@stamhoofd/backend 2.71.0 → 2.73.0

package/src/excel-loaders/receivable-balances.ts

@@ -0,0 +1,294 @@
+import { XlsxBuiltInNumberFormat, XlsxTransformerColumn, XlsxTransformerConcreteColumn } from '@stamhoofd/excel-writer';
+import { BalanceItemRelationType, BalanceItemWithPayments, DetailedReceivableBalance, ExcelExportType, getBalanceItemRelationTypeName, getBalanceItemStatusName, getBalanceItemTypeName, getReceivableBalanceTypeNameNotTranslated, PaginatedResponse, ReceivableBalance } from '@stamhoofd/structures';
+import { Formatter } from '@stamhoofd/utility';
+import { ExportToExcelEndpoint } from '../endpoints/global/files/ExportToExcelEndpoint';
+import { GetReceivableBalancesEndpoint } from '../endpoints/organization/dashboard/receivable-balances/GetReceivableBalancesEndpoint';
+
+type ReceivableBalanceWithItem = {
+    receivableBalance: DetailedReceivableBalance;
+    balanceItem: BalanceItemWithPayments;
+};
+
+ExportToExcelEndpoint.loaders.set(ExcelExportType.ReceivableBalances, {
+    fetch: async (requestQuery) => {
+        const data = await GetReceivableBalancesEndpoint.buildDetailedData(requestQuery);
+
+        return new PaginatedResponse({
+            ...data,
+        });
+    },
+    sheets: [
+        {
+            id: 'receivableBalances',
+            name: 'Te ontvangen bedragen',
+            columns: getGeneralColumns(),
+        },
+        {
+            id: 'balanceItems',
+            name: 'Lijnen',
+            transform: (data: DetailedReceivableBalance): ReceivableBalanceWithItem[] => data.balanceItems.map(balanceItem => ({
+                receivableBalance: data,
+                balanceItem,
+            })),
+            columns: [
+                ...getBalanceItemColumns(),
+
+                // Repeating columns need to de-transform again
+                ...getGeneralColumns()
+                    .map((c) => {
+                        return {
+                            ...c,
+                            id: `receivableBalance.${c.id}`,
+                            getValue: (object: ReceivableBalanceWithItem) => {
+                                return c.getValue(object.receivableBalance);
+                            },
+                        };
+                    }),
+            ],
+        },
+    ],
+});
+
+function getBalanceItemColumns(): XlsxTransformerColumn<ReceivableBalanceWithItem>[] {
+    return [
+        {
+            id: 'id',
+            name: 'ID',
+            width: 40,
+            getValue: (object: ReceivableBalanceWithItem) => ({
+                value: object.balanceItem.id,
+                style: {
+                    font: {
+                        bold: true,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'type',
+            name: 'Type',
+            width: 30,
+            getValue: (object: ReceivableBalanceWithItem) => ({
+                value: getBalanceItemTypeName(object.balanceItem.type),
+            }),
+        },
+        {
+            id: 'category',
+            name: 'Categorie',
+            width: 30,
+            getValue: (object: ReceivableBalanceWithItem) => {
+                return {
+                    value: Formatter.capitalizeFirstLetter(object.balanceItem.category),
+                };
+            },
+        },
+        {
+            id: 'description',
+            name: 'Beschrijving',
+            width: 40,
+            getValue: (object: ReceivableBalanceWithItem) => ({
+                value: object.balanceItem.description,
+            }),
+        },
+        {
+            id: 'amount',
+            name: 'Aantal',
+            width: 20,
+            getValue: (object: ReceivableBalanceWithItem) => ({
+                value: object.balanceItem.amount,
+                style: {
+                    numberFormat: {
+                        id: XlsxBuiltInNumberFormat.Number,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'unitPrice',
+            name: 'Eenheidsprijs',
+            width: 20,
+            getValue: (object: ReceivableBalanceWithItem) => ({
+                value: object.balanceItem.unitPrice / 100,
+                style: {
+                    numberFormat: {
+                        id: XlsxBuiltInNumberFormat.Currency2DecimalWithRed,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'price',
+            name: 'Prijs',
+            width: 20,
+            getValue: (object: ReceivableBalanceWithItem) => ({
+                value: object.balanceItem.price / 100,
+                style: {
+                    numberFormat: {
+                        id: XlsxBuiltInNumberFormat.Currency2DecimalWithRed,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'pricePaid',
+            name: 'Betaald bedrag',
+            width: 20,
+            getValue: (object: ReceivableBalanceWithItem) => ({
+                value: object.balanceItem.pricePaid / 100,
+                style: {
+                    numberFormat: {
+                        id: XlsxBuiltInNumberFormat.Currency2DecimalWithRed,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'pricePending',
+            name: 'In verwerking',
+            width: 20,
+            getValue: (object: ReceivableBalanceWithItem) => ({
+                value: object.balanceItem.pricePending / 100,
+                style: {
+                    numberFormat: {
+                        id: XlsxBuiltInNumberFormat.Currency2DecimalWithRed,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'priceOpen',
+            name: 'Openstaand bedrag',
+            width: 20,
+            getValue: (object: ReceivableBalanceWithItem) => ({
+                value: object.balanceItem.priceOpen / 100,
+                style: {
+                    numberFormat: {
+                        id: XlsxBuiltInNumberFormat.Currency2DecimalWithRed,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'createdAt',
+            name: 'Aangemaakt op',
+            width: 20,
+            getValue: (object: ReceivableBalanceWithItem) => ({
+                value: object.balanceItem.createdAt,
+                style: {
+                    numberFormat: {
+                        id: XlsxBuiltInNumberFormat.DateSlash,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'dueAt',
+            name: 'Verschuldigd vanaf',
+            width: 20,
+            getValue: (object: ReceivableBalanceWithItem) => ({
+                value: object.balanceItem.dueAt,
+                style: {
+                    numberFormat: {
+                        id: XlsxBuiltInNumberFormat.DateSlash,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'status',
+            name: 'Status',
+            width: 20,
+            getValue: (object: ReceivableBalanceWithItem) => ({
+                value: getBalanceItemStatusName(object.balanceItem.status),
+            }),
+        },
+
+        {
+            match: (id) => {
+                if (id.startsWith('relations.')) {
+                    const type = id.split('.')[1] as BalanceItemRelationType;
+                    if (Object.values(BalanceItemRelationType).includes(type)) {
+                        return [
+                            {
+                                id: `relations.${type}`,
+                                name: getBalanceItemRelationTypeName(type),
+                                width: 35,
+                                getValue: (object: ReceivableBalanceWithItem) => ({
+                                    value: object.balanceItem.relations.get(type)?.name || '',
+                                }),
+                            },
+                        ];
+                    }
+                }
+            },
+        },
+    ];
+}
+
+function getGeneralColumns(): XlsxTransformerConcreteColumn<ReceivableBalance>[] {
+    return [
+        {
+            id: 'id',
+            name: 'ID schuldenaar',
+            width: 40,
+            getValue: (object: ReceivableBalance) => ({
+                value: object.id,
+                style: {
+                    font: {
+                        bold: true,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'name',
+            name: 'Schuldenaar',
+            width: 40,
+            getValue: (object: ReceivableBalance) => ({
+                value: object.object.name,
+            }),
+        },
+        {
+            id: 'uri',
+            name: 'Groepsnummer',
+            width: 16,
+            getValue: (object: ReceivableBalance) => ({
+                value: object.object.uri,
+            }),
+        },
+        {
+            id: 'amountOpen',
+            name: 'Openstaand bedrag',
+            width: 10,
+            getValue: (object: ReceivableBalance) => ({
+                value: object.amountOpen / 100,
+                style: {
+                    numberFormat: {
+                        id: XlsxBuiltInNumberFormat.Currency2DecimalWithRed,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'amountPending',
+            name: 'In verwerking',
+            width: 18,
+            getValue: (object: ReceivableBalance) => ({
+                value: object.amountPending / 100,
+                style: {
+                    numberFormat: {
+                        id: XlsxBuiltInNumberFormat.Currency2DecimalWithRed,
+                    },
+                },
+            }),
+        },
+        {
+            id: 'objectType',
+            name: 'type',
+            width: 10,
+            getValue: (object: ReceivableBalance) => ({
+                value: getReceivableBalanceTypeNameNotTranslated(object.objectType),
+            }),
+        },
+    ];
+}

package/src/helpers/AdminPermissionChecker.ts

@@ -538,6 +538,10 @@ export class AdminPermissionChecker {
     }
 
     async canEditUserName(user: User) {
+        if (user.hasAccount() && !user.hasPasswordBasedAccount()) {
+            return false;
+        }
+
         if (user.id === this.user.id) {
             return true;
         }
@@ -556,9 +560,6 @@ export class AdminPermissionChecker {
     }
 
     async canEditUserEmail(user: User) {
-        if (user.meta?.loginProviderIds?.size) {
-            return false;
-        }
         return this.canEditUserName(user);
     }
 

package/src/helpers/AuthenticatedStructures.ts

@@ -1,6 +1,6 @@
 import { SimpleError } from '@simonbackx/simple-errors';
 import { AuditLog, BalanceItem, CachedBalance, Document, Event, Group, Member, MemberPlatformMembership, MemberResponsibilityRecord, MemberWithRegistrations, Order, Organization, OrganizationRegistrationPeriod, Payment, Registration, RegistrationPeriod, Ticket, User, Webshop } from '@stamhoofd/models';
-import { AuditLogReplacement, AuditLogReplacementType, AuditLog as AuditLogStruct, Document as DocumentStruct, Event as EventStruct, GenericBalance, Group as GroupStruct, MemberPlatformMembership as MemberPlatformMembershipStruct, MemberWithRegistrationsBlob, MembersBlob, NamedObject, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, Organization as OrganizationStruct, PaymentGeneral, PermissionLevel, Platform, PrivateOrder, PrivateWebshop, ReceivableBalanceObject, ReceivableBalanceObjectContact, ReceivableBalance as ReceivableBalanceStruct, ReceivableBalanceType, TicketPrivate, UserWithMembers, WebshopPreview, Webshop as WebshopStruct } from '@stamhoofd/structures';
+import { AuditLogReplacement, AuditLogReplacementType, AuditLog as AuditLogStruct, DetailedReceivableBalance, Document as DocumentStruct, Event as EventStruct, GenericBalance, Group as GroupStruct, MemberPlatformMembership as MemberPlatformMembershipStruct, MemberWithRegistrationsBlob, MembersBlob, NamedObject, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, Organization as OrganizationStruct, PaymentGeneral, PermissionLevel, Platform, PrivateOrder, PrivateWebshop, ReceivableBalanceObject, ReceivableBalanceObjectContact, ReceivableBalance as ReceivableBalanceStruct, ReceivableBalanceType, TicketPrivate, UserWithMembers, WebshopPreview, Webshop as WebshopStruct } from '@stamhoofd/structures';
 
 import { Formatter } from '@stamhoofd/utility';
 import { Context } from './Context';
@@ -399,7 +399,7 @@ export class AuthenticatedStructures {
         const platformMemberships = members.length > 0 ? await MemberPlatformMembership.where({ deletedAt: null, memberId: { sign: 'IN', value: members.map(m => m.id) } }) : [];
 
         // Load missing organizations
-        const organizationIds = Formatter.uniqueArray(responsibilities.map(r => r.organizationId).filter(id => id !== null));
+        const organizationIds = Formatter.uniqueArray(responsibilities.map(r => r.organizationId).concat(platformMemberships.map(r => r.organizationId)).filter(id => id !== null));
         for (const id of organizationIds) {
             if (includeContextOrganization || id !== Context.auth.organization?.id) {
                 const found = organizations.get(id);
@@ -575,6 +575,10 @@ export class AuthenticatedStructures {
     }
 
     static async receivableBalances(balances: CachedBalance[]): Promise<ReceivableBalanceStruct[]> {
+        return (await this.receivableBalancesHelper(balances)).map(({ balance, object }) => ReceivableBalanceStruct.create({ ...balance, object }));
+    }
+
+    private static async receivableBalancesHelper(balances: CachedBalance[]): Promise< { balance: CachedBalance; object: ReceivableBalanceObject }[]> {
         if (balances.length === 0) {
             return [];
         }
@@ -608,7 +612,8 @@ export class AuthenticatedStructures {
         ]);
         const users = userIds.length > 0 ? await User.getByIDs(...userIds) : [];
 
-        const result: ReceivableBalanceStruct[] = [];
+        const result: { balance: CachedBalance; object: ReceivableBalanceObject }[] = [];
+
         for (const balance of balances) {
             let object = ReceivableBalanceObject.create({
                 id: balance.objectId,
@@ -632,6 +637,7 @@ export class AuthenticatedStructures {
                     object = ReceivableBalanceObject.create({
                         id: balance.objectId,
                         name: organization.name,
+                        uri: organization.uri,
                         contacts: thisMembers.map(({ member, responsibilities }) => ReceivableBalanceObjectContact.create({
                             firstName: member.firstName ?? '',
                             lastName: member.lastName ?? '',
@@ -749,15 +755,35 @@ export class AuthenticatedStructures {
                 }
             }
 
-            const struct = ReceivableBalanceStruct.create({
+            result.push({
+                balance,
+                object,
+            });
+        }
+
+        return result;
+    }
+
+    static async detailedReceivableBalances(organizationId: string, balances: CachedBalance[]): Promise<DetailedReceivableBalance[]> {
+        const items = await this.receivableBalancesHelper(balances);
+        const results: DetailedReceivableBalance[] = [];
+
+        for (const { balance, object } of items) {
+            const balanceItems = await CachedBalance.balanceForObjects(organizationId, [balance.objectId], balance.objectType, true);
+            const balanceItemsWithPayments = await BalanceItem.getStructureWithPayments(balanceItems);
+
+            const result = DetailedReceivableBalance.create({
                 ...balance,
                 object,
+                balanceItems: balanceItemsWithPayments,
+                // todo!!!
+                payments: [],
             });
 
-            result.push(struct);
+            results.push(result);
         }
 
-        return result;
+        return results;
     }
 
     static async auditLogs(logs: AuditLog[]): Promise<AuditLogStruct[]> {

package/src/helpers/SetupStepUpdater.ts

@@ -283,10 +283,16 @@ export class SetupStepUpdater {
             finishedSteps++;
         }
 
-        setupSteps.update(SetupStepType.Premises, {
-            totalSteps,
-            finishedSteps,
-        });
+        if (premiseTypes.length > 0) {
+            setupSteps.update(SetupStepType.Premises, {
+                totalSteps,
+                finishedSteps,
+            });
+        }
+        else {
+            // if no premise types, remove step
+            setupSteps.remove(SetupStepType.Premises);
+        }
     }
 
     private static updateStepGroups(

package/src/helpers/xlsxAddressTransformerColumnFactory.ts

@@ -90,6 +90,14 @@ export class XlsxTransformerColumnHelper {
                     value: getParent(member)?.email ?? '',
                 }),
             },
+            {
+                id: getId('nationalRegisterNumber'),
+                name: getName('Rijksregisternummer'),
+                width: 20,
+                getValue: (member: PlatformMember) => ({
+                    value: getParent(member)?.nationalRegisterNumber?.toString() ?? '',
+                }),
+            },
             XlsxTransformerColumnHelper.createAddressColumns<PlatformMember>({
                 matchId: getId('address'),
                 getAddress: member => getParent(member)?.address,

package/src/services/PaymentReallocationService.ts

@@ -40,13 +40,13 @@ export const PaymentReallocationService = {
                 continue;
             }
 
-            const similarDueItems = balanceItems.filter(b => b.id !== balanceItem.id && b.status === BalanceItemStatus.Due && doBalanceItemRelationsMatch(b.relations, balanceItem.relations, 0));
+            const similarDueItems = balanceItems.filter(b => b.id !== balanceItem.id && b.type === balanceItem.type && b.status === BalanceItemStatus.Due && doBalanceItemRelationsMatch(b.relations, balanceItem.relations, 0));
 
             if (similarDueItems.length) {
                 // Not possible to merge into one: there are 2 due items
                 continue;
             }
-            const similarCanceledItems = balanceItems.filter(b => b.id !== balanceItem.id && b.status !== BalanceItemStatus.Due && doBalanceItemRelationsMatch(b.relations, balanceItem.relations, 0));
+            const similarCanceledItems = balanceItems.filter(b => b.id !== balanceItem.id && b.type === balanceItem.type && b.status !== BalanceItemStatus.Due && doBalanceItemRelationsMatch(b.relations, balanceItem.relations, 0));
 
             if (similarCanceledItems.length) {
                 await this.mergeBalanceItems(balanceItem, similarCanceledItems);
@@ -190,6 +190,7 @@ export const PaymentReallocationService = {
             payment.type = PaymentType.Reallocation;
             payment.method = PaymentMethod.Unknown;
             payment.status = PaymentStatus.Succeeded;
+            payment.paidAt = new Date();
             await payment.save();
 
             // Create balance item payments

package/src/services/PaymentService.ts

@@ -161,7 +161,7 @@ export const PaymentService = {
                             if (token) {
                                 try {
                                     const mollieClient = createMollieClient({ accessToken: await token.getAccessToken() });
-                                    const mollieData = await mollieClient.payments.get(molliePayment.mollieId, {
+                                    let mollieData = await mollieClient.payments.get(molliePayment.mollieId, {
                                         testmode: organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production',
                                     });
 
@@ -187,6 +187,22 @@ export const PaymentService = {
                                     else if (mollieData.status === MolliePaymentStatus.failed || mollieData.status === MolliePaymentStatus.expired || mollieData.status === MolliePaymentStatus.canceled) {
                                         await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
                                     }
+                                    else if ((cancel || this.shouldTryToCancel(payment.status, payment)) && mollieData.isCancelable) {
+                                        console.log('Cancelling Mollie payment on request', payment.id);
+                                        mollieData = await mollieClient.payments.cancel(molliePayment.mollieId);
+
+                                        if (mollieData.status === MolliePaymentStatus.paid) {
+                                            await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Succeeded);
+                                        }
+                                        else if (mollieData.status === MolliePaymentStatus.failed || mollieData.status === MolliePaymentStatus.expired || mollieData.status === MolliePaymentStatus.canceled) {
+                                            await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
+                                        }
+                                        else if (this.isManualExpired(payment.status, payment)) {
+                                            // Mollie still returning pending after 1 day: mark as failed
+                                            console.error('Manually marking Mollie payment as expired', payment.id);
+                                            await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
+                                        }
+                                    }
                                     else if (this.isManualExpired(payment.status, payment)) {
                                         // Mollie still returning pending after 1 day: mark as failed
                                         console.error('Manually marking Mollie payment as expired', payment.id);

package/src/services/SSOService.ts

@@ -1,7 +1,7 @@
 import { DecodedRequest, Response } from '@simonbackx/simple-endpoints';
 import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
 import { Organization, Platform, Token, User, Webshop } from '@stamhoofd/models';
-import { LoginProviderType, OpenIDClientConfiguration, StartOpenIDFlowStruct, Token as TokenStruct } from '@stamhoofd/structures';
+import { LoginMethod, LoginProviderType, OpenIDClientConfiguration, StartOpenIDFlowStruct, Token as TokenStruct } from '@stamhoofd/structures';
 import crypto from 'crypto';
 import { generators, Issuer } from 'openid-client';
 import { Context } from '../helpers/Context';
@@ -81,8 +81,8 @@ export class SSOService {
         const platform = await Platform.getShared();
 
         const service = new SSOService({ provider, platform, organization, user: Context.user });
-        // Validate configuration
-        const _ = service.configuration;
+        service.validate();
+
         return service;
     }
 
@@ -117,6 +117,51 @@ export class SSOService {
         return configuration;
     }
 
+    get loginConfiguration() {
+        if (this.organization) {
+            throw new SimpleError({
+                code: 'invalid_client',
+                message: 'Login configuration not yet supported for organization users',
+                statusCode: 400,
+            });
+        }
+
+        const loginConfiguration = this.platform.config.loginMethods.get(this.provider as unknown as LoginMethod);
+        if (!loginConfiguration) {
+            throw new SimpleError({
+                code: 'invalid_client',
+                message: 'SSO not configured (correctly)',
+                statusCode: 400,
+            });
+        }
+
+        return loginConfiguration;
+    }
+
+    validate() {
+        // Validate configuration exists
+        const _ = this.configuration;
+        const __ = this.loginConfiguration;
+
+        if (this.user) {
+            this.validateEmail(this.user.email);
+        }
+    }
+
+    validateEmail(email: string) {
+        // Validate configuration
+        const loginConfiguration = this.loginConfiguration;
+
+        if (!loginConfiguration.isEnabledForEmail(email)) {
+            throw new SimpleError({
+                code: 'invalid_user',
+                message: 'User not allowed to use this login method',
+                human: 'Je kan deze inlogmethode niet gebruiken',
+                statusCode: 400,
+            });
+        }
+    }
+
     async setConfiguration(configuration: OpenIDClientConfiguration) {
         if (this.provider === LoginProviderType.SSO) {
             if (this.organization) {
@@ -289,8 +334,15 @@ export class SSOService {
             const client = await this.getClient();
             await SSOService.storeSession(response, session);
 
+            const scopes = ['openid', 'email', 'profile'];
+
+            if (this.provider === LoginProviderType.SSO) {
+                // Google doesn't support this scope
+                scopes.push('offline_access');
+            }
+
             const redirect = client.authorizationUrl({
-                scope: 'openid email profile',
+                scope: scopes.join(' '),
                 code_challenge,
                 code_challenge_method: 'S256',
                 response_mode: 'form_post',
@@ -300,6 +352,9 @@ export class SSOService {
                 prompt: prompt ?? undefined,
                 login_hint: this.user?.email ?? undefined,
                 redirect_uri: this.externalRedirectUri,
+
+                // Google has this instead of the offline_access scope
+                access_type: this.provider === LoginProviderType.Google ? 'offline' : undefined,
             });
 
             response.headers['location'] = redirect;
@@ -387,6 +442,13 @@ export class SSOServiceWithSession {
                 }
             }
 
+            if (tokenSet.refresh_token) {
+                console.log('OK. Refresh token received!');
+            }
+            else {
+                console.log('No refresh token');
+            }
+
             if (!claims.email) {
                 throw new SimpleError({
                     code: 'invalid_user',
@@ -403,6 +465,8 @@ export class SSOServiceWithSession {
                 });
             }
 
+            this.service.validateEmail(claims.email);
+
             // Get user from database
             let user = await User.getForRegister(this.service.organization?.id ?? null, claims.email);
             if (!user) {

package/src/sql-filters/members.ts

@@ -1,5 +1,8 @@
+import { SimpleError } from '@simonbackx/simple-errors';
 import { SQL, SQLAge, SQLConcat, SQLFilterDefinitions, SQLScalar, SQLValueType, baseSQLFilterCompilers, createSQLColumnFilterCompiler, createSQLExpressionFilterCompiler, createSQLFilterNamespace, createSQLRelationFilterCompiler } from '@stamhoofd/sql';
+import { AccessRight } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
+import { Context } from '../helpers/Context';
 import { organizationFilterCompilers } from './organizations';
 import { registrationFilterCompilers } from './registrations';
 
@@ -44,7 +47,23 @@ export const memberFilterCompilers: SQLFilterDefinitions = {
 
     'details.requiresFinancialSupport': createSQLExpressionFilterCompiler(
         SQL.jsonValue(SQL.column('details'), '$.value.requiresFinancialSupport.value'),
-        { isJSONValue: true, type: SQLValueType.JSONBoolean },
+        { isJSONValue: true, type: SQLValueType.JSONBoolean, checkPermission: async () => {
+            const organization = Context.organization;
+            if (!organization) {
+                return;
+            }
+
+            const permissions = await Context.auth.getOrganizationPermissions(organization);
+
+            if (!permissions || !permissions.hasAccessRight(AccessRight.MemberReadFinancialData)) {
+                throw new SimpleError({
+                    code: 'permission_denied',
+                    message: 'No permissions for financial support filter (organization scope).',
+                    human: 'Je hebt geen toegangsrechten om deze filter te gebruiken.',
+                    statusCode: 400,
+                });
+            }
+        } },
     ),
 
     'email': createSQLExpressionFilterCompiler(

package/src/sql-filters/organizations.ts

@@ -22,6 +22,7 @@ import { SetupStepType } from '@stamhoofd/structures';
 export const organizationFilterCompilers: SQLFilterDefinitions = {
     ...baseSQLFilterCompilers,
     id: createSQLExpressionFilterCompiler(SQL.column('organizations', 'id')),
+    uriPadded: createSQLExpressionFilterCompiler(SQL.lpad(SQL.column('organizations', 'uri'), 100, '0')),
     uri: createSQLExpressionFilterCompiler(SQL.column('organizations', 'uri')),
     name: createSQLExpressionFilterCompiler(
         SQL.column('organizations', 'name'),