@stamhoofd/backend 2.49.1 → 2.50.2

package/index.ts

@@ -10,7 +10,7 @@ import { loadLogger } from '@stamhoofd/logging';
 import { Version } from '@stamhoofd/structures';
 import { sleep } from '@stamhoofd/utility';
 
-import { areCronsRunning, crons, stopCronScheduling } from './src/crons';
+import { stopCrons, startCrons, waitForCrons } from '@stamhoofd/crons';
 import { resumeEmails } from './src/helpers/EmailResumer';
 import { ContextMiddleware } from './src/middleware/ContextMiddleware';
 
@@ -115,8 +115,7 @@ const start = async () => {
             routerServer.server.keepAliveTimeout = 1;
         }
 
-        stopCronScheduling();
-        clearInterval(cronInterval);
+        stopCrons();
 
         if (STAMHOOFD.environment === 'development') {
             setTimeout(() => {
@@ -134,16 +133,7 @@ const start = async () => {
             console.error(err);
         }
 
-        try {
-            while (areCronsRunning()) {
-                console.log('Crons are still running. Waiting 2 seconds...');
-                await sleep(2000);
-            }
-        }
-        catch (err) {
-            console.error('Failed to wait for crons to finish:');
-            console.error(err);
-        }
+        await waitForCrons();
 
         try {
             while (Email.currentQueue.length > 0) {
@@ -185,10 +175,9 @@ const start = async () => {
         });
     });
 
-    const cronInterval = setInterval(() => {
-        crons().catch(console.error);
-    }, 5 * 60 * 1000);
-    crons().catch(console.error);
+    // Register crons
+    await import('./src/crons');
+    startCrons();
     seeds().catch(console.error);
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.49.1",
+    "version": "2.50.2",
     "main": "./dist/index.js",
     "exports": {
         ".": {
@@ -33,17 +33,17 @@
     "dependencies": {
         "@mollie/api-client": "3.7.0",
         "@simonbackx/simple-database": "1.25.0",
-        "@simonbackx/simple-encoding": "2.16.1",
+        "@simonbackx/simple-encoding": "2.16.5",
         "@simonbackx/simple-endpoints": "1.14.0",
         "@simonbackx/simple-logging": "^1.0.1",
-        "@stamhoofd/backend-i18n": "2.49.1",
-        "@stamhoofd/backend-middleware": "2.49.1",
-        "@stamhoofd/email": "2.49.1",
-        "@stamhoofd/models": "2.49.1",
-        "@stamhoofd/queues": "2.49.1",
-        "@stamhoofd/sql": "2.49.1",
-        "@stamhoofd/structures": "2.49.1",
-        "@stamhoofd/utility": "2.49.1",
+        "@stamhoofd/backend-i18n": "2.50.2",
+        "@stamhoofd/backend-middleware": "2.50.2",
+        "@stamhoofd/email": "2.50.2",
+        "@stamhoofd/models": "2.50.2",
+        "@stamhoofd/queues": "2.50.2",
+        "@stamhoofd/sql": "2.50.2",
+        "@stamhoofd/structures": "2.50.2",
+        "@stamhoofd/utility": "2.50.2",
         "archiver": "^7.0.1",
         "aws-sdk": "^2.885.0",
         "axios": "1.6.8",
@@ -60,5 +60,8 @@
         "postmark": "^4.0.5",
         "stripe": "^16.6.0"
     },
-    "gitHead": "d99dc987933ceb59c4f5fcb0e4af869b4007826a"
+    "publishConfig": {
+        "access": "public"
+    },
+    "gitHead": "ffbc162ba4d0def7714d88b255b72a5f8991b4c3"
 }

package/src/crons.ts

@@ -1,13 +1,13 @@
 /* eslint-disable @typescript-eslint/no-unsafe-argument */
 import { Database } from '@simonbackx/simple-database';
-import { logger, StyledText } from '@simonbackx/simple-logging';
 import { Email, EmailAddress } from '@stamhoofd/email';
 import { Group, Organization, Payment, Registration, STPackage, Webshop } from '@stamhoofd/models';
 import { PaymentMethod, PaymentProvider, PaymentStatus } from '@stamhoofd/structures';
-import { Formatter, sleep } from '@stamhoofd/utility';
+import { Formatter } from '@stamhoofd/utility';
 import AWS from 'aws-sdk';
 import { DateTime } from 'luxon';
 
+import { registerCron } from '@stamhoofd/crons';
 import { clearExcelCache } from './crons/clearExcelCache';
 import { endFunctionsOfUsersWithoutRegistration } from './crons/endFunctionsOfUsersWithoutRegistration';
 import { ExchangePaymentEndpoint } from './endpoints/organization/shared/ExchangePaymentEndpoint';
@@ -654,163 +654,16 @@ async function checkDrips() {
     lastDripId = organizations[organizations.length - 1].id;
 }
 
-type CronJobDefinition = {
-    name: string;
-    method: () => Promise<void>;
-    running: boolean;
-};
-
-const registeredCronJobs: CronJobDefinition[] = [];
-
-registeredCronJobs.push({
-    name: 'checkSettlements',
-    method: checkSettlements,
-    running: false,
-});
-
-registeredCronJobs.push({
-    name: 'checkFailedBuckarooPayments',
-    method: checkFailedBuckarooPayments,
-    running: false,
-});
-
-registeredCronJobs.push({
-    name: 'checkExpirationEmails',
-    method: checkExpirationEmails,
-    running: false,
-});
-
-registeredCronJobs.push({
-    name: 'checkPostmarkBounces',
-    method: checkPostmarkBounces,
-    running: false,
-});
-
-registeredCronJobs.push({
-    name: 'checkReservedUntil',
-    method: checkReservedUntil,
-    running: false,
-});
-
-registeredCronJobs.push({
-    name: 'checkComplaints',
-    method: checkComplaints,
-    running: false,
-});
-
-registeredCronJobs.push({
-    name: 'checkReplies',
-    method: checkReplies,
-    running: false,
-});
-
-registeredCronJobs.push({
-    name: 'checkBounces',
-    method: checkBounces,
-    running: false,
-});
-
-registeredCronJobs.push({
-    name: 'checkDNS',
-    method: checkDNS,
-    running: false,
-});
-
-registeredCronJobs.push({
-    name: 'checkWebshopDNS',
-    method: checkWebshopDNS,
-    running: false,
-});
-
-registeredCronJobs.push({
-    name: 'checkPayments',
-    method: checkPayments,
-    running: false,
-});
-
-registeredCronJobs.push({
-    name: 'checkDrips',
-    method: checkDrips,
-    running: false,
-});
-
-registeredCronJobs.push({
-    name: 'clearExcelCache',
-    method: clearExcelCache,
-    running: false,
-});
-
-registeredCronJobs.push({
-    name: 'endFunctionsOfUsersWithoutRegistration',
-    method: endFunctionsOfUsersWithoutRegistration,
-    running: false,
-});
-
-async function run(name: string, handler: () => Promise<void>) {
-    try {
-        await logger.setContext({
-            prefixes: [
-                new StyledText(`[${name}] `).addClass('crons', 'tag'),
-            ],
-            tags: ['crons'],
-        }, async () => {
-            try {
-                await handler();
-            }
-            catch (e) {
-                console.error(new StyledText(e).addClass('error'));
-            }
-        });
-    }
-    catch (e) {
-        console.error(new StyledText(e).addClass('error'));
-    }
-}
-
-let stopCrons = false;
-export function stopCronScheduling() {
-    stopCrons = true;
-}
-
-let schedulingJobs = false;
-export function areCronsRunning(): boolean {
-    if (schedulingJobs && !stopCrons) {
-        return true;
-    }
-
-    for (const job of registeredCronJobs) {
-        if (job.running) {
-            return true;
-        }
-    }
-    return false;
-}
-
-export const crons = async () => {
-    if (STAMHOOFD.CRONS_DISABLED) {
-        console.log('Crons are disabled. Make sure to enable them in the environment variables.');
-        return;
-    }
-
-    schedulingJobs = true;
-    for (const job of registeredCronJobs) {
-        if (stopCrons) {
-            break;
-        }
-        if (job.running) {
-            continue;
-        }
-        job.running = true;
-        run(job.name, job.method).finally(() => {
-            job.running = false;
-        }).catch((e) => {
-            console.error(e);
-        });
-
-        // Prevent starting too many jobs at once
-        if (STAMHOOFD.environment !== 'development') {
-            await sleep(10 * 1000);
-        }
-    }
-    schedulingJobs = false;
-};
+registerCron('checkSettlements', checkSettlements);
+registerCron('checkExpirationEmails', checkExpirationEmails);
+registerCron('checkPostmarkBounces', checkPostmarkBounces);
+registerCron('checkReservedUntil', checkReservedUntil);
+registerCron('checkComplaints', checkComplaints);
+registerCron('checkReplies', checkReplies);
+registerCron('checkBounces', checkBounces);
+registerCron('checkDNS', checkDNS);
+registerCron('checkWebshopDNS', checkWebshopDNS);
+registerCron('checkPayments', checkPayments);
+registerCron('checkDrips', checkDrips);
+registerCron('clearExcelCache', clearExcelCache);
+registerCron('endFunctionsOfUsersWithoutRegistration', endFunctionsOfUsersWithoutRegistration);

package/src/endpoints/admin/organizations/PatchOrganizationsEndpoint.ts

@@ -40,7 +40,6 @@ export class PatchOrganizationsEndpoint extends Endpoint<Params, Query, Body, Re
         }
 
         const result: Organization[] = [];
-        const platform = await Platform.getShared();
 
         for (const id of request.body.getDeletes()) {
             if (!Context.auth.hasPlatformFullAccess()) {
@@ -119,6 +118,9 @@ export class PatchOrganizationsEndpoint extends Endpoint<Params, Query, Body, Re
             organization.meta = put.meta;
             organization.address = put.address;
 
+            const periodId = (await Platform.getShared()).periodId;
+            organization.periodId = periodId;
+
             if (put.privateMeta) {
                 organization.privateMeta = put.privateMeta;
             }
@@ -137,7 +139,7 @@ export class PatchOrganizationsEndpoint extends Endpoint<Params, Query, Body, Re
 
             const organizationPeriod = new OrganizationRegistrationPeriod();
             organizationPeriod.organizationId = organization.id;
-            organizationPeriod.periodId = (await Platform.getShared()).periodId;
+            organizationPeriod.periodId = periodId;
             await organizationPeriod.save();
 
             result.push(organization);

package/src/endpoints/global/organizations/CreateOrganizationEndpoint.ts

@@ -80,16 +80,6 @@ export class CreateOrganizationEndpoint extends Endpoint<Params, Query, Body, Re
         organization.id = request.body.organization.id;
         organization.name = request.body.organization.name;
 
-        // Delay save until after organization is saved, but do validations before the organization is saved
-        // let registerCodeModels: Model[] = []
-        // let delayEmails: EmailInterfaceBase[] = []
-
-        // if (request.body.registerCode) {
-        //    const applied = await RegisterCode.applyRegisterCode(organization, request.body.registerCode)
-        //    registerCodeModels = applied.models
-        //    delayEmails = applied.emails
-        // }
-
         organization.uri = uri;
         organization.meta = request.body.organization.meta;
         organization.address = request.body.organization.address;

package/src/endpoints/global/payments/StripeWebhookEndpoint.ts

@@ -2,6 +2,7 @@ import { AnyDecoder, AutoEncoder, Decoder, field, StringDecoder } from '@simonba
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Organization, StripeAccount, StripeCheckoutSession, StripePaymentIntent } from '@stamhoofd/models';
+import { isDebouncedError, QueueHandler } from '@stamhoofd/queues';
 
 import { StripeHelper } from '../../../helpers/StripeHelper';
 import { ExchangePaymentEndpoint } from '../../organization/shared/ExchangePaymentEndpoint';
@@ -114,13 +115,7 @@ export class StripeWebookEndpoint extends Endpoint<Params, Query, Body, Response
                 const checkoutId = request.body.data.object.id;
                 const [model] = await StripeCheckoutSession.where({ stripeSessionId: checkoutId }, { limit: 1 });
                 if (model && model.organizationId) {
-                    const organization = await Organization.getByID(model.organizationId);
-                    if (organization) {
-                        await ExchangePaymentEndpoint.pollStatus(model.paymentId, organization);
-                    }
-                    else {
-                        console.warn('Could not find organization with id', model.organizationId);
-                    }
+                    await this.checkDebounced(model.paymentId, model.organizationId);
                 }
                 else {
                     console.warn('Could not find stripe checkout session with id', checkoutId);
@@ -157,17 +152,35 @@ export class StripeWebookEndpoint extends Endpoint<Params, Query, Body, Response
         return new Response(undefined);
     }
 
+    async checkDebounced(paymentId: string, organizationId: string) {
+        // Stripe often sends a couple of webhooks for the same payment in short succession.
+        // Make sure we only do one check in a certain amount of time to prevent hammering the stripe API + system
+        try {
+            await QueueHandler.debounce('stripe-webhook/payment-' + paymentId, async () => {
+                const organization = await Organization.getByID(organizationId);
+                if (organization) {
+                    await ExchangePaymentEndpoint.pollStatus(paymentId, organization);
+                }
+                else {
+                    console.warn('Could not find organization with id', organizationId);
+                }
+            }, 1000);
+        }
+        catch (e) {
+            if (isDebouncedError(e)) {
+                // Okay, we are debounced (new request came in)
+                console.log('Debounced', paymentId);
+                return;
+            }
+            throw e;
+        }
+    }
+
     async updateIntent(intentId: string) {
         console.log('[Webooks] Updating intent', intentId);
         const [model] = await StripePaymentIntent.where({ stripeIntentId: intentId }, { limit: 1 });
         if (model && model.organizationId) {
-            const organization = await Organization.getByID(model.organizationId);
-            if (organization) {
-                await ExchangePaymentEndpoint.pollStatus(model.paymentId, organization);
-            }
-            else {
-                console.warn('Could not find organization with id', model.organizationId);
-            }
+            await this.checkDebounced(model.paymentId, model.organizationId);
         }
         else {
             console.warn('Could not find stripe payment intent with id', intentId);

package/src/endpoints/organization/dashboard/documents/GetDocumentsCountEndpoint.ts

@@ -0,0 +1,49 @@
+import { Decoder } from '@simonbackx/simple-encoding';
+import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
+import { CountFilteredRequest, CountResponse } from '@stamhoofd/structures';
+
+import { Context } from '../../../../helpers/Context';
+import { GetDocumentsEndpoint } from './GetDocumentsEndpoint';
+
+type Params = Record<string, never>;
+type Query = CountFilteredRequest;
+type Body = undefined;
+type ResponseBody = CountResponse;
+
+export class GetDocumentsCountEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    queryDecoder = CountFilteredRequest as Decoder<CountFilteredRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'GET') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/organization/documents/count', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        const organization = await Context.setOrganizationScope();
+        await Context.authenticate();
+
+        // Fast throw first (more in depth checking for patches later)
+        if (!await Context.auth.hasSomeAccess(organization.id)) {
+            throw Context.auth.error();
+        }
+
+        const query = GetDocumentsEndpoint.buildQuery(request.query);
+
+        const count = await query
+            .count();
+
+        return new Response(
+            CountResponse.create({
+                count,
+            }),
+        );
+    }
+}

package/src/endpoints/organization/dashboard/documents/GetDocumentsEndpoint.ts

@@ -1,26 +1,36 @@
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
-import { SimpleError } from '@simonbackx/simple-errors';
-import { Document, DocumentTemplate } from '@stamhoofd/models';
-import { Document as DocumentStruct } from '@stamhoofd/structures';
+import { Document } from '@stamhoofd/models';
+import { assertSort, CountFilteredRequest, Document as DocumentStruct, getSortFilter, LimitedFilteredRequest, PaginatedResponse } from '@stamhoofd/structures';
 
+import { Decoder } from '@simonbackx/simple-encoding';
+import { compileToSQLFilter, compileToSQLSorter, SQL, SQLFilterDefinitions, SQLSortDefinitions } from '@stamhoofd/sql';
+import { AuthenticatedStructures } from '../../../../helpers/AuthenticatedStructures';
 import { Context } from '../../../../helpers/Context';
+import { LimitedFilteredRequestHelper } from '../../../../helpers/LimitedFilteredRequestHelper';
+import { documentFilterCompilers } from '../../../../sql-filters/documents';
+import { documentSorters } from '../../../../sql-sorters/documents';
 
-type Params = { id: string };
-type Query = undefined;
+type Params = Record<string, never>;
+type Query = LimitedFilteredRequest;
 type Body = undefined;
-type ResponseBody = DocumentStruct[];
+type ResponseBody = PaginatedResponse<DocumentStruct[], LimitedFilteredRequest>;
+
+const filterCompilers: SQLFilterDefinitions = documentFilterCompilers;
+const sorters: SQLSortDefinitions<Document> = documentSorters;
 
 /**
  * One endpoint to create, patch and delete groups. Usefull because on organization setup, we need to create multiple groups at once. Also, sometimes we need to link values and update multiple groups at once
  */
 
 export class GetDocumentsEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    queryDecoder = LimitedFilteredRequest as Decoder<LimitedFilteredRequest>;
+
     protected doesMatch(request: Request): [true, Params] | [false] {
         if (request.method !== 'GET') {
             return [false];
         }
 
-        const params = Endpoint.parseParameters(request.url, '/organization/document-templates/@id/documents', { id: String });
+        const params = Endpoint.parseParameters(request.url, '/organization/documents', {});
 
         if (params) {
             return [true, params as Params];
@@ -28,6 +38,76 @@ export class GetDocumentsEndpoint extends Endpoint<Params, Query, Body, Response
         return [false];
     }
 
+    static buildQuery(q: CountFilteredRequest | LimitedFilteredRequest) {
+        const organization = Context.organization!;
+
+        const documentTable: string = Document.table;
+
+        const query = SQL
+            .select(SQL.wildcard(documentTable))
+            .from(SQL.table(documentTable))
+            .where(compileToSQLFilter({
+                organizationId: organization.id,
+            }, filterCompilers));
+
+        if (q.filter) {
+            query.where(compileToSQLFilter(q.filter, filterCompilers));
+        }
+
+        if (q.search) {
+            // todo
+            // const searchFilter: StamhoofdFilter | null = getOrderSearchFilter(q.search, parsePhoneNumber);
+
+            // if (searchFilter) {
+            //     query.where(compileToSQLFilter(searchFilter, filterCompilers));
+            // }
+        }
+
+        if (q instanceof LimitedFilteredRequest) {
+            if (q.pageFilter) {
+                query.where(compileToSQLFilter(q.pageFilter, filterCompilers));
+            }
+
+            q.sort = assertSort(q.sort, [{ key: 'id' }]);
+            query.orderBy(compileToSQLSorter(q.sort, sorters));
+            query.limit(q.limit);
+        }
+
+        return query;
+    }
+
+    static async buildData(requestQuery: LimitedFilteredRequest) {
+        const query = this.buildQuery(requestQuery);
+        const data = await query.fetch();
+
+        const documents: Document[] = Document.fromRows(data, Document.table);
+
+        let next: LimitedFilteredRequest | undefined;
+
+        if (documents.length >= requestQuery.limit) {
+            const lastObject = documents[documents.length - 1];
+            const nextFilter = getSortFilter(lastObject, sorters, requestQuery.sort);
+
+            next = new LimitedFilteredRequest({
+                filter: requestQuery.filter,
+                pageFilter: nextFilter,
+                sort: requestQuery.sort,
+                limit: requestQuery.limit,
+                search: requestQuery.search,
+            });
+
+            if (JSON.stringify(nextFilter) === JSON.stringify(requestQuery.pageFilter)) {
+                console.error('Found infinite loading loop for', requestQuery);
+                next = undefined;
+            }
+        }
+
+        return new PaginatedResponse<DocumentStruct[], LimitedFilteredRequest>({
+            results: await AuthenticatedStructures.documents(documents),
+            next,
+        });
+    }
+
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOrganizationScope();
         await Context.authenticate();
@@ -36,15 +116,13 @@ export class GetDocumentsEndpoint extends Endpoint<Params, Query, Body, Response
             throw Context.auth.error();
         }
 
-        const template = await DocumentTemplate.getByID(request.params.id);
-        if (!template || !await Context.auth.canAccessDocumentTemplate(template)) {
-            throw Context.auth.notFoundOrNoAccess('Onbekend document');
-        }
-
-        const documents = await Document.where({ templateId: template.id });
+        LimitedFilteredRequestHelper.throwIfInvalidLimit({
+            request: request.query,
+            maxLimit: Context.auth.hasSomePlatformAccess() ? 1000 : 100,
+        });
 
         return new Response(
-            documents.map(t => t.getStructure()),
+            await GetDocumentsEndpoint.buildData(request.query),
         );
     }
 }

package/src/endpoints/organization/dashboard/email-templates/GetEmailTemplatesEndpoint.ts

@@ -3,6 +3,7 @@ import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-
 import { EmailTemplate } from '@stamhoofd/models';
 import { EmailTemplate as EmailTemplateStruct, EmailTemplateType } from '@stamhoofd/structures';
 
+import { SimpleError } from '@simonbackx/simple-errors';
 import { StringArrayDecoder } from '../../../../decoders/StringArrayDecoder';
 import { StringNullableDecoder } from '../../../../decoders/StringNullableDecoder';
 import { Context } from '../../../../helpers/Context';
@@ -54,6 +55,13 @@ export class GetEmailTemplatesEndpoint extends Endpoint<Params, Query, Body, Res
             }
         }
 
+        if (request.query.types?.length === 0) {
+            throw new SimpleError({
+                code: 'empty_types',
+                message: 'Types cannot be empty',
+            });
+        }
+
         const types = (request.query.types ?? [...Object.values(EmailTemplateType)]).filter((type) => {
             if (!organization) {
                 return EmailTemplateStruct.allowPlatformLevel(type);
@@ -61,14 +69,29 @@ export class GetEmailTemplatesEndpoint extends Endpoint<Params, Query, Body, Res
             return EmailTemplateStruct.allowOrganizationLevel(type);
         });
 
+        if (types.length === 0) {
+            throw new SimpleError({
+                code: 'empty_types',
+                message: 'Types after filtering allowed types is empty',
+            });
+        }
+
         const templates = organization
             ? (
-                    await EmailTemplate.where({ organizationId: organization.id, webshopId: request.query.webshopId ?? null, groupId: request.query.groupIds ? { sign: 'IN', value: request.query.groupIds } : null, type: { sign: 'IN', value: types } })
+                    await EmailTemplate.where({
+                        organizationId: organization.id,
+                        webshopId: request.query.webshopId ?? null,
+                        groupId: request.query.groupIds ? { sign: 'IN', value: request.query.groupIds } : null,
+                        type: { sign: 'IN', value: types } })
                 )
             : (
                 // Required for event emails when logged in as the platform admin
                     (request.query.webshopId || request.query.groupIds)
-                        ? await EmailTemplate.where({ webshopId: request.query.webshopId ?? null, groupId: request.query.groupIds ? { sign: 'IN', value: request.query.groupIds } : null, type: { sign: 'IN', value: types } })
+                        ? await EmailTemplate.where({
+                            webshopId: request.query.webshopId ?? null,
+                            groupId: request.query.groupIds ? { sign: 'IN', value: request.query.groupIds } : null,
+                            type: { sign: 'IN', value: types },
+                        })
                         : []
                 );
 

package/src/endpoints/organization/dashboard/webshops/GetWebshopOrdersEndpoint.ts

@@ -46,6 +46,9 @@ export class GetWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Resp
             .from(SQL.table(ordersTable))
             .where(compileToSQLFilter({
                 organizationId: organization.id,
+                number: {
+                    $neq: null,
+                },
             }, filterCompilers));
 
         if (q.filter) {

package/src/endpoints/organization/dashboard/webshops/GetWebshopTicketsCountEndpoint

@@ -0,0 +1,49 @@
+import { Decoder } from '@simonbackx/simple-encoding';
+import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
+import { CountFilteredRequest, CountResponse } from '@stamhoofd/structures';
+import { GetWebshopTicketsEndpoint } from './GetWebshopTicketsEndpoint';
+
+import { Context } from '../../../../helpers/Context';
+
+type Params = Record<string, never>;
+type Query = CountFilteredRequest;
+type Body = undefined;
+type ResponseBody = CountResponse;
+
+export class GetWebshopTicketsCountEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    queryDecoder = CountFilteredRequest as Decoder<CountFilteredRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'GET') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/webshop/tickets/private/count', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>): Promise<Response<ResponseBody>> {
+        const organization = await Context.setOrganizationScope();
+        await Context.authenticate();
+
+        // Fast throw first (more in depth checking for patches later)
+        if (!await Context.auth.hasSomeAccess(organization.id)) {
+            throw Context.auth.error();
+        }
+
+        const query = GetWebshopTicketsEndpoint.buildQuery(request.query);
+
+        const count = await query
+            .count();
+
+        return new Response(
+            CountResponse.create({
+                count,
+            }),
+        );
+    }
+}

package/src/endpoints/organization/dashboard/webshops/GetWebshopTicketsEndpoint.ts

@@ -1,24 +1,32 @@
 import { Decoder } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
-import { Ticket, Webshop } from '@stamhoofd/models';
-import { PaginatedResponse, PermissionLevel, TicketPrivate, WebshopTicketsQuery } from '@stamhoofd/structures';
+import { Ticket } from '@stamhoofd/models';
+import { assertSort, CountFilteredRequest, getSortFilter, LimitedFilteredRequest, PaginatedResponse, TicketPrivate } from '@stamhoofd/structures';
 
+import { compileToSQLFilter, compileToSQLSorter, SQL, SQLFilterDefinitions, SQLSortDefinitions } from '@stamhoofd/sql';
+import { AuthenticatedStructures } from '../../../../helpers/AuthenticatedStructures';
 import { Context } from '../../../../helpers/Context';
+import { LimitedFilteredRequestHelper } from '../../../../helpers/LimitedFilteredRequestHelper';
+import { ticketFilterCompilers } from '../../../../sql-filters/tickets';
+import { ticketSorters } from '../../../../sql-sorters/tickets';
 
-type Params = { id: string };
-type Query = WebshopTicketsQuery;
+type Params = Record<string, never>;
+type Query = LimitedFilteredRequest;
 type Body = undefined;
-type ResponseBody = PaginatedResponse<TicketPrivate[], Query>;
+type ResponseBody = PaginatedResponse<TicketPrivate[], LimitedFilteredRequest>;
+
+const filterCompilers: SQLFilterDefinitions = ticketFilterCompilers;
+const sorters: SQLSortDefinitions<Ticket> = ticketSorters;
 
 export class GetWebshopTicketsEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
-    queryDecoder = WebshopTicketsQuery as Decoder<WebshopTicketsQuery>;
+    queryDecoder = LimitedFilteredRequest as Decoder<LimitedFilteredRequest>;
 
     protected doesMatch(request: Request): [true, Params] | [false] {
         if (request.method !== 'GET') {
             return [false];
         }
 
-        const params = Endpoint.parseParameters(request.url, '/webshop/@id/tickets/private', { id: String });
+        const params = Endpoint.parseParameters(request.url, '/webshop/tickets/private', {});
 
         if (params) {
             return [true, params as Params];
@@ -26,45 +34,87 @@ export class GetWebshopTicketsEndpoint extends Endpoint<Params, Query, Body, Res
         return [false];
     }
 
-    async handle(_: DecodedRequest<Params, Query, Body>): Promise<Response<ResponseBody>> {
-        await Promise.resolve();
-        throw new Error('Not implemented');
-        /* const organization = await Context.setOrganizationScope();
-        await Context.authenticate()
+    static buildQuery(q: CountFilteredRequest | LimitedFilteredRequest) {
+        const organization = Context.organization!;
 
-        // Fast throw first (more in depth checking for patches later)
-        if (!await Context.auth.hasSomeAccess(organization.id)) {
-            throw Context.auth.error()
+        const ticketsTable: string = Ticket.table;
+
+        const query = SQL
+            .select(SQL.wildcard(ticketsTable))
+            .from(SQL.table(ticketsTable))
+            .where(compileToSQLFilter({
+                organizationId: organization.id,
+            }, filterCompilers));
+
+        if (q.filter) {
+            query.where(compileToSQLFilter(q.filter, filterCompilers));
         }
 
-        const webshop = await Webshop.getByID(request.params.id)
-        if (!webshop || !await Context.auth.canAccessWebshopTickets(webshop, PermissionLevel.Read)) {
-            throw Context.auth.notFoundOrNoAccess("Je hebt geen toegang tot de tickets van deze webshop")
+        // currently no search supported, probably not needed?
+        // if (q.search) {
+        // }
+
+        if (q instanceof LimitedFilteredRequest) {
+            if (q.pageFilter) {
+                query.where(compileToSQLFilter(q.pageFilter, filterCompilers));
+            }
+
+            q.sort = assertSort(q.sort, [{ key: 'id' }]);
+            query.orderBy(compileToSQLSorter(q.sort, sorters));
+            query.limit(q.limit);
         }
 
-        let tickets: Ticket[] | undefined = undefined
-        const limit = 150
+        return query;
+    }
+
+    static async buildData(requestQuery: LimitedFilteredRequest) {
+        const query = this.buildQuery(requestQuery);
+        const data = await query.fetch();
+
+        const tickets: Ticket[] = Ticket.fromRows(data, Ticket.table);
 
-        if (request.query.updatedSince !== undefined) {
-            if (request.query.lastId !== undefined) {
-                tickets = await Ticket.select("WHERE webshopId = ? AND (updatedAt > ? OR (updatedAt = ? AND id > ?)) ORDER BY updatedAt, id LIMIT ?", [webshop.id, request.query.updatedSince, request.query.updatedSince, request.query.lastId, limit])
-            } else {
-                tickets = await Ticket.select("WHERE webshopId = ? AND updatedAt >= ? ORDER BY updatedAt, id LIMIT ?", [webshop.id, request.query.updatedSince, limit])
+        let next: LimitedFilteredRequest | undefined;
+
+        if (tickets.length >= requestQuery.limit) {
+            const lastObject = tickets[tickets.length - 1];
+            const nextFilter = getSortFilter(lastObject, sorters, requestQuery.sort);
+
+            next = new LimitedFilteredRequest({
+                filter: requestQuery.filter,
+                pageFilter: nextFilter,
+                sort: requestQuery.sort,
+                limit: requestQuery.limit,
+                search: requestQuery.search,
+            });
+
+            if (JSON.stringify(nextFilter) === JSON.stringify(requestQuery.pageFilter)) {
+                console.error('Found infinite loading loop for', requestQuery);
+                next = undefined;
             }
-        } else {
-            tickets = await Ticket.select("WHERE webshopId = ? ORDER BY updatedAt, id LIMIT ?", [webshop.id, limit])
         }
 
-        const supportsDeletedTickets = request.request.getVersion() >= 229
+        return new PaginatedResponse<TicketPrivate[], LimitedFilteredRequest>({
+            results: await AuthenticatedStructures.tickets(tickets),
+            next,
+        });
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>): Promise<Response<ResponseBody>> {
+        const organization = await Context.setOrganizationScope();
+        await Context.authenticate();
+
+        // Fast throw first (more in depth checking for patches later)
+        if (!await Context.auth.hasSomeAccess(organization.id)) {
+            throw Context.auth.error();
+        }
+
+        LimitedFilteredRequestHelper.throwIfInvalidLimit({
+            request: request.query,
+            maxLimit: Context.auth.hasSomePlatformAccess() ? 1000 : 100,
+        });
 
         return new Response(
-            new PaginatedResponse({
-                results: tickets.map(ticket => TicketPrivate.create(ticket)).filter(ticket => supportsDeletedTickets || !ticket.deletedAt),
-                next: tickets.length >= limit ? WebshopTicketsQuery.create({
-                    updatedSince: tickets[tickets.length - 1].updatedAt ?? undefined,
-                    lastId: tickets[tickets.length - 1].id ?? undefined
-                }) : undefined
-            })
-        ); */
+            await GetWebshopTicketsEndpoint.buildData(request.query),
+        );
     }
 }

package/src/endpoints/organization/shared/ExchangePaymentEndpoint.ts

@@ -2,7 +2,7 @@ import { createMollieClient, PaymentStatus as MolliePaymentStatus } from '@molli
 import { AutoEncoder, BooleanDecoder, Decoder, field } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { BalanceItem, BalanceItemPayment, MolliePayment, MollieToken, Organization, PayconiqPayment, Payment } from '@stamhoofd/models';
+import { BalanceItem, BalanceItemPayment, MolliePayment, MollieToken, Order, Organization, PayconiqPayment, Payment } from '@stamhoofd/models';
 import { QueueHandler } from '@stamhoofd/queues';
 import { PaymentGeneral, PaymentMethod, PaymentProvider, PaymentStatus } from '@stamhoofd/structures';
 
@@ -48,7 +48,7 @@ export class ExchangePaymentEndpoint extends Endpoint<Params, Query, Body, Respo
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOptionalOrganizationScope();
         if (!request.query.exchange) {
-            await Context.authenticate();
+            await Context.optionalAuthenticate();
         }
 
         // Not method on payment because circular references (not supprted in ts)
@@ -64,8 +64,22 @@ export class ExchangePaymentEndpoint extends Endpoint<Params, Query, Body, Respo
             return new Response(undefined);
         }
 
+        // #region skip check permissions if order and created less than hour ago
+        let checkPermissions = true;
+        const hourAgo = new Date();
+        hourAgo.setHours(-1);
+
+        if (payment.createdAt > hourAgo) {
+            const orders = await Order.where({ paymentId: payment.id }, { limit: 1 });
+            const isOrder = orders[0] !== undefined;
+            if (isOrder) {
+                checkPermissions = false;
+            }
+        }
+        // #endregion
+
         return new Response(
-            await AuthenticatedStructures.paymentGeneral(payment, true),
+            await AuthenticatedStructures.paymentGeneral(payment, checkPermissions),
         );
     }
 
@@ -154,7 +168,6 @@ export class ExchangePaymentEndpoint extends Endpoint<Params, Query, Body, Respo
      */
     static async pollStatus(paymentId: string, org: Organization | null, cancel = false): Promise<Payment | undefined> {
         // Prevent polling the same payment multiple times at the same time: create a queue to prevent races
-        QueueHandler.cancel('payments/' + paymentId); // Prevent creating more than one queue item for the same payment
         return await QueueHandler.schedule('payments/' + paymentId, async () => {
             // Get a new copy of the payment (is required to prevent concurreny bugs)
             const payment = await Payment.getByID(paymentId);

package/src/helpers/AdminPermissionChecker.ts

@@ -1,6 +1,6 @@
 import { AutoEncoderPatchType, PatchMap } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { BalanceItem, CachedBalance, Document, DocumentTemplate, EmailTemplate, Event, Group, Member, MemberPlatformMembership, MemberWithRegistrations, Order, Organization, OrganizationRegistrationPeriod, Payment, Registration, User, Webshop } from '@stamhoofd/models';
+import { BalanceItem, CachedBalance, Document, EmailTemplate, Event, Group, Member, MemberPlatformMembership, MemberWithRegistrations, Order, Organization, OrganizationRegistrationPeriod, Payment, Registration, User, Webshop } from '@stamhoofd/models';
 import { AccessRight, EventPermissionChecker, FinancialSupportSettings, GroupCategory, GroupStatus, MemberWithRegistrationsBlob, PermissionLevel, PermissionsResourceType, Platform as PlatformStruct, RecordCategory } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { addTemporaryMemberAccess, hasTemporaryMemberAccess } from './TemporaryMemberAccess';
@@ -305,7 +305,7 @@ export class AdminPermissionChecker {
         return false;
     }
 
-    async canAccessWebshop(webshop: Webshop, permissionLevel: PermissionLevel = PermissionLevel.Read) {
+    async canAccessWebshop(webshop: { id: string; organizationId: string }, permissionLevel: PermissionLevel = PermissionLevel.Read) {
         const organizationPermissions = await this.getOrganizationPermissions(webshop.organizationId);
 
         if (!organizationPermissions) {
@@ -323,7 +323,7 @@ export class AdminPermissionChecker {
         return false;
     }
 
-    async canAccessWebshopTickets(webshop: Webshop, permissionLevel: PermissionLevel = PermissionLevel.Read) {
+    async canAccessWebshopTickets(webshop: { id: string; organizationId: string }, permissionLevel: PermissionLevel = PermissionLevel.Read) {
         if (!this.checkScope(webshop.organizationId)) {
             return false;
         }
@@ -345,7 +345,7 @@ export class AdminPermissionChecker {
         return false;
     }
 
-    async canAccessOrder(webshop: Webshop, permissionLevel: PermissionLevel = PermissionLevel.Read) {
+    async canAccessOrder(webshop: { id: string; organizationId: string }, permissionLevel: PermissionLevel = PermissionLevel.Read) {
         return await this.canAccessWebshop(webshop, permissionLevel);
     }
 
@@ -477,7 +477,7 @@ export class AdminPermissionChecker {
         return false;
     }
 
-    async canAccessDocumentTemplate(documentTemplate: DocumentTemplate, _: PermissionLevel = PermissionLevel.Read) {
+    async canAccessDocumentTemplate(documentTemplate: { organizationId: string }, _: PermissionLevel = PermissionLevel.Read) {
         if (!this.checkScope(documentTemplate.organizationId)) {
             return false;
         }

package/src/helpers/AuthenticatedStructures.ts

@@ -1,6 +1,6 @@
 import { SimpleError } from '@simonbackx/simple-errors';
-import { CachedBalance, Event, Group, Member, MemberPlatformMembership, MemberResponsibilityRecord, MemberWithRegistrations, Order, Organization, OrganizationRegistrationPeriod, Payment, RegistrationPeriod, User, Webshop } from '@stamhoofd/models';
-import { AccessRight, Event as EventStruct, Group as GroupStruct, MemberPlatformMembership as MemberPlatformMembershipStruct, MemberWithRegistrationsBlob, MembersBlob, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, Organization as OrganizationStruct, PaymentGeneral, PermissionLevel, PrivateOrder, PrivateWebshop, ReceivableBalanceObject, ReceivableBalanceObjectContact, ReceivableBalance as ReceivableBalanceStruct, ReceivableBalanceType, UserWithMembers, WebshopPreview, Webshop as WebshopStruct } from '@stamhoofd/structures';
+import { BalanceItem, CachedBalance, Document, Event, Group, Member, MemberPlatformMembership, MemberResponsibilityRecord, MemberWithRegistrations, Order, Organization, OrganizationRegistrationPeriod, Payment, RegistrationPeriod, Ticket, User, Webshop } from '@stamhoofd/models';
+import { AccessRight, Document as DocumentStruct, Event as EventStruct, Group as GroupStruct, MemberPlatformMembership as MemberPlatformMembershipStruct, MemberWithRegistrationsBlob, MembersBlob, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, Organization as OrganizationStruct, PaymentGeneral, PermissionLevel, PrivateOrder, PrivateWebshop, ReceivableBalanceObject, ReceivableBalanceObjectContact, ReceivableBalance as ReceivableBalanceStruct, ReceivableBalanceType, TicketPrivate, UserWithMembers, WebshopPreview, Webshop as WebshopStruct } from '@stamhoofd/structures';
 
 import { Formatter } from '@stamhoofd/utility';
 import { Context } from './Context';
@@ -428,20 +428,63 @@ export class AuthenticatedStructures {
     }
 
     static async orders(orders: Order[]): Promise<PrivateOrder[]> {
-        // Load groups
-        // const groupIds = orders.map(e => e.groupId).filter(id => id !== null);
-        // const groups = groupIds.length > 0 ? await Group.getByIDs(...groupIds) : [];
-        // const groupStructs = await this.groups(groups);
-
         const result: PrivateOrder[] = [];
+        const webshopIds = new Set(orders.map(o => o.webshopId));
+
+        for (const webshopId of webshopIds) {
+            const organizationId = orders.find(o => o.webshopId === webshopId)!.organizationId;
+
+            const canAccess = await Context.auth.canAccessOrder({
+                id: webshopId,
+                organizationId,
+            }, PermissionLevel.Read);
+
+            if (!canAccess) {
+                throw new SimpleError({
+                    code: 'permission_denied',
+                    message: 'Permission denied',
+                    human: 'Je hebt geen toegang tot de orders van deze webshop',
+                });
+            }
+        }
 
         for (const order of orders) {
-            // const group = groupStructs.find(g => g.id == event.groupId) ?? null;
+            const balanceItems = await BalanceItem.where({ orderId: order.id });
 
             const struct = PrivateOrder.create({
                 ...order,
-                // todo!!!!!
-                balanceItems: [],
+                balanceItems: await BalanceItem.getStructureWithPrivatePayments(balanceItems),
+            });
+
+            result.push(struct);
+        }
+
+        return result;
+    }
+
+    static async documents(documents: Document[]): Promise<DocumentStruct[]> {
+        const result: DocumentStruct[] = [];
+        const templateIds = new Set(documents.map(d => d.templateId));
+
+        for (const templateId of templateIds) {
+            const organizationId = documents.find(d => d.templateId === templateId)!.organizationId;
+
+            const canAccess = await Context.auth.canAccessDocumentTemplate({
+                organizationId,
+            }, PermissionLevel.Read);
+
+            if (!canAccess) {
+                throw new SimpleError({
+                    code: 'permission_denied',
+                    message: 'Permission denied',
+                    human: 'Je hebt geen toegang tot de documenten van deze template',
+                });
+            }
+        }
+
+        for (const document of documents) {
+            const struct = DocumentStruct.create({
+                ...document,
             });
 
             result.push(struct);
@@ -450,6 +493,37 @@ export class AuthenticatedStructures {
         return result;
     }
 
+    // todo?
+    static async tickets(tickets: Ticket[]): Promise<TicketPrivate[]> {
+        const result: TicketPrivate[] = [];
+        const webshopIds = new Set(tickets.map(t => t.webshopId));
+
+        for (const webshopId of webshopIds) {
+            const organizationId = tickets.find(t => t.webshopId === webshopId)!.organizationId;
+
+            const canAccess = await Context.auth.canAccessWebshopTickets({
+                id: webshopId,
+                organizationId,
+            }, PermissionLevel.Read);
+
+            if (!canAccess) {
+                throw new SimpleError({
+                    code: 'permission_denied',
+                    message: 'Permission denied',
+                    human: 'Je hebt geen toegang tot de tickets van deze webshop',
+                });
+            }
+        }
+
+        for (const ticket of tickets) {
+            const struct = TicketPrivate.create({ ...ticket });
+
+            result.push(struct);
+        }
+
+        return result;
+    }
+
     static async receivableBalance(balance: CachedBalance): Promise<ReceivableBalanceStruct> {
         return (await this.receivableBalances([balance]))[0];
     }

package/src/helpers/StripeHelper.ts

@@ -358,6 +358,11 @@ export class StripeHelper {
                 customer_creation: 'if_required',
                 metadata: fullMetadata,
                 expires_at: Math.floor(Date.now() / 1000) + 30 * 60, // Expire in 30 minutes
+                payment_method_options: {
+                    card: {
+                        request_three_d_secure: 'challenge', // Force usage of string customer authentication for card payments
+                    },
+                },
             });
             console.log('Stripe session', session);
 

package/src/sql-filters/documents.ts

@@ -0,0 +1,17 @@
+import { baseSQLFilterCompilers, createSQLColumnFilterCompiler, createSQLExpressionFilterCompiler, SQL, SQLFilterDefinitions, SQLValueType } from '@stamhoofd/sql';
+
+export const documentFilterCompilers: SQLFilterDefinitions = {
+    ...baseSQLFilterCompilers,
+    id: createSQLColumnFilterCompiler('id'),
+    description: createSQLExpressionFilterCompiler(
+        SQL.jsonValue(SQL.column('data'), '$.value.description'),
+        { isJSONValue: true, type: SQLValueType.JSONString },
+    ),
+    organizationId: createSQLColumnFilterCompiler('organizationId'),
+    templateId: createSQLColumnFilterCompiler('templateId'),
+    memberId: createSQLColumnFilterCompiler('memberId'),
+    updatedAt: createSQLColumnFilterCompiler('updatedAt'),
+    createdAt: createSQLColumnFilterCompiler('createdAt'),
+    number: createSQLColumnFilterCompiler('number'),
+    status: createSQLColumnFilterCompiler('status'),
+};

package/src/sql-filters/tickets.ts

@@ -0,0 +1,10 @@
+import { baseSQLFilterCompilers, createSQLColumnFilterCompiler, SQLFilterDefinitions } from '@stamhoofd/sql';
+
+export const ticketFilterCompilers: SQLFilterDefinitions = {
+    ...baseSQLFilterCompilers,
+    organizationId: createSQLColumnFilterCompiler('organizationId'),
+    updatedAt: createSQLColumnFilterCompiler('updatedAt'),
+    webshopId: createSQLColumnFilterCompiler('webshopId'),
+    id: createSQLColumnFilterCompiler('id'),
+    createdAt: createSQLColumnFilterCompiler('createdAt'),
+};

package/src/sql-sorters/documents.ts

@@ -0,0 +1,79 @@
+import { Document } from '@stamhoofd/models';
+import { SQL, SQLOrderBy, SQLOrderByDirection, SQLSortDefinitions } from '@stamhoofd/sql';
+import { Formatter } from '@stamhoofd/utility';
+
+export const documentSorters: SQLSortDefinitions<Document> = {
+    // WARNING! TEST NEW SORTERS THOROUGHLY!
+    // Try to avoid creating sorters on fields that er not 1:1 with the database, that often causes pagination issues if not thought through
+    // An example: sorting on 'name' is not a good idea, because it is a concatenation of two fields.
+    // You might be tempted to use ORDER BY firstName, lastName, but that will not work as expected and it needs to be ORDER BY CONCAT(firstName, ' ', lastName)
+    // Why? Because ORDER BY firstName, lastName produces a different order dan ORDER BY CONCAT(firstName, ' ', lastName) if there are multiple people with spaces in the first name
+    // And that again causes issues with pagination because the next query will append a filter of name > 'John Doe' - causing duplicate and/or skipped results
+    // What if you need mapping? simply map the sorters in the frontend: name -> firstname, lastname, age -> birthDay, etc.
+    id: {
+        getValue(a) {
+            return a.id;
+        },
+        toSQL: (direction: SQLOrderByDirection): SQLOrderBy => {
+            return new SQLOrderBy({
+                column: SQL.column('id'),
+                direction,
+            });
+        },
+    },
+    description: {
+        getValue(a) {
+            return a.data.description;
+        },
+        toSQL: (direction: SQLOrderByDirection): SQLOrderBy => {
+            return new SQLOrderBy({
+                column: SQL.jsonValue(SQL.column('data'), '$.value.description'),
+                direction,
+            });
+        },
+    },
+    createdAt: {
+        getValue(a) {
+            return Formatter.dateTimeIso(a.createdAt);
+        },
+        toSQL: (direction: SQLOrderByDirection): SQLOrderBy => {
+            return new SQLOrderBy({
+                column: SQL.column('createdAt'),
+                direction,
+            });
+        },
+    },
+    updatedAt: {
+        getValue(a) {
+            return Formatter.dateTimeIso(a.updatedAt);
+        },
+        toSQL: (direction: SQLOrderByDirection): SQLOrderBy => {
+            return new SQLOrderBy({
+                column: SQL.column('updatedAt'),
+                direction,
+            });
+        },
+    },
+    number: {
+        getValue(a) {
+            return a.number;
+        },
+        toSQL: (direction: SQLOrderByDirection): SQLOrderBy => {
+            return new SQLOrderBy({
+                column: SQL.column('number'),
+                direction,
+            });
+        },
+    },
+    status: {
+        getValue(a) {
+            return a.status;
+        },
+        toSQL: (direction: SQLOrderByDirection): SQLOrderBy => {
+            return new SQLOrderBy({
+                column: SQL.column('status'),
+                direction,
+            });
+        },
+    },
+};

package/src/sql-sorters/orders.ts

@@ -21,6 +21,17 @@ export const orderSorters: SQLSortDefinitions<Order> = {
             });
         },
     },
+    updatedAt: {
+        getValue(a) {
+            return Formatter.dateTimeIso(a.updatedAt);
+        },
+        toSQL: (direction: SQLOrderByDirection): SQLOrderBy => {
+            return new SQLOrderBy({
+                column: SQL.column('updatedAt'),
+                direction,
+            });
+        },
+    },
     id: {
         getValue(a) {
             return a.id;

package/src/sql-sorters/tickets.ts

@@ -0,0 +1,46 @@
+import { Ticket } from '@stamhoofd/models';
+import { SQL, SQLOrderBy, SQLOrderByDirection, SQLSortDefinitions } from '@stamhoofd/sql';
+import { Formatter } from '@stamhoofd/utility';
+
+export const ticketSorters: SQLSortDefinitions<Ticket> = {
+    // WARNING! TEST NEW SORTERS THOROUGHLY!
+    // Try to avoid creating sorters on fields that er not 1:1 with the database, that often causes pagination issues if not thought through
+    // An example: sorting on 'name' is not a good idea, because it is a concatenation of two fields.
+    // You might be tempted to use ORDER BY firstName, lastName, but that will not work as expected and it needs to be ORDER BY CONCAT(firstName, ' ', lastName)
+    // Why? Because ORDER BY firstName, lastName produces a different order dan ORDER BY CONCAT(firstName, ' ', lastName) if there are multiple people with spaces in the first name
+    // And that again causes issues with pagination because the next query will append a filter of name > 'John Doe' - causing duplicate and/or skipped results
+    // What if you need mapping? simply map the sorters in the frontend: name -> firstname, lastname, age -> birthDay, etc.
+    createdAt: {
+        getValue(a) {
+            return Formatter.dateTimeIso(a.createdAt);
+        },
+        toSQL: (direction: SQLOrderByDirection): SQLOrderBy => {
+            return new SQLOrderBy({
+                column: SQL.column('createdAt'),
+                direction,
+            });
+        },
+    },
+    updatedAt: {
+        getValue(a) {
+            return Formatter.dateTimeIso(a.updatedAt);
+        },
+        toSQL: (direction: SQLOrderByDirection): SQLOrderBy => {
+            return new SQLOrderBy({
+                column: SQL.column('updatedAt'),
+                direction,
+            });
+        },
+    },
+    id: {
+        getValue(a) {
+            return a.id;
+        },
+        toSQL: (direction: SQLOrderByDirection): SQLOrderBy => {
+            return new SQLOrderBy({
+                column: SQL.column('id'),
+                direction,
+            });
+        },
+    },
+};