@stamhoofd/backend 2.141.0 → 2.142.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.141.0",
+    "version": "2.142.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -65,20 +65,20 @@
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
         "@simplewebauthn/server": "13.3.2",
-        "@stamhoofd/backend-env": "2.141.0",
-        "@stamhoofd/backend-i18n": "2.141.0",
-        "@stamhoofd/backend-middleware": "2.141.0",
-        "@stamhoofd/crons": "2.141.0",
-        "@stamhoofd/email": "2.141.0",
-        "@stamhoofd/excel-writer": "2.141.0",
-        "@stamhoofd/logging": "2.141.0",
-        "@stamhoofd/models": "2.141.0",
-        "@stamhoofd/object-differ": "2.141.0",
-        "@stamhoofd/queues": "2.141.0",
-        "@stamhoofd/sql": "2.141.0",
-        "@stamhoofd/structures": "2.141.0",
-        "@stamhoofd/types": "2.141.0",
-        "@stamhoofd/utility": "2.141.0",
+        "@stamhoofd/backend-env": "2.142.0",
+        "@stamhoofd/backend-i18n": "2.142.0",
+        "@stamhoofd/backend-middleware": "2.142.0",
+        "@stamhoofd/crons": "2.142.0",
+        "@stamhoofd/email": "2.142.0",
+        "@stamhoofd/excel-writer": "2.142.0",
+        "@stamhoofd/logging": "2.142.0",
+        "@stamhoofd/models": "2.142.0",
+        "@stamhoofd/object-differ": "2.142.0",
+        "@stamhoofd/queues": "2.142.0",
+        "@stamhoofd/sql": "2.142.0",
+        "@stamhoofd/structures": "2.142.0",
+        "@stamhoofd/types": "2.142.0",
+        "@stamhoofd/utility": "2.142.0",
         "archiver": "7.0.1",
         "argon2": "0.44.0",
         "axios": "1.18.1",
@@ -102,7 +102,7 @@
         "uuid": "14.0.1"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.141.0",
+        "@stamhoofd/test-utils": "2.142.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.2",
         "@types/mailparser": "3.4.6",
@@ -117,5 +117,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "cf38053fe1507022767148347f436100a7ef07ed"
+    "gitHead": "2903821fe8196e3bb194da193aaf1cda2c3bf076"
 }

package/src/crons/settlement-sync.ts

@@ -96,7 +96,7 @@ export async function reportProblemSettlements() {
     const total = new Set([...unexplained, ...unsynced, ...stalePendingFees].map(s => s.id)).size;
 
     const describe = (settlement: Settlement) => {
-        return settlement.provider + ' ' + settlement.externalId + ' (' + Formatter.dateIso(settlement.settledAt) + ', ' + Formatter.price(settlement.unexplainedAmount) + ' onverklaard, ' + Formatter.price(settlement.pendingFees) + ' niet-gefactureerde kosten, ' + settlement.syncFailureCount + ' mislukte pogingen)';
+        return settlement.provider + ' ' + settlement.externalId + ' (' + Formatter.dateIso(settlement.settledAt) + ', ' + Formatter.price(settlement.unexplainedAmount) + ' onverklaard, ' + Formatter.price(settlement.pendingFees) + ' niet-gefactureerde kosten, ' + Formatter.price(settlement.uncollectibleFees) + ' niet-aanrekenbare kosten, ' + settlement.syncFailureCount + ' mislukte pogingen)';
     };
 
     Email.sendWebmaster({

package/src/endpoints/admin/organizations/PatchOrganizationsEndpoint.test.ts

@@ -0,0 +1,165 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { BalanceItemFactory, Invoice, Organization, OrganizationFactory, Payment } from '@stamhoofd/models';
+import { ApplicationFee } from '@stamhoofd/models/models/ApplicationFee.js';
+import { SettlementCharge } from '@stamhoofd/models/models/SettlementCharge.js';
+import { PatchableArray } from '@simonbackx/simple-encoding';
+import type { PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
+import type { Organization as OrganizationStruct } from '@stamhoofd/structures';
+import { PaymentMethod, PaymentStatus } from '@stamhoofd/structures';
+import { ApplicationFeeType } from '@stamhoofd/structures/settlements/ApplicationFeeType.js';
+import { SettlementChargeType } from '@stamhoofd/structures/settlements/SettlementChargeType.js';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
+import { v4 as uuidv4 } from 'uuid';
+import { testServer } from '../../../../tests/helpers/TestServer.js';
+import { initPlatformAdmin } from '../../../../tests/init/index.js';
+import { initMembershipOrganization } from '../../../../tests/init/initMembershipOrganization.js';
+import { PatchOrganizationsEndpoint } from './PatchOrganizationsEndpoint.js';
+
+const baseUrl = `/admin/organizations`;
+const endpoint = new PatchOrganizationsEndpoint();
+
+describe('Endpoint.PatchOrganizationsEndpoint', () => {
+    let membershipOrganization: Organization;
+
+    beforeEach(async () => {
+        TestUtils.setEnvironment('userMode', 'organization');
+    });
+
+    beforeAll(async () => {
+        membershipOrganization = await initMembershipOrganization();
+    });
+
+    const deleteOrganization = async (organization: Organization) => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const patch: PatchableArrayAutoEncoder<OrganizationStruct> = new PatchableArray();
+        patch.addDelete(organization.id);
+
+        // Platform admins are not scoped to an organization, so no host is required
+        const request = Request.patch({
+            path: baseUrl,
+            host: '',
+            body: patch,
+            headers: {
+                authorization: 'Bearer ' + adminToken.accessToken,
+            },
+        });
+
+        return await testServer.test(endpoint, request);
+    };
+
+    const createPayment = async ({ payingOrganizationId }: { payingOrganizationId: string | null }) => {
+        const payment = new Payment();
+        payment.organizationId = membershipOrganization.id;
+        payment.payingOrganizationId = payingOrganizationId;
+        payment.method = PaymentMethod.Transfer;
+        payment.status = PaymentStatus.Succeeded;
+        payment.price = 10_00;
+        await payment.save();
+        return payment;
+    };
+
+    const createApplicationFee = async ({ payingOrganizationId }: { payingOrganizationId: string }) => {
+        const charge = new SettlementCharge();
+        charge.type = SettlementChargeType.ApplicationFeeService;
+        charge.externalId = uuidv4();
+        charge.amount = -30_00;
+        charge.organizationId = payingOrganizationId;
+        charge.occurredAt = new Date();
+        await charge.save();
+
+        const fee = new ApplicationFee();
+        fee.externalId = uuidv4();
+        fee.type = ApplicationFeeType.Service;
+        fee.amount = 30_00;
+        fee.organizationId = membershipOrganization.id;
+        fee.payingOrganizationId = payingOrganizationId;
+        fee.settlementChargeId = charge.id;
+        fee.occurredAt = new Date();
+        await fee.save();
+        return fee;
+    };
+
+    const createInvoice = async ({ payingOrganizationId }: { payingOrganizationId: string | null }) => {
+        const invoice = new Invoice();
+        invoice.organizationId = membershipOrganization.id;
+        invoice.payingOrganizationId = payingOrganizationId;
+        await invoice.save();
+        return invoice;
+    };
+
+    test('An organization without financial records can be deleted', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const response = await deleteOrganization(organization);
+
+        expect(response.status).toBe(200);
+        expect(await Organization.getByID(organization.id)).toBeUndefined();
+    });
+
+    const payerRecords = [
+        {
+            name: 'a balance item it owes',
+            create: async (organization: Organization) => {
+                await new BalanceItemFactory({
+                    organizationId: membershipOrganization.id,
+                    payingOrganizationId: organization.id,
+                    amount: 1,
+                    unitPrice: 10_00,
+                }).create();
+            },
+        },
+        {
+            name: 'a payment it made',
+            create: async (organization: Organization) => {
+                await createPayment({ payingOrganizationId: organization.id });
+            },
+        },
+        {
+            name: 'an application fee it was charged',
+            create: async (organization: Organization) => {
+                await createApplicationFee({ payingOrganizationId: organization.id });
+            },
+        },
+        {
+            name: 'an invoice it has to pay',
+            create: async (organization: Organization) => {
+                await createInvoice({ payingOrganizationId: organization.id });
+            },
+        },
+    ];
+
+    test.each(payerRecords)('An organization with $name cannot be deleted', async ({ create }) => {
+        const organization = await new OrganizationFactory({}).create();
+        await create(organization);
+
+        await expect(deleteOrganization(organization)).rejects.toThrow(STExpect.errorWithCode('organization_has_financial_records'));
+        expect(await Organization.getByID(organization.id)).toBeDefined();
+    });
+
+    test('Financial records the organization received do not block the delete', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        await new BalanceItemFactory({
+            organizationId: organization.id,
+            amount: 1,
+            unitPrice: 10_00,
+        }).create();
+
+        const payment = new Payment();
+        payment.organizationId = organization.id;
+        payment.method = PaymentMethod.Transfer;
+        payment.status = PaymentStatus.Succeeded;
+        payment.price = 10_00;
+        await payment.save();
+
+        const invoice = new Invoice();
+        invoice.organizationId = organization.id;
+        await invoice.save();
+
+        const response = await deleteOrganization(organization);
+
+        expect(response.status).toBe(200);
+        expect(await Organization.getByID(organization.id)).toBeUndefined();
+    });
+});

package/src/endpoints/admin/organizations/PatchOrganizationsEndpoint.ts

@@ -3,7 +3,8 @@ import { PatchableArrayDecoder, StringDecoder } from '@simonbackx/simple-encodin
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { Organization, OrganizationRegistrationPeriod, Platform, RegistrationPeriod } from '@stamhoofd/models';
+import { BalanceItem, Invoice, Organization, OrganizationRegistrationPeriod, Payment, Platform, RegistrationPeriod } from '@stamhoofd/models';
+import { ApplicationFee } from '@stamhoofd/models/models/ApplicationFee.js';
 import { Organization as OrganizationStruct } from '@stamhoofd/structures';
 
 import { Formatter } from '@stamhoofd/utility';
@@ -61,6 +62,22 @@ export class PatchOrganizationsEndpoint extends Endpoint<Params, Query, Body, Re
                 });
             }
 
+            // Financial records may not disappear together with the organization that had to pay them
+            const payerRecordCounts = await Promise.all([
+                BalanceItem.select().where('payingOrganizationId', id).count(),
+                Payment.select().where('payingOrganizationId', id).count(),
+                ApplicationFee.select().where('payingOrganizationId', id).count(),
+                Invoice.select().where('payingOrganizationId', id).count(),
+            ]);
+
+            if (payerRecordCounts.some(count => count > 0)) {
+                throw new SimpleError({
+                    code: 'organization_has_financial_records',
+                    message: 'Organization is still referenced as paying organization',
+                    human: $t('Er zijn nog openstaande bedragen, betalingen, transactiekosten of facturen waarvoor {organization} moet betalen of betaald heeft. Die gegevens mogen niet verloren gaan.', { organization: organization.name }),
+                });
+            }
+
             await organization.delete();
         }
 

package/src/endpoints/global/registration-invitations/PatchRegistrationInvitationsEndpoint.test.ts

@@ -2,17 +2,18 @@ import type { PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { PatchableArray } from '@simonbackx/simple-encoding';
 import { Request } from '@simonbackx/simple-endpoints';
 import type { Organization, User } from '@stamhoofd/models';
-import { GroupFactory, MemberFactory, OrganizationFactory, RegistrationFactory, RegistrationInvitationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { GroupFactory, MemberFactory, OrganizationFactory, RegistrationFactory, RegistrationInvitation, RegistrationInvitationFactory, Token, UserFactory } from '@stamhoofd/models';
 import type { RegistrationInvitation as RegistrationInvitationStruct } from '@stamhoofd/structures';
-import { PermissionLevel, Permissions, PermissionsResourceType, RegistrationInvitationRequest, ResourcePermissions, TranslatedString } from '@stamhoofd/structures';
+import { GroupType, PermissionLevel, Permissions, PermissionsResourceType, RegistrationInvitationRequest, ResourcePermissions, TranslatedString } from '@stamhoofd/structures';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { PatchRegistrationInvitationsEndpoint } from './PatchRegistrationInvitationsEndpoint.js';
 
 describe('Endpoint.PatchRegistrationInvitationsEndpoint', () => {
     const endpoint = new PatchRegistrationInvitationsEndpoint();
 
-    const patchInvitations = async ({ patch, organization, user }: { patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest>; organization: Organization; user: User | null }) => {
-        const request = Request.buildJson('PATCH', '/registration-invitations', organization.getApiHost(), patch);
+    const patchInvitations = async ({ patch, organization, user }: { patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest>; organization: Organization | null; user: User | null }) => {
+        const request = Request.buildJson('PATCH', '/registration-invitations', organization?.getApiHost(), patch);
         if (user) {
             const token = await Token.createToken(user);
             request.headers.authorization = 'Bearer ' + token.accessToken;
@@ -401,4 +402,153 @@ describe('Endpoint.PatchRegistrationInvitationsEndpoint', () => {
             })).rejects.toThrow('Je hebt geen toegangsrechten om deze uitnodiging te verwijderen.');
         });
     });
+
+    describe('Without organization scope (platform admins)', () => {
+        beforeEach(() => {
+            TestUtils.setEnvironment('userMode', 'platform');
+        });
+
+        test('A platform admin can invite for an event group', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const group = await new GroupFactory({ organization, type: GroupType.EventRegistration, name: new TranslatedString('test event') }).create();
+
+            const admin = await new UserFactory({
+                globalPermissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addPut(RegistrationInvitationRequest.create({
+                groupId: group.id,
+                memberId: member.id,
+            }));
+
+            const response = await patchInvitations({
+                patch,
+                organization: null,
+                user: admin,
+            });
+
+            expect(response.body).toHaveLength(1);
+            expect(response.body[0].group.id).toBe(group.id);
+            expect(response.body[0].member.id).toBe(member.id);
+
+            // The invitation belongs to the organization of the group
+            const invitation = await RegistrationInvitation.getByID(response.body[0].id);
+            expect(invitation?.organizationId).toBe(organization.id);
+        });
+
+        test('Should fail for a user without platform access', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const group = await new GroupFactory({ organization, type: GroupType.EventRegistration, name: new TranslatedString('test event') }).create();
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addPut(RegistrationInvitationRequest.create({
+                groupId: group.id,
+                memberId: member.id,
+            }));
+
+            await expect(patchInvitations({
+                patch,
+                organization: null,
+                user,
+            })).rejects.toThrow(STExpect.simpleError({ code: 'permission_denied' }));
+        });
+
+        test('Should fail for a platform admin without access to the group', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const group = await new GroupFactory({ organization, type: GroupType.EventRegistration, name: new TranslatedString('test event') }).create();
+
+            // Some platform access (passes the fast throw), but no rights on this group or its organization
+            const admin = await new UserFactory({
+                globalPermissions: Permissions.create({
+                    level: PermissionLevel.None,
+                    resources: new Map([
+                        [PermissionsResourceType.OrganizationTags, new Map([
+                            ['unrelated-tag-id', ResourcePermissions.create({
+                                level: PermissionLevel.Read,
+                            })],
+                        ])],
+                    ]),
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addPut(RegistrationInvitationRequest.create({
+                groupId: group.id,
+                memberId: member.id,
+            }));
+
+            await expect(patchInvitations({
+                patch,
+                organization: null,
+                user: admin,
+            })).rejects.toThrow(STExpect.simpleError({ code: 'permission_denied' }));
+        });
+
+        test('A platform admin can delete an invitation', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const group = await new GroupFactory({ organization, type: GroupType.EventRegistration, name: new TranslatedString('test event') }).create();
+
+            const admin = await new UserFactory({
+                globalPermissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const invitation = await new RegistrationInvitationFactory({ member, group, organization }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addDelete(invitation.id);
+
+            const response = await patchInvitations({
+                patch,
+                organization: null,
+                user: admin,
+            });
+
+            expect(response.body).toHaveLength(0);
+            expect(await RegistrationInvitation.getByID(invitation.id)).toBeUndefined();
+        });
+    });
 });

package/src/endpoints/global/registration-invitations/PatchRegistrationInvitationsEndpoint.ts

@@ -35,11 +35,15 @@ export class PatchRegistrationInvitationsEndpoint extends Endpoint<Params, Query
     }
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
-        const organization = await Context.setOrganizationScope();
+        const organization = await Context.setOptionalOrganizationScope();
         await Context.authenticate();
 
         // Fast throw first (more in depth checking for patches later)
-        if (!await Context.auth.hasSomeAccess(organization.id)) {
+        if (organization) {
+            if (!await Context.auth.hasSomeAccess(organization.id)) {
+                throw Context.auth.error();
+            }
+        } else if (!Context.auth.hasSomePlatformAccess()) {
             throw Context.auth.error();
         }
 
@@ -48,11 +52,11 @@ export class PatchRegistrationInvitationsEndpoint extends Endpoint<Params, Query
 
         const puts = request.body.getPuts();
         for (const { put } of puts) {
-            await this.checkCanCreateRegistrationInvitation(put, organization.id);
+            const group = await this.checkCanCreateRegistrationInvitation(put, organization?.id ?? null);
 
             const invitation = new RegistrationInvitation();
             invitation.id = put.id;
-            invitation.organizationId = organization.id;
+            invitation.organizationId = group.organizationId;
             invitation.groupId = put.groupId;
             invitation.memberId = put.memberId;
 
@@ -125,12 +129,13 @@ export class PatchRegistrationInvitationsEndpoint extends Endpoint<Params, Query
     /**
      * Will throw if not allowed to invite.
      * @param invitation
-     * @param organizationId id of organization to invite for, should match the organizationId in the invitation
+     * @param organizationId organization scope of the request; when set, the group must belong to it (platform admins can invite without a scope)
+     * @returns the group to invite for
      */
-    private async checkCanCreateRegistrationInvitation(invitation: RegistrationInvitationRequest, organizationId: string) {
+    private async checkCanCreateRegistrationInvitation(invitation: RegistrationInvitationRequest, organizationId: string | null): Promise<Group> {
         const group = await Group.getByID(invitation.groupId);
 
-        if (!group || group.organizationId !== organizationId || !await Context.auth.canAccessGroup(group, PermissionLevel.Write)) {
+        if (!group || (organizationId !== null && group.organizationId !== organizationId) || !await Context.auth.canAccessGroup(group, PermissionLevel.Write)) {
             throw Context.auth.error($t(`%1ST`));
         }
 
@@ -147,7 +152,7 @@ export class PatchRegistrationInvitationsEndpoint extends Endpoint<Params, Query
 
         if (!member
             // in userMode 'organization' we can only invite members from the same organization
-            || (STAMHOOFD.userMode === 'organization' && member.organizationId !== organizationId)
+            || (STAMHOOFD.userMode === 'organization' && member.organizationId !== group.organizationId)
             // read access is suficient
             || !await Context.auth.canAccessMember(member, PermissionLevel.Read)
         ) {
@@ -163,5 +168,7 @@ export class PatchRegistrationInvitationsEndpoint extends Endpoint<Params, Query
                 human: $t('%1S2'),
             });
         }
+
+        return group;
     }
 }

package/src/helpers/ApplicationFeeInvoicer.test.ts

@@ -1,3 +1,4 @@
+import { EmailMocker } from '@stamhoofd/email';
 import type { StripeAccount } from '@stamhoofd/models';
 import { BalanceItem, BalanceItemPayment, Organization, OrganizationFactory, Payment } from '@stamhoofd/models';
 import { ApplicationFee } from '@stamhoofd/models/models/ApplicationFee.js';
@@ -15,6 +16,7 @@ import { initMembershipOrganization } from '../../tests/init/initMembershipOrgan
 import { ApplicationFeeService, LEGACY_FEE_PAYMENT_REFERENCE_PREFIX } from '../services/ApplicationFeeService.js';
 import { SettlementService } from '../services/SettlementService.js';
 import { ApplicationFeeInvoicer } from './ApplicationFeeInvoicer.js';
+import { WebmasterReport } from './WebmasterReport.js';
 
 describe('ApplicationFeeInvoicer', () => {
     const stripeMocker = new StripeMocker();
@@ -262,8 +264,18 @@ describe('ApplicationFeeInvoicer', () => {
         await createFee(organization, stripeAccount, { amount: 30_00 });
         await createFee(organization, broken, { amount: 40_00 });
 
-        // Deleting the account clears payingStripeAccountId: that group can't be billed anymore
-        await broken.delete();
+        // A month the legacy invoicer billed may never be billed again: that group throws
+        const legacy = new Payment();
+        legacy.organizationId = membershipOrganization.id;
+        legacy.payingOrganizationId = organization.id;
+        legacy.stripeAccountId = broken.id;
+        legacy.method = PaymentMethod.AccountDeductions;
+        legacy.provider = PaymentProvider.Stripe;
+        legacy.status = PaymentStatus.Succeeded;
+        legacy.reference = LEGACY_FEE_PAYMENT_REFERENCE_PREFIX + '2024-07-01';
+        legacy.price = 40_00;
+        legacy.paidAt = occurredAt;
+        await legacy.save();
 
         await invoiceMonth();
 
@@ -272,14 +284,63 @@ describe('ApplicationFeeInvoicer', () => {
         expect(payments[0].price).toBe(30_00);
     });
 
+    test('fees without the Stripe account they were deducted from are skipped, not retried forever', async () => {
+        const { organization, stripeAccount } = await init();
+        const removed = await stripeMocker.createStripeAccount(organization.id);
+
+        await createFee(organization, stripeAccount, { amount: 30_00 });
+        const orphaned = await createFee(organization, removed, { amount: 40_00 });
+
+        // Deleting the account row clears payingStripeAccountId: that fee can no longer be checked
+        // against what the legacy invoicer billed per account, so it is not billed at all
+        await removed.delete();
+
+        await WebmasterReport.group('Overslaan applicatiekosten', async () => {
+            await invoiceMonth();
+        });
+
+        const payments = await getFeePayments(organization);
+        expect(payments).toHaveLength(1);
+        expect(payments[0].price).toBe(30_00);
+        expect((await ApplicationFee.getByID(orphaned.id))!.balanceItemId).toBeNull();
+
+        // Skipping is silent here: the sync that stored the fee already reported it, and this run
+        // repeats every night
+        const emails = (await EmailMocker.transactional.getSucceededEmails()).filter(e => e.subject.startsWith('Overslaan applicatiekosten'));
+        expect(emails).toHaveLength(0);
+    });
+
     test('charges of a billed fee keep pointing at the deduction row', async () => {
         const { organization, stripeAccount } = await init();
         const fee = await createFee(organization, stripeAccount);
 
         await invoiceMonth();
 
-        const charge = await SettlementCharge.getByID(fee.settlementChargeId);
+        const charge = await SettlementCharge.getByID(fee.settlementChargeId!);
         expect(charge).toBeDefined();
         expect(charge!.amount).toBe(-30_00);
     });
+
+    test('fees of a deleted organization are never billed, and do not block the other accounts', async () => {
+        const { organization, stripeAccount } = await init();
+        const { organization: other, stripeAccount: otherAccount } = await init();
+
+        const orphaned = await createFee(organization, stripeAccount, { amount: 30_00 });
+        await createFee(other, otherAccount, { amount: 40_00 });
+
+        // Takes the Stripe account and the deduction charge with it, but not our income
+        await organization.delete();
+
+        await invoiceMonth();
+
+        const payments = await getFeePayments(other);
+        expect(payments).toHaveLength(1);
+        expect(payments[0].price).toBe(40_00);
+
+        const stored = await ApplicationFee.getByID(orphaned.id);
+        expect(stored).toBeDefined();
+        expect(stored!.payingOrganizationId).toBeNull();
+        expect(stored!.settlementChargeId).toBeNull();
+        expect(stored!.balanceItemId).toBeNull();
+    });
 });