@stamhoofd/backend 2.142.0 → 2.143.1

package/src/helpers/StripeSettlementSync.ts

@@ -4,6 +4,7 @@ import { ApplicationFee } from '@stamhoofd/models/models/ApplicationFee.js';
 import { PaymentSettlement } from '@stamhoofd/models/models/PaymentSettlement.js';
 import type { Settlement } from '@stamhoofd/models/models/Settlement.js';
 import type { SettlementCharge } from '@stamhoofd/models/models/SettlementCharge.js';
+import type { AbortSignal } from '@stamhoofd/queues';
 import { PaymentProvider, PaymentStatus } from '@stamhoofd/structures';
 import { ApplicationFeeType } from '@stamhoofd/structures/settlements/ApplicationFeeType.js';
 import { SettlementChargeType } from '@stamhoofd/structures/settlements/SettlementChargeType.js';
@@ -111,7 +112,7 @@ export class StripeSettlementSync {
      * Sync all paid payouts that arrived in the window. A failing payout is marked, reported and
      * skipped so the other payouts still sync; the summary tells the caller how bad it was.
      */
-    async syncPayouts({ start, end, force = false }: { start: Date; end?: Date; force?: boolean }): Promise<{ synced: number; skipped: number; failed: number }> {
+    async syncPayouts({ start, end, force = false, abort }: { start: Date; end?: Date; force?: boolean; abort?: AbortSignal }): Promise<{ synced: number; skipped: number; failed: number }> {
         const result = { synced: 0, skipped: 0, failed: 0 };
 
         // Fail once up front when no organization can own these payouts, instead of once per payout
@@ -127,14 +128,20 @@ export class StripeSettlementSync {
             },
             limit: 100,
         })) {
+            abort?.throwIfAborted();
+
             try {
-                const { skipped } = await this.syncPayout(payout, { force });
+                const { skipped } = await this.syncPayout(payout, { force, abort });
                 if (skipped) {
                     result.skipped += 1;
                 } else {
                     result.synced += 1;
                 }
             } catch (e) {
+                // An interrupted payout is not a failing payout: counting or reporting it would
+                // turn every restart into a wave of problems to look into
+                abort?.throwIfAborted();
+
                 console.error('Failed to sync Stripe payout ' + payout.id, e);
                 result.failed += 1;
 
@@ -150,7 +157,7 @@ export class StripeSettlementSync {
     /**
      * Re-sync one payout by its id, e.g. to retry a settlement that stayed unsynced.
      */
-    async syncPayoutById(externalId: string, options: { force?: boolean } = {}): Promise<{ settlement: Settlement; skipped: boolean }> {
+    async syncPayoutById(externalId: string, options: { force?: boolean; abort?: AbortSignal } = {}): Promise<{ settlement: Settlement; skipped: boolean }> {
         const payout = await this.stripe.payouts.retrieve(externalId);
         return await this.syncPayout(payout, options);
     }
@@ -161,7 +168,7 @@ export class StripeSettlementSync {
      * in the settlement links later. A broken fee doesn't block storing the others, but the walk
      * still fails loudly at the end: a month is only invoiced after a run without errors.
      */
-    async syncFees({ start, end }: { start: Date; end: Date }) {
+    async syncFees({ start, end, abort }: { start: Date; end: Date; abort?: AbortSignal }) {
         if (this.stripeAccount) {
             throw new SimpleError({
                 code: 'invalid_scope',
@@ -175,26 +182,35 @@ export class StripeSettlementSync {
         // billed). When it is already paid out, its payout needs the derived line for it
         const invoicedFeeBalanceItemIds = new Set<string>();
 
-        for await (const transaction of this.stripe.balanceTransactions.list({
-            type: 'application_fee',
-            created: {
-                gte: Math.floor(start.getTime() / 1000),
-                lte: Math.floor(end.getTime() / 1000),
-            },
-            expand: ['data.source', 'data.source.originating_transaction'],
-            limit: 100,
-        })) {
-            try {
-                const { fees } = await this.#handleApplicationFee(transaction);
-                for (const fee of fees) {
-                    if (fee.balanceItemId && fee.settlementId) {
-                        invoicedFeeBalanceItemIds.add(fee.balanceItemId);
-                    }
+        try {
+            for await (const transaction of this.stripe.balanceTransactions.list({
+                type: 'application_fee',
+                created: {
+                    gte: Math.floor(start.getTime() / 1000),
+                    lte: Math.floor(end.getTime() / 1000),
+                },
+                expand: ['data.source', 'data.source.originating_transaction'],
+                limit: 100,
+            })) {
+                abort?.throwIfAborted();
+
+                try {
+                    await this.#handleApplicationFee(transaction, { invoicedFeeBalanceItemIds });
+                } catch (e) {
+                    // The month is only invoiced after a walk without errors, so an interrupted
+                    // walk has to stop the walk itself instead of joining the errors of its
+                    // transactions
+                    abort?.throwIfAborted();
+
+                    console.error('Failed to sync application fee transaction ' + transaction.id, e);
+                    errors.push(e);
                 }
-            } catch (e) {
-                console.error('Failed to sync application fee transaction ' + transaction.id, e);
-                errors.push(e);
             }
+        } catch (e) {
+            // The payouts of the fees stored so far still need their derived lines, but failing to
+            // update them may not hide what broke the walk
+            await SettlementService.updatePaymentSettlementsForAccountDeductionBalanceItems([...invoicedFeeBalanceItemIds]).catch(console.error);
+            throw e;
         }
 
         await SettlementService.updatePaymentSettlementsForAccountDeductionBalanceItems([...invoicedFeeBalanceItemIds]);
@@ -210,7 +226,16 @@ export class StripeSettlementSync {
     /**
      * Stores the SettlementCharge for the connected account (costs) and ApplicationFee for the platform account (revenue), related to an application fee in Stripe.
      */
-    async #handleApplicationFee(transaction: Stripe.BalanceTransaction, options: { settlementId?: string } = {}): Promise<{ fees: ApplicationFee[]; charges: SettlementCharge[] }> {
+    async #handleApplicationFee(transaction: Stripe.BalanceTransaction, options: {
+        settlementId?: string;
+
+        /**
+         * Collects the balance items of the invoiced fees stored here, so their fee payments can
+         * be updated afterwards. Filled while storing, not from the return value: a fee that is
+         * stored before a later one throws still needs its derived line.
+         */
+        invoicedFeeBalanceItemIds?: Set<string>;
+    } = {}): Promise<{ fees: ApplicationFee[]; charges: SettlementCharge[] }> {
         const fee = transaction.source as Stripe.ApplicationFee;
         const payingAccountId = typeof fee.account === 'string' ? fee.account : fee.account.id;
 
@@ -273,7 +298,7 @@ export class StripeSettlementSync {
                 charges.push(charge);
             }
 
-            fees.push(await ApplicationFeeService.upsertFee({
+            const storedFee = await ApplicationFeeService.upsertFee({
                 externalId: fee.id,
                 type: feeType,
                 amount,
@@ -286,7 +311,14 @@ export class StripeSettlementSync {
                 settlementChargeId: charge?.id ?? undefined,
                 settlementId: options.settlementId,
                 occurredAt,
-            }));
+            });
+            fees.push(storedFee);
+
+            // An invoiced fee is explained by the derived line of its fee payment instead of by
+            // itself, so the payouts it sits in have to rebuild those lines
+            if (storedFee.balanceItemId && storedFee.settlementId) {
+                options.invoicedFeeBalanceItemIds?.add(storedFee.balanceItemId);
+            }
         }
 
         return { fees, charges };
@@ -370,7 +402,7 @@ export class StripeSettlementSync {
         return this.#organizationId;
     }
 
-    async syncPayout(payout: Stripe.Payout, { force = false }: { force?: boolean } = {}): Promise<{ settlement: Settlement; skipped: boolean }> {
+    async syncPayout(payout: Stripe.Payout, { force = false, abort }: { force?: boolean; abort?: AbortSignal } = {}): Promise<{ settlement: Settlement; skipped: boolean }> {
         // All amounts are stored in the same unit: a payout in another currency would be stored as
         // a plausible but wrong number
         if (payout.currency && payout.currency.toUpperCase() !== 'EUR') {
@@ -380,7 +412,7 @@ export class StripeSettlementSync {
             });
         }
 
-        return await SettlementService.lock(PaymentProvider.Stripe, payout.id, async () => {
+        return await SettlementService.lock(PaymentProvider.Stripe, payout.id, async (signal) => {
             const settlement = await SettlementService.upsertSettlement({
                 provider: PaymentProvider.Stripe,
                 externalId: payout.id,
@@ -418,17 +450,23 @@ export class StripeSettlementSync {
             }
 
             try {
-                await this.#walkPayout(payout, settlement);
+                await this.#walkPayout(payout, settlement, signal);
             } catch (e) {
-                await SettlementService.markSyncFailed(settlement);
+                // A walk that was interrupted stored only part of the payout: it has to be walked
+                // again, but it didn't fail
+                if (signal.isAborted) {
+                    await SettlementService.markSyncInterrupted(settlement);
+                } else {
+                    await SettlementService.markSyncFailed(settlement);
+                }
                 throw e;
             }
 
             return { settlement, skipped: false };
-        });
+        }, { abort });
     }
 
-    async #walkPayout(payout: Stripe.Payout, settlement: Settlement) {
+    async #walkPayout(payout: Stripe.Payout, settlement: Settlement, abort: AbortSignal) {
         const reported = new ReportedRows();
         let transactionCount = 0;
 
@@ -436,31 +474,45 @@ export class StripeSettlementSync {
         // payments' derived lines must follow
         const invoicedFeeBalanceItemIds = new Set<string>();
 
-        for await (const transaction of this.stripe.balanceTransactions.list({
-            payout: payout.id,
-            limit: 100,
-            expand: this.stripeAccount
-                ? ['data.source', 'data.source.application_fee', 'data.source.application_fee.originating_transaction', 'data.source.charge']
-                : ['data.source', 'data.source.originating_transaction', 'data.source.charge'],
-        })) {
-            transactionCount += 1;
-            await this.#handleTransaction(transaction, settlement, reported, invoicedFeeBalanceItemIds);
-        }
+        try {
+            for await (const transaction of this.stripe.balanceTransactions.list({
+                payout: payout.id,
+                limit: 100,
+                expand: this.stripeAccount
+                    ? ['data.source', 'data.source.application_fee', 'data.source.application_fee.originating_transaction', 'data.source.charge']
+                    : ['data.source', 'data.source.originating_transaction', 'data.source.charge'],
+            })) {
+                // Between two transactions is a safe point to stop: only a complete walk sweeps
+                // and marks the settlement synced, so an interrupted one is re-walked from scratch
+                abort.throwIfAborted();
+
+                transactionCount += 1;
+                await this.#handleTransaction(transaction, settlement, reported, invoicedFeeBalanceItemIds);
+            }
 
-        // Stripe reported nothing for money that did move: storing that as a complete sync would
-        // silently hide the whole payout
-        if (transactionCount === 0 && settlement.amount !== 0) {
-            throw new SimpleError({
-                code: 'empty_payout',
-                message: 'Payout ' + payout.id + ' of ' + settlement.amount + ' has no balance transactions',
-            });
-        }
+            // Stripe reported nothing for money that did move: storing that as a complete sync
+            // would silently hide the whole payout
+            if (transactionCount === 0 && settlement.amount !== 0) {
+                throw new SimpleError({
+                    code: 'empty_payout',
+                    message: 'Payout ' + payout.id + ' of ' + settlement.amount + ' has no balance transactions',
+                });
+            }
 
-        const { unlinkedFees } = await SettlementService.sweepSettlement(settlement, reported);
-        for (const fee of unlinkedFees) {
-            if (fee.balanceItemId) {
-                invoicedFeeBalanceItemIds.add(fee.balanceItemId);
+            // Only a complete walk may sweep: it can't tell a row that moved away from one this
+            // walk never reached
+            const { unlinkedFees } = await SettlementService.sweepSettlement(settlement, reported);
+            for (const fee of unlinkedFees) {
+                if (fee.balanceItemId) {
+                    invoicedFeeBalanceItemIds.add(fee.balanceItemId);
+                }
             }
+        } catch (e) {
+            // The fee payments still follow the fees this walk linked before it broke (a fee may
+            // never sit in a payout that has no line for it), but failing to update them may not
+            // hide what broke the walk
+            await SettlementService.updatePaymentSettlementsForAccountDeductionBalanceItems([...invoicedFeeBalanceItemIds]).catch(console.error);
+            throw e;
         }
 
         await SettlementService.updatePaymentSettlementsForAccountDeductionBalanceItems([...invoicedFeeBalanceItemIds]);
@@ -528,15 +580,8 @@ export class StripeSettlementSync {
 
             case 'application_fee': {
                 // The fee rows, now linked to the platform payout that contains them
-                const { fees } = await this.#handleApplicationFee(transaction, { settlementId: settlement.id });
+                const { fees } = await this.#handleApplicationFee(transaction, { settlementId: settlement.id, invoicedFeeBalanceItemIds });
                 reported.applicationFees(fees);
-                for (const fee of fees) {
-                    if (fee.balanceItemId) {
-                        // Make sure we update the AccountDeduction payments and settlements that are connected to this
-                        // application fee.
-                        invoicedFeeBalanceItemIds.add(fee.balanceItemId);
-                    }
-                }
                 await this.#storePaidFeesForTransaction(transaction, settlement, reported, { paymentId: null });
                 return;
             }

package/src/helpers/StripeSettlementSyncRunner.test.ts

@@ -1,7 +1,9 @@
 import type { Organization } from '@stamhoofd/models';
 import { OrganizationFactory } from '@stamhoofd/models';
 import { Settlement } from '@stamhoofd/models/models/Settlement.js';
+import { AbortSignal } from '@stamhoofd/queues';
 import { PaymentProvider } from '@stamhoofd/structures';
+import { STExpect } from '@stamhoofd/test-utils';
 import { v4 as uuidv4 } from 'uuid';
 
 import { StripeMocker } from '../../tests/helpers/StripeMocker.js';
@@ -63,4 +65,20 @@ describe('Helper.StripeSettlementSyncRunner', () => {
         const fresh = await Settlement.getByID(settlement.id);
         expect(fresh!.syncFailureCount).toBe(5);
     });
+
+    test('an interrupted retry does not count towards the cap', async () => {
+        const settlement = await createUnsyncedSettlement(1);
+
+        const abort = new AbortSignal();
+        abort.abort();
+
+        const runner = new StripeSettlementSyncRunner({ secretKey: STAMHOOFD.STRIPE_SECRET_KEY! });
+        await expect(runner.retryUnsyncedSettlements({ windowStart, abort })).rejects.toThrow(
+            STExpect.simpleError({ code: 'queue-aborted' }),
+        );
+
+        // A restart is not an attempt: the payout is still waiting for a real one
+        const fresh = await Settlement.getByID(settlement.id);
+        expect(fresh!.syncFailureCount).toBe(1);
+    });
 });

package/src/helpers/StripeSettlementSyncRunner.ts

@@ -1,5 +1,6 @@
 import { StripeAccount } from '@stamhoofd/models';
 import { Settlement } from '@stamhoofd/models/models/Settlement.js';
+import { AbortSignal } from '@stamhoofd/queues';
 import { PaymentProvider } from '@stamhoofd/structures';
 import { SettlementStatus } from '@stamhoofd/structures/settlements/SettlementStatus.js';
 
@@ -44,12 +45,14 @@ export class StripeSettlementSyncRunner implements ProviderSettlementSyncRunner
      * Walks the window month by month: fees first, then our platform payouts, then the connected
      * accounts.
      */
-    async run({ start, end, summary, onProgress }: ProviderSyncRunOptions): Promise<void> {
+    async run({ start, end, summary, onProgress, abort }: ProviderSyncRunOptions): Promise<void> {
         const platformSync = new StripeSettlementSync({ secretKey: this.#secretKey });
 
         let currentMonth = new Date(start.getFullYear(), start.getMonth(), 1);
 
         while (true) {
+            abort.throwIfAborted();
+
             const { start: monthStartUnix, end: monthEndUnix } = SettlementService.getMonthUnixStartEnd(currentMonth);
             if (monthStartUnix * 1000 > end.getTime()) {
                 break;
@@ -59,21 +62,23 @@ export class StripeSettlementSyncRunner implements ProviderSettlementSyncRunner
             const windowEnd = new Date(Math.min(monthEndUnix * 1000, end.getTime()));
 
             try {
-                await platformSync.syncFees({ start: windowStart, end: windowEnd });
+                await platformSync.syncFees({ start: windowStart, end: windowEnd, abort });
                 summary.feeMonths += 1;
             } catch (e) {
+                abort.throwIfAborted();
+
                 // syncFees already emailed nothing: it throws an aggregate, the month is retried by
                 // the next run and the month is not invoiced until it completes
                 console.error('Fee sync failed for month ' + currentMonth.toISOString(), e);
                 summary.failedFeeMonths += 1;
             }
 
-            const platformResult = await platformSync.syncPayouts({ start: windowStart, end: windowEnd, force: this.#force });
+            const platformResult = await platformSync.syncPayouts({ start: windowStart, end: windowEnd, force: this.#force, abort });
             summary.synced += platformResult.synced;
             summary.skipped += platformResult.skipped;
             summary.failed += platformResult.failed;
 
-            const connectedResult = await this.syncConnectedPayouts({ start: windowStart, end: windowEnd });
+            const connectedResult = await this.syncConnectedPayouts({ start: windowStart, end: windowEnd, abort });
             summary.synced += connectedResult.synced;
             summary.skipped += connectedResult.skipped;
             summary.failed += connectedResult.failed;
@@ -83,26 +88,32 @@ export class StripeSettlementSyncRunner implements ProviderSettlementSyncRunner
         }
 
         if (this.#retryUnsynced) {
-            await this.retryUnsyncedSettlements({ windowStart: start });
+            await this.retryUnsyncedSettlements({ windowStart: start, abort });
         }
     }
 
     /**
      * Walks the payouts of every active connected account.
      */
-    async syncConnectedPayouts({ start, end }: { start: Date; end?: Date }): Promise<{ synced: number; skipped: number; failed: number }> {
+    async syncConnectedPayouts({ start, end, abort = new AbortSignal() }: { start: Date; end?: Date; abort?: AbortSignal }): Promise<{ synced: number; skipped: number; failed: number }> {
         const totals = { synced: 0, skipped: 0, failed: 0 };
 
         const accounts = await StripeAccount.select().where('status', 'active').fetch();
 
         for (const account of accounts) {
+            abort.throwIfAborted();
+
             try {
                 const sync = new StripeSettlementSync({ secretKey: this.#secretKey, stripeAccount: account });
-                const result = await sync.syncPayouts({ start, end, force: this.#force });
+                const result = await sync.syncPayouts({ start, end, force: this.#force, abort });
                 totals.synced += result.synced;
                 totals.skipped += result.skipped;
                 totals.failed += result.failed;
             } catch (e) {
+                // An interrupted account is not an account with a problem: it may not be marked
+                // inaccessible, counted or reported
+                abort.throwIfAborted();
+
                 if (e !== null && typeof e === 'object' && 'type' in e && e.type === 'StripePermissionError' && e.message.includes(account.accountId) && e.message.includes('does not have access to account')) {
                     // Stripe account no longer in active use
                     console.error(e, 'marking stripe account', account.id, account.accountId, 'as inaccessible because we do not seem to have access to it any longer');
@@ -127,7 +138,7 @@ export class StripeSettlementSyncRunner implements ProviderSettlementSyncRunner
      * after MAXIMUM_FAILURE_COUNT attempts and waits in the problem report instead. Always forced,
      * regardless of the force configuration.
      */
-    async retryUnsyncedSettlements({ windowStart }: { windowStart: Date }): Promise<void> {
+    async retryUnsyncedSettlements({ windowStart, abort = new AbortSignal() }: { windowStart: Date; abort?: AbortSignal }): Promise<void> {
         const settlements = await Settlement.select()
             .where('provider', PaymentProvider.Stripe)
             .where('syncedAt', null)
@@ -140,12 +151,18 @@ export class StripeSettlementSyncRunner implements ProviderSettlementSyncRunner
             .fetch();
 
         for (const settlement of settlements) {
+            abort.throwIfAborted();
+
             const failureCountBefore = settlement.syncFailureCount;
             try {
                 const stripeAccount = settlement.stripeAccountId ? await StripeAccount.getByID(settlement.stripeAccountId) : null;
                 const sync = new StripeSettlementSync({ secretKey: this.#secretKey, stripeAccount: stripeAccount ?? null });
-                await sync.syncPayoutById(settlement.externalId, { force: true });
+                await sync.syncPayoutById(settlement.externalId, { force: true, abort });
             } catch (e) {
+                // An interrupted retry may not count towards the cap: the payout is still waiting
+                // for a real attempt
+                abort.throwIfAborted();
+
                 console.error('Retry of settlement ' + settlement.externalId + ' failed', e);
 
                 // Errors before the walk (e.g. the payout can't be retrieved anymore) don't pass

package/src/helpers/waitUntilDeadline.test.ts

@@ -0,0 +1,48 @@
+import { sleep } from '@stamhoofd/utility';
+import { vi } from 'vitest';
+
+import { waitUntilDeadline } from './waitUntilDeadline.js';
+
+describe('Helper.waitUntilDeadline', () => {
+    let errors: string[];
+
+    beforeEach(() => {
+        errors = [];
+        vi.spyOn(console, 'error').mockImplementation((message: unknown) => {
+            errors.push(typeof message === 'string' ? message : String(message));
+        });
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+    const deadlineIn = (ms: number) => new Date(Date.now() + ms);
+
+    test('returns as soon as the work finishes', async () => {
+        const started = Date.now();
+        await waitUntilDeadline(sleep(10), { deadline: deadlineIn(60_000), description: 'work' });
+
+        expect(Date.now() - started).toBeLessThan(1000);
+        expect(errors).toHaveLength(0);
+    });
+
+    test('gives up on work that never finishes', async () => {
+        await waitUntilDeadline(new Promise(() => {}), { deadline: deadlineIn(20), description: 'work' });
+
+        expect(errors).toContain('Gave up waiting for work to finish');
+    });
+
+    test('a deadline that already passed does not wait', async () => {
+        await waitUntilDeadline(sleep(60_000), { deadline: deadlineIn(-1000), description: 'work' });
+
+        expect(errors).toContain('Gave up waiting for work to finish');
+    });
+
+    test('a failure in the work is logged instead of thrown', async () => {
+        await waitUntilDeadline(Promise.reject(new Error('Broken')), { deadline: deadlineIn(60_000), description: 'work' });
+
+        expect(errors).toContain('Failed to wait for work:');
+        expect(errors).not.toContain('Gave up waiting for work to finish');
+    });
+});

package/src/helpers/waitUntilDeadline.ts

@@ -0,0 +1,28 @@
+/**
+ * Waits for `promise`, but gives up at `deadline`: a shutdown may not hang on work that never
+ * checks its abort signal, or that is stuck on a network call. What is left behind runs again after
+ * the restart.
+ *
+ * A failure in the awaited work is logged instead of thrown: it may not stop the shutdown either.
+ */
+export async function waitUntilDeadline(promise: Promise<unknown>, { deadline, description }: { deadline: Date; description: string }): Promise<void> {
+    let timer: NodeJS.Timeout | undefined;
+
+    const timedOut = await Promise.race([
+        promise.then(() => false).catch((error) => {
+            console.error('Failed to wait for ' + description + ':');
+            console.error(error);
+            return false;
+        }),
+        new Promise<boolean>((resolve) => {
+            timer = setTimeout(() => resolve(true), Math.max(deadline.getTime() - Date.now(), 0));
+        }),
+    ]);
+
+    // Or the timer keeps the process alive until the deadline it no longer needs
+    clearTimeout(timer);
+
+    if (timedOut) {
+        console.error('Gave up waiting for ' + description + ' to finish');
+    }
+}

package/src/services/ApplicationFeeService.ts

@@ -142,14 +142,32 @@ export class ApplicationFeeService {
         periodStart: Date;
     }): Promise<Payment[]> {
         const reference = LEGACY_FEE_PAYMENT_REFERENCE_PREFIX + Formatter.dateIso(periodStart);
-        const key = organizationId + ':' + payingStripeAccountId + ':' + reference;
+        const key = organizationId + ':' + payingOrganizationId + ':' + payingStripeAccountId + ':' + reference;
 
         const cached = this.legacyFeePayments.get(key);
         if (cached && cached.length > 0) {
             return cached;
         }
 
-        const payments = await Payment.select()
+        // Prefer matching stripeAccountId
+        let payments = await Payment.select()
+            .where('organizationId', organizationId)
+            .where('payingOrganizationId', payingOrganizationId)
+            .where(
+                SQL.where('stripeAccountId', payingStripeAccountId),
+            )
+            .where('reference', reference)
+            .where('method', PaymentMethod.AccountDeductions)
+            .where('provider', PaymentProvider.Stripe)
+            .where('status', PaymentStatus.Succeeded)
+            .fetch();
+
+        if (payments.length) {
+            this.legacyFeePayments.set(key, payments);
+            return payments;
+        }
+
+        payments = await Payment.select()
             .where('organizationId', organizationId)
             .where('payingOrganizationId', payingOrganizationId)
             .where(

package/src/services/BalanceItemService.ts

@@ -11,6 +11,7 @@ import { OrderService } from './OrderService.js';
 import { PaymentReallocationService } from './PaymentReallocationService.js';
 import { RegistrationService } from './RegistrationService.js';
 import { STPackageService } from './STPackageService.js';
+import { WebshopCrowdfundingService } from './WebshopCrowdfundingService.js';
 
 const memberUpdateQueue = new GroupedThrottledQueue(async (organizationId: string, memberIds: string[]) => {
     await CachedBalance.updateForMembers(organizationId, memberIds);
@@ -183,6 +184,10 @@ export class BalanceItemService {
             if (item.registrationId) {
                 registrationUpdateQueue.addItem(item.organizationId, item.registrationId);
             }
+
+            if (item.orderId) {
+                WebshopCrowdfundingService.scheduleUpdateForOrder(item.orderId);
+            }
         }
     }
 

package/src/services/SettlementService.ts

@@ -6,7 +6,7 @@ import { ApplicationFee } from '@stamhoofd/models/models/ApplicationFee.js';
 import { PaymentSettlement } from '@stamhoofd/models/models/PaymentSettlement.js';
 import { Settlement } from '@stamhoofd/models/models/Settlement.js';
 import { SettlementCharge } from '@stamhoofd/models/models/SettlementCharge.js';
-import { QueueHandler } from '@stamhoofd/queues';
+import { AbortSignal, QueueHandler } from '@stamhoofd/queues';
 import { SQL } from '@stamhoofd/sql';
 import type { PaymentProvider } from '@stamhoofd/structures';
 import { PaymentMethod, SettlementReference } from '@stamhoofd/structures';
@@ -114,9 +114,20 @@ export class SettlementService {
      * Serializes syncs of the same settlement, so cron and manual backfill can't race. In-process
      * only: across multiple API instances the tables' unique keys are the real guard, so a
      * concurrent sync surfaces as a duplicate-key error and is retryable.
+     *
+     * Interrupting a walk is opt-in: the caller's signal governs the whole sync (so it stops as
+     * one, and every caller in it recognizes the abort), and a caller without one walks to the end.
      */
-    static lock<T>(provider: PaymentProvider, externalId: string, handler: () => Promise<T>): Promise<T> {
-        return QueueHandler.schedule('settlement-sync-' + provider + '-' + externalId, handler);
+    static lock<T>(provider: PaymentProvider, externalId: string, handler: (abort: AbortSignal) => Promise<T>, { abort }: { abort?: AbortSignal } = {}): Promise<T> {
+        return QueueHandler.schedule('settlement-sync-' + provider + '-' + externalId, async (o) => {
+            const signal = abort ?? o.abort;
+
+            // Waiting behind another settlement may have taken a while: don't start a walk that is
+            // interrupted at its first step anyway
+            signal.throwIfAborted();
+
+            return await handler(signal);
+        });
     }
 
     /**
@@ -575,6 +586,18 @@ export class SettlementService {
         }
     }
 
+    /**
+     * A walk that was interrupted halfway (a restart aborted it) stored only part of what the
+     * provider reports, so the settlement may not keep claiming it is synced: the next run walks it
+     * again. Unlike a failed sync it doesn't count towards the retry cap — nothing is wrong with
+     * this settlement.
+     */
+    static async markSyncInterrupted(settlement: Settlement): Promise<Settlement> {
+        settlement.syncedAt = null;
+        await settlement.save();
+        return settlement;
+    }
+
     /**
      * A failed sync leaves syncedAt NULL: that is the whole error queue.
      */