            await expectFilter({ createdAt: { $gt: new Date('2023-06-01T00:00:00Z') } }, [newer]);
+        });
+    });
+
+    describe('validAt', () => {
+        it('$eq null / $neq null', async () => {
+            const valid = await createOrder({ validAt: new Date('2024-01-01T12:00:00Z') });
+            const invalid = await createOrder({ validAt: null });
+
+            await expectFilter({ validAt: { $eq: null } }, [invalid]);
+            await expectFilter({ validAt: { $neq: null } }, [valid]);
+        });
+
+        it('date comparison', async () => {
+            const older = await createOrder({ validAt: new Date('2023-01-01T12:00:00Z') });
+            const newer = await createOrder({ validAt: new Date('2024-01-01T12:00:00Z') });
+
+            await expectFilter({ validAt: { $gt: new Date('2023-06-01T00:00:00Z') } }, [newer]);
+            await expectFilter({ validAt: { $lt: new Date('2023-06-01T00:00:00Z') } }, [older]);
+        });
+    });
+
+    // --- customer JSON ---------------------------------------------------------------------------------
+
+    describe('name', () => {
+        it('$eq and $contains (case-insensitive)', async () => {
+            const john = await createOrder({ data: orderData({ firstName: 'John', lastName: 'Doe' }) });
+            const jane = await createOrder({ data: orderData({ firstName: 'Jane', lastName: 'Roe' }) });
+
+            await expectFilter({ name: { $eq: 'John Doe' } }, [john]);
+            await expectFilter({ name: { $eq: 'john doe' } }, [john]);
+            await expectFilter({ name: { $contains: 'oe' } }, [john, jane]);
+            await expectFilter({ name: { $contains: 'jane' } }, [jane]);
+        });
+    });
+
+    describe('email', () => {
+        it('$eq and $contains', async () => {
+            const a = await createOrder({ data: orderData({ email: 'alice@example.com' }) });
+            const b = await createOrder({ data: orderData({ email: 'bob@other.org' }) });
+
+            await expectFilter({ email: { $eq: 'alice@example.com' } }, [a]);
+            await expectFilter({ email: { $contains: 'example.com' } }, [a]);
+            await expectFilter({ email: { $contains: '@' } }, [a, b]);
+        });
+    });
+
+    describe('phone', () => {
+        it('$contains and $eq on a set phone number', async () => {
+            const a = await createOrder({ data: orderData({ phone: '+32412345678' }) });
+            const b = await createOrder({ data: orderData({ phone: '+32498765432' }) });
+
+            await expectFilter({ phone: { $eq: '+32412345678' } }, [a]);
+            await expectFilter({ phone: { $contains: '4123' } }, [a]);
+            await expectFilter({ phone: { $contains: '3' } }, [a, b]);
+        });
+    });
+
+    // --- cached columns --------------------------------------------------------------------------------
+
+    describe('totalPrice', () => {
+        it('numeric comparisons', async () => {
+            const cheap = await createOrder({ data: orderData({ items: [cartItem({ unitPrice: 5_00, amount: 1 })] }) });
+            const expensive = await createOrder({ data: orderData({ items: [cartItem({ unitPrice: 50_00, amount: 1 })] }) });
+
+            await expectFilter({ totalPrice: { $eq: 5_00 } }, [cheap]);
+            await expectFilter({ totalPrice: { $gt: 10_00 } }, [expensive]);
+            await expectFilter({ totalPrice: { $lt: 10_00 } }, [cheap]);
+        });
+    });
+
+    describe('amount', () => {
+        it('numeric comparisons', async () => {
+            const few = await createOrder({ data: orderData({ items: [cartItem({ amount: 1, unitPrice: 1_00 })] }) });
+            const many = await createOrder({ data: orderData({ items: [cartItem({ amount: 5, unitPrice: 1_00 })] }) });
+
+            await expectFilter({ amount: { $eq: 1 } }, [few]);
+            await expectFilter({ amount: { $gt: 3 } }, [many]);
+            await expectFilter({ amount: { $lte: 1 } }, [few]);
+        });
+    });
+
+    // --- time slot -------------------------------------------------------------------------------------
+
+    describe('time slot', () => {
+        const slot = (options: { date: Date; startTime?: number; endTime?: number }) => WebshopTimeSlot.create({
+            date: options.date,
+            startTime: options.startTime ?? 12 * 60,
+            endTime: options.endTime ?? 14 * 60,
+        });
+
+        it('timeSlotDate $eq null matches orders without a time slot', async () => {
+            const withSlot = await createOrder({ data: orderData({ timeSlot: slot({ date: new Date('2024-05-10T00:00:00Z') }) }) });
+            const without = await createOrder({ data: orderData({ timeSlot: null }) });
+
+            await expectFilter({ timeSlotDate: { $eq: null } }, [without]);
+            await expectFilter({ timeSlotDate: { $neq: null } }, [withSlot]);
+        });
+
+        // timeSlotStartTime / timeSlotEndTime hold numbers (minutes since midnight). Numeric comparisons
+        // must work in both engines, and a missing time slot must behave like SQL NULL: matched by $eq null
+        // and by $lt (NULL is the smallest), not matched by $gt or $neq null.
+        it('timeSlotStartTime / timeSlotEndTime comparisons and null parity', async () => {
+            const morning = await createOrder({ data: orderData({ timeSlot: slot({ date: new Date('2024-05-10T00:00:00Z'), startTime: 9 * 60, endTime: 11 * 60 }) }) });
+            const evening = await createOrder({ data: orderData({ timeSlot: slot({ date: new Date('2024-05-10T00:00:00Z'), startTime: 18 * 60, endTime: 20 * 60 }) }) });
+            const without = await createOrder({ data: orderData({ timeSlot: null }) });
+
+            await expectFilter({ timeSlotStartTime: { $eq: null } }, [without]);
+            await expectFilter({ timeSlotStartTime: { $neq: null } }, [morning, evening]);
+            await expectFilter({ timeSlotStartTime: { $gt: 12 * 60 } }, [evening]);
+            await expectFilter({ timeSlotStartTime: { $lt: 12 * 60 } }, [morning, without]);
+            await expectFilter({ timeSlotEndTime: { $gt: 12 * 60 } }, [evening]);
+            await expectFilter({ timeSlotEndTime: { $lt: 12 * 60 } }, [morning, without]);
+        });
+    });
+
+    // --- checkout method -------------------------------------------------------------------------------
+
+    describe('checkout method', () => {
+        const takeout = (id: string, name = 'Pickup point') => WebshopTakeoutMethod.create({
+            id,
+            name,
+            address: address(),
+        });
+
+        it('checkoutMethod (type) and checkoutMethodId, incl null parity', async () => {
+            const a = await createOrder({ data: orderData({ checkoutMethod: takeout('method-a') }) });
+            const b = await createOrder({ data: orderData({ checkoutMethod: takeout('method-b') }) });
+            const without = await createOrder({ data: orderData({ checkoutMethod: null }) });
+
+            await expectFilter({ checkoutMethodId: { $eq: 'method-a' } }, [a]);
+            await expectFilter({ checkoutMethodId: { $eq: null } }, [without]);
+            await expectFilter({ checkoutMethod: { $in: [CheckoutMethodType.Takeout] } }, [a, b]);
+            await expectFilter({ checkoutMethod: { $eq: null } }, [without]);
+        });
+    });
+
+    // --- discount codes --------------------------------------------------------------------------------
+
+    describe('discountCodes.code', () => {
+        // Codes are stored with mixed case on purpose: both $eq and $in on a JSON array must be
+        // case-insensitive, exactly like the in-memory engine.
+        it('$eq and $in match the codes in the array (case-insensitive)', async () => {
+            const summer = await createOrder({ data: orderData({ discountCodes: [DiscountCode.create({ code: 'SUMMER' })] }) });
+            const summerLower = await createOrder({ data: orderData({ discountCodes: [DiscountCode.create({ code: 'summer' })] }) });
+            const summerCombination = await createOrder({ data: orderData({ discountCodes: [DiscountCode.create({ code: 'suMMER' })] }) });
+
+            const winter = await createOrder({ data: orderData({ discountCodes: [DiscountCode.create({ code: 'WINTER' })] }) });
+
+            const none = await createOrder({ data: orderData({ discountCodes: [] }) });
+
+            await expectFilter({ discountCodes: { code: { $eq: 'summer' } } }, [summer, summerLower, summerCombination]);
+            await expectFilter({ discountCodes: { code: { $in: ['summer', 'winter'] } } }, [summer, summerLower, summerCombination, winter]);
+            await expectFilter({ discountCodes: { code: { $in: ['SUMMER', 'WINTER'] } } }, [summer, summerLower, summerCombination, winter]);
+            await expectFilter({ discountCodes: { code: { $in: ['suMmer', 'winTEr'] } } }, [summer, summerLower, summerCombination, winter]);
+            expect(none.id).toBeDefined();
+        });
+    });
+
+    // --- cart items ($elemMatch) -----------------------------------------------------------------------
+
+    describe('items', () => {
+        it('$elemMatch on product / productPrice / amount', async () => {
+            const apple = await createOrder({ data: orderData({ items: [cartItem({ productId: 'apple', productPriceId: 'apple-price', amount: 2, unitPrice: 1_00 })] }) });
+            const pear = await createOrder({ data: orderData({ items: [cartItem({ productId: 'pear', productPriceId: 'pear-price', amount: 5, unitPrice: 1_00 })] }) });
+
+            await expectFilter({ items: { $elemMatch: { product: { id: { $eq: 'apple' } } } } }, [apple]);
+            await expectFilter({ items: { $elemMatch: { productPrice: { id: { $eq: 'pear-price' } } } } }, [pear]);
+            await expectFilter({ items: { $elemMatch: { amount: { $gt: 3 } } } }, [pear]);
+            await expectFilter({ items: { $elemMatch: { product: { id: { $in: ['apple', 'pear'] } } } } }, [apple, pear]);
+        });
+    });
+
+    // --- record answers --------------------------------------------------------------------------------
+
+    describe('record answers', () => {
+        const RID = 'record-id-1';
+
+        const checkbox = (selected: boolean) => new Map([[RID, RecordCheckboxAnswer.create({ settings: RecordSettings.create({ id: RID, type: RecordType.Checkbox }), selected })]]);
+        const text = (value: string) => new Map([[RID, RecordTextAnswer.create({ settings: RecordSettings.create({ id: RID, type: RecordType.Text }), value })]]);
+        const chooseOne = (choiceId: string | null) => new Map([[RID, RecordChooseOneAnswer.create({ settings: RecordSettings.create({ id: RID, type: RecordType.ChooseOne }), selectedChoice: choiceId === null ? null : RecordChoice.create({ id: choiceId }) })]]);
+        const multipleChoice = (choiceIds: string[]) => new Map([[RID, RecordMultipleChoiceAnswer.create({ settings: RecordSettings.create({ id: RID, type: RecordType.MultipleChoice }), selectedChoices: choiceIds.map(id => RecordChoice.create({ id })) })]]);
+        const date = (dateValue: Date | null) => new Map([[RID, RecordDateAnswer.create({ settings: RecordSettings.create({ id: RID, type: RecordType.Date }), dateValue })]]);
+        const integer = (value: number | null) => new Map([[RID, RecordIntegerAnswer.create({ settings: RecordSettings.create({ id: RID, type: RecordType.Integer }), value })]]);
+
+        it('checkbox: selected', async () => {
+            const checked = await createOrder({ data: orderData({ recordAnswers: checkbox(true) }) });
+            const unchecked = await createOrder({ data: orderData({ recordAnswers: checkbox(false) }) });
+
+            await expectFilter({ recordAnswers: { [RID]: { selected: { $eq: true } } } }, [checked]);
+            await expectFilter({ recordAnswers: { [RID]: { selected: { $eq: false } } } }, [unchecked]);
+        });
+
+        it('text value: $contains and $eq', async () => {
+            const hello = await createOrder({ data: orderData({ recordAnswers: text('say hello world') }) });
+            const bye = await createOrder({ data: orderData({ recordAnswers: text('goodbye') }) });
+
+            await expectFilter({ recordAnswers: { [RID]: { value: { $contains: 'hello' } } } }, [hello]);
+            await expectFilter({ recordAnswers: { [RID]: { value: { $eq: 'goodbye' } } } }, [bye]);
+        });
+
+        it('single choice: selectedChoice.id', async () => {
+            const a = await createOrder({ data: orderData({ recordAnswers: chooseOne('choice-a') }) });
+            const b = await createOrder({ data: orderData({ recordAnswers: chooseOne('choice-b') }) });
+
+            await expectFilter({ recordAnswers: { [RID]: { selectedChoice: { id: { $eq: 'choice-a' } } } } }, [a]);
+            await expectFilter({ recordAnswers: { [RID]: { selectedChoice: { id: { $in: ['choice-a', 'choice-b'] } } } } }, [a, b]);
+        });
+
+        it('multiple choice: selectedChoices.id', async () => {
+            const ab = await createOrder({ data: orderData({ recordAnswers: multipleChoice(['choice-a', 'choice-b']) }) });
+            const c = await createOrder({ data: orderData({ recordAnswers: multipleChoice(['choice-c']) }) });
+
+            await expectFilter({ recordAnswers: { [RID]: { selectedChoices: { id: { $in: ['choice-a'] } } } } }, [ab]);
+            await expectFilter({ recordAnswers: { [RID]: { selectedChoices: { id: { $in: ['choice-c'] } } } } }, [c]);
+        });
+
+        it('date value: comparisons and $eq null', async () => {
+            const stored = await createOrder({ data: orderData({ recordAnswers: date(new Date('2023-06-10T14:30:00Z')) }) });
+            const later = await createOrder({ data: orderData({ recordAnswers: date(new Date('2023-06-25T14:30:00Z')) }) });
+            const nullDate = await createOrder({ data: orderData({ recordAnswers: date(null) }) });
+
+            await expectFilter({ recordAnswers: { [RID]: { dateValue: { $gt: new Date('2023-06-20T00:00:00Z') } } } }, [later]);
+            await expectFilter({ recordAnswers: { [RID]: { dateValue: { $eq: null } } } }, [nullDate]);
+            expect(stored.id).toBeDefined();
+        });
+
+        //  An unanswered record question (missing map key) or a null answer value must behave in memory exactly like the SQL NULL the JSON extraction yields.
+        describe('missing / null answer parity (the SQL NULL behaviour)', () => {
+            it('$eq null matches both a null value and an unanswered question', async () => {
+                const nullValue = await createOrder({ data: orderData({ recordAnswers: text('') }) });
+                // Overwrite with an actual null text value
+                const nullAnswer = await createOrder({ data: orderData({ recordAnswers: new Map([[RID, RecordTextAnswer.create({ settings: RecordSettings.create({ id: RID, type: RecordType.Text }), value: null })]]) }) });
+                const unanswered = await createOrder({ data: orderData({ recordAnswers: new Map() }) });
+                const answered = await createOrder({ data: orderData({ recordAnswers: text('something') }) });
+
+                await expectFilter({ recordAnswers: { [RID]: { value: { $eq: null } } } }, [nullAnswer, unanswered]);
+                expect(nullValue.id).toBeDefined();
+                expect(answered.id).toBeDefined();
+            });
+
+            it('$lt matches smaller values, null and unanswered (null is the smallest)', async () => {
+                const small = await createOrder({ data: orderData({ recordAnswers: date(new Date('2023-01-01T00:00:00Z')) }) });
+                const big = await createOrder({ data: orderData({ recordAnswers: date(new Date('2025-01-01T00:00:00Z')) }) });
+                const nullAnswer = await createOrder({ data: orderData({ recordAnswers: date(null) }) });
+                const unanswered = await createOrder({ data: orderData({ recordAnswers: new Map() }) });
+
+                await expectFilter({ recordAnswers: { [RID]: { dateValue: { $lt: new Date('2024-01-01T00:00:00Z') } } } }, [small, nullAnswer, unanswered]);
+                expect(big.id).toBeDefined();
+            });
+
+            it('$contains never matches a null value or an unanswered question', async () => {
+                const match = await createOrder({ data: orderData({ recordAnswers: text('hello world') }) });
+                const nullAnswer = await createOrder({ data: orderData({ recordAnswers: new Map([[RID, RecordTextAnswer.create({ settings: RecordSettings.create({ id: RID, type: RecordType.Text }), value: null })]]) }) });
+                const unanswered = await createOrder({ data: orderData({ recordAnswers: new Map() }) });
+
+                await expectFilter({ recordAnswers: { [RID]: { value: { $contains: 'hello' } } } }, [match]);
+                expect(nullAnswer.id).toBeDefined();
+                expect(unanswered.id).toBeDefined();
+            });
+
+            it('number value $lt matches smaller values, null and unanswered', async () => {
+                const small = await createOrder({ data: orderData({ recordAnswers: integer(5) }) });
+                const big = await createOrder({ data: orderData({ recordAnswers: integer(15) }) });
+                const nullValue = await createOrder({ data: orderData({ recordAnswers: integer(null) }) });
+                const unanswered = await createOrder({ data: orderData({ recordAnswers: new Map() }) });
+
+                await expectFilter({ recordAnswers: { [RID]: { value: { $lt: 10 } } } }, [small, nullValue, unanswered]);
+                expect(big.id).toBeDefined();
+            });
+
+            it('date value $gt matches later values but not null or unanswered', async () => {
+                const later = await createOrder({ data: orderData({ recordAnswers: date(new Date('2023-06-10T00:00:00Z')) }) });
+                const earlier = await createOrder({ data: orderData({ recordAnswers: date(new Date('2023-06-01T00:00:00Z')) }) });
+                const nullValue = await createOrder({ data: orderData({ recordAnswers: date(null) }) });
+                const unanswered = await createOrder({ data: orderData({ recordAnswers: new Map() }) });
+
+                await expectFilter({ recordAnswers: { [RID]: { dateValue: { $gt: new Date('2023-06-05T00:00:00Z') } } } }, [later]);
+                expect(earlier.id).toBeDefined();
+                expect(nullValue.id).toBeDefined();
+                expect(unanswered.id).toBeDefined();
+            });
+
+            it('date value $eq null matches null and unanswered', async () => {
+                const stored = await createOrder({ data: orderData({ recordAnswers: date(new Date('2023-06-10T00:00:00Z')) }) });
+                const nullValue = await createOrder({ data: orderData({ recordAnswers: date(null) }) });
+                const unanswered = await createOrder({ data: orderData({ recordAnswers: new Map() }) });
+
+                await expectFilter({ recordAnswers: { [RID]: { dateValue: { $eq: null } } } }, [nullValue, unanswered]);
+                expect(stored.id).toBeDefined();
+            });
+
+            it('checkbox selected: $in [null, true] matches unanswered, $in [true] does not', async () => {
+                const checked = await createOrder({ data: orderData({ recordAnswers: checkbox(true) }) });
+                const unchecked = await createOrder({ data: orderData({ recordAnswers: checkbox(false) }) });
+                const unanswered = await createOrder({ data: orderData({ recordAnswers: new Map() }) });
+
+                await expectFilter({ recordAnswers: { [RID]: { selected: { $in: [null, true] } } } }, [checked, unanswered]);
+                await expectFilter({ recordAnswers: { [RID]: { selected: { $in: [true] } } } }, [checked]);
+                expect(unchecked.id).toBeDefined();
+            });
+
+            it('single choice: $in [null, choice] matches a null choice and unanswered', async () => {
+                const a = await createOrder({ data: orderData({ recordAnswers: chooseOne('choice-a') }) });
+                const b = await createOrder({ data: orderData({ recordAnswers: chooseOne('choice-b') }) });
+                const nullChoice = await createOrder({ data: orderData({ recordAnswers: chooseOne(null) }) });
+                const unanswered = await createOrder({ data: orderData({ recordAnswers: new Map() }) });
+
+                await expectFilter({ recordAnswers: { [RID]: { selectedChoice: { id: { $in: [null, 'choice-a'] } } } } }, [a, nullChoice, unanswered]);
+                expect(b.id).toBeDefined();
+            });
+        });
+
+        // Negated filters on an empty record answer (null value, or a question that was never answered).
+        // The dashboard builds "not equal to x" and "does not contain x" as $not { ... }. A missing or null
+        // answer is not equal to and does not contain any concrete value, so it must match — in both engines.
+        describe('negated filters on missing or null values', () => {
+            const nullText = () => new Map([[RID, RecordTextAnswer.create({ settings: RecordSettings.create({ id: RID, type: RecordType.Text }), value: null })]]);
+
+            it('$not { $eq } (NotEquals) matches null and unanswered in both engines', async () => {
+                const x = await createOrder({ data: orderData({ recordAnswers: text('x') }) });
+                const y = await createOrder({ data: orderData({ recordAnswers: text('y') }) });
+                const nullValue = await createOrder({ data: orderData({ recordAnswers: nullText() }) });
+                const unanswered = await createOrder({ data: orderData({ recordAnswers: new Map() }) });
+
+                await expectFilter({ recordAnswers: { [RID]: { $not: { value: { $eq: 'x' } } } } }, [y, nullValue, unanswered]);
+                expect(x.id).toBeDefined();
+            });
+
+            it('$not { $contains } (NotContains) matches null and unanswered in both engines', async () => {
+                const withX = await createOrder({ data: orderData({ recordAnswers: text('fox') }) });
+                const withoutX = await createOrder({ data: orderData({ recordAnswers: text('dog') }) });
+                const nullValue = await createOrder({ data: orderData({ recordAnswers: nullText() }) });
+                const unanswered = await createOrder({ data: orderData({ recordAnswers: new Map() }) });
+
+                await expectFilter({ recordAnswers: { [RID]: { $not: { value: { $contains: 'x' } } } } }, [withoutX, nullValue, unanswered]);
+                expect(withX.id).toBeDefined();
+            });
+        });
+    });
+
+    // --- payments ($elemMatch) -------------------------------------------------------------------------
+
+    describe('payments', () => {
+        it('$elemMatch on method / price / transferDescription, ignoring failed payments', async () => {
+            const transferOrder = await createOrder();
+            const transferItem = await addBalanceItem(transferOrder, { unitPrice: 10_00, pricePaid: 10_00 });
+            await addPayment(transferItem, { method: PaymentMethod.Transfer, price: 10_00, transferDescription: '+++123/456/789+++' });
+
+            const cardOrder = await createOrder();
+            const cardItem = await addBalanceItem(cardOrder, { unitPrice: 25_00, pricePaid: 25_00 });
+            await addPayment(cardItem, { method: PaymentMethod.CreditCard, price: 25_00 });
+
+            // Order whose only payment failed: both engines must ignore the failed payment.
+            const failedOrder = await createOrder();
+            const failedItem = await addBalanceItem(failedOrder, { unitPrice: 5_00, pricePaid: 0 });
+            await addPayment(failedItem, { method: PaymentMethod.Transfer, price: 5_00, status: PaymentStatus.Failed });
+
+            await expectFilter({ payments: { $elemMatch: { method: { $eq: PaymentMethod.Transfer } } } }, [transferOrder]);
+            await expectFilter({ payments: { $elemMatch: { price: { $gt: 20_00 } } } }, [cardOrder]);
+            await expectFilter({ payments: { $elemMatch: { transferDescription: { $contains: '123' } } } }, [transferOrder]);
+        });
+    });
+
+    // --- amountToPay -----------------------------------------------------------------------------------
+
+    describe('amountToPay', () => {
+        // amountToPay = totalPrice - sum(balance item pricePaid). Every order here has a balance item so the
+        // SQL SUM is not NULL (an order with no balance items would make amountToPay NULL in SQL but
+        // totalPrice in memory, which is a separate, documented divergence).
+        it('numeric comparisons', async () => {
+            const fullyPaid = await createOrder({ data: orderData({ items: [cartItem({ unitPrice: 10_00, amount: 1 })] }) });
+            await addBalanceItem(fullyPaid, { unitPrice: 10_00, pricePaid: 10_00 });
+
+            const partlyPaid = await createOrder({ data: orderData({ items: [cartItem({ unitPrice: 10_00, amount: 1 })] }) });
+            await addBalanceItem(partlyPaid, { unitPrice: 10_00, pricePaid: 4_00 });
+
+            const unpaid = await createOrder({ data: orderData({ items: [cartItem({ unitPrice: 10_00, amount: 1 })] }) });
+            await addBalanceItem(unpaid, { unitPrice: 10_00, pricePaid: 0 });
+
+            await expectFilter({ amountToPay: { $eq: 0 } }, [fullyPaid]);
+            await expectFilter({ amountToPay: { $gt: 0 } }, [partlyPaid, unpaid]);
+            await expectFilter({ amountToPay: { $eq: 10_00 } }, [unpaid]);
+        });
+    });
+});