@stamhoofd/backend 2.6.0 → 2.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.6.0",
+    "version": "2.8.0",
     "main": "./dist/index.js",
     "exports": {
         ".": {
@@ -50,5 +50,5 @@
         "postmark": "4.0.2",
         "stripe": "^16.6.0"
     },
-    "gitHead": "7a3f9f6c08058dc8b671befbfad73184afdc6d7c"
+    "gitHead": "1e0e1853f8dea6b47718433b2890907042c17ddc"
 }

package/src/endpoints/global/events/GetEventsEndpoint.ts

@@ -23,7 +23,7 @@ const filterCompilers: SQLFilterDefinitions = {
     startDate: createSQLColumnFilterCompiler('startDate'),
     endDate: createSQLColumnFilterCompiler('endDate'),
     groupIds: createSQLExpressionFilterCompiler(
-        SQL.jsonValue(SQL.column('meta'), '$.value.groupIds'),
+        SQL.jsonValue(SQL.column('meta'), '$.value.groups[*].id'),
         undefined,
         true,
         true
@@ -35,7 +35,10 @@ const filterCompilers: SQLFilterDefinitions = {
         true
     ),
     organizationTagIds: createSQLExpressionFilterCompiler(
-        SQL.jsonValue(SQL.column('meta'), '$.value.organizationTagIds')
+        SQL.jsonValue(SQL.column('meta'), '$.value.organizationTagIds'),
+        undefined,
+        true,
+        true
     )
 }
 

package/src/endpoints/global/members/GetMembersEndpoint.ts

@@ -3,8 +3,8 @@ import { Decoder } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Email, Member, MemberWithRegistrations, Platform } from '@stamhoofd/models';
-import { SQL, SQLAge, SQLConcat, SQLFilterDefinitions, SQLJSONValue, SQLOrderBy, SQLOrderByDirection, SQLScalar, SQLSortDefinitions, baseSQLFilterCompilers, compileToSQLFilter, compileToSQLSorter, createSQLColumnFilterCompiler, createSQLExpressionFilterCompiler, createSQLFilterNamespace, createSQLRelationFilterCompiler, joinSQLQuery } from "@stamhoofd/sql";
-import { CountFilteredRequest, EmailRecipientFilterType, GroupStatus, LimitedFilteredRequest, MembersBlob, PaginatedResponse, PermissionLevel, StamhoofdFilter, getSortFilter, mergeFilters } from '@stamhoofd/structures';
+import { SQL, SQLAge, SQLConcat, SQLFilterDefinitions, SQLOrderBy, SQLOrderByDirection, SQLScalar, SQLSortDefinitions, baseSQLFilterCompilers, compileToSQLFilter, compileToSQLSorter, createSQLColumnFilterCompiler, createSQLExpressionFilterCompiler, createSQLFilterNamespace, createSQLRelationFilterCompiler, joinSQLQuery } from "@stamhoofd/sql";
+import { CountFilteredRequest, EmailRecipientFilterType, LimitedFilteredRequest, MembersBlob, PaginatedResponse, PermissionLevel, StamhoofdFilter, getSortFilter, mergeFilters } from '@stamhoofd/structures';
 import { DataValidator, Formatter } from '@stamhoofd/utility';
 
 import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures';
@@ -36,6 +36,7 @@ Email.recipientLoaders.set(EmailRecipientFilterType.Members, {
         return await q.count();
     }
 });
+
 Email.recipientLoaders.set(EmailRecipientFilterType.MemberParents, {
     fetch: async (query: LimitedFilteredRequest) => {
         const result = await GetMembersEndpoint.buildData(query)
@@ -54,6 +55,24 @@ Email.recipientLoaders.set(EmailRecipientFilterType.MemberParents, {
     }
 });
 
+Email.recipientLoaders.set(EmailRecipientFilterType.MemberUnverified, {
+    fetch: async (query: LimitedFilteredRequest) => {
+        const result = await GetMembersEndpoint.buildData(query)
+
+        return new PaginatedResponse({
+            results: result.results.members.flatMap(m => m.getEmailRecipients(['unverified'])),
+            next: result.next
+        });
+    },
+
+    count: async (query: LimitedFilteredRequest) => {
+        const q = await GetMembersEndpoint.buildQuery(query)
+        return await q.sum(
+            SQL.jsonLength(SQL.column('details'), '$.value.unverifiedEmails')
+        );
+    }
+});
+
 const registrationFilterCompilers: SQLFilterDefinitions = {
     ...baseSQLFilterCompilers,
     "price": createSQLColumnFilterCompiler('price'),
@@ -378,9 +397,6 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                                 }
                             },
                             periodId: platform.periodId,
-                            registeredAt: {
-                                $neq: null
-                            },
                             group: {
                                 defaultAgeGroupId: {
                                     $neq: null
@@ -397,16 +413,26 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             const groups = await Context.auth.getAccessibleGroups(organization.id)
 
             if (groups === 'all') {
-                scopeFilter = {
-                    registrations: {
-                        $elemMatch: {
-                            organizationId: organization.id,
-                            registeredAt: {
-                                $neq: null
+                if (await Context.auth.hasFullAccess(organization.id)) {
+                    // Can access full history for now
+                    scopeFilter = {
+                        registrations: {
+                            $elemMatch: {
+                                organizationId: organization.id,
                             }
                         }
-                    }
-                };
+                    };
+                } else {
+                    // Can only access current period
+                    scopeFilter = {
+                        registrations: {
+                            $elemMatch: {
+                                organizationId: organization.id,
+                                periodId: organization.periodId,
+                            }
+                        }
+                    };
+                }
             } else {
                 scopeFilter = {
                     registrations: {
@@ -415,9 +441,6 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                             periodId: organization.periodId,
                             groupId: {
                                 $in: groups
-                            },
-                            registeredAt: {
-                                $neq: null
                             }
                         }
                     }

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.ts

@@ -76,15 +76,6 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
         const balanceItemRegistrationIdsPerOrganization: Map<string, string[]> = new Map()
         const updateMembershipMemberIds = new Set<string>()
 
-        function addBalanceItemRegistrationId(organizationId: string, registrationId: string) {
-            const existing = balanceItemRegistrationIdsPerOrganization.get(organizationId);
-            if (existing) {
-                existing.push(registrationId)
-                return;
-            }
-            balanceItemRegistrationIdsPerOrganization.set(organizationId, [registrationId])
-        }
-
         // Loop all members one by one
         for (const put of request.body.getPuts()) {
             const struct = put.put
@@ -118,38 +109,14 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
                 }
             }
 
-            if (struct.registrations.length === 0) {
-                // We risk creating a new member without being able to access it manually afterwards
-
-                if ((organization && !await Context.auth.hasFullAccess(organization.id)) || (!organization && !Context.auth.hasPlatformFullAccess())) {
-                    throw new SimpleError({
-                        code: "missing_group",
-                        message: "Missing group",
-                        human: "Je moet hoofdbeheerder zijn om een lid toe te voegen zonder inschrijving in het systeem",
-                        statusCode: 400
-                    })
-                }
-            }
-
-            // Throw early
-            for (const registrationStruct of struct.registrations) {
-                const group = await getGroup(registrationStruct.groupId)
-                if (!group || group.organizationId !== registrationStruct.organizationId || !await Context.auth.canAccessGroup(group, PermissionLevel.Write)) {
-                    throw Context.auth.notFoundOrNoAccess("Je hebt niet voldoende rechten om leden toe te voegen in deze groep")
-                }
-
-                const period = await RegistrationPeriod.getByID(group.periodId)
-                if (!period || period.locked) {
-                    throw new SimpleError({
-                        code: "period_locked",
-                        message: "Deze inschrijvingsperiode is afgesloten en staat geen wijzigingen meer toe.",
-                    })
-                }
-
-                // Set organization id of member based on registrations
-                if (!organization && STAMHOOFD.userMode !== 'platform' && !member.organizationId) {
-                    member.organizationId = group.organizationId
-                }
+            // We risk creating a new member without being able to access it manually afterwards
+            if ((organization && !await Context.auth.hasFullAccess(organization.id)) || (!organization && !Context.auth.hasPlatformFullAccess())) {
+                throw new SimpleError({
+                    code: "missing_group",
+                    message: "Missing group",
+                    human: "Je moet hoofdbeheerder zijn om een lid toe te voegen in het systeem",
+                    statusCode: 400
+                })
             }
 
             if (STAMHOOFD.userMode !== 'platform' && !member.organizationId) {
@@ -167,16 +134,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
             if ((STAMHOOFD.environment == "development" || STAMHOOFD.environment == "staging") && organization) {
                 if (member.details.firstName.toLocaleLowerCase() == "create" && parseInt(member.details.lastName) > 0) {
                     const count = parseInt(member.details.lastName);
-                    let group = groups[0];
-
-                    for (const registrationStruct of struct.registrations) {
-                        const g = await getGroup(registrationStruct.groupId)
-                        if (g) {
-                            group = g
-                        }
-                    }
-
-                    await this.createDummyMembers(organization, group, count)
+                    await this.createDummyMembers(organization, count)
 
                     // Skip creating this member
                     continue;
@@ -188,20 +146,6 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
             balanceItemMemberIds.push(member.id)
             updateMembershipMemberIds.add(member.id)
 
-            // Add registrations
-            for (const registrationStruct of struct.registrations) {
-                const group = await getGroup(registrationStruct.groupId)
-                if (!group || group.organizationId !== registrationStruct.organizationId || !await Context.auth.canAccessGroup(group, PermissionLevel.Write)) {
-                    throw Context.auth.notFoundOrNoAccess("Je hebt niet voldoende rechten om leden toe te voegen in deze groep")
-                }
-
-                const reg = await this.addRegistration(member, registrationStruct, group)
-                addBalanceItemRegistrationId(reg.organizationId, reg.id)
-
-                // Update occupancy at the end of the call
-                updateGroups.set(group.id, group)
-            }
-
             // Auto link users based on data
             await MemberUserSyncer.onChangeMember(member)
         }
@@ -233,192 +177,6 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
             // Update documents
             await Document.updateForMember(member.id)
 
-            // Update registrations
-            for (const patchRegistration of patch.registrations.getPatches()) {
-                const registration = member.registrations.find(r => r.id === patchRegistration.id)
-                if (!registration || registration.memberId != member.id || (!await Context.auth.canAccessRegistration(registration, PermissionLevel.Write))) {
-                    throw new SimpleError({
-                        code: "permission_denied",
-                        message: "You don't have permissions to access this endpoint",
-                        human: "Je hebt geen toegang om deze registratie te wijzigen"
-                    })
-                }
-
-                let group: Group | null = null
-
-                console.log('Patch registration', patchRegistration)
-
-                if (patchRegistration.group) {
-                    patchRegistration.groupId = patchRegistration.group.id
-                }
-
-                if (patchRegistration.groupId) {
-                    group = await getGroup(patchRegistration.groupId)
-                    if (group) {
-                        // We need to update group occupancy because we moved a member to it
-                        updateGroups.set(group.id, group)
-                    }
-                    const oldGroup = await getGroup(registration.groupId)
-                    if (oldGroup) {
-                        // We need to update this group occupancy because we moved one member away from it
-                        updateGroups.set(oldGroup.id, oldGroup)
-                    }
-                } else {
-                    group = await getGroup(registration.groupId)
-                }
-
-                if (!group || group.organizationId !== (patchRegistration.organizationId ?? registration.organizationId)) {
-                    throw new SimpleError({
-                        code: "invalid_field",
-                        message: "Group doesn't exist",
-                        human: "De groep naarwaar je dit lid wilt verplaatsen bestaat niet",
-                        field: "groupId"
-                    })
-                }
-
-                if (!await Context.auth.canAccessGroup(group, PermissionLevel.Write)) {
-                    throw Context.auth.error("Je hebt niet voldoende rechten om leden te verplaatsen naar deze groep")
-                }
-
-                if (patchRegistration.cycle && patchRegistration.cycle > group.cycle) {
-                    throw new SimpleError({
-                        code: "invalid_field",
-                        message: "Invalid cycle",
-                        human: "Je kan een lid niet inschrijven voor een groep die nog moet starten",
-                        field: "cycle"
-                    })
-                }
-
-                const period = await RegistrationPeriod.getByID(group.periodId)
-                if (!period || period.locked) {
-                    throw new SimpleError({
-                        code: "period_locked",
-                        message: "Deze inschrijvingsperiode is afgesloten en staat geen wijzigingen meer toe.",
-                    })
-                }
-
-                // TODO: allow group changes
-                registration.waitingList = patchRegistration.waitingList ?? registration.waitingList
-
-                if (!registration.waitingList && registration.registeredAt === null) {
-                    registration.registeredAt = new Date()
-                }
-                registration.canRegister = patchRegistration.canRegister ?? registration.canRegister
-                if (!registration.waitingList) {
-                    registration.canRegister = false
-                }
-                registration.cycle = patchRegistration.cycle ?? registration.cycle
-                registration.groupId = patchRegistration.groupId ?? registration.groupId
-                registration.group = group
-                registration.organizationId = patchRegistration.organizationId ?? registration.organizationId
-
-                // Check if we should create a placeholder payment?
-
-                if (patchRegistration.cycle !== undefined || patchRegistration.waitingList !== undefined || patchRegistration.canRegister !== undefined) {
-                    // We need to update occupancy (because cycle / waitlist change)
-                    updateGroups.set(group.id, group)
-                }
-
-                if (patchRegistration.price) {
-                    // Create balance item
-                    const balanceItem = new BalanceItem();
-                    balanceItem.registrationId = registration.id;
-                    balanceItem.price = patchRegistration.price
-                    balanceItem.description = group ? `Inschrijving ${group.settings.name}` : `Inschrijving`
-                    balanceItem.pricePaid = patchRegistration.pricePaid ?? 0
-                    balanceItem.memberId = registration.memberId;
-                    balanceItem.userId = member.users[0]?.id ?? null
-                    balanceItem.organizationId = group.organizationId
-                    balanceItem.status = BalanceItemStatus.Pending;
-                    await balanceItem.save();
-
-                    addBalanceItemRegistrationId(registration.organizationId, registration.id)
-                    balanceItemMemberIds.push(member.id)
-
-                    if (balanceItem.pricePaid > 0) {
-                        // Create an Unknown payment and attach it to the balance item
-                        const payment = new Payment();
-                        payment.userId = member.users[0]?.id ?? null
-                        payment.organizationId = member.organizationId
-                        payment.method = PaymentMethod.Unknown
-                        payment.status = PaymentStatus.Succeeded
-                        payment.price = balanceItem.pricePaid;
-                        payment.paidAt = new Date()
-                        payment.provider = null
-                        await payment.save()
-
-                        const balanceItemPayment = new BalanceItemPayment()
-                        balanceItemPayment.balanceItemId = balanceItem.id;
-                        balanceItemPayment.paymentId = payment.id;
-                        balanceItemPayment.organizationId = group.organizationId
-                        balanceItemPayment.price = payment.price;
-                        await balanceItemPayment.save();
-                    }
-                }
-
-                await registration.save()
-                updateMembershipMemberIds.add(member.id)
-            }
-
-            for (const deleteId of patch.registrations.getDeletes()) {
-                const registration = member.registrations.find(r => r.id === deleteId)
-                if (!registration || registration.memberId != member.id) {
-                    throw new SimpleError({
-                        code: "permission_denied",
-                        message: "You don't have permissions to access this endpoint",
-                        human: "Je hebt geen toegang om deze registratie te wijzigen"
-                    })
-                }
-
-                if (!await Context.auth.canAccessRegistration(registration, PermissionLevel.Write)) {
-                    throw Context.auth.error("Je hebt niet voldoende rechten om deze inschrijving te verwijderen")
-                }
-                const oldGroup = await getGroup(registration.groupId)
-                const period = oldGroup && await RegistrationPeriod.getByID(oldGroup.periodId)
-                if (!period || period.locked) {
-                    throw new SimpleError({
-                        code: "period_locked",
-                        message: "Deze inschrijvingsperiode is afgesloten en staat geen wijzigingen meer toe.",
-                    })
-                }
-
-                balanceItemMemberIds.push(member.id)     
-                updateMembershipMemberIds.add(member.id)           
-                await BalanceItem.deleteForDeletedRegistration(registration.id)
-                await registration.delete()
-                member.registrations = member.registrations.filter(r => r.id !== deleteId)
-
-                if (oldGroup) {
-                    // We need to update this group occupancy because we moved one member away from it
-                    updateGroups.set(oldGroup.id, oldGroup)
-                }
-            }
-
-            // Add registrations
-            for (const registrationStruct of patch.registrations.getPuts()) {
-                const struct = registrationStruct.put
-                const group = await getGroup(struct.groupId)
-
-                if (!group || group.organizationId !== struct.organizationId || !await Context.auth.canAccessGroup(group, PermissionLevel.Write)) {
-                    throw Context.auth.error("Je hebt niet voldoende rechten om inschrijvingen in deze groep te maken")
-                }
-                const period = await RegistrationPeriod.getByID(group.periodId)
-                if (!period || period.locked) {
-                    throw new SimpleError({
-                        code: "period_locked",
-                        message: "Deze inschrijvingsperiode is afgesloten en staat geen wijzigingen meer toe.",
-                    })
-                }
-
-                const reg = await this.addRegistration(member, struct, group)
-                balanceItemMemberIds.push(member.id)
-                updateMembershipMemberIds.add(member.id)
-                addBalanceItemRegistrationId(reg.organizationId, reg.id)
-
-                // We need to update this group occupancy because we moved one member away from it
-                updateGroups.set(group.id, group)
-            }
-
             // Update responsibilities
             for (const patchResponsibility of patch.responsibilities.getPatches()) {
                 if (!Context.auth.hasPlatformFullAccess() && !(organization && await Context.auth.hasFullAccess(organization.id))) {
@@ -570,6 +328,26 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
             // Auto link users based on data
             await MemberUserSyncer.onChangeMember(member)
 
+            // Allow to remove access for certain users
+            for (const id of patch.users.getDeletes()) {
+                const user = member.users.find(u => u.id === id)
+                if (!user) {
+                    // Ignore silently
+                    continue;
+                }
+
+                if (MemberUserSyncer.doesEmailHaveAccess(member.details, user.email)) {
+                    throw new SimpleError({
+                        code: "invalid_field",
+                        message: "Invalid email",
+                        human: "Je kan een account niet de toegang ontzetten tot een lid als het e-mailadres nog steeds is opgeslagen als onderdeel van de gegevens van dat lid. Verwijder eerst het e-mailadres uit de gegevens van het lid en ontkoppel daarna het account."
+                    });
+                }
+
+                // Remove access
+                await MemberUserSyncer.unlinkUser(user, member)
+            }
+
             // Add platform memberships
             for (const {put} of patch.platformMemberships.getPuts()) {
                 if (put.periodId !== platform.periodId) {
@@ -745,120 +523,9 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
         }
     }
 
-    async addRegistration(member: Member & Record<"registrations", (Registration & {group: Group})[]> & Record<"users", User[]>, registrationStruct: RegistrationStruct, group: Group) {
-        // Check if this member has this registration already.
-        // Note: we cannot use the relation here, because invalid ones or reserved ones are not loaded in there
-        const existings = await Registration.where({ 
-            memberId: member.id, 
-            groupId: registrationStruct.groupId,
-            cycle: registrationStruct.cycle
-        }, { limit: 1 })
-        const existing = existings.length > 0 ? existings[0] : null
-
-        // If the existing is invalid, delete it.
-        if (existing && !existing.registeredAt && !existing.waitingList) {
-            console.log('Deleting invalid registration', existing.id)
-            await existing.delete()
-        } else if (existing) {
-            throw new SimpleError({
-                code: "invalid_field",
-                message: "Registration already exists",
-                human: existing.waitingList ? "Dit lid staat al op de wachtlijst voor deze groep" : "Dit lid is al ingeschreven voor deze groep",
-                field: "groupId"
-            });
-        }
-
-        if (!group) {
-            throw new SimpleError({
-                code: 'invalid_field',
-                field: 'groupId',
-                message: 'Invalid groupId',
-                human: 'Deze inschrijvingsgroep is ongeldig'
-            })
-        }
-
-        const registration = new Registration()
-        registration.groupId = registrationStruct.groupId
-        registration.organizationId = group.organizationId
-        registration.periodId = group.periodId
-        registration.cycle = registrationStruct.cycle
-        registration.memberId = member.id
-        registration.registeredAt = registrationStruct.registeredAt
-        registration.waitingList = registrationStruct.waitingList
-        registration.createdAt = registrationStruct.createdAt ?? new Date()
-
-        if (registration.waitingList) {
-            registration.registeredAt = null
-        }
-        registration.canRegister = registrationStruct.canRegister
-
-        if (!registration.waitingList) {
-            registration.canRegister = false
-        }
-        registration.deactivatedAt = registrationStruct.deactivatedAt
-
-        await registration.save()
-        member.registrations.push(registration.setRelation(Registration.group, group))
-
-        if (registrationStruct.price) {
-            // Create balance item
-            const balanceItem = new BalanceItem();
-            balanceItem.registrationId = registration.id;
-            balanceItem.price = registrationStruct.price
-            balanceItem.description = group ? `Inschrijving ${group.settings.name}` : `Inschrijving`
-            balanceItem.pricePaid = registrationStruct.pricePaid ?? 0
-            balanceItem.memberId = registration.memberId;
-            balanceItem.userId = member.users[0]?.id ?? null
-            balanceItem.organizationId = group.organizationId
-            balanceItem.status = BalanceItemStatus.Pending;
-            await balanceItem.save();
-
-            if (balanceItem.pricePaid > 0) {
-                // Create an Unknown payment and attach it to the balance item
-                const payment = new Payment();
-                payment.userId = member.users[0]?.id ?? null
-                payment.organizationId = member.organizationId
-                payment.method = PaymentMethod.Unknown
-                payment.status = PaymentStatus.Succeeded
-                payment.price = balanceItem.pricePaid;
-                payment.paidAt = new Date()
-                payment.provider = null
-                await payment.save()
-
-                const balanceItemPayment = new BalanceItemPayment()
-                balanceItemPayment.balanceItemId = balanceItem.id;
-                balanceItemPayment.paymentId = payment.id;
-                balanceItemPayment.organizationId = group.organizationId
-                balanceItemPayment.price = payment.price;
-                await balanceItemPayment.save();
-            }
-        }
-
-        return registration
-    }
-
-    async createDummyMembers(organization: Organization, group: Group, count: number) {
-        const members = await new MemberFactory({ 
-            organization,
-            minAge: group.settings.minAge ?? undefined,
-            maxAge: group.settings.maxAge ?? undefined
+    async createDummyMembers(organization: Organization, count: number) {
+        await new MemberFactory({ 
+            organization
         }).createMultiple(count)
-
-        for (const m of members) {
-            const member = m.setManyRelation(Member.registrations as unknown as OneToManyRelation<"registrations", Member, Registration>, []).setManyRelation(Member.users, [])
-            const d = new Date(new Date().getTime() - Math.random() * 60 * 1000 * 60 * 24 * 60)
-
-            // Create a registration for this member for thisg roup
-            const registration = new Registration()
-            registration.organizationId = organization.id
-            registration.memberId = member.id
-            registration.groupId = group.id
-            registration.periodId = group.periodId
-            registration.cycle = group.cycle
-            registration.registeredAt = d
-
-            member.registrations.push(registration)
-            await registration.save()
-        }
     }
 }

package/src/endpoints/global/registration/PatchUserMembersEndpoint.ts

@@ -4,10 +4,10 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import { Document, Member } from '@stamhoofd/models';
 import { MemberWithRegistrationsBlob, MembersBlob } from "@stamhoofd/structures";
 
-import { Context } from '../../../helpers/Context';
-import { PatchOrganizationMembersEndpoint } from '../../global/members/PatchOrganizationMembersEndpoint';
 import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures';
+import { Context } from '../../../helpers/Context';
 import { MemberUserSyncer } from '../../../helpers/MemberUserSyncer';
+import { PatchOrganizationMembersEndpoint } from '../../global/members/PatchOrganizationMembersEndpoint';
 type Params = Record<string, never>;
 type Query = undefined;
 type Body = PatchableArrayAutoEncoder<MemberWithRegistrationsBlob>
@@ -48,15 +48,6 @@ export class PatchUserMembersEndpoint extends Endpoint<Params, Query, Body, Resp
             struct.details.cleanData()
             member.details = struct.details
 
-            if (!struct.details) {
-                throw new SimpleError({
-                    code: "invalid_data",
-                    message: "No details provided",
-                    human: "Opgelet! Je gebruikt een oudere versie van de inschrijvingspagina die niet langer wordt ondersteund. Herlaad de website grondig en wis je browser cache.",
-                    field: "details"
-                })
-            }
-
             // Check for duplicates and prevent creating a duplicate member by a user
             const duplicate = await PatchOrganizationMembersEndpoint.checkDuplicate(member);
             if (duplicate) {
@@ -85,6 +76,12 @@ export class PatchUserMembersEndpoint extends Endpoint<Params, Query, Body, Resp
             if (updatedMember) {
                 // Make sure we also give access to other parents
                 await MemberUserSyncer.onChangeMember(updatedMember)
+
+                if (!updatedMember.users.find(u => u.id === user.id)) {
+                    // Also link the user to the member if the email address is missing in the details
+                    await MemberUserSyncer.linkUser(user.email, updatedMember, true)
+                }
+
                 await Document.updateForMember(updatedMember.id)
             }
         }

package/src/endpoints/global/registration/RegisterMembersEndpoint.ts

@@ -13,7 +13,6 @@ import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructure
 import { BuckarooHelper } from '../../../helpers/BuckarooHelper';
 import { Context } from '../../../helpers/Context';
 import { StripeHelper } from '../../../helpers/StripeHelper';
-import { ExchangePaymentEndpoint } from '../../organization/shared/ExchangePaymentEndpoint';
 type Params = Record<string, never>;
 type Query = undefined;
 type Body = IDRegisterCheckout
@@ -99,8 +98,11 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             }
         }
 
+        const deleteRegistrationIds = request.body.cart.deleteRegistrationIds
+        const deleteRegistrationModels = (deleteRegistrationIds.length ? (await Registration.getByIDs(...deleteRegistrationIds)) : []).filter(r => r.organizationId === organization.id)
+
         const memberIds = Formatter.uniqueArray(
-            [...request.body.cart.items.map(i => i.memberId), ...request.body.cart.deleteRegistrations.map(i => i.member.id)]
+            [...request.body.cart.items.map(i => i.memberId), ...deleteRegistrationModels.map(i => i.memberId)]
         )
         const members = await Member.getBlobByIds(...memberIds)
         const groupIds = Formatter.uniqueArray(request.body.cart.items.map(i => i.groupId))
@@ -175,23 +177,23 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
 
         // Validate balance items (can only happen serverside)
         const balanceItemIds = request.body.cart.balanceItems.map(i => i.item.id)
-        let memberBalanceItems: MemberBalanceItem[] = []
-        let balanceItems: BalanceItem[] = []
+        let memberBalanceItemsStructs: MemberBalanceItem[] = []
+        let balanceItemsModels: BalanceItem[] = []
         if (balanceItemIds.length > 0) {
-            balanceItems = await BalanceItem.where({ id: { sign:'IN', value: balanceItemIds }, organizationId: organization.id })
-            if (balanceItems.length != balanceItemIds.length) {
+            balanceItemsModels = await BalanceItem.where({ id: { sign:'IN', value: balanceItemIds }, organizationId: organization.id })
+            if (balanceItemsModels.length != balanceItemIds.length) {
                 throw new SimpleError({
                     code: "invalid_data",
                     message: "Oeps, één of meerdere openstaande bedragen in jouw winkelmandje zijn aangepast. Herlaad de pagina en probeer opnieuw."
                 })
             }
-            memberBalanceItems = await BalanceItem.getMemberStructure(balanceItems)
+            memberBalanceItemsStructs = await BalanceItem.getMemberStructure(balanceItemsModels)
         }
 
         console.log('isAdminFromSameOrganization', checkout.isAdminFromSameOrganization)
 
         // Validate the cart
-        checkout.validate({memberBalanceItems})
+        checkout.validate({memberBalanceItems: memberBalanceItemsStructs})
 
         // Recalculate the price
         checkout.updatePrices()
@@ -234,34 +236,37 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
 
             // Check if this member is already registered in this group?
             const existingRegistrations = await Registration.where({ memberId: member.id, groupId: item.groupId, cycle: group.cycle })
-            let registration: RegistrationWithMemberAndGroup | undefined = undefined;
 
             for (const existingRegistration of existingRegistrations) {
-                registration = existingRegistration
-                    .setRelation(registrationMemberRelation, member as Member)
-                    .setRelation(Registration.group, group)
-                
+                if (item.replaceRegistrations.some(r => r.id === existingRegistration.id)) {
+                    // Safe
+                    continue;
+                }
+
+                if (checkout.cart.deleteRegistrations.some(r => r.id === existingRegistration.id)) {
+                    // Safe
+                    continue;
+                }
 
                 if (existingRegistration.registeredAt !== null && existingRegistration.deactivatedAt === null) {
                     throw new SimpleError({
                         code: "already_registered",
-                        message: "Dit lid is reeds ingeschreven. Herlaad de pagina en probeer opnieuw."
+                        message: `${member.firstName} is al ingeschreven voor ${group.settings.name}. Mogelijks heb je meerdere keren proberen in te schrijven en is het intussen wel gelukt. Herlaad de pagina best even om zeker te zijn.`
                     })
                 }
             }
 
-            if (!registration) {
-                registration = new Registration()
-                    .setRelation(registrationMemberRelation, member as Member)
-                    .setRelation(Registration.group, group)
-                registration.organizationId = organization.id
-                registration.periodId = group.periodId
-            }
+            const registration = new Registration()
+                .setRelation(registrationMemberRelation, member as Member)
+                .setRelation(Registration.group, group)
+            registration.organizationId = organization.id
+            registration.periodId = group.periodId
 
             registration.memberId = member.id
             registration.groupId = group.id
-            registration.cycle = group.cycle
-            registration.price = item.calculatedPrice
+            registration.price = 0 // will get filled by balance items themselves 
+            registration.groupPrice = item.groupPrice;
+            registration.options = item.options
 
             payRegistrations.push({
                 registration,
@@ -306,8 +311,59 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
 
         console.log('Registering members using whoWillPayNow', whoWillPayNow, checkout.paymentMethod, totalPrice)
 
-        const items: BalanceItem[] = []
-        const shouldMarkValid = whoWillPayNow === 'nobody' || checkout.paymentMethod === PaymentMethod.Transfer || checkout.paymentMethod === PaymentMethod.PointOfSale
+        const createdBalanceItems: BalanceItem[] = []
+        const shouldMarkValid = whoWillPayNow === 'nobody' || checkout.paymentMethod === PaymentMethod.Transfer || checkout.paymentMethod === PaymentMethod.PointOfSale || checkout.paymentMethod === PaymentMethod.Unknown
+        
+        // Create negative balance items
+        for (const registrationStruct of [...checkout.cart.deleteRegistrations, ...checkout.cart.items.flatMap(i => i.replaceRegistrations)]) {
+            if (whoWillPayNow !== 'nobody') {
+                // this also fixes the issue that we cannot delete the registration right away if we would need to wait for a payment 
+                throw new SimpleError({
+                    code: "forbidden",
+                    message: "Permission denied: you are not allowed to delete registrations",
+                    human: "Oeps, je hebt geen toestemming om inschrijvingen te verwijderen.",
+                    statusCode: 403
+                })
+            }
+
+            const existingRegistration = await Registration.getByID(registrationStruct.id)
+            if (!existingRegistration || existingRegistration.organizationId !== organization.id) {
+                throw new SimpleError({
+                    code: "invalid_data",
+                    message: "Oeps, één of meerdere inschrijvingen die je probeert te verwijderen lijken niet meer te bestaan. Herlaad de pagina en probeer opnieuw."
+                })
+            }
+
+            if (!await Context.auth.canAccessRegistration(existingRegistration, PermissionLevel.Write)) {
+                throw new SimpleError({
+                    code: "forbidden",
+                    message: "Je hebt geen toegaansrechten om deze inschrijving te verwijderen.",
+                    statusCode: 403
+                })
+            }
+
+            if (existingRegistration.deactivatedAt || !existingRegistration.registeredAt) {
+                throw new SimpleError({
+                    code: "invalid_data",
+                    message: "Oeps, één of meerdere inschrijvingen die je probeert te verwijderen was al verwijderd. Herlaad de pagina en probeer opnieuw."
+                })
+            }
+
+            // We can alter right away since whoWillPayNow is nobody, and shouldMarkValid will always be true
+            // Find all balance items of this registration and set them to zero
+            await BalanceItem.deleteForDeletedRegistration(existingRegistration.id)
+            
+            // Clear the registration
+            await existingRegistration.deactivate()
+
+            const group = groups.find(g => g.id === existingRegistration.groupId)
+            if (!group) {
+                const g = await Group.getByID(existingRegistration.groupId)
+                if (g) {
+                    groups.push(g)
+                }
+            }
+        }
 
         // Save registrations and add extra data if needed
         for (const bundle of payRegistrations) {
@@ -367,7 +423,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
                 balanceItem2.status = shouldMarkValid ? BalanceItemStatus.Pending : BalanceItemStatus.Hidden
                 await balanceItem2.save();
 
-                // do not add to items array because we don't want to add this to the payment if we create a payment
+                // do not add to createdBalanceItems array because we don't want to add this to the payment if we create a payment
             } else {
                 balanceItem.memberId = registration.memberId;
                 balanceItem.userId = user.id
@@ -380,7 +436,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             balanceItem.dependingBalanceItemId = balanceItem2?.id ?? null
             
             await balanceItem.save();
-            items.push(balanceItem)
+            createdBalanceItems.push(balanceItem)
         }
         
         const oldestMember = members.slice().sort((a, b) => b.details.defaultAge - a.details.defaultAge)[0]
@@ -400,7 +456,7 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             }
             balanceItem.status = shouldMarkValid ? BalanceItemStatus.Pending : BalanceItemStatus.Hidden
             await balanceItem.save();
-            items.push(balanceItem)
+            createdBalanceItems.push(balanceItem)
         }
 
         if (checkout.administrationFee && whoWillPayNow !== 'nobody') {
@@ -424,64 +480,15 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             balanceItem.status = shouldMarkValid ? BalanceItemStatus.Pending : BalanceItemStatus.Hidden
             await balanceItem.save();
 
-            items.push(balanceItem)
+            createdBalanceItems.push(balanceItem);
         }
 
         if (checkout.cart.balanceItems.length && whoWillPayNow === 'nobody') {
-            throw new Error('Not possible to pay balance items when whoWillPayNow is nobody')
-        }
-
-        // Create negative balance items
-        for (const registrationStruct of checkout.cart.deleteRegistrations) {
-            if (whoWillPayNow !== 'nobody') {
-                // this also fixes the issue that we cannot delete the registration right away if we would need to wait for a payment 
-                throw new SimpleError({
-                    code: "forbidden",
-                    message: "Permission denied: you are not allowed to delete registrations",
-                    human: "Oeps, je hebt geen toestemming om inschrijvingen te verwijderen.",
-                    statusCode: 403
-                })
-            }
-
-            const existingRegistration = await Registration.getByID(registrationStruct.id)
-            if (!existingRegistration || existingRegistration.organizationId !== organization.id) {
-                throw new SimpleError({
-                    code: "invalid_data",
-                    message: "Oeps, één of meerdere inschrijvingen die je probeert te verwijderen lijken niet meer te bestaan. Herlaad de pagina en probeer opnieuw."
-                })
-            }
-
-            if (!await Context.auth.canAccessRegistration(existingRegistration, PermissionLevel.Write)) {
-                throw new SimpleError({
-                    code: "forbidden",
-                    message: "Je hebt geen toegaansrechten om deze inschrijving te verwijderen.",
-                    statusCode: 403
-                })
-            }
-
-            if (existingRegistration.deactivatedAt || !existingRegistration.registeredAt) {
-                throw new SimpleError({
-                    code: "invalid_data",
-                    message: "Oeps, één of meerdere inschrijvingen die je probeert te verwijderen was al verwijderd. Herlaad de pagina en probeer opnieuw."
-                })
-            }
-
-            // We can alter right away since whoWillPayNow is nobody, and shouldMarkValid will always be true
-            // Find all balance items of this registration and set them to zero
-            await BalanceItem.deleteForDeletedRegistration(existingRegistration.id)
-            
-            // Clear the registration
-            existingRegistration.deactivatedAt = new Date()
-            await existingRegistration.save()
-            existingRegistration.scheduleStockUpdate()
-
-            const group = groups.find(g => g.id === existingRegistration.groupId)
-            if (!group) {
-                const g = await Group.getByID(existingRegistration.groupId)
-                if (g) {
-                    groups.push(g)
-                }
-            }
+            throw new SimpleError({
+                code: 'invalid_data',
+                message: 'Not possible to pay balance items as the organization',
+                statusCode: 400
+            })
         }
 
         let paymentUrl: string | null = null
@@ -490,19 +497,21 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
         if (whoWillPayNow !== 'nobody') {
             const mappedBalanceItems = new Map<BalanceItem, number>()
 
-            for (const item of items) {
+            for (const item of createdBalanceItems) {
                 mappedBalanceItems.set(item, item.price)
             }
 
             for (const item of checkout.cart.balanceItems) {
-                const balanceItem = balanceItems.find(i => i.id === item.item.id)
+                const balanceItem = balanceItemsModels.find(i => i.id === item.item.id)
                 if (!balanceItem) {
                     throw new Error('Balance item not found')
                 }
                 mappedBalanceItems.set(balanceItem, item.price)
-                items.push(balanceItem)
+                createdBalanceItems.push(balanceItem)
             }
 
+            // Make sure every price is accurate before creating a payment
+            await BalanceItem.updateOutstanding(createdBalanceItems, organization.id)
             const response = await this.createPayment({
                 balanceItems: mappedBalanceItems,
                 organization,
@@ -515,9 +524,10 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
                 paymentUrl = response.paymentUrl
                 payment = response.payment
             }
+        } else {
+            await BalanceItem.updateOutstanding(createdBalanceItems, organization.id)
         }
 
-        await BalanceItem.updateOutstanding(items, organization.id)
 
         // Update occupancy
         for (const group of groups) {
@@ -527,9 +537,11 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
             }
         }
 
+        const updatedMembers = await Member.getBlobByIds(...memberIds)
+
         return new Response(RegisterResponse.create({
             payment: payment ? PaymentStruct.create(payment) : null,
-            members: await AuthenticatedStructures.membersBlob(members),
+            members: await AuthenticatedStructures.membersBlob(updatedMembers),
             registrations: registrations.map(r => Member.getRegistrationWithMemberStructure(r)),
             paymentUrl
         }));

package/src/endpoints/global/registration-periods/PatchRegistrationPeriodsEndpoint.ts

@@ -2,10 +2,9 @@ import { ConvertArrayToPatchableArray, Decoder, PatchableArrayAutoEncoder, Patch
 import { DecodedRequest, Endpoint, Request, Response } from "@simonbackx/simple-endpoints";
 import { RegistrationPeriod as RegistrationPeriodStruct } from "@stamhoofd/structures";
 
-import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures';
-import { Context } from '../../../helpers/Context';
-import { Platform, RegistrationPeriod } from '@stamhoofd/models';
 import { SimpleError } from '@simonbackx/simple-errors';
+import { Platform, RegistrationPeriod } from '@stamhoofd/models';
+import { Context } from '../../../helpers/Context';
 
 type Params = Record<string, never>;
 type Query = undefined;

package/src/helpers/AdminPermissionChecker.ts

@@ -207,10 +207,11 @@ export class AdminPermissionChecker {
         return await this.hasFullAccess(organizationId)
     }
 
-    /**
-     * Note: only checks admin permissions. Users that 'own' this member can also access it but that does not use the AdminPermissionChecker
-     */
     async canAccessMember(member: MemberWithRegistrations, permissionLevel: PermissionLevel = PermissionLevel.Read) {
+        if (this.isUserManager(member) && permissionLevel !== PermissionLevel.Full) {
+            return true;
+        }
+
         // Check user has permissions
         if (!this.user.permissions) {
             return false
@@ -761,18 +762,6 @@ export class AdminPermissionChecker {
                 for (const category of organization.meta.recordsConfiguration.recordCategories) {
                     recordCategories.push(category)
                 }
-
-                for (const [id] of organization.meta.recordsConfiguration.inheritedRecordCategories) {
-                    if (recordCategories.find(c => c.id === id)) {
-                        // Already added
-                        continue;
-                    }
-    
-                    const category = this.platform.config.recordsConfiguration.recordCategories.find(c => c.id === id)
-                    if (category) {
-                        recordCategories.push(category)
-                    }
-                }
                 continue;
             }
 
@@ -788,17 +777,15 @@ export class AdminPermissionChecker {
                 }
             }
 
-            for (const [id] of organization.meta.recordsConfiguration.inheritedRecordCategories) {
-                if (recordCategories.find(c => c.id === id)) {
+            // Platform ones where we have been given permissions for in this organization
+            for (const category of this.platform.config.recordsConfiguration.recordCategories) {
+                if (recordCategories.find(c => c.id === category.id)) {
                     // Already added
                     continue;
                 }
 
-                if (permissions.hasResourceAccess(PermissionsResourceType.RecordCategories, id, level)) {
-                    const category = this.platform.config.recordsConfiguration.recordCategories.find(c => c.id === id)
-                    if (category) {
-                        recordCategories.push(category)
-                    }
+                if (permissions.hasResourceAccess(PermissionsResourceType.RecordCategories, category.id, level)) {
+                    recordCategories.push(category)
                 }
             }
         }
@@ -916,6 +903,10 @@ export class AdminPermissionChecker {
         const isUserManager = this.isUserManager(member)
         if (isUserManager) {
             // For the user manager, we don't delete data, because when registering a new member, it doesn't have any organizations yet...
+
+            // Notes are not visible for the member.
+            data.details.notes = null;
+
             return data;
         }
 
@@ -932,6 +923,7 @@ export class AdminPermissionChecker {
         // Has financial read access?
         if (!await this.hasFinancialMemberAccess(member, PermissionLevel.Read)) {
             cloned.details.requiresFinancialSupport = null
+            cloned.details.uitpasNumber = null
             cloned.outstandingBalance = 0
 
             for (const registration of cloned.registrations) {
@@ -955,48 +947,63 @@ export class AdminPermissionChecker {
             })
         }
 
-        if (data.details.recordAnswers) {
-            if (!(data.details.recordAnswers instanceof PatchMap)) {
-                throw new SimpleError({
-                    code: 'invalid_request',
-                    message: 'Cannot PUT recordAnswers',
-                    statusCode: 400
-                })
-            }
-            const isUserManager = this.isUserManager(member)
-            const records = isUserManager ? new Set() : await this.getAccessibleRecordSet(member, PermissionLevel.Write)
+        const hasRecordAnswers = !!data.details.recordAnswers;
+        const hasNotes = data.details.notes !== undefined;
 
-            for (const [key, value] of data.details.recordAnswers.entries()) {
-                let name: string | undefined = undefined
-                if (value) {
-                    if (value.isPatch()) {
-                        throw new SimpleError({
-                            code: 'invalid_request',
-                            message: 'Cannot PATCH a record answer object',
-                            statusCode: 400
-                        })
-                    }
+        if(hasRecordAnswers || hasNotes) {
+            const isUserManager = this.isUserManager(member);
 
-                    const id = value.settings.id
+            if (hasRecordAnswers) {
+                if (!(data.details.recordAnswers instanceof PatchMap)) {
+                    throw new SimpleError({
+                        code: 'invalid_request',
+                        message: 'Cannot PUT recordAnswers',
+                        statusCode: 400
+                    })
+                }
+                
+                const records = isUserManager ? new Set() : await this.getAccessibleRecordSet(member, PermissionLevel.Write)
+
+                for (const [key, value] of data.details.recordAnswers.entries()) {
+                    let name: string | undefined = undefined
+                    if (value) {
+                        if (value.isPatch()) {
+                            throw new SimpleError({
+                                code: 'invalid_request',
+                                message: 'Cannot PATCH a record answer object',
+                                statusCode: 400
+                            })
+                        }
+
+                        const id = value.settings.id
+
+                        if (id !== key) {
+                            throw new SimpleError({
+                                code: 'invalid_request',
+                                message: 'Record answer key does not match record id',
+                                statusCode: 400
+                            })
+                        }
+
+                        name = value.settings.name
+                    }
 
-                    if (id !== key) {
+                    if (!isUserManager && !records.has(key)) {
                         throw new SimpleError({
-                            code: 'invalid_request',
-                            message: 'Record answer key does not match record id',
+                            code: 'permission_denied',
+                            message: `Je hebt geen toegangsrechten om het antwoord op ${name ?? 'deze vraag'} aan te passen voor dit lid`,
                             statusCode: 400
                         })
                     }
-
-                    name = value.settings.name
                 }
+            }
 
-                if (!isUserManager && !records.has(key)) {
-                    throw new SimpleError({
-                        code: 'permission_denied',
-                        message: `Je hebt geen toegangsrechten om het antwoord op ${name ?? 'deze vraag'} aan te passen voor dit lid`,
-                        statusCode: 400
-                    })
-                }
+            if(hasNotes && isUserManager) {
+                throw new SimpleError({
+                    code: 'permission_denied',
+                    message: 'Cannot edit notes',
+                    statusCode: 400
+                })
             }
         }
 
@@ -1010,6 +1017,14 @@ export class AdminPermissionChecker {
                 })
             }
 
+            if (data.details.uitpasNumber) {
+                throw new SimpleError({
+                    code: 'permission_denied',
+                    message: 'Je hebt geen toegangsrechten om het UiTPAS-nummer van dit lid aan te passen',
+                    statusCode: 400
+                })
+            }
+
             if (data.outstandingBalance) {
                 throw new SimpleError({
                     code: 'permission_denied',

package/src/helpers/AuthenticatedStructures.ts

@@ -228,7 +228,6 @@ export class AuthenticatedStructures {
                 }
             }
 
-
             const blob = member.getStructureWithRegistrations()
             memberBlobs.push(
                 await Context.auth.filterMemberData(member, blob)

package/src/helpers/MemberUserSyncer.ts

@@ -1,6 +1,6 @@
 import { Member, MemberResponsibilityRecord, MemberWithRegistrations, User } from "@stamhoofd/models";
 import { SQL } from "@stamhoofd/sql";
-import { Permissions, UserPermissions } from "@stamhoofd/structures";
+import { MemberDetails, Permissions, UserPermissions } from "@stamhoofd/structures";
 
 export class MemberUserSyncerStatic {
     /**
@@ -8,15 +8,8 @@ export class MemberUserSyncerStatic {
      * - responsibilities have changed
      * - email addresses have changed
      */
-    async onChangeMember(member: MemberWithRegistrations) {
-        const userEmails = [...member.details.alternativeEmails]
-
-        if (member.details.email) {
-            userEmails.push(member.details.email)
-        }
-
-        const uncategorizedEmails: string[] = member.details.uncategorizedEmails;
-        const parentAndUncategorizedEmails = member.details.parentsHaveAccess ? member.details.parents.flatMap(p => p.email ? [p.email, ...p.alternativeEmails] : p.alternativeEmails).concat(uncategorizedEmails) : []
+    async onChangeMember(member: MemberWithRegistrations, unlinkUsers: boolean = false) {
+        const {userEmails, parentAndUnverifiedEmails} = this.getMemberAccessEmails(member.details)
 
         // Make sure all these users have access to the member
         for (const email of userEmails) {
@@ -24,19 +17,54 @@ export class MemberUserSyncerStatic {
             await this.linkUser(email, member, false)
         }
 
-        for (const email of parentAndUncategorizedEmails) {
-            // Link parents and uncategorized emails
+        for (const email of parentAndUnverifiedEmails) {
+            // Link parents and unverified emails
             await this.linkUser(email, member, true)
         }
 
-        // Remove access of users that are not in this list
-        for (const user of member.users) {
-            if (!userEmails.includes(user.email) && !parentAndUncategorizedEmails.includes(user.email)) {
-                await this.unlinkUser(user, member)
+        if (unlinkUsers && !member.details.parentsHaveAccess) {
+            // Remove access of users that are not in this list
+            // NOTE: we should only do this once a year (preferably on the birthday of the member)
+            // only once because otherwise users loose the access to a member during the creation of the member, or when they have changed their email address
+            // users can regain access to a member after they have lost control by using the normal verification flow when detecting duplicate members
+
+            for (const user of member.users) {
+                if (!userEmails.includes(user.email) && !parentAndUnverifiedEmails.includes(user.email)) {
+                    await this.unlinkUser(user, member)
+                }
+            }
+        } else {
+            // Only auto unlink users that do not have an account
+            for (const user of member.users) {
+                if (!user.hasAccount() && !userEmails.includes(user.email) && !parentAndUnverifiedEmails.includes(user.email)) {
+                    await this.unlinkUser(user, member)
+                }
             }
         }
     }
 
+    getMemberAccessEmails(details: MemberDetails) {
+        const userEmails = [...details.alternativeEmails]
+
+        if (details.email) {
+            userEmails.push(details.email)
+        }
+
+        const unverifiedEmails: string[] = details.unverifiedEmails;
+        const parentAndUnverifiedEmails = details.parentsHaveAccess ? details.parents.flatMap(p => p.email ? [p.email, ...p.alternativeEmails] : p.alternativeEmails).concat(unverifiedEmails) : []
+
+        return {
+            userEmails,
+            parentAndUnverifiedEmails,
+            emails: userEmails.concat(parentAndUnverifiedEmails)
+        }
+    }
+
+    doesEmailHaveAccess(details: MemberDetails, email: string) {
+        const {emails} = this.getMemberAccessEmails(details)
+        return emails.includes(email)
+    }
+
     async onDeleteMember(member: MemberWithRegistrations) {
         for (const u of member.users) {
             console.log("Unlinking user "+u.email+" from deleted member "+member.id)