@stamhoofd/backend 2.139.0 → 2.141.0

package/src/crons/settlement-sync.ts

@@ -0,0 +1,109 @@
+// Nightly settlement sync for all providers. Everything is an upsert and synced payouts are
+// skipped, so the windowed re-walk is cheap.
+import { registerCron } from '@stamhoofd/crons';
+import { Email } from '@stamhoofd/email';
+import { Settlement } from '@stamhoofd/models/models/Settlement.js';
+import { PaymentProvider } from '@stamhoofd/structures';
+import { SettlementStatus } from '@stamhoofd/structures/settlements/SettlementStatus.js';
+import { Formatter } from '@stamhoofd/utility';
+
+import { SettlementSyncRunner } from '../helpers/SettlementSyncRunner.js';
+import { isApplicationFeeInvoicingEnabled } from './stripe-invoices.js';
+
+registerCron('settlement-sync', syncSettlements);
+
+/**
+ * How many days of settlements the nightly run re-walks.
+ */
+const SYNC_WINDOW_DAYS = 30;
+
+/**
+ * Fees received in a platform payout are billed by the monthly invoicer, so pendingFees taking a
+ * while to reach 0 is normal. Older than this it means the invoicer failed or skipped something.
+ */
+const MAXIMUM_PENDING_FEES_AGE_MS = 31 * 24 * 60 * 60 * 1000;
+
+let lastSettlementSync: Date | null = null;
+
+async function syncSettlements() {
+    if (STAMHOOFD.environment !== 'production') {
+        return;
+    }
+
+    // Between 5 and 6 AM Brussels time.
+    if (Formatter.luxon().hour !== 5) {
+        return;
+    }
+
+    // Wait for the next day before doing a new sync
+    const today = new Date();
+    if (lastSettlementSync && Formatter.dateIso(lastSettlementSync) === Formatter.dateIso(today)) {
+        console.log('Settlement sync done for this day');
+        return;
+    }
+
+    console.log('Syncing settlements...');
+
+    const start = new Date(today.getTime() - SYNC_WINDOW_DAYS * 24 * 60 * 60 * 1000);
+
+    const runner = new SettlementSyncRunner();
+    await runner.run({
+        start,
+        providers: [PaymentProvider.Stripe, PaymentProvider.Mollie],
+        stripe: { retryUnsynced: true },
+    });
+
+    await reportProblemSettlements();
+
+    lastSettlementSync = new Date();
+}
+
+/**
+ * Every unsynced settlement or non-zero delta is a real question to answer, not noise.
+ *
+ * Exported for tests only.
+ */
+export async function reportProblemSettlements() {
+    // Only payouts that actually arrived: money that failed or was canceled holds no transactions
+    // to reconcile
+    const unexplained = await Settlement.select()
+        .where('status', SettlementStatus.Paid)
+        .where('unexplainedAmount', '!=', 0)
+        .limit(50)
+        .fetch();
+
+    const unsynced = await Settlement.select()
+        .where('status', SettlementStatus.Paid)
+        .where('syncedAt', null)
+        .limit(50)
+        .fetch();
+
+    // Fees only stop being pending once the invoicer bills them: while it is off, every platform
+    // payout would be reported forever
+    const stalePendingFees = isApplicationFeeInvoicingEnabled()
+        ? await Settlement.select()
+                .where('status', SettlementStatus.Paid)
+                .where('pendingFees', '!=', 0)
+                .where('settledAt', '<', new Date(Date.now() - MAXIMUM_PENDING_FEES_AGE_MS))
+                .limit(50)
+                .fetch()
+        : [];
+
+    if (unexplained.length === 0 && unsynced.length === 0 && stalePendingFees.length === 0) {
+        return;
+    }
+
+    const total = new Set([...unexplained, ...unsynced, ...stalePendingFees].map(s => s.id)).size;
+
+    const describe = (settlement: Settlement) => {
+        return settlement.provider + ' ' + settlement.externalId + ' (' + Formatter.dateIso(settlement.settledAt) + ', ' + Formatter.price(settlement.unexplainedAmount) + ' onverklaard, ' + Formatter.price(settlement.pendingFees) + ' niet-gefactureerde kosten, ' + settlement.syncFailureCount + ' mislukte pogingen)';
+    };
+
+    Email.sendWebmaster({
+        subject: 'Uitbetalingen met problemen: ' + total,
+        html: 'Deze uitbetalingen kloppen niet of konden niet gesynchroniseerd worden: <br><br>'
+            + 'Onverklaard verschil:<br>' + (unexplained.map(describe).join('<br>') || 'geen') + '<br><br>'
+            + 'Niet gesynchroniseerd:<br>' + (unsynced.map(describe).join('<br>') || 'geen') + '<br><br>'
+            + 'Kosten te lang niet gefactureerd:<br>' + (stalePendingFees.map(describe).join('<br>') || 'geen'),
+    });
+}

package/src/crons/stripe-invoices.ts

@@ -1,22 +1,28 @@
 import { registerCron } from '@stamhoofd/crons';
-import { Formatter } from '@stamhoofd/utility';
-import { StripeInvoicer } from '../helpers/StripeInvoicer.js';
 import { Organization, Platform } from '@stamhoofd/models';
+import { Formatter } from '@stamhoofd/utility';
+
+import { ApplicationFeeInvoicer } from '../helpers/ApplicationFeeInvoicer.js';
 
 registerCron('stripe-invoices', createStripeInvoices);
 
 let lastStripeInvoice: Date | null = null;
 
-async function createStripeInvoices() {
-    if (STAMHOOFD.environment !== 'production' && STAMHOOFD.environment !== 'development') {
-        return;
-    }
-
-    if (STAMHOOFD.userMode === 'platform') {
-        return;
-    }
+/**
+ * Whether application fees are billed automatically. The sync stores what we received either way,
+ * so anything that reports on uninvoiced fees has to ask this first: while it is off, fees staying
+ * uninvoiced is the expected state, not a problem.
+ *
+ * The settlements feature is not released yet: allow production at go-live.
+ */
+export function isApplicationFeeInvoicingEnabled(): boolean {
+    return (STAMHOOFD.environment as string) === 'development'
+        && STAMHOOFD.userMode !== 'platform'
+        && STAMHOOFD.STRIPE_CONNECT_METHOD !== 'standard';
+}
 
-    if (STAMHOOFD.STRIPE_CONNECT_METHOD === 'standard') {
+async function createStripeInvoices() {
+    if (!isApplicationFeeInvoicingEnabled()) {
         return;
     }
 
@@ -41,9 +47,9 @@ async function createStripeInvoices() {
 
     const membershipOrganization = await Organization.getByID(membershipOrganizationId, true);
 
-    const invoicer = new StripeInvoicer({
+    const invoicer = new ApplicationFeeInvoicer({
         secretKey: STAMHOOFD.STRIPE_SECRET_KEY,
     });
-    await invoicer.generateAllInvoices(membershipOrganization, { forceLast: Formatter.dateIso(today) === '2026-07-04' });
+    await invoicer.generateInvoices(membershipOrganization);
     lastStripeInvoice = new Date();
 }

package/src/crons.ts

@@ -3,7 +3,6 @@ import { registerCron } from '@stamhoofd/crons';
 import { Group, Organization, Payment, Registration, STPackage, Webshop } from '@stamhoofd/models';
 import { SQL } from '@stamhoofd/sql';
 import { PaymentMethod, PaymentProvider, PaymentStatus } from '@stamhoofd/structures';
-import { checkSettlements } from './helpers/CheckSettlements.js';
 import { OrganizationDNSService } from './services/OrganizationDNSService.js';
 import { PaymentService } from './services/PaymentService.js';
 import { RegistrationService } from './services/RegistrationService.js';
@@ -193,7 +192,6 @@ async function checkOldPayments() {
 // 5 days - 10 days
 async function checkOldDirectDebitPayments() {
     let timeout = 60 * 1000 * 60 * 24 * 5;
-    const timeout2 = 60 * 1000 * 60 * 24 * 10;
 
     if (STAMHOOFD.environment === 'development') {
         // For Mollie, webhooks won't work, so we poll in the backend
@@ -207,8 +205,7 @@ async function checkOldDirectDebitPayments() {
                 PaymentMethod.DirectDebit,
             ])
                 .and('status', [PaymentStatus.Created, PaymentStatus.Pending])
-                .and('createdAt', '<', new Date(new Date().getTime() - timeout))
-                .and('createdAt', '>', new Date(new Date().getTime() - timeout2)),
+                .and('createdAt', '<', new Date(new Date().getTime() - timeout)),
         )
         .orderBy('createdAt', 'ASC')
         .limit(500)
@@ -357,7 +354,6 @@ async function checkReservedUntil() {
     }
 }
 
-registerCron('checkSettlements', checkSettlements);
 registerCron('checkExpirationEmails', checkExpirationEmails);
 registerCron('checkReservedUntil', checkReservedUntil);
 registerCron('checkDNS', checkDNS);

package/src/endpoints/auth/MFA.security.test.ts

@@ -1,7 +1,7 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
 import { EmailVerificationCode, MFARecoveryCode, MFATOTP, MFAToken, Organization, OrganizationFactory, PasswordToken, Token, User, UserFactory, WebauthnCredential } from '@stamhoofd/models';
-import { PermissionLevel, Permissions, Token as TokenStruct } from '@stamhoofd/structures';
+import { NewUser, PermissionLevel, Permissions, Token as TokenStruct } from '@stamhoofd/structures';
 import { TestUtils } from '@stamhoofd/test-utils';
 import crypto from 'crypto';
 import { authenticator } from 'otplib';
@@ -16,6 +16,7 @@ import { DeletePasskeyEndpoint } from './DeletePasskeyEndpoint.js';
 import { DeleteTOTPEndpoint } from './DeleteTOTPEndpoint.js';
 import { GetMFAChallengeEndpoint } from './GetMFAChallengeEndpoint.js';
 import { GetMFAStatusEndpoint } from './GetMFAStatusEndpoint.js';
+import { PatchUserEndpoint } from './PatchUserEndpoint.js';
 import { RegisterPasskeyOptionsEndpoint } from './RegisterPasskeyOptionsEndpoint.js';
 import { SetupTOTPEndpoint } from './SetupTOTPEndpoint.js';
 import { VerifyEmailEndpoint } from './VerifyEmailEndpoint.js';
@@ -508,6 +509,80 @@ describe('MFA security', () => {
         });
     });
 
+    // -----------------------------------------------------------------------
+    // Absorbing someone else's account by taking over their email address
+    // -----------------------------------------------------------------------
+    describe('merging accounts', () => {
+        /**
+         * Verifying an email address that already belongs to another account merges that
+         * account into yours. Reading the victim's mailbox is a single primary credential,
+         * exactly the one a second factor exists to back up, so it must not be enough to
+         * pull an account that has a second factor (and its permissions) into an account
+         * that does not.
+         */
+        async function requestEmailChange(user: User, token: Token, newEmail: string, organization: Organization): Promise<EmailVerificationCode> {
+            const request = Request.patch({
+                path: '/user/' + user.id,
+                host: organization.getApiHost(),
+                headers: { authorization: 'Bearer ' + token.accessToken },
+                body: NewUser.patch({ id: user.id, email: newEmail }),
+            });
+
+            const err = await captureError(testServer.test(new PatchUserEndpoint(), request));
+            expect(err.code).toBe('verify_email');
+
+            const verificationToken = (err.meta as { token: string }).token;
+            const code = await EmailVerificationCode.select().where('token', verificationToken).first(true);
+            expect(code.email).toBe(newEmail);
+            return code;
+        }
+
+        test('taking over the email address of an account with a second factor is refused', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const victim = await new UserFactory({ organization, password, permissions: Permissions.create({ level: PermissionLevel.Full }) }).create();
+            const victimTotp = await addConfirmedTOTP(victim);
+
+            const attacker = await new UserFactory({ organization, password }).create();
+            const attackerToken = await freshToken(attacker);
+
+            const code = await requestEmailChange(attacker, attackerToken, victim.email, organization);
+
+            const err = await captureError(testServer.test(new VerifyEmailEndpoint(), bearer(Request.buildJson('POST', '/verify-email', organization.getApiHost(), { token: code.token, code: code.code }), attackerToken)));
+            expect(err.code).toBe('email_in_use');
+
+            // The victim still owns their account, their permissions and their factor.
+            const storedVictim = await User.getByID(victim.id);
+            expect(storedVictim).toBeDefined();
+            expect(storedVictim!.email).toBe(victim.email);
+            expect(await MFATOTP.getByID(victimTotp.id)).toBeDefined();
+
+            const storedAttacker = await User.getByID(attacker.id);
+            expect(storedAttacker!.email).toBe(attacker.email);
+            expect(storedAttacker!.permissions).toBeNull();
+        });
+
+        test('an account without a second factor can still be merged', async () => {
+            // Merging is a real feature for people who signed up twice. Without a factor,
+            // whoever reads the mailbox could take that account over with a password reset
+            // anyway, so nothing is bypassed here.
+            const organization = await new OrganizationFactory({}).create();
+            const other = await new UserFactory({ organization, password, permissions: Permissions.create({ level: PermissionLevel.Full }) }).create();
+
+            const user = await new UserFactory({ organization, password }).create();
+            const token = await freshToken(user);
+
+            const code = await requestEmailChange(user, token, other.email, organization);
+
+            const response = await testServer.test(new VerifyEmailEndpoint(), bearer(Request.buildJson('POST', '/verify-email', organization.getApiHost(), { token: code.token, code: code.code }), token));
+            expect(response.body).toBeInstanceOf(TokenStruct);
+
+            expect(await User.getByID(other.id)).toBeUndefined();
+            const stored = await User.getByID(user.id);
+            expect(stored!.email).toBe(other.email);
+            expect(stored!.permissions).not.toBeNull();
+        });
+    });
+
     // -----------------------------------------------------------------------
     // Changing the factors of an account ends the sessions the user is not on
     // -----------------------------------------------------------------------

package/src/endpoints/auth/VerifyEmailEndpoint.ts

@@ -82,6 +82,20 @@ export class VerifyEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
             const other = await User.getForAuthentication(user.organizationId, code.email, { allowWithoutAccount: true });
 
             if (other) {
+                // Merging absorbs the other account (its permissions included) and then
+                // deletes it, second factor and all. Reading the mailbox is exactly the
+                // single credential a second factor exists to back up, so an account that
+                // has one may not be taken over this way: nothing in this request proves
+                // the caller can pass it.
+                if (await TwoFactorHelper.userHasFactors(other.id)) {
+                    throw new SimpleError({
+                        code: 'email_in_use',
+                        message: 'This e-mail is already in use by an account with two-factor authentication',
+                        human: $t('%Zis'),
+                        statusCode: 400,
+                    });
+                }
+
                 // Delete the other user, but merge data
                 await user.merge(other);
                 if (user.organizationId) {

package/src/endpoints/organization/dashboard/balance-items/GetBalanceItemBreakdownEndpoint.test.ts

@@ -2,7 +2,7 @@ import { Request } from '@simonbackx/simple-endpoints';
 import type { BalanceItem, Organization, User } from '@stamhoofd/models';
 import { BalanceItemFactory, BalanceItemPayment, OrderFactory, OrganizationFactory, Payment, Token, UserFactory, WebshopFactory } from '@stamhoofd/models';
 import type { StamhoofdFilter } from '@stamhoofd/structures';
-import { BalanceItemRelation, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, Cart, CartItem, CartItemOption, CartItemPrice, Customer, Option, OptionMenu, OrderData, PaymentMethod, PaymentProvider, PaymentStatus, PermissionLevel, Permissions, Product, ProductPrice, Settlement, TranslatedString } from '@stamhoofd/structures';
+import { BalanceItemRelation, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, Cart, CartItem, CartItemOption, CartItemPrice, Customer, Option, OptionMenu, OrderData, PaymentMethod, PaymentProvider, PaymentStatus, PermissionLevel, Permissions, Product, ProductPrice, SettlementReference, TranslatedString } from '@stamhoofd/structures';
 import { BreakdownRequest } from '@stamhoofd/structures/breakdown/BreakdownRequest.js';
 import type { BalanceItemBreakdown } from '@stamhoofd/structures/PaymentBreakdown.js';
 import { BreakdownAmountType, BreakdownObjectType, BreakdownPathItem, BreakdownTab } from '@stamhoofd/structures/PaymentBreakdown.js';
@@ -254,13 +254,13 @@ describe('Endpoint.GetBalanceItemBreakdownEndpoint', () => {
     });
 
     describe('Grouping by payout', () => {
-        const march = Settlement.create({ id: 'stl_march', reference: '1234567.0312.01', settledAt: new Date(2026, 2, 12), amount: 0 });
-        const april = Settlement.create({ id: 'stl_april', reference: '1234567.0409.01', settledAt: new Date(2026, 3, 9), amount: 0 });
+        const march = SettlementReference.create({ id: 'stl_march', reference: '1234567.0312.01', settledAt: new Date(2026, 2, 12), amount: 0 });
+        const april = SettlementReference.create({ id: 'stl_april', reference: '1234567.0409.01', settledAt: new Date(2026, 3, 9), amount: 0 });
 
         /**
          * Pays a part of a balance item, the way a payment provider settles it afterwards.
          */
-        const payItem = async (organization: Organization, balanceItem: BalanceItem, options: { price: number; settlement?: Settlement; status?: PaymentStatus; method?: PaymentMethod }) => {
+        const payItem = async (organization: Organization, balanceItem: BalanceItem, options: { price: number; settlement?: SettlementReference; status?: PaymentStatus; method?: PaymentMethod }) => {
             const payment = new Payment();
             payment.organizationId = organization.id;
             payment.method = options.method ?? PaymentMethod.Bancontact;
@@ -317,17 +317,17 @@ describe('Endpoint.GetBalanceItemBreakdownEndpoint', () => {
             expect(response.status).toBe(200);
             expect(response.body.bySettlement.map(g => ({ name: g.name.toString(), price: g.price }))).toEqual([
                 { name: '1234567.0312.01', price: 40_00 },
-                { name: $t('In verwerking'), price: 30_00 },
+                { name: $t('%1OL'), price: 30_00 },
                 // Only what was tried sits under the failed payment, the rest was never attempted
-                { name: $t('Mislukte betaling'), price: 20_00 },
-                { name: $t('Openstaand na mislukte poging'), price: 10_00 },
+                { name: $t('%ZjW'), price: 20_00 },
+                { name: $t('%ZjC'), price: 10_00 },
             ]);
 
             // Every part of what was charged ends up in exactly one row
             expect(response.body.bySettlement.reduce((total, g) => total + g.price, 0)).toBe(response.body.price);
 
             // Running the rows through the database gives back the balance items they were added up from
-            for (const name of [$t('Mislukte betaling'), $t('Openstaand na mislukte poging')]) {
+            for (const name of [$t('%ZjW'), $t('%ZjC')]) {
                 const row = response.body.bySettlement.find(g => g.name.toString() === name)!;
                 const exported = await getBreakdown({ organization, user, filter: row.selection!.listFilter });
                 expect(exported.body.balanceItemCount).toBe(1);
@@ -348,19 +348,19 @@ describe('Endpoint.GetBalanceItemBreakdownEndpoint', () => {
             expect(response.status).toBe(200);
             expect(response.body.bySettlement.map(g => ({ name: g.name.toString(), price: g.price }))).toEqual([
                 { name: '1234567.0312.01', price: 50_00 },
-                { name: $t('Terug te betalen'), price: -50_00 },
-                { name: $t('Openstaand'), price: 25_00 },
+                { name: $t('%10b'), price: -50_00 },
+                { name: $t('%1Ni'), price: 25_00 },
             ]);
 
             // A canceled item is not charged anymore, so it doesn't add to what is open
             expect(response.body.bySettlement.reduce((total, g) => total + g.price, 0)).toBe(response.body.price);
 
             // Each row selects exactly the balance items it was added up from
-            const refund = response.body.bySettlement.find(g => g.name.toString() === $t('Terug te betalen'))!;
+            const refund = response.body.bySettlement.find(g => g.name.toString() === $t('%10b'))!;
             const refunded = await getBreakdown({ organization, user, filter: refund.selection!.listFilter });
             expect(refunded.body.balanceItemCount).toBe(1);
 
-            const open = response.body.bySettlement.find(g => g.name.toString() === $t('Openstaand'))!;
+            const open = response.body.bySettlement.find(g => g.name.toString() === $t('%1Ni'))!;
             const stillOpen = await getBreakdown({ organization, user, filter: open.selection!.listFilter });
             expect(stillOpen.body.balanceItemCount).toBe(1);
             expect(stillOpen.body.price).toBe(25_00);
@@ -381,13 +381,13 @@ describe('Endpoint.GetBalanceItemBreakdownEndpoint', () => {
 
             expect(response.status).toBe(200);
             expect(response.body.bySettlement.map(g => ({ name: g.name.toString(), price: g.price }))).toEqual([
-                { name: $t('Mislukte betaling'), price: 100_00 },
+                { name: $t('%ZjW'), price: 100_00 },
                 { name: '1234567.0312.01', price: 40_00 },
-                { name: $t('Openstaand'), price: 25_00 },
+                { name: $t('%1Ni'), price: 25_00 },
             ]);
 
             // Both rows select exactly the balance items they were added up from
-            for (const [name, count] of [[$t('Mislukte betaling'), 1], [$t('Openstaand'), 1]] as [string, number][]) {
+            for (const [name, count] of [[$t('%ZjW'), 1], [$t('%1Ni'), 1]] as [string, number][]) {
                 const row = response.body.bySettlement.find(g => g.name.toString() === name)!;
                 const exported = await getBreakdown({ organization, user, filter: row.selection!.listFilter });
                 expect(exported.body.balanceItemCount).toBe(count);
@@ -405,7 +405,7 @@ describe('Endpoint.GetBalanceItemBreakdownEndpoint', () => {
             await payItem(organization, processing, { price: 25_00, status: PaymentStatus.Pending });
 
             const all = await getBreakdown({ organization, user });
-            const row = all.body.bySettlement.find(g => g.name.toString() === $t('In verwerking'))!;
+            const row = all.body.bySettlement.find(g => g.name.toString() === $t('%1OL'))!;
 
             const narrowed = await getBreakdown({
                 organization,

package/src/endpoints/organization/dashboard/mollie/ConnectMollieEndpoint.ts

@@ -7,8 +7,8 @@ import type { Organization as OrganizationStruct } from '@stamhoofd/structures';
 import { PermissionLevel } from '@stamhoofd/structures';
 
 import { AuthenticatedStructures } from '../../../../helpers/AuthenticatedStructures.js';
-import { checkMollieSettlementsFor } from '../../../../helpers/CheckSettlements.js';
 import { Context } from '../../../../helpers/Context.js';
+import { MollieSettlementSync } from '../../../../helpers/MollieSettlementSync.js';
 import { MollieService } from '../../../../services/MollieService.js';
 
 type Params = Record<string, never>;
@@ -53,7 +53,7 @@ export class ConnectMollieEndpoint extends Endpoint<Params, Query, Body, Respons
             await service.setupOnboarding();
 
             // Check settlements after linking (shouldn't block)
-            checkMollieSettlementsFor(mollieToken.accessToken, true).catch(console.error);
+            new MollieSettlementSync({ token: mollieToken }).syncSettlements({ start: organization.createdAt }).catch(console.error);
         }
 
         return new Response(await AuthenticatedStructures.organization(organization));

package/src/endpoints/organization/dashboard/organization/PatchOrganizationEndpoint.ts

@@ -667,7 +667,7 @@ export class PatchOrganizationEndpoint extends Endpoint<Params, Query, Body, Res
      * A custom PEPPOL endpoint id may only be set by full platform admins for now.
      */
     private requirePeppolPermission() {
-        if (!Context.auth.hasPlatformFullAccess()) {
+        if (!Context.auth.hasPlatformFullAccess() && STAMHOOFD.userMode === 'platform') {
             throw new SimpleError({
                 code: 'permission_denied',
                 message: 'Only platform admins can set a custom PEPPOL endpoint id',

package/src/endpoints/organization/dashboard/payments/GetPaymentBreakdownEndpoint.test.ts

@@ -2,7 +2,7 @@ import { Request } from '@simonbackx/simple-endpoints';
 import type { BalanceItem, Organization, User } from '@stamhoofd/models';
 import { BalanceItemFactory, BalanceItemPayment, OrderFactory, OrganizationFactory, Payment, StripeAccount, Token, UserFactory, WebshopFactory } from '@stamhoofd/models';
 import type { StamhoofdFilter } from '@stamhoofd/structures';
-import { BalanceItemRelation, BalanceItemRelationType, BalanceItemType, Cart, CartItem, CartItemOption, CartItemPrice, Customer, getBalanceItemTypeIcon, getPaymentProviderName, OptionMenu, OrderData, Option, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, PermissionLevel, Permissions, Product, ProductPrice, Settlement, StripeBusinessProfile, StripeMetaData, TransferSettings, TranslatedString } from '@stamhoofd/structures';
+import { BalanceItemRelation, BalanceItemRelationType, BalanceItemType, Cart, CartItem, CartItemOption, CartItemPrice, Customer, getBalanceItemTypeIcon, getPaymentProviderName, OptionMenu, OrderData, Option, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, PermissionLevel, Permissions, Product, ProductPrice, SettlementReference, StripeBusinessProfile, StripeMetaData, TransferSettings, TranslatedString } from '@stamhoofd/structures';
 import { BreakdownRequest } from '@stamhoofd/structures/breakdown/BreakdownRequest.js';
 import type { PaymentBreakdown } from '@stamhoofd/structures/PaymentBreakdown.js';
 import { BreakdownGraphUnit, BreakdownObjectType, BreakdownPathItem, BreakdownTab } from '@stamhoofd/structures/PaymentBreakdown.js';
@@ -142,7 +142,7 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
         iban?: string;
         transferDescription?: string;
         transferFee?: number;
-        settlement?: Settlement;
+        settlement?: SettlementReference;
         /**
          * What this payment rounded away, because a payment goes to the cent while what was charged
          * goes to four digits after the comma.
@@ -367,7 +367,7 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
 
             expect(response.status).toBe(200);
             expect(response.body.byArticle).toHaveLength(1);
-            expect(response.body.byArticle[0].name.toString()).toBe($t('Deels betaalde bestelling'));
+            expect(response.body.byArticle[0].name.toString()).toBe($t('%Zjb'));
             expect(response.body.byArticle[0].price).toBe(1_00);
         });
 
@@ -391,7 +391,7 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
             const response = await getBreakdown({ organization, user });
 
             expect(response.status).toBe(200);
-            expect(response.body.byArticle.map(g => g.name.toString())).toEqual([$t('Gewijzigde bestelling')]);
+            expect(response.body.byArticle.map(g => g.name.toString())).toEqual([$t('%Zik')]);
         });
     });
 
@@ -631,7 +631,7 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
 
     describe('Grouping by payout', () => {
         const createSettlement = (reference: string, settledAt: Date) => {
-            return Settlement.create({ id: 'stl_' + reference, reference, settledAt, amount: 0 });
+            return SettlementReference.create({ id: 'stl_' + reference, reference, settledAt, amount: 0 });
         };
 
         test('per payout, with what is not online and what still has to be paid out apart', async () => {
@@ -652,8 +652,8 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
             expect(response.status).toBe(200);
             expect(response.body.bySettlement.map(g => ({ name: g.name.toString(), price: g.price, count: g.count }))).toEqual([
                 { name: '1234567.0312.01', price: 50_00, count: 2 },
-                { name: $t('Nog niet uitbetaald'), price: 30_00, count: 1 },
-                { name: $t('Niet online betaald'), price: 20_00, count: 1 },
+                { name: $t('%Zjn'), price: 30_00, count: 1 },
+                { name: $t('%ZjN'), price: 20_00, count: 1 },
             ]);
         });
 
@@ -717,7 +717,7 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
             await createPayment(organization, { items: [[item, 20_00]], method: PaymentMethod.PointOfSale });
 
             const all = await getBreakdown({ organization, user });
-            const pending = all.body.bySettlement.find(g => g.name.toString() === $t('Nog niet uitbetaald'))!;
+            const pending = all.body.bySettlement.find(g => g.name.toString() === $t('%Zjn'))!;
 
             const exported = await getBreakdown({ organization, user, filter: pending.selection!.filter });
             expect(exported.body.price).toBe(30_00);
@@ -735,7 +735,7 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
             await createPayment(organization, { items: [[item, 10_00]], iban: 'BE68539007547034' });
 
             const all = await getBreakdown({ organization, user });
-            const offline = all.body.bySettlement.find(g => g.name.toString() === $t('Niet online betaald'))!;
+            const offline = all.body.bySettlement.find(g => g.name.toString() === $t('%ZjN'))!;
 
             const exported = await getBreakdown({ organization, user, filter: offline.selection!.filter });
             expect(exported.body.price).toBe(30_00);
@@ -756,9 +756,9 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
             const all = await getBreakdown({ organization, user });
 
             expect(all.body.bySettlement.map(g => ({ name: g.name.toString(), price: g.price }))).toEqual([
-                { name: $t('Nog niet uitbetaald'), price: 40_00 },
+                { name: $t('%Zjn'), price: 40_00 },
                 { name: getPaymentProviderName(PaymentProvider.Buckaroo), price: 25_00 },
-                { name: $t('Niet online betaald'), price: 20_00 },
+                { name: $t('%ZjN'), price: 20_00 },
                 { name: getPaymentProviderName(PaymentProvider.Payconiq), price: 15_00 },
             ]);
 
@@ -812,7 +812,7 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
 
             expect(response.body.byCategory.map(g => ({ name: g.name.toString(), price: g.price }))).toEqual([
                 { name: 'Kapoenen', price: 14_6652 },
-                { name: $t('Afronding'), price: 48 },
+                { name: $t('%1b6'), price: 48 },
             ]);
 
             // Everything the payment is worth is accounted for
@@ -870,12 +870,12 @@ describe('Endpoint.GetPaymentBreakdownEndpoint', () => {
 
             expect(response.status).toBe(200);
             expect(response.body.bySettlement.map(g => ({ name: g.name.toString(), price: g.price }))).toEqual([
-                { name: $t('Niet online betaald'), price: 40_00 },
+                { name: $t('%ZjN'), price: 40_00 },
                 { name: PaymentMethodHelper.getNameCapitalized(PaymentMethod.AccountDeductions), price: 10_00 },
             ]);
 
             // Running the rows through the database keeps them apart
-            for (const [name, price] of [[$t('Niet online betaald'), 40_00], [PaymentMethodHelper.getNameCapitalized(PaymentMethod.AccountDeductions), 10_00]] as [string, number][]) {
+            for (const [name, price] of [[$t('%ZjN'), 40_00], [PaymentMethodHelper.getNameCapitalized(PaymentMethod.AccountDeductions), 10_00]] as [string, number][]) {
                 const row = response.body.bySettlement.find(g => g.name.toString() === name)!;
                 const exported = await getBreakdown({ organization, user, filter: row.selection!.listFilter });
                 expect(exported.body.price).toBe(price);