@stamhoofd/backend 2.141.0 → 2.143.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.141.0",
+    "version": "2.143.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -65,20 +65,20 @@
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
         "@simplewebauthn/server": "13.3.2",
-        "@stamhoofd/backend-env": "2.141.0",
-        "@stamhoofd/backend-i18n": "2.141.0",
-        "@stamhoofd/backend-middleware": "2.141.0",
-        "@stamhoofd/crons": "2.141.0",
-        "@stamhoofd/email": "2.141.0",
-        "@stamhoofd/excel-writer": "2.141.0",
-        "@stamhoofd/logging": "2.141.0",
-        "@stamhoofd/models": "2.141.0",
-        "@stamhoofd/object-differ": "2.141.0",
-        "@stamhoofd/queues": "2.141.0",
-        "@stamhoofd/sql": "2.141.0",
-        "@stamhoofd/structures": "2.141.0",
-        "@stamhoofd/types": "2.141.0",
-        "@stamhoofd/utility": "2.141.0",
+        "@stamhoofd/backend-env": "2.143.0",
+        "@stamhoofd/backend-i18n": "2.143.0",
+        "@stamhoofd/backend-middleware": "2.143.0",
+        "@stamhoofd/crons": "2.143.0",
+        "@stamhoofd/email": "2.143.0",
+        "@stamhoofd/excel-writer": "2.143.0",
+        "@stamhoofd/logging": "2.143.0",
+        "@stamhoofd/models": "2.143.0",
+        "@stamhoofd/object-differ": "2.143.0",
+        "@stamhoofd/queues": "2.143.0",
+        "@stamhoofd/sql": "2.143.0",
+        "@stamhoofd/structures": "2.143.0",
+        "@stamhoofd/types": "2.143.0",
+        "@stamhoofd/utility": "2.143.0",
         "archiver": "7.0.1",
         "argon2": "0.44.0",
         "axios": "1.18.1",
@@ -102,7 +102,7 @@
         "uuid": "14.0.1"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.141.0",
+        "@stamhoofd/test-utils": "2.143.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.2",
         "@types/mailparser": "3.4.6",
@@ -117,5 +117,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "cf38053fe1507022767148347f436100a7ef07ed"
+    "gitHead": "8959c4f720d332be9769e033d40bb25f9e6aa322"
 }

package/src/boot.ts

@@ -16,6 +16,7 @@ import { Platform } from '@stamhoofd/models';
 import { QueueHandler } from '@stamhoofd/queues';
 import { resumeEmails } from './helpers/EmailResumer.js';
 import { GlobalHelper } from './helpers/GlobalHelper.js';
+import { waitUntilDeadline } from './helpers/waitUntilDeadline.js';
 import { SetupStepUpdater } from './helpers/SetupStepUpdater.js';
 import { ContextMiddleware } from './middleware/ContextMiddleware.js';
 import { TenantScopeMiddleware } from './middleware/TenantScopeMiddleware.js';
@@ -29,6 +30,7 @@ import { UitpasService } from './services/uitpas/UitpasService.js';
 import { UniqueMemberNumberService } from './services/UniqueMemberNumberService.js';
 import { UniqueUserService } from './services/UniqueUserService.js';
 import { QueryableModel, SQLLogger } from '@stamhoofd/sql';
+import { WebshopCrowdfundingService } from './services/WebshopCrowdfundingService.js';
 
 process.on('unhandledRejection', (error: Error) => {
     console.error('unhandledRejection');
@@ -51,6 +53,13 @@ if (new Date().getTimezoneOffset() !== 0) {
     throw new Error('Process should always run in UTC timezone');
 }
 
+/**
+ * How long a shutdown waits for the running crons, queue jobs and emails together. Aborting them is
+ * a request: a job that never checks it, or that hangs on a network call, may not keep the restart
+ * waiting. Everything left behind runs again after the restart.
+ */
+const MAXIMUM_SHUTDOWN_WAIT = 29 * 1000;
+
 const seeds = async (options: { shutdown: () => Promise<void> }) => {
     if (await checkReadOnly()) {
         console.error(new StyledText(`[SEEDS] `).addClass('migration', 'tag'), new StyledText('MySQL is in read-only mode: Seeds are disabled.').addClass('error'));
@@ -210,13 +219,15 @@ export const boot = async (options: { killProcess: boolean }) => {
         if (shuttingDown) {
             return;
         }
+        const deadline = new Date(Date.now() + MAXIMUM_SHUTDOWN_WAIT);
+
         shuttingDown = true;
         QueryableModel.shutdownMigrations = true;
         productionLog('Shutting down...');
         // Disable keep alive
         routerServer.defaultHeaders = Object.assign(routerServer.defaultHeaders, { Connection: 'close' });
         if (routerServer.server) {
-            routerServer.server.headersTimeout = 5000;
+            routerServer.server.headersTimeout = 1000;
             routerServer.server.keepAliveTimeout = 1;
         }
 
@@ -236,27 +247,31 @@ export const boot = async (options: { killProcess: boolean }) => {
             console.error('Failed to stop HTTP server:');
             console.error(err);
         }
+        const shutdownError = new SimpleError({
+            code: 'SHUTDOWN',
+            message: 'Shutting down',
+            statusCode: 503,
+        });
+        QueueHandler.abortAll(shutdownError);
 
-        await BalanceItemService.flushAll();
-        await waitForCrons();
-        QueueHandler.abortAll(
-            new SimpleError({
-                code: 'SHUTDOWN',
-                message: 'Shutting down',
-                statusCode: 503,
-            }),
-        );
-        await QueueHandler.awaitAll();
+        await Promise.allSettled([
+            BalanceItemService.flushAll(),
+            WebshopCrowdfundingService.flush(),
+            waitUntilDeadline(waitForCrons(), { deadline, description: 'crons' }),
+            waitUntilDeadline(QueueHandler.awaitAll(), { deadline, description: 'queues' }),
+        ]);
 
-        try {
+        // Any last queues started in above jobs
+        QueueHandler.abortAll(shutdownError);
+        await waitUntilDeadline(QueueHandler.awaitAll(), { deadline, description: 'queues' });
+
+        // Wait for emails
+        await waitUntilDeadline((async () => {
             while (Email.currentQueue.length > 0) {
                 console.log(`${Email.currentQueue.length} emails still in queue. Waiting 500ms...`);
                 await sleep(500);
             }
-        } catch (err) {
-            console.error('Failed to wait for emails to finish:');
-            console.error(err);
-        }
+        })(), { deadline, description: 'emails' });
 
         try {
             await Database.end();

package/src/crons/settlement-sync.test.ts

@@ -1,11 +1,15 @@
 import { EmailMocker } from '@stamhoofd/email';
 import type { Organization } from '@stamhoofd/models';
 import { OrganizationFactory } from '@stamhoofd/models';
+import { QueueHandler } from '@stamhoofd/queues';
 import { PaymentProvider } from '@stamhoofd/structures';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { v4 as uuidv4 } from 'uuid';
+import { vi } from 'vitest';
 
+import { SettlementSyncRunner } from '../helpers/SettlementSyncRunner.js';
 import { SettlementService } from '../services/SettlementService.js';
-import { reportProblemSettlements } from './settlement-sync.js';
+import { reportProblemSettlements, syncSettlements } from './settlement-sync.js';
 
 describe('Cron.settlement-sync', () => {
     let organization: Organization;
@@ -36,4 +40,58 @@ describe('Cron.settlement-sync', () => {
         const emails = await EmailMocker.transactional.getSucceededEmails();
         expect(emails.find(e => e.subject.startsWith('Uitbetalingen met problemen'))).toBeDefined();
     });
+
+    describe('The nightly run', () => {
+        /**
+         * The run only starts between 5 and 6 AM Brussels time, and remembers the day it ran: every
+         * test needs its own day.
+         */
+        const arriveAt5AM = (dayOfMarch: number) => {
+            vi.setSystemTime(new Date(Date.UTC(2026, 2, dayOfMarch, 4, 30)));
+        };
+
+        beforeEach(() => {
+            TestUtils.setEnvironment('environment', 'production');
+            vi.useFakeTimers({ shouldAdvanceTime: true, toFake: ['Date'] });
+        });
+
+        afterEach(() => {
+            vi.useRealTimers();
+            vi.restoreAllMocks();
+        });
+
+        test('runs on the same queue as the manual sync, and only once a day', async () => {
+            arriveAt5AM(10);
+
+            const runs: string[][] = [];
+            vi.spyOn(SettlementSyncRunner.prototype, 'run').mockImplementation(async () => {
+                // Nested in the queue of the manual sync, so the two never walk at once
+                runs.push(QueueHandler.asyncLocalStorage.getStore() ?? []);
+                return { feeMonths: 0, failedFeeMonths: 0, synced: 0, skipped: 0, failed: 0 };
+            });
+
+            await syncSettlements();
+            await syncSettlements();
+
+            expect(runs).toEqual([['settlement-sync']]);
+        });
+
+        test('an interrupted run is not remembered as the sync of this day', async () => {
+            arriveAt5AM(11);
+
+            const spy = vi.spyOn(SettlementSyncRunner.prototype, 'run').mockImplementation(async ({ abort } = {}) => {
+                abort?.abort();
+                abort?.throwIfAborted();
+                return { feeMonths: 0, failedFeeMonths: 0, synced: 0, skipped: 0, failed: 0 };
+            });
+
+            await expect(syncSettlements()).rejects.toThrow(STExpect.simpleError({ code: 'queue-aborted' }));
+
+            // A restart may not skip the sync of this day: the next tick starts over
+            spy.mockResolvedValue({ feeMonths: 0, failedFeeMonths: 0, synced: 0, skipped: 0, failed: 0 });
+            await syncSettlements();
+
+            expect(spy).toHaveBeenCalledTimes(2);
+        });
+    });
 });

package/src/crons/settlement-sync.ts

@@ -3,6 +3,7 @@
 import { registerCron } from '@stamhoofd/crons';
 import { Email } from '@stamhoofd/email';
 import { Settlement } from '@stamhoofd/models/models/Settlement.js';
+import { QueueHandler } from '@stamhoofd/queues';
 import { PaymentProvider } from '@stamhoofd/structures';
 import { SettlementStatus } from '@stamhoofd/structures/settlements/SettlementStatus.js';
 import { Formatter } from '@stamhoofd/utility';
@@ -25,7 +26,10 @@ const MAXIMUM_PENDING_FEES_AGE_MS = 31 * 24 * 60 * 60 * 1000;
 
 let lastSettlementSync: Date | null = null;
 
-async function syncSettlements() {
+/**
+ * Exported for tests only.
+ */
+export async function syncSettlements() {
     if (STAMHOOFD.environment !== 'production') {
         return;
     }
@@ -46,15 +50,22 @@ async function syncSettlements() {
 
     const start = new Date(today.getTime() - SYNC_WINDOW_DAYS * 24 * 60 * 60 * 1000);
 
-    const runner = new SettlementSyncRunner();
-    await runner.run({
-        start,
-        providers: [PaymentProvider.Stripe, PaymentProvider.Mollie],
-        stripe: { retryUnsynced: true },
+    // The same queue as the manual backfill: the two never walk the same period at once, and a
+    // shutdown aborts this run instead of waiting for the whole window. An aborted run throws, so
+    // it is not remembered as the sync of this day: a later tick within the hour runs it again,
+    // and otherwise the next day re-walks the same window anyway
+    await QueueHandler.schedule('settlement-sync', async ({ abort }) => {
+        const runner = new SettlementSyncRunner();
+        await runner.run({
+            start,
+            providers: [PaymentProvider.Stripe, PaymentProvider.Mollie],
+            stripe: { retryUnsynced: true },
+            abort,
+        });
+
+        await reportProblemSettlements();
     });
 
-    await reportProblemSettlements();
-
     lastSettlementSync = new Date();
 }
 
@@ -96,7 +107,7 @@ export async function reportProblemSettlements() {
     const total = new Set([...unexplained, ...unsynced, ...stalePendingFees].map(s => s.id)).size;
 
     const describe = (settlement: Settlement) => {
-        return settlement.provider + ' ' + settlement.externalId + ' (' + Formatter.dateIso(settlement.settledAt) + ', ' + Formatter.price(settlement.unexplainedAmount) + ' onverklaard, ' + Formatter.price(settlement.pendingFees) + ' niet-gefactureerde kosten, ' + settlement.syncFailureCount + ' mislukte pogingen)';
+        return settlement.provider + ' ' + settlement.externalId + ' (' + Formatter.dateIso(settlement.settledAt) + ', ' + Formatter.price(settlement.unexplainedAmount) + ' onverklaard, ' + Formatter.price(settlement.pendingFees) + ' niet-gefactureerde kosten, ' + Formatter.price(settlement.uncollectibleFees) + ' niet-aanrekenbare kosten, ' + settlement.syncFailureCount + ' mislukte pogingen)';
     };
 
     Email.sendWebmaster({

package/src/endpoints/admin/organizations/PatchOrganizationsEndpoint.test.ts

@@ -0,0 +1,165 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { BalanceItemFactory, Invoice, Organization, OrganizationFactory, Payment } from '@stamhoofd/models';
+import { ApplicationFee } from '@stamhoofd/models/models/ApplicationFee.js';
+import { SettlementCharge } from '@stamhoofd/models/models/SettlementCharge.js';
+import { PatchableArray } from '@simonbackx/simple-encoding';
+import type { PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
+import type { Organization as OrganizationStruct } from '@stamhoofd/structures';
+import { PaymentMethod, PaymentStatus } from '@stamhoofd/structures';
+import { ApplicationFeeType } from '@stamhoofd/structures/settlements/ApplicationFeeType.js';
+import { SettlementChargeType } from '@stamhoofd/structures/settlements/SettlementChargeType.js';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
+import { v4 as uuidv4 } from 'uuid';
+import { testServer } from '../../../../tests/helpers/TestServer.js';
+import { initPlatformAdmin } from '../../../../tests/init/index.js';
+import { initMembershipOrganization } from '../../../../tests/init/initMembershipOrganization.js';
+import { PatchOrganizationsEndpoint } from './PatchOrganizationsEndpoint.js';
+
+const baseUrl = `/admin/organizations`;
+const endpoint = new PatchOrganizationsEndpoint();
+
+describe('Endpoint.PatchOrganizationsEndpoint', () => {
+    let membershipOrganization: Organization;
+
+    beforeEach(async () => {
+        TestUtils.setEnvironment('userMode', 'organization');
+    });
+
+    beforeAll(async () => {
+        membershipOrganization = await initMembershipOrganization();
+    });
+
+    const deleteOrganization = async (organization: Organization) => {
+        const { adminToken } = await initPlatformAdmin();
+
+        const patch: PatchableArrayAutoEncoder<OrganizationStruct> = new PatchableArray();
+        patch.addDelete(organization.id);
+
+        // Platform admins are not scoped to an organization, so no host is required
+        const request = Request.patch({
+            path: baseUrl,
+            host: '',
+            body: patch,
+            headers: {
+                authorization: 'Bearer ' + adminToken.accessToken,
+            },
+        });
+
+        return await testServer.test(endpoint, request);
+    };
+
+    const createPayment = async ({ payingOrganizationId }: { payingOrganizationId: string | null }) => {
+        const payment = new Payment();
+        payment.organizationId = membershipOrganization.id;
+        payment.payingOrganizationId = payingOrganizationId;
+        payment.method = PaymentMethod.Transfer;
+        payment.status = PaymentStatus.Succeeded;
+        payment.price = 10_00;
+        await payment.save();
+        return payment;
+    };
+
+    const createApplicationFee = async ({ payingOrganizationId }: { payingOrganizationId: string }) => {
+        const charge = new SettlementCharge();
+        charge.type = SettlementChargeType.ApplicationFeeService;
+        charge.externalId = uuidv4();
+        charge.amount = -30_00;
+        charge.organizationId = payingOrganizationId;
+        charge.occurredAt = new Date();
+        await charge.save();
+
+        const fee = new ApplicationFee();
+        fee.externalId = uuidv4();
+        fee.type = ApplicationFeeType.Service;
+        fee.amount = 30_00;
+        fee.organizationId = membershipOrganization.id;
+        fee.payingOrganizationId = payingOrganizationId;
+        fee.settlementChargeId = charge.id;
+        fee.occurredAt = new Date();
+        await fee.save();
+        return fee;
+    };
+
+    const createInvoice = async ({ payingOrganizationId }: { payingOrganizationId: string | null }) => {
+        const invoice = new Invoice();
+        invoice.organizationId = membershipOrganization.id;
+        invoice.payingOrganizationId = payingOrganizationId;
+        await invoice.save();
+        return invoice;
+    };
+
+    test('An organization without financial records can be deleted', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const response = await deleteOrganization(organization);
+
+        expect(response.status).toBe(200);
+        expect(await Organization.getByID(organization.id)).toBeUndefined();
+    });
+
+    const payerRecords = [
+        {
+            name: 'a balance item it owes',
+            create: async (organization: Organization) => {
+                await new BalanceItemFactory({
+                    organizationId: membershipOrganization.id,
+                    payingOrganizationId: organization.id,
+                    amount: 1,
+                    unitPrice: 10_00,
+                }).create();
+            },
+        },
+        {
+            name: 'a payment it made',
+            create: async (organization: Organization) => {
+                await createPayment({ payingOrganizationId: organization.id });
+            },
+        },
+        {
+            name: 'an application fee it was charged',
+            create: async (organization: Organization) => {
+                await createApplicationFee({ payingOrganizationId: organization.id });
+            },
+        },
+        {
+            name: 'an invoice it has to pay',
+            create: async (organization: Organization) => {
+                await createInvoice({ payingOrganizationId: organization.id });
+            },
+        },
+    ];
+
+    test.each(payerRecords)('An organization with $name cannot be deleted', async ({ create }) => {
+        const organization = await new OrganizationFactory({}).create();
+        await create(organization);
+
+        await expect(deleteOrganization(organization)).rejects.toThrow(STExpect.errorWithCode('organization_has_financial_records'));
+        expect(await Organization.getByID(organization.id)).toBeDefined();
+    });
+
+    test('Financial records the organization received do not block the delete', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        await new BalanceItemFactory({
+            organizationId: organization.id,
+            amount: 1,
+            unitPrice: 10_00,
+        }).create();
+
+        const payment = new Payment();
+        payment.organizationId = organization.id;
+        payment.method = PaymentMethod.Transfer;
+        payment.status = PaymentStatus.Succeeded;
+        payment.price = 10_00;
+        await payment.save();
+
+        const invoice = new Invoice();
+        invoice.organizationId = organization.id;
+        await invoice.save();
+
+        const response = await deleteOrganization(organization);
+
+        expect(response.status).toBe(200);
+        expect(await Organization.getByID(organization.id)).toBeUndefined();
+    });
+});

package/src/endpoints/admin/organizations/PatchOrganizationsEndpoint.ts

@@ -3,7 +3,8 @@ import { PatchableArrayDecoder, StringDecoder } from '@simonbackx/simple-encodin
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { Organization, OrganizationRegistrationPeriod, Platform, RegistrationPeriod } from '@stamhoofd/models';
+import { BalanceItem, Invoice, Organization, OrganizationRegistrationPeriod, Payment, Platform, RegistrationPeriod } from '@stamhoofd/models';
+import { ApplicationFee } from '@stamhoofd/models/models/ApplicationFee.js';
 import { Organization as OrganizationStruct } from '@stamhoofd/structures';
 
 import { Formatter } from '@stamhoofd/utility';
@@ -61,6 +62,22 @@ export class PatchOrganizationsEndpoint extends Endpoint<Params, Query, Body, Re
                 });
             }
 
+            // Financial records may not disappear together with the organization that had to pay them
+            const payerRecordCounts = await Promise.all([
+                BalanceItem.select().where('payingOrganizationId', id).count(),
+                Payment.select().where('payingOrganizationId', id).count(),
+                ApplicationFee.select().where('payingOrganizationId', id).count(),
+                Invoice.select().where('payingOrganizationId', id).count(),
+            ]);
+
+            if (payerRecordCounts.some(count => count > 0)) {
+                throw new SimpleError({
+                    code: 'organization_has_financial_records',
+                    message: 'Organization is still referenced as paying organization',
+                    human: $t('%Zks', { organization: organization.name }),
+                });
+            }
+
             await organization.delete();
         }
 

package/src/endpoints/global/registration-invitations/PatchRegistrationInvitationsEndpoint.test.ts

@@ -2,17 +2,18 @@ import type { PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { PatchableArray } from '@simonbackx/simple-encoding';
 import { Request } from '@simonbackx/simple-endpoints';
 import type { Organization, User } from '@stamhoofd/models';
-import { GroupFactory, MemberFactory, OrganizationFactory, RegistrationFactory, RegistrationInvitationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { GroupFactory, MemberFactory, OrganizationFactory, RegistrationFactory, RegistrationInvitation, RegistrationInvitationFactory, Token, UserFactory } from '@stamhoofd/models';
 import type { RegistrationInvitation as RegistrationInvitationStruct } from '@stamhoofd/structures';
-import { PermissionLevel, Permissions, PermissionsResourceType, RegistrationInvitationRequest, ResourcePermissions, TranslatedString } from '@stamhoofd/structures';
+import { GroupType, PermissionLevel, Permissions, PermissionsResourceType, RegistrationInvitationRequest, ResourcePermissions, TranslatedString } from '@stamhoofd/structures';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { PatchRegistrationInvitationsEndpoint } from './PatchRegistrationInvitationsEndpoint.js';
 
 describe('Endpoint.PatchRegistrationInvitationsEndpoint', () => {
     const endpoint = new PatchRegistrationInvitationsEndpoint();
 
-    const patchInvitations = async ({ patch, organization, user }: { patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest>; organization: Organization; user: User | null }) => {
-        const request = Request.buildJson('PATCH', '/registration-invitations', organization.getApiHost(), patch);
+    const patchInvitations = async ({ patch, organization, user }: { patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest>; organization: Organization | null; user: User | null }) => {
+        const request = Request.buildJson('PATCH', '/registration-invitations', organization?.getApiHost(), patch);
         if (user) {
             const token = await Token.createToken(user);
             request.headers.authorization = 'Bearer ' + token.accessToken;
@@ -401,4 +402,153 @@ describe('Endpoint.PatchRegistrationInvitationsEndpoint', () => {
             })).rejects.toThrow('Je hebt geen toegangsrechten om deze uitnodiging te verwijderen.');
         });
     });
+
+    describe('Without organization scope (platform admins)', () => {
+        beforeEach(() => {
+            TestUtils.setEnvironment('userMode', 'platform');
+        });
+
+        test('A platform admin can invite for an event group', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const group = await new GroupFactory({ organization, type: GroupType.EventRegistration, name: new TranslatedString('test event') }).create();
+
+            const admin = await new UserFactory({
+                globalPermissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addPut(RegistrationInvitationRequest.create({
+                groupId: group.id,
+                memberId: member.id,
+            }));
+
+            const response = await patchInvitations({
+                patch,
+                organization: null,
+                user: admin,
+            });
+
+            expect(response.body).toHaveLength(1);
+            expect(response.body[0].group.id).toBe(group.id);
+            expect(response.body[0].member.id).toBe(member.id);
+
+            // The invitation belongs to the organization of the group
+            const invitation = await RegistrationInvitation.getByID(response.body[0].id);
+            expect(invitation?.organizationId).toBe(organization.id);
+        });
+
+        test('Should fail for a user without platform access', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const group = await new GroupFactory({ organization, type: GroupType.EventRegistration, name: new TranslatedString('test event') }).create();
+
+            const user = await new UserFactory({
+                organization,
+                permissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addPut(RegistrationInvitationRequest.create({
+                groupId: group.id,
+                memberId: member.id,
+            }));
+
+            await expect(patchInvitations({
+                patch,
+                organization: null,
+                user,
+            })).rejects.toThrow(STExpect.simpleError({ code: 'permission_denied' }));
+        });
+
+        test('Should fail for a platform admin without access to the group', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const group = await new GroupFactory({ organization, type: GroupType.EventRegistration, name: new TranslatedString('test event') }).create();
+
+            // Some platform access (passes the fast throw), but no rights on this group or its organization
+            const admin = await new UserFactory({
+                globalPermissions: Permissions.create({
+                    level: PermissionLevel.None,
+                    resources: new Map([
+                        [PermissionsResourceType.OrganizationTags, new Map([
+                            ['unrelated-tag-id', ResourcePermissions.create({
+                                level: PermissionLevel.Read,
+                            })],
+                        ])],
+                    ]),
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addPut(RegistrationInvitationRequest.create({
+                groupId: group.id,
+                memberId: member.id,
+            }));
+
+            await expect(patchInvitations({
+                patch,
+                organization: null,
+                user: admin,
+            })).rejects.toThrow(STExpect.simpleError({ code: 'permission_denied' }));
+        });
+
+        test('A platform admin can delete an invitation', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const group = await new GroupFactory({ organization, type: GroupType.EventRegistration, name: new TranslatedString('test event') }).create();
+
+            const admin = await new UserFactory({
+                globalPermissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }).create();
+
+            const member = await new MemberFactory({
+                organization,
+                firstName: 'John',
+                lastName: 'Doe',
+                birthDay: { year: 1994, month: 6, day: 24 },
+            }).create();
+
+            const invitation = await new RegistrationInvitationFactory({ member, group, organization }).create();
+
+            const patch: PatchableArrayAutoEncoder<RegistrationInvitationRequest> = new PatchableArray();
+
+            patch.addDelete(invitation.id);
+
+            const response = await patchInvitations({
+                patch,
+                organization: null,
+                user: admin,
+            });
+
+            expect(response.body).toHaveLength(0);
+            expect(await RegistrationInvitation.getByID(invitation.id)).toBeUndefined();
+        });
+    });
 });