@stamhoofd/backend 2.5.0 → 2.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.5.0",
+    "version": "2.6.0",
     "main": "./dist/index.js",
     "exports": {
         ".": {
@@ -48,7 +48,7 @@
         "node-rsa": "1.1.1",
         "openid-client": "^5.4.0",
         "postmark": "4.0.2",
-        "stripe": "^11.5.0"
+        "stripe": "^16.6.0"
     },
-    "gitHead": "07cc26af0e3036e4ae4309a268fbf57b7f6ac2ed"
+    "gitHead": "7a3f9f6c08058dc8b671befbfad73184afdc6d7c"
 }

package/src/endpoints/global/events/PatchEventsEndpoint.ts

@@ -1,6 +1,6 @@
 import { AutoEncoderPatchType, Decoder, PatchableArrayAutoEncoder, PatchableArrayDecoder, patchObject, StringDecoder } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request, Response } from "@simonbackx/simple-endpoints";
-import { Event, Organization, Platform, RegistrationPeriod } from '@stamhoofd/models';
+import { Event, Group, Organization, Platform, RegistrationPeriod } from '@stamhoofd/models';
 import { Event as EventStruct, GroupType, PermissionLevel } from "@stamhoofd/structures";
 
 import { SimpleError } from '@simonbackx/simple-errors';
@@ -80,6 +80,12 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
             event.startDate = put.startDate
             event.endDate = put.endDate
             event.meta = put.meta
+            event.typeId = await PatchEventsEndpoint.validateEventType(put.typeId)
+            await PatchEventsEndpoint.checkEventLimits(event)
+
+            if (!(await Context.auth.canAccessEvent(event, PermissionLevel.Full))) {
+                throw Context.auth.error()
+            }
 
             if (put.group) {
                 const period = await RegistrationPeriod.getByDate(event.startDate)
@@ -99,14 +105,8 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     put.group.organizationId,
                     period.id
                 )
+                await event.syncGroupRequirements(group)
                 event.groupId = group.id
-
-            }
-            event.typeId = await PatchEventsEndpoint.validateEventType(put.typeId)
-            await PatchEventsEndpoint.checkEventLimits(event)
-
-            if (!(await Context.auth.canAccessEvent(event, PermissionLevel.Full))) {
-                throw Context.auth.error()
             }
 
             await event.save()
@@ -130,7 +130,6 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
             event.endDate = patch.endDate ?? event.endDate
             event.meta = patchObject(event.meta, patch.meta)
 
-
             if (patch.organizationId !== undefined) {
                 if (organization?.id && patch.organizationId !== organization.id) {
                     throw new SimpleError({
@@ -210,6 +209,14 @@ export class PatchEventsEndpoint extends Endpoint<Params, Query, Body, ResponseB
             }
 
             await event.save()
+
+            if (event.groupId) {
+                const group = await Group.getByID(event.groupId)
+                if (group) {
+                    await event.syncGroupRequirements(group)
+                }
+            }
+ 
             events.push(event)
         }
 

package/src/endpoints/global/members/GetMembersEndpoint.ts

@@ -157,6 +157,15 @@ const filterCompilers: SQLFilterDefinitions = {
         .where(
             SQL.column('memberId'),
             SQL.column('members', 'id'),
+        ).whereNot(
+            SQL.column('registeredAt'),
+            null,
+        ).where(
+            SQL.column('deactivatedAt'),
+            null,
+        ).where(
+            SQL.column('groups', 'deletedAt'),
+            null
         ),
         {
             ...registrationFilterCompilers,
@@ -245,9 +254,12 @@ const filterCompilers: SQLFilterDefinitions = {
         ).whereNot(
             SQL.column('registeredAt'),
             null,
-        ).whereNot(
-            SQL.column('groups', 'status'),
-            GroupStatus.Archived
+        ).where(
+            SQL.column('deactivatedAt'),
+            null,
+        ).where(
+            SQL.column('groups', 'deletedAt'),
+            null
         ),
         registrationFilterCompilers
     ),
@@ -276,9 +288,9 @@ const filterCompilers: SQLFilterDefinitions = {
         ).whereNot(
             SQL.column('registeredAt'),
             null,
-        ).whereNot(
-            SQL.column('groups', 'status'),
-            GroupStatus.Archived
+        ).where(
+            SQL.column('groups', 'deletedAt'),
+            null
         ),
         organizationFilterCompilers
     ),

package/src/endpoints/global/payments/StripeWebhookEndpoint.ts

@@ -18,6 +18,12 @@ class Body extends AutoEncoder {
     @field({ decoder: StringDecoder })
     id: string
 
+    /**
+     * Events for direct charges
+     */
+    @field({ decoder: StringDecoder, nullable: true, optional: true })
+    account: string|null = null
+
     @field({ decoder: AnyDecoder })
     data: any
 }

package/src/endpoints/global/registration/RegisterMembersEndpoint.ts

@@ -6,7 +6,7 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import { I18n } from '@stamhoofd/backend-i18n';
 import { Email } from '@stamhoofd/email';
 import { BalanceItem, BalanceItemPayment, Group, Member, MemberWithRegistrations, MolliePayment, MollieToken, Organization, PayconiqPayment, Payment, Platform, RateLimiter, Registration, User } from '@stamhoofd/models';
-import { BalanceItemStatus, IDRegisterCheckout, MemberBalanceItem, MemberDetails, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, Payment as PaymentStruct, PermissionLevel, PlatformFamily, PlatformMember, RegisterItem, RegisterResponse, Version } from "@stamhoofd/structures";
+import { BalanceItemStatus, IDRegisterCheckout, MemberBalanceItem, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, Payment as PaymentStruct, PermissionLevel, PlatformFamily, PlatformMember, RegisterItem, RegisterResponse, Version } from "@stamhoofd/structures";
 import { Formatter } from '@stamhoofd/utility';
 
 import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures';
@@ -99,7 +99,9 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             }
         }
 
-        const memberIds = Formatter.uniqueArray(request.body.cart.items.map(i => i.memberId))
+        const memberIds = Formatter.uniqueArray(
+            [...request.body.cart.items.map(i => i.memberId), ...request.body.cart.deleteRegistrations.map(i => i.member.id)]
+        )
         const members = await Member.getBlobByIds(...memberIds)
         const groupIds = Formatter.uniqueArray(request.body.cart.items.map(i => i.groupId))
         const groups = await Group.getByIDs(...groupIds)
@@ -141,11 +143,19 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             platformMembers.push(...family.members)
         }
 
+        const organizationStruct = await AuthenticatedStructures.organization(organization)
         const checkout = request.body.hydrate({
             members: platformMembers,
             groups: await AuthenticatedStructures.groups(groups),
-            organizations: [await AuthenticatedStructures.organization(organization)]
+            organizations: [organizationStruct]
         })
+
+        // Set circular references
+        for (const member of platformMembers) {
+            member.family.checkout = checkout
+        }
+
+        checkout.setDefaultOrganization(organizationStruct)
         
         const registrations: RegistrationWithMemberAndGroup[] = []
         const payRegistrations: {registration: RegistrationWithMemberAndGroup, item: RegisterItem}[] = []
@@ -178,6 +188,8 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             memberBalanceItems = await BalanceItem.getMemberStructure(balanceItems)
         }
 
+        console.log('isAdminFromSameOrganization', checkout.isAdminFromSameOrganization)
+
         // Validate the cart
         checkout.validate({memberBalanceItems})
 
@@ -230,7 +242,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
                     .setRelation(Registration.group, group)
                 
 
-                if (existingRegistration.registeredAt !== null) {
+                if (existingRegistration.registeredAt !== null && existingRegistration.deactivatedAt === null) {
                     throw new SimpleError({
                         code: "already_registered",
                         message: "Dit lid is reeds ingeschreven. Herlaad de pagina en probeer opnieuw."
@@ -260,18 +272,18 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
         }
 
         // Who is going to pay?
-        let whoWillPay: 'member'|'organization'|'nobody' = 'member' // if this is set to 'organization', there will also be created separate balance items so the member can pay back the paying organization
+        let whoWillPayNow: 'member'|'organization'|'nobody' = 'member' // if this is set to 'organization', there will also be created separate balance items so the member can pay back the paying organization
 
         if (request.body.asOrganizationId && request.body.asOrganizationId === organization.id) {
             // Will get added to the outstanding amount of the member
-            whoWillPay = 'nobody'
+            whoWillPayNow = 'nobody'
         } else if (request.body.asOrganizationId && request.body.asOrganizationId !== organization.id) {
             // The organization will pay to the organizing organization, and it will get added to the outstanding amount of the member towards the paying organization
-            whoWillPay = 'organization'
+            whoWillPayNow = 'organization'
         }
 
         // Validate payment method
-        if (totalPrice > 0 && whoWillPay !== 'nobody') {
+        if (totalPrice > 0 && whoWillPayNow !== 'nobody') {
             const allowedPaymentMethods = organization.meta.registrationPaymentConfiguration.paymentMethods
 
             if (!checkout.paymentMethod || !allowedPaymentMethods.includes(checkout.paymentMethod)) {
@@ -292,10 +304,10 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             checkout.paymentMethod = PaymentMethod.Unknown
         }
 
-        console.log('Registering members using whoWillPay', whoWillPay, checkout.paymentMethod, totalPrice)
+        console.log('Registering members using whoWillPayNow', whoWillPayNow, checkout.paymentMethod, totalPrice)
 
         const items: BalanceItem[] = []
-        const shouldMarkValid = whoWillPay === 'nobody' || checkout.paymentMethod === PaymentMethod.Transfer || checkout.paymentMethod === PaymentMethod.PointOfSale
+        const shouldMarkValid = whoWillPayNow === 'nobody' || checkout.paymentMethod === PaymentMethod.Transfer || checkout.paymentMethod === PaymentMethod.PointOfSale
 
         // Save registrations and add extra data if needed
         for (const bundle of payRegistrations) {
@@ -330,7 +342,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
 
             // Who is responsible for payment?
             let balanceItem2: BalanceItem | null = null
-            if (whoWillPay === 'organization' && request.body.asOrganizationId) {
+            if (whoWillPayNow === 'organization' && request.body.asOrganizationId) {
                 // Create a separate balance item for this meber to pay back the paying organization
                 // this is not yet associated with a payment but will be added to the outstanding balance of the member
 
@@ -391,7 +403,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             items.push(balanceItem)
         }
 
-        if (checkout.administrationFee && whoWillPay !== 'nobody') {
+        if (checkout.administrationFee && whoWillPayNow !== 'nobody') {
             // Create balance item
             const balanceItem = new BalanceItem();
             balanceItem.price = checkout.administrationFee
@@ -415,14 +427,67 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             items.push(balanceItem)
         }
 
-        if (checkout.cart.balanceItems.length && whoWillPay === 'nobody') {
-            throw new Error('Not possible to pay balance items when whoWillPay is nobody')
+        if (checkout.cart.balanceItems.length && whoWillPayNow === 'nobody') {
+            throw new Error('Not possible to pay balance items when whoWillPayNow is nobody')
+        }
+
+        // Create negative balance items
+        for (const registrationStruct of checkout.cart.deleteRegistrations) {
+            if (whoWillPayNow !== 'nobody') {
+                // this also fixes the issue that we cannot delete the registration right away if we would need to wait for a payment 
+                throw new SimpleError({
+                    code: "forbidden",
+                    message: "Permission denied: you are not allowed to delete registrations",
+                    human: "Oeps, je hebt geen toestemming om inschrijvingen te verwijderen.",
+                    statusCode: 403
+                })
+            }
+
+            const existingRegistration = await Registration.getByID(registrationStruct.id)
+            if (!existingRegistration || existingRegistration.organizationId !== organization.id) {
+                throw new SimpleError({
+                    code: "invalid_data",
+                    message: "Oeps, één of meerdere inschrijvingen die je probeert te verwijderen lijken niet meer te bestaan. Herlaad de pagina en probeer opnieuw."
+                })
+            }
+
+            if (!await Context.auth.canAccessRegistration(existingRegistration, PermissionLevel.Write)) {
+                throw new SimpleError({
+                    code: "forbidden",
+                    message: "Je hebt geen toegaansrechten om deze inschrijving te verwijderen.",
+                    statusCode: 403
+                })
+            }
+
+            if (existingRegistration.deactivatedAt || !existingRegistration.registeredAt) {
+                throw new SimpleError({
+                    code: "invalid_data",
+                    message: "Oeps, één of meerdere inschrijvingen die je probeert te verwijderen was al verwijderd. Herlaad de pagina en probeer opnieuw."
+                })
+            }
+
+            // We can alter right away since whoWillPayNow is nobody, and shouldMarkValid will always be true
+            // Find all balance items of this registration and set them to zero
+            await BalanceItem.deleteForDeletedRegistration(existingRegistration.id)
+            
+            // Clear the registration
+            existingRegistration.deactivatedAt = new Date()
+            await existingRegistration.save()
+            existingRegistration.scheduleStockUpdate()
+
+            const group = groups.find(g => g.id === existingRegistration.groupId)
+            if (!group) {
+                const g = await Group.getByID(existingRegistration.groupId)
+                if (g) {
+                    groups.push(g)
+                }
+            }
         }
 
         let paymentUrl: string | null = null
         let payment: Payment | null = null
 
-        if (whoWillPay !== 'nobody') {
+        if (whoWillPayNow !== 'nobody') {
             const mappedBalanceItems = new Map<BalanceItem, number>()
 
             for (const item of items) {
@@ -452,11 +517,11 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             }
         }
 
-        await ExchangePaymentEndpoint.updateOutstanding(items, organization.id)
+        await BalanceItem.updateOutstanding(items, organization.id)
 
         // Update occupancy
         for (const group of groups) {
-            if (registrations.find(p => p.groupId === group.id)) {
+            if (registrations.find(p => p.groupId === group.id) || checkout.cart.deleteRegistrations.find(p => p.groupId === group.id)) {
                 await group.updateOccupancy()
                 await group.save()
             }
@@ -501,10 +566,12 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
         }
 
         if (totalPrice < 0) {
-            throw new SimpleError({
-                code: "empty_data",
-                message: "Oeps! De totaalprijs is negatief."
-            })
+            // No payment needed: the outstanding balance will be negative and can be used in the future
+            return;
+            // throw new SimpleError({
+            //     code: "empty_data",
+            //     message: "Oeps! De totaalprijs is negatief."
+            // })
         }
 
         if (totalPrice === 0) {
@@ -595,11 +662,14 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             }
 
             const _redirectUrl = new URL(checkout.redirectUrl)
-            _redirectUrl.searchParams.set('id', payment.id);
-            
+            _redirectUrl.searchParams.set('paymentId', payment.id);
+            _redirectUrl.searchParams.set('organizationId', organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
+
             const _cancelUrl = new URL(checkout.cancelUrl)
-            _cancelUrl.searchParams.set('id', payment.id);
-            
+            _cancelUrl.searchParams.set('paymentId', payment.id);
+            _cancelUrl.searchParams.set('cancel', 'true');
+            _cancelUrl.searchParams.set('organizationId', organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
+
             const redirectUrl = _redirectUrl.href
             const cancelUrl = _cancelUrl.href
 

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -132,6 +132,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
 
             for (const groupPut of patch.groups.getPuts()) {
                 await PatchOrganizationRegistrationPeriodsEndpoint.createGroup(groupPut.put, organization.id, organizationPeriod.periodId, {allowedIds})
+                deleteUnreachable = true
             }
 
             for (const struct of patch.groups.getPatches()) {

package/src/endpoints/organization/dashboard/stripe/ConnectStripeEndpoint.ts

@@ -46,17 +46,22 @@ export class ConnectMollieEndpoint extends Endpoint<Params, Query, Body, Respons
             })
         }
 
-        const type = 'express'
+        const type = STAMHOOFD.STRIPE_CONNECT_METHOD
 
-        let expressData: Stripe.AccountCreateParams = {
-            country: organization.address.country,
-            // Problem: we cannot set company or business_type, because then it defaults the structure of the company to one that requires a company number
+        const sharedData: Stripe.AccountCreateParams = {
             capabilities: {
                 card_payments: { requested: true },
                 transfers: { requested: true },
                 bancontact_payments: { requested: true },
                 ideal_payments: { requested: true },
             },
+        }
+
+        let expressData: Stripe.AccountCreateParams = {
+            country: organization.address.country,
+            controller: {
+                requirement_collection: 'application',
+            },
             settings: {
                 payouts: {
                     schedule: {
@@ -76,6 +81,7 @@ export class ConnectMollieEndpoint extends Endpoint<Params, Query, Body, Respons
         const stripe = StripeHelper.getInstance()
         const account = await stripe.accounts.create({
             type,
+            ...sharedData,
             ...expressData
         });
 

package/src/endpoints/organization/dashboard/stripe/GetStripeAccountLinkEndpoint.ts

@@ -68,7 +68,10 @@ export class GetStripeAccountLinkEndpoint extends Endpoint<Params, Query, Body,
             refresh_url: request.body.refreshUrl,
             return_url: request.body.returnUrl,
             type: 'account_onboarding',
-            collect: model.meta.type === 'express' ? 'eventually_due' : undefined, // Collect all at the start
+            collection_options: {
+                fields: 'eventually_due',
+                future_requirements: 'include'
+            }
         });
 
         return new Response(ResponseBody.create({

package/src/endpoints/organization/dashboard/stripe/GetStripeLoginLinkEndpoint.ts

@@ -59,6 +59,12 @@ export class GetStripeLoginLinkEndpoint extends Endpoint<Params, Query, Body, Re
             })
         }
 
+        if (model.meta.type === 'standard') {
+            return new Response(ResponseBody.create({
+                url: 'https://dashboard.stripe.com/'
+            }));
+        }
+
         const stripe = StripeHelper.getInstance()
         const accountLink = await stripe.accounts.createLoginLink(model.accountId);
 

package/src/endpoints/organization/dashboard/webshops/PatchWebshopOrdersEndpoint.ts

@@ -243,13 +243,18 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                 // Update balance item prices for this order if price has changed
                 if (previousToPay !== model.totalToPay) {
                     const items = await BalanceItem.where({ orderId: model.id })
-                    if (items.length === 1) {
+                    if (items.length >= 1) {
                         model.markUpdated()
                         items[0].price = model.totalToPay
                         items[0].description = model.generateBalanceDescription(webshop)
                         items[0].updateStatus();
                         await items[0].save()
-                    } else if (items.length === 0 && model.totalToPay > 0) {
+
+                        // Zero out the other items
+                        const otherItems = items.slice(1)
+                        await BalanceItem.deleteItems(otherItems)
+                    } else if (items.length === 0
+                         && model.totalToPay > 0) {
                         model.markUpdated()
                         const balanceItem = new BalanceItem();
                         balanceItem.orderId = model.id;

package/src/endpoints/organization/shared/ExchangePaymentEndpoint.ts

@@ -2,11 +2,11 @@ import { createMollieClient } from '@mollie/api-client';
 import { AutoEncoder, BooleanDecoder, Decoder, field } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request, Response } from "@simonbackx/simple-endpoints";
 import { SimpleError } from "@simonbackx/simple-errors";
-import { BalanceItem, BalanceItemPayment, Member, MolliePayment, MollieToken, Organization, PayconiqPayment, Payment, Registration, STPendingInvoice } from '@stamhoofd/models';
+import { BalanceItem, BalanceItemPayment, MolliePayment, MollieToken, Organization, PayconiqPayment, Payment, STPendingInvoice } from '@stamhoofd/models';
 import { QueueHandler } from '@stamhoofd/queues';
-import { Payment as PaymentStruct, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, STInvoiceItem } from "@stamhoofd/structures";
-import { Formatter } from '@stamhoofd/utility';
+import { PaymentGeneral, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, STInvoiceItem } from "@stamhoofd/structures";
 
+import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures';
 import { BuckarooHelper } from '../../../helpers/BuckarooHelper';
 import { Context } from '../../../helpers/Context';
 import { StripeHelper } from '../../../helpers/StripeHelper';
@@ -27,7 +27,7 @@ class Query extends AutoEncoder {
     cancel = false
 }
 type Body = undefined
-type ResponseBody = PaymentStruct | undefined;
+type ResponseBody = PaymentGeneral | undefined
 
 /**
  * One endpoint to create, patch and delete groups. Usefull because on organization setup, we need to create multiple groups at once. Also, sometimes we need to link values and update multiple groups at once
@@ -51,6 +51,9 @@ export class ExchangePaymentEndpoint extends Endpoint<Params, Query, Body, Respo
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOrganizationScope()
+        if (!request.query.exchange) {
+            await Context.authenticate()
+        }
         
         // Not method on payment because circular references (not supprted in ts)
         const payment = await ExchangePaymentEndpoint.pollStatus(request.params.id, organization, request.query.cancel)
@@ -66,28 +69,9 @@ export class ExchangePaymentEndpoint extends Endpoint<Params, Query, Body, Respo
         }
         
         return new Response( 
-            PaymentStruct.create({
-                id: payment.id,
-                method: payment.method,
-                provider: payment.provider,
-                status: payment.status,
-                price: payment.price,
-                transferDescription: payment.transferDescription,
-                paidAt: payment.paidAt,
-                createdAt: payment.createdAt,
-                updatedAt: payment.updatedAt
-            })
+            await AuthenticatedStructures.paymentGeneral(payment, true)
         );
     }
-    
-    static async updateOutstanding(items: BalanceItem[], organizationId: string) {
-        // Update outstanding amount of related members and registrations
-        const memberIds: string[] = Formatter.uniqueArray(items.map(p => p.memberId).filter(id => id !== null)) as any
-        await Member.updateOutstandingBalance(memberIds)
-
-        const registrationIds: string[] = Formatter.uniqueArray(items.map(p => p.registrationId).filter(id => id !== null)) as any
-        await Registration.updateOutstandingBalance(registrationIds, organizationId)
-    }
 
     static async handlePaymentStatusUpdate(payment: Payment, organization: Organization, status: PaymentStatus) {
         if (payment.status === status) {
@@ -110,7 +94,7 @@ export class ExchangePaymentEndpoint extends Endpoint<Params, Query, Body, Respo
                     await balanceItemPayment.markPaid(organization);
                 }
 
-                await this.updateOutstanding(balanceItemPayments.map(p => p.balanceItem), organization.id)
+                await BalanceItem.updateOutstanding(balanceItemPayments.map(p => p.balanceItem), organization.id)
             })
 
             if (!wasPaid && payment.provider === PaymentProvider.Buckaroo && payment.method) {
@@ -153,7 +137,7 @@ export class ExchangePaymentEndpoint extends Endpoint<Params, Query, Body, Respo
                     await balanceItemPayment.undoPaid(organization);
                 }
 
-                await this.updateOutstanding(balanceItemPayments.map(p => p.balanceItem), organization.id)
+                await BalanceItem.updateOutstanding(balanceItemPayments.map(p => p.balanceItem), organization.id)
             })
         }
         
@@ -167,7 +151,7 @@ export class ExchangePaymentEndpoint extends Endpoint<Params, Query, Body, Respo
                     await balanceItemPayment.markFailed(organization);
                 }
 
-                await this.updateOutstanding(balanceItemPayments.map(p => p.balanceItem), organization.id)
+                await BalanceItem.updateOutstanding(balanceItemPayments.map(p => p.balanceItem), organization.id)
             })
         }
 

package/src/helpers/AdminPermissionChecker.ts

@@ -366,8 +366,7 @@ export class AdminPermissionChecker {
         permissionLevel: PermissionLevel = PermissionLevel.Read,
         data?: {
             registrations: Registration[],
-            orders: Order[],
-            members: Member[]
+            orders: Order[]
         }
     ): Promise<boolean> {
         for (const balanceItem of balanceItems) {
@@ -403,7 +402,7 @@ export class AdminPermissionChecker {
         }
 
         // Slight optimization possible here
-        const {registrations, orders, members} = data ?? (this.user.permissions || permissionLevel === PermissionLevel.Read) ? (await Payment.loadBalanceItemRelations(balanceItems)) : {registrations: [], members: [] as Member[], orders: []}
+        const {registrations, orders} = data ?? (this.user.permissions || permissionLevel === PermissionLevel.Read) ? (await Payment.loadBalanceItemRelations(balanceItems)) : {registrations: [], orders: []}
 
         if (this.user.permissions) {
             // We grant permission for a whole payment when the user has at least permission for a part of that payment.
@@ -431,7 +430,7 @@ export class AdminPermissionChecker {
             // Check members
             const userMembers = await Member.getMembersWithRegistrationForUser(this.user)
             for (const member of userMembers) {
-                if (members.find(m => m.id === member.id)) {
+                if (balanceItems.find(m => m.memberId === member.id)) {
                     return true;
                 }
             }

package/src/helpers/AuthenticatedStructures.ts

@@ -26,11 +26,11 @@ export class AuthenticatedStructures {
         }
 
         const {balanceItemPayments, balanceItems} = await Payment.loadBalanceItems(payments)
-        const {registrations, orders, members, groups} = await Payment.loadBalanceItemRelations(balanceItems);
+        const {registrations, orders, groups} = await Payment.loadBalanceItemRelations(balanceItems);
 
         if (checkPermissions) {
             // Note: permission checking is moved here for performacne to avoid loading the data multiple times
-            if (!(await Context.auth.canAccessBalanceItems(balanceItems, PermissionLevel.Read, {registrations, orders, members}))) {
+            if (!(await Context.auth.canAccessBalanceItems(balanceItems, PermissionLevel.Read, {registrations, orders}))) {
                 throw new SimpleError({
                     code: "not_found",
                     message: "Payment not found",
@@ -41,13 +41,12 @@ export class AuthenticatedStructures {
 
         const includeSettlements = checkPermissions && !!Context.user && !!Context.user.permissions
 
-        return Payment.getGeneralStructureFromRelations({
+        return await Payment.getGeneralStructureFromRelations({
             payments,
             balanceItemPayments,
             balanceItems,
             registrations,
             orders,
-            members,
             groups
         }, includeSettlements)
     }

package/src/helpers/MemberUserSyncer.ts

@@ -15,7 +15,8 @@ export class MemberUserSyncerStatic {
             userEmails.push(member.details.email)
         }
 
-        const parentEmails = member.details.parentsHaveAccess ? member.details.parents.flatMap(p => p.email ? [p.email, ...p.alternativeEmails] : p.alternativeEmails) : []
+        const uncategorizedEmails: string[] = member.details.uncategorizedEmails;
+        const parentAndUncategorizedEmails = member.details.parentsHaveAccess ? member.details.parents.flatMap(p => p.email ? [p.email, ...p.alternativeEmails] : p.alternativeEmails).concat(uncategorizedEmails) : []
 
         // Make sure all these users have access to the member
         for (const email of userEmails) {
@@ -23,18 +24,17 @@ export class MemberUserSyncerStatic {
             await this.linkUser(email, member, false)
         }
 
-        for (const email of parentEmails) {
-            // Link parents
+        for (const email of parentAndUncategorizedEmails) {
+            // Link parents and uncategorized emails
             await this.linkUser(email, member, true)
         }
 
         // Remove access of users that are not in this list
         for (const user of member.users) {
-            if (!userEmails.includes(user.email) && !parentEmails.includes(user.email)) {
+            if (!userEmails.includes(user.email) && !parentAndUncategorizedEmails.includes(user.email)) {
                 await this.unlinkUser(user, member)
             }
         }
-
     }
 
     async onDeleteMember(member: MemberWithRegistrations) {

package/src/helpers/StripeHelper.ts

@@ -6,8 +6,46 @@ import { Formatter } from '@stamhoofd/utility';
 import Stripe from 'stripe';
 
 export class StripeHelper {
-    static getInstance() {
-        return new Stripe(STAMHOOFD.STRIPE_SECRET_KEY, {apiVersion: '2022-11-15', typescript: true, maxNetworkRetries: 0, timeout: 10000});
+    static getInstance(accountId: string|null = null) {
+        return new Stripe(STAMHOOFD.STRIPE_SECRET_KEY, {apiVersion: '2024-06-20', typescript: true, maxNetworkRetries: 0, timeout: 10000, stripeAccount: accountId ?? undefined});
+    }
+
+    static async saveChargeInfo(model: StripePaymentIntent|StripeCheckoutSession, charge: Stripe.Charge, payment: Payment) {
+        try {
+            if (model.accountId) {
+                // This is a direct charge
+                
+                if (charge.balance_transaction !== null && typeof charge.balance_transaction !== 'string') {
+                    const fees = charge.balance_transaction.fee;
+                    payment.transferFee = fees;
+                }
+            }
+
+            if (charge.billing_details.name) {
+                payment.ibanName = charge.billing_details.name
+            }
+
+            if (charge.payment_method_details?.bancontact) {
+                if (charge.payment_method_details.bancontact.iban_last4) {
+                    payment.iban = "xxxx " + charge.payment_method_details.bancontact.iban_last4
+                }
+                payment.ibanName = charge.payment_method_details.bancontact.verified_name
+            }
+            if (charge.payment_method_details?.ideal) {
+                if (charge.payment_method_details.ideal.iban_last4) {
+                    payment.iban = "xxxx " + charge.payment_method_details.ideal.iban_last4
+                }
+                payment.ibanName = charge.payment_method_details.ideal.verified_name
+            }
+            if (charge.payment_method_details?.card) {
+                if (charge.payment_method_details.card.last4) {
+                    payment.iban = "xxxx " + charge.payment_method_details.card.last4
+                }
+            }
+            await payment.save()
+        } catch (e) {
+            console.error('Failed processing charge', e)
+        }
     }
 
     static async getStatus(payment: Payment, cancel = false, testMode = false): Promise<PaymentStatus> {
@@ -22,37 +60,15 @@ export class StripeHelper {
             return await this.getStatusFromCheckoutSession(payment, cancel)
         }
 
-        const stripe = this.getInstance()
+        const stripe = this.getInstance(model.accountId)
 
-        let intent = await stripe.paymentIntents.retrieve(model.stripeIntentId)
+        let intent = await stripe.paymentIntents.retrieve(model.stripeIntentId, {
+            expand: ['latest_charge.balance_transaction']
+        })
         console.log(intent);
         if (intent.status === "succeeded") {
-            if (intent.latest_charge) {
-                try {
-                    const charge = await stripe.charges.retrieve(typeof intent.latest_charge === 'string' ? intent.latest_charge : intent.latest_charge.id)
-                    if (charge.payment_method_details?.bancontact) {
-                        if (charge.payment_method_details.bancontact.iban_last4) {
-                            payment.iban = "xxxx " + charge.payment_method_details.bancontact.iban_last4
-                        }
-                        payment.ibanName = charge.payment_method_details.bancontact.verified_name
-                        await payment.save()
-                    }
-                    if (charge.payment_method_details?.ideal) {
-                        if (charge.payment_method_details.ideal.iban_last4) {
-                            payment.iban = "xxxx " + charge.payment_method_details.ideal.iban_last4
-                        }
-                        payment.ibanName = charge.payment_method_details.ideal.verified_name
-                        await payment.save()
-                    }
-                    if (charge.payment_method_details?.card) {
-                        if (charge.payment_method_details.card.last4) {
-                            payment.iban = "xxxx " + charge.payment_method_details.card.last4
-                        }
-                        await payment.save()
-                    }
-                } catch (e) {
-                    console.error('Failed fatching charge', e)
-                }
+            if (intent.latest_charge !== null && typeof intent.latest_charge !== 'string') {
+                await this.saveChargeInfo(model, intent.latest_charge, payment)
             }
             return PaymentStatus.Succeeded
         }
@@ -93,10 +109,22 @@ export class StripeHelper {
             return PaymentStatus.Failed
         }
 
-        const stripe = this.getInstance()
-        const session = await stripe.checkout.sessions.retrieve(model.stripeSessionId)
+        const stripe = this.getInstance(model.accountId)
+        const session = await stripe.checkout.sessions.retrieve(model.stripeSessionId, {
+            expand: ['payment_intent.latest_charge.balance_transaction']
+        })
+
         console.log("session", session);
+
         if (session.status === "complete") {
+            // This is a direct charge
+            const payment_intent = session.payment_intent
+            if (payment_intent !== null && typeof payment_intent !== 'string') {
+                const charge = payment_intent.latest_charge
+                if (charge !== null && typeof charge !== 'string') {
+                    await this.saveChargeInfo(model, charge, payment)
+                }
+            }
             return PaymentStatus.Succeeded
         }
         if (session.status === "expired") {
@@ -145,6 +173,7 @@ export class StripeHelper {
         const totalPrice = payment.price;
 
         let fee = 0;
+        let directCharge = false;
         const vat = calculateVATPercentage(organization.address, organization.meta.VATNumber)
         function calculateFee(fixed: number, percentageTimes100: number) {
             return Math.round(Math.round(fixed + Math.max(1, totalPrice * percentageTimes100 / 100 / 100)) * (100 + vat) / 100); // € 0,21 + 0,2%
@@ -158,6 +187,12 @@ export class StripeHelper {
             fee = calculateFee(25, 150); // € 0,25 + 1,5%
         }
 
+        if (stripeAccount.meta.type === 'standard') {
+            // Submerchant is charged by Stripe for the fees directly
+            fee = 0;
+            directCharge = true;
+        }
+
         payment.transferFee = fee;
 
         const fullMetadata = {
@@ -165,7 +200,7 @@ export class StripeHelper {
             organizationVATNumber: organization.meta.VATNumber
         }
 
-        const stripe = StripeHelper.getInstance()
+        const stripe = StripeHelper.getInstance(directCharge ? stripeAccount.accountId : null)
         let paymentUrl: string
 
         // Bancontact or iDEAL: use payment intends
@@ -185,12 +220,12 @@ export class StripeHelper {
                 payment_method_types: [payment.method.toLowerCase()],
                 statement_descriptor: Formatter.slug(statementDescriptor).substring(0, 22).toUpperCase(),
                 application_fee_amount: fee,
-                on_behalf_of: stripeAccount.accountId,
+                on_behalf_of: !directCharge ? stripeAccount.accountId : undefined,
                 confirm: true,
                 return_url: redirectUrl,
-                transfer_data: {
+                transfer_data: !directCharge ?  {
                     destination: stripeAccount.accountId,
-                },
+                } : undefined,
                 metadata: fullMetadata,
                 payment_method_options: {bancontact: {preferred_language: ['nl', 'fr', 'de', 'en'].includes(i18n.language) ? i18n.language as 'en' : 'nl'}},
             });
@@ -213,6 +248,10 @@ export class StripeHelper {
             paymentIntentModel.paymentId = payment.id
             paymentIntentModel.stripeIntentId = paymentIntent.id
             paymentIntentModel.organizationId = organization.id
+
+            if (directCharge) {
+                paymentIntentModel.accountId = stripeAccount.accountId
+            }
             await paymentIntentModel.save()
         } else {
             // Build Stripe line items
@@ -253,11 +292,11 @@ export class StripeHelper {
                 currency: 'eur',
                 locale: i18n.language as 'nl',
                 payment_intent_data: {
-                    on_behalf_of: stripeAccount.accountId,
+                    on_behalf_of: !directCharge ? stripeAccount.accountId : undefined,
                     application_fee_amount: fee,
-                    transfer_data: {
+                    transfer_data: !directCharge ? {
                         destination: stripeAccount.accountId,
-                    },
+                    } : undefined,
                     metadata: fullMetadata,
                     statement_descriptor: Formatter.slug(statementDescriptor).substring(0, 22).toUpperCase(),
                 },
@@ -281,6 +320,10 @@ export class StripeHelper {
             paymentIntentModel.paymentId = payment.id
             paymentIntentModel.stripeSessionId = session.id
             paymentIntentModel.organizationId = organization.id
+
+            if (directCharge) {
+                paymentIntentModel.accountId = stripeAccount.accountId
+            }
             await paymentIntentModel.save()
         }
 
@@ -290,4 +333,4 @@ export class StripeHelper {
             paymentUrl
         }
     }
-}
+}

package/src/helpers/StripePayoutChecker.ts

@@ -9,7 +9,7 @@ export class StripePayoutChecker {
     constructor({secretKey, stripeAccount}: { secretKey: string, stripeAccount?: string}) {
         this.stripe = new Stripe(
             secretKey, {
-                apiVersion: '2022-11-15', 
+                apiVersion: '2024-06-20', 
                 typescript: true, 
                 maxNetworkRetries: 1, 
                 timeout: 10000,
@@ -18,7 +18,7 @@ export class StripePayoutChecker {
 
         this.stripePlatform = new Stripe(
             secretKey, {
-                apiVersion: '2022-11-15', 
+                apiVersion: '2024-06-20', 
                 typescript: true, 
                 maxNetworkRetries: 1, 
                 timeout: 10000
@@ -147,6 +147,8 @@ export class StripePayoutChecker {
         }
 
         const applicationFee = balanceItem.source.application_fee_amount;
+        const otherFees = balanceItem.fee
+        const totalFees = otherFees + (applicationFee ?? 0);
 
         // Cool, we can store this in the database now.
 
@@ -167,11 +169,11 @@ export class StripePayoutChecker {
             settledAt: new Date(payout.arrival_date * 1000),
             amount: payout.amount,
             // Set only if application fee is witheld
-            fee: applicationFee ?? 0
+            fee: totalFees
         });
 
         payment.settlement = settlement;
-        payment.transferFee = applicationFee ?? 0;
+        payment.transferFee = totalFees;
 
         // Force an updatedAt timestamp of the related order
         // Mark order as 'updated', or the frontend won't pull in the updates
@@ -185,4 +187,4 @@ export class StripePayoutChecker {
         await payment.save();
     }
 
-}
+}