@stamhoofd/backend 2.8.0 → 2.13.0

package/src/endpoints/organization/dashboard/payments/legacy/GetPaymentsEndpoint.ts

@@ -0,0 +1,170 @@
+import { AutoEncoder, DateDecoder, EnumDecoder, field, IntegerDecoder, StringDecoder } from "@simonbackx/simple-encoding";
+import { DecodedRequest, Endpoint, Request, Response } from "@simonbackx/simple-endpoints";
+import { Organization, Payment } from "@stamhoofd/models";
+import { PaymentGeneral, PaymentMethod, PaymentProvider, PaymentStatus } from "@stamhoofd/structures";
+
+import { StringArrayDecoder } from "../../../../../decoders/StringArrayDecoder";
+import { AuthenticatedStructures } from "../../../../../helpers/AuthenticatedStructures";
+import { Context } from "../../../../../helpers/Context";
+import { StringNullableDecoder } from "../../../../../decoders/StringNullableDecoder";
+
+type Params = Record<string, never>;
+type Body = undefined
+type ResponseBody = PaymentGeneral[]
+
+
+class Query extends AutoEncoder {
+    /**
+     * Usage in combination with paidSince is special!
+     */
+    @field({ decoder: StringDecoder, optional: true })
+    afterId?: string
+
+    /**
+     * Return all payments that were paid after (and including) this date. 
+     * Only returns orders **equal** to this date if afterId is not provided or if the id of those payments is also higher.
+     */
+    @field({ decoder: DateDecoder, optional: true })
+    paidSince?: Date
+
+    @field({ decoder: DateDecoder, optional: true })
+    paidBefore?: Date
+
+    @field({ decoder: IntegerDecoder, optional: true })
+    limit?: number
+
+    @field({ decoder: new StringArrayDecoder(new EnumDecoder(PaymentMethod)), optional: true })
+    methods?: PaymentMethod[]
+
+    @field({ decoder: new StringArrayDecoder(new StringNullableDecoder(new EnumDecoder(PaymentProvider))), optional: true })
+    providers?: (PaymentProvider|null)[]
+}
+
+export class GetPaymentsEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected queryDecoder = Query;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method != "GET") {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, "/organization/payments", {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        const organization = await Context.setOrganizationScope();
+        await Context.authenticate()
+
+        if (!await Context.auth.canManagePayments(organization.id)) {
+            throw Context.auth.error()
+        } 
+
+        return new Response(
+            (await this.getPayments(organization, request.query))
+        );
+    }
+
+    async getPayments(organization: Organization, query: Query) {
+        const paidSince = query.paidSince ?? new Date(Date.now() - (24 * 60 * 60 * 1000 * 7 ))
+        paidSince.setMilliseconds(0)
+        const payments: Payment[] = []
+
+        if (query.afterId) {
+            // First return all payments with id > afterId and paidAt == paidSince
+            payments.push(...await Payment.where({
+                organizationId: organization.id, 
+                paidAt: {
+                    sign: '=', 
+                    value: paidSince
+                },
+                id: {
+                    sign: '>',
+                    value: query.afterId ?? ""
+                },
+                method: {
+                    sign: 'IN', 
+                    value: query.methods ?? [PaymentMethod.Transfer]
+                },
+                provider: {
+                    sign: 'IN', 
+                    value: query.providers ?? [null]
+                }
+            }, {
+                limit: query.limit ?? undefined,
+                sort: [{
+                    column: "id",
+                    direction: "ASC"
+                }]
+            }));
+        }
+
+        payments.push(...await Payment.where({
+            organizationId: organization.id, 
+            paidAt: query.paidBefore ? [{
+                sign: query.afterId  ? '>' : '>=', 
+                value: paidSince
+            }, {
+                sign: '<=', 
+                value: query.paidBefore
+            }] : {
+                sign: query.afterId  ? '>' : '>=', 
+                value: paidSince
+            },
+            method: {
+                sign: 'IN', 
+                value: query.methods ?? [PaymentMethod.Transfer]
+            },
+            provider: {
+                sign: 'IN', 
+                value: query.providers ?? [null]
+            }
+        }, {
+            limit: query.limit ? (query.limit - payments.length) : undefined,
+            sort: [{
+                column: "paidAt",
+                direction: "ASC"
+            }, 
+            {
+                column: "id",
+                direction: "ASC"
+            }]
+        }));
+
+
+        if (!query.paidSince && !query.methods && !query.providers) {
+            // Default behaviour is to return all not-paid transfer payments that are not yet paid
+
+            payments.push(...
+                await Payment.where({
+                    organizationId: organization.id, 
+                    paidAt: null,
+                    method: PaymentMethod.Transfer,
+                    status: {
+                        sign: '!=',
+                        value: PaymentStatus.Failed
+                    }
+                })
+            );
+
+            payments.push(...
+                await Payment.where({
+                    organizationId: organization.id, 
+                    paidAt: null,
+                    updatedAt: {
+                        sign: '>', 
+                        value: new Date(Date.now() - (24 * 60 * 60 * 1000 * 7 ))
+                    },
+                    method: PaymentMethod.Transfer,
+                    status: PaymentStatus.Failed
+                })
+            );
+        }
+
+        return await AuthenticatedStructures.paymentsGeneral(payments, true)
+    }
+}

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -274,6 +274,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                 }
             }
         }
+
         
         await model.updateOccupancy()
         await model.save();

package/src/endpoints/organization/dashboard/webshops/PatchWebshopOrdersEndpoint.ts

@@ -3,7 +3,7 @@ import { DecodedRequest, Endpoint, Request, Response } from "@simonbackx/simple-
 import { SimpleError } from "@simonbackx/simple-errors";
 import { BalanceItem, BalanceItemPayment, Order, Payment, Token, Webshop } from '@stamhoofd/models';
 import { QueueHandler } from '@stamhoofd/queues';
-import { BalanceItemStatus, OrderStatus, PaymentMethod, PaymentStatus, PermissionLevel, PrivateOrder, PrivatePayment,Webshop as WebshopStruct } from "@stamhoofd/structures";
+import { BalanceItemRelation, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, OrderStatus, PaymentMethod, PaymentStatus, PermissionLevel, PrivateOrder, PrivatePayment,Webshop as WebshopStruct } from "@stamhoofd/structures";
 
 import { Context } from '../../../../helpers/Context';
 
@@ -157,11 +157,21 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                         // Create balance item
                         const balanceItem = new BalanceItem();
                         balanceItem.orderId = order.id;
-                        balanceItem.price = totalPrice
+                        balanceItem.type = BalanceItemType.Order;
+                        balanceItem.unitPrice = totalPrice
                         balanceItem.description = webshop.meta.name
                         balanceItem.pricePaid = 0
                         balanceItem.organizationId = organization.id;
                         balanceItem.status = BalanceItemStatus.Pending;
+                        balanceItem.relations = new Map([
+                            [
+                                BalanceItemRelationType.Webshop, 
+                                BalanceItemRelation.create({
+                                    id: webshop.id,
+                                    name: webshop.meta.name,
+                                })
+                            ]
+                        ])
                         await balanceItem.save();
 
                         // Create one balance item payment to pay it in one payment
@@ -245,7 +255,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                     const items = await BalanceItem.where({ orderId: model.id })
                     if (items.length >= 1) {
                         model.markUpdated()
-                        items[0].price = model.totalToPay
+                        items[0].unitPrice = model.totalToPay
                         items[0].description = model.generateBalanceDescription(webshop)
                         items[0].updateStatus();
                         await items[0].save()
@@ -258,7 +268,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                         model.markUpdated()
                         const balanceItem = new BalanceItem();
                         balanceItem.orderId = model.id;
-                        balanceItem.price = model.totalToPay
+                        balanceItem.unitPrice = model.totalToPay
                         balanceItem.description = model.generateBalanceDescription(webshop)
                         balanceItem.pricePaid = 0
                         balanceItem.organizationId = organization.id;

package/src/endpoints/organization/webshops/PlaceOrderEndpoint.ts

@@ -6,7 +6,7 @@ import { I18n } from '@stamhoofd/backend-i18n';
 import { Email } from '@stamhoofd/email';
 import { BalanceItem, BalanceItemPayment, MolliePayment, MollieToken, Order, PayconiqPayment, Payment, RateLimiter, Webshop, WebshopDiscountCode } from '@stamhoofd/models';
 import { QueueHandler } from '@stamhoofd/queues';
-import { BalanceItemStatus, Order as OrderStruct, OrderData, OrderResponse, Payment as PaymentStruct, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, Version, Webshop as WebshopStruct,WebshopAuthType } from "@stamhoofd/structures";
+import { BalanceItemStatus, Order as OrderStruct, OrderData, OrderResponse, Payment as PaymentStruct, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, Version, Webshop as WebshopStruct,WebshopAuthType, BalanceItemType, BalanceItemRelationType, BalanceItemRelation } from "@stamhoofd/structures";
 import { Formatter } from '@stamhoofd/utility';
 
 import { BuckarooHelper } from '../../../helpers/BuckarooHelper';
@@ -182,12 +182,22 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
 
                 // Create balance item
                 const balanceItem = new BalanceItem();
+                balanceItem.type = BalanceItemType.Order;
                 balanceItem.orderId = order.id;
-                balanceItem.price = totalPrice
+                balanceItem.unitPrice = totalPrice
                 balanceItem.description = webshop.meta.name
                 balanceItem.pricePaid = 0
                 balanceItem.organizationId = organization.id;
                 balanceItem.status = BalanceItemStatus.Hidden;
+                balanceItem.relations = new Map([
+                    [
+                        BalanceItemRelationType.Webshop, 
+                        BalanceItemRelation.create({
+                            id: webshop.id,
+                            name: webshop.meta.name,
+                        })
+                    ]
+                ])
                 await balanceItem.save();
 
                 // Create one balance item payment to pay it in one payment

package/src/helpers/AdminPermissionChecker.ts

@@ -1,7 +1,7 @@
 import { AutoEncoderPatchType, PatchMap } from "@simonbackx/simple-encoding"
 import { SimpleError } from "@simonbackx/simple-errors"
 import { BalanceItem, Document, DocumentTemplate, EmailTemplate, Event, Group, Member, MemberWithRegistrations, Order, Organization, Payment, Registration, User, Webshop } from "@stamhoofd/models"
-import { AccessRight, GroupCategory, GroupStatus, MemberWithRegistrationsBlob, PermissionLevel, PermissionsResourceType, Platform as PlatformStruct, RecordCategory } from "@stamhoofd/structures"
+import { AccessRight, FinancialSupportSettings, GroupCategory, GroupStatus, MemberWithRegistrationsBlob, PermissionLevel, PermissionsResourceType, Platform as PlatformStruct, RecordCategory } from "@stamhoofd/structures"
 import { Formatter } from "@stamhoofd/utility"
 
 /**
@@ -814,7 +814,7 @@ export class AdminPermissionChecker {
     async hasFinancialMemberAccess(member: MemberWithRegistrations, level: PermissionLevel = PermissionLevel.Read): Promise<boolean> {
         const isUserManager = this.isUserManager(member)
 
-        if (isUserManager) {
+        if (isUserManager && level === PermissionLevel.Read) {
             return true;
         }
 
@@ -846,6 +846,15 @@ export class AdminPermissionChecker {
                 continue;
             }
 
+            if (isUserManager) {
+                // Requirements are higher: you need financial access to write your own financial
+                // data changes
+                if (permissions.hasAccessRight(AccessRight.OrganizationManagePayments)) {
+                    return true;
+                }
+                continue;
+            }
+
             if (permissions.hasAccessRight(level === PermissionLevel.Read ? AccessRight.MemberReadFinancialData : AccessRight.MemberWriteFinancialData)) {
                 return true;
             }
@@ -854,8 +863,16 @@ export class AdminPermissionChecker {
         // Platform data
         const platformPermissions = this.platformPermissions
         if (platformPermissions) {
-            if (platformPermissions.hasAccessRight(level === PermissionLevel.Read ? AccessRight.MemberReadFinancialData : AccessRight.MemberWriteFinancialData)) {
-                return true;
+            if (isUserManager) {
+                // Requirements are higher: you need financial access to write your own financial
+                // data changes
+                if (platformPermissions.hasAccessRight(AccessRight.OrganizationManagePayments)) {
+                    return true;
+                }
+            } else {
+                if (platformPermissions.hasAccessRight(level === PermissionLevel.Read ? AccessRight.MemberReadFinancialData : AccessRight.MemberWriteFinancialData)) {
+                    return true;
+                }
             }
         }
 
@@ -949,80 +966,98 @@ export class AdminPermissionChecker {
 
         const hasRecordAnswers = !!data.details.recordAnswers;
         const hasNotes = data.details.notes !== undefined;
+        const isSetFinancialSupportTrue = data.details.requiresFinancialSupport?.value === true;
+        const isUserManager = this.isUserManager(member);
 
-        if(hasRecordAnswers || hasNotes) {
-            const isUserManager = this.isUserManager(member);
+        if (hasRecordAnswers) {
+            if (!(data.details.recordAnswers instanceof PatchMap)) {
+                throw new SimpleError({
+                    code: 'invalid_request',
+                    message: 'Cannot PUT recordAnswers',
+                    statusCode: 400
+                })
+            }
+            
+            const records = isUserManager ? new Set() : await this.getAccessibleRecordSet(member, PermissionLevel.Write)
 
-            if (hasRecordAnswers) {
-                if (!(data.details.recordAnswers instanceof PatchMap)) {
-                    throw new SimpleError({
-                        code: 'invalid_request',
-                        message: 'Cannot PUT recordAnswers',
-                        statusCode: 400
-                    })
-                }
-                
-                const records = isUserManager ? new Set() : await this.getAccessibleRecordSet(member, PermissionLevel.Write)
-
-                for (const [key, value] of data.details.recordAnswers.entries()) {
-                    let name: string | undefined = undefined
-                    if (value) {
-                        if (value.isPatch()) {
-                            throw new SimpleError({
-                                code: 'invalid_request',
-                                message: 'Cannot PATCH a record answer object',
-                                statusCode: 400
-                            })
-                        }
-
-                        const id = value.settings.id
-
-                        if (id !== key) {
-                            throw new SimpleError({
-                                code: 'invalid_request',
-                                message: 'Record answer key does not match record id',
-                                statusCode: 400
-                            })
-                        }
-
-                        name = value.settings.name
+            for (const [key, value] of data.details.recordAnswers.entries()) {
+                let name: string | undefined = undefined
+                if (value) {
+                    if (value.isPatch()) {
+                        throw new SimpleError({
+                            code: 'invalid_request',
+                            message: 'Cannot PATCH a record answer object',
+                            statusCode: 400
+                        })
                     }
 
-                    if (!isUserManager && !records.has(key)) {
+                    const id = value.settings.id
+
+                    if (id !== key) {
                         throw new SimpleError({
-                            code: 'permission_denied',
-                            message: `Je hebt geen toegangsrechten om het antwoord op ${name ?? 'deze vraag'} aan te passen voor dit lid`,
+                            code: 'invalid_request',
+                            message: 'Record answer key does not match record id',
                             statusCode: 400
                         })
                     }
+
+                    name = value.settings.name
                 }
-            }
 
-            if(hasNotes && isUserManager) {
-                throw new SimpleError({
-                    code: 'permission_denied',
-                    message: 'Cannot edit notes',
-                    statusCode: 400
-                })
+                if (!isUserManager && !records.has(key)) {
+                    throw new SimpleError({
+                        code: 'permission_denied',
+                        message: `Je hebt geen toegangsrechten om het antwoord op ${name ?? 'deze vraag'} aan te passen voor dit lid`,
+                        statusCode: 400
+                    })
+                }
             }
         }
 
+        if (hasNotes && isUserManager) {
+            throw new SimpleError({
+                code: 'permission_denied',
+                message: 'Cannot edit notes',
+                statusCode: 400
+            })
+        }
+
         // Has financial write access?
         if (!await this.hasFinancialMemberAccess(member, PermissionLevel.Write)) {
+            if (isUserManager && isSetFinancialSupportTrue) {
+                const financialSupportSettings = this.platform.config.financialSupport;
+                const preventSelfAssignment = financialSupportSettings?.preventSelfAssignment === true;
+    
+                if(preventSelfAssignment) {
+                    throw new SimpleError({
+                        code: 'permission_denied',
+                        message: 'No permissions to enable financial support for your own members',
+                        human: financialSupportSettings.preventSelfAssignmentText ?? FinancialSupportSettings.defaultPreventSelfAssignmentText,
+                        statusCode: 400
+                    });
+                }
+            }
+    
             if (data.details.requiresFinancialSupport) {
-                throw new SimpleError({
-                    code: 'permission_denied',
-                    message: 'Je hebt geen toegangsrechten om de financiële status van dit lid aan te passen',
-                    statusCode: 400
-                })
+                if (isUserManager) {
+                    // Already handled
+                } else {
+                    throw new SimpleError({
+                        code: 'permission_denied',
+                        message: 'Je hebt geen toegangsrechten om de financiële status van dit lid aan te passen',
+                        statusCode: 400
+                    })
+                }
             }
 
-            if (data.details.uitpasNumber) {
-                throw new SimpleError({
-                    code: 'permission_denied',
-                    message: 'Je hebt geen toegangsrechten om het UiTPAS-nummer van dit lid aan te passen',
-                    statusCode: 400
-                })
+            if (!isUserManager) {
+                if (data.details.uitpasNumber) {
+                    throw new SimpleError({
+                        code: 'permission_denied',
+                        message: 'Je hebt geen toegangsrechten om het UiTPAS-nummer van dit lid aan te passen',
+                        statusCode: 400
+                    })
+                }
             }
 
             if (data.outstandingBalance) {

package/src/helpers/AuthenticatedStructures.ts

@@ -26,7 +26,7 @@ export class AuthenticatedStructures {
         }
 
         const {balanceItemPayments, balanceItems} = await Payment.loadBalanceItems(payments)
-        const {registrations, orders, groups} = await Payment.loadBalanceItemRelations(balanceItems);
+        const {registrations, orders} = await Payment.loadBalanceItemRelations(balanceItems);
 
         if (checkPermissions) {
             // Note: permission checking is moved here for performacne to avoid loading the data multiple times
@@ -41,13 +41,10 @@ export class AuthenticatedStructures {
 
         const includeSettlements = checkPermissions && !!Context.user && !!Context.user.permissions
 
-        return await Payment.getGeneralStructureFromRelations({
+        return Payment.getGeneralStructureFromRelations({
             payments,
             balanceItemPayments,
-            balanceItems,
-            registrations,
-            orders,
-            groups
+            balanceItems
         }, includeSettlements)
     }
 
@@ -154,6 +151,19 @@ export class AuthenticatedStructures {
         })
     }
 
+    static async organizations(organizations: Organization[]): Promise<OrganizationStruct[]> {
+        // for now simple loop
+        if (organizations.length > 10) {
+            console.warn('Trying to load too many organizations at once: ' + organizations.length)
+        }
+
+        const structs: OrganizationStruct[] = [];
+        for (const organization of organizations) {
+            structs.push(await this.organization(organization))
+        }
+        return structs
+    }
+
     static async adminOrganizations(organizations: Organization[]): Promise<OrganizationStruct[]> {
         const structs: OrganizationStruct[] = [];
 

package/src/helpers/Context.ts

@@ -60,6 +60,27 @@ export class ContextInstance {
         return c;
     }
 
+    static async startForUser<T>(user: User, organization: Organization|null, handler: () => Promise<T>): Promise<T> {
+        const request = new Request({
+            method: 'GET',
+            url: '/',
+            host: ''
+        })
+        const context = new ContextInstance(request);
+
+        if (organization) {
+            context.organization = organization
+            context.i18n.switchToLocale({ country: organization.address.country })
+        }
+
+        context.user = user
+        context.#auth = new AdminPermissionChecker(user, await Platform.getSharedPrivateStruct(), context.organization);
+
+        return await this.asyncLocalStorage.run(context, async () => {
+            return await handler()
+        });
+    }
+
     static async start<T>(request: Request, handler: () => Promise<T>): Promise<T> {
         const context = new ContextInstance(request);
 

package/src/helpers/EmailResumer.ts

@@ -1,6 +1,7 @@
-import { Email } from "@stamhoofd/models";
+import { Email, Organization, User } from "@stamhoofd/models";
 import { SQL } from "@stamhoofd/sql";
 import { EmailStatus } from "@stamhoofd/structures";
+import { ContextInstance } from "./Context";
 
 export async function resumeEmails() {
     const query = SQL.select()
@@ -11,7 +12,26 @@ export async function resumeEmails() {
     const emails = Email.fromRows(result, Email.table);
 
     for (const email of emails) {
+        if (!email.userId) {
+            console.warn('Cannot retry sending email because userId is not set - which is required for setting the scope', email.id)
+            continue;
+        }
         console.log('Resuming email that has sending status on boot', email.id);
-        await email.send()
+
+        const user = await User.getByID(email.userId);
+        if (!user) {
+            console.warn('Cannot retry sending email because user not found', email.id)
+            continue;
+        }
+
+        const organization = email.organizationId ? (await Organization.getByID(email.organizationId)) : null;
+        if (organization === undefined) {
+            console.warn('Cannot retry sending email because organization not found', email.id)
+            continue;
+        }
+        
+        await ContextInstance.startForUser(user, organization, async () => {
+            await email.send()
+        })
     }
 }

package/src/helpers/MemberUserSyncer.ts

@@ -36,8 +36,14 @@ export class MemberUserSyncerStatic {
         } else {
             // Only auto unlink users that do not have an account
             for (const user of member.users) {
-                if (!user.hasAccount() && !userEmails.includes(user.email) && !parentAndUnverifiedEmails.includes(user.email)) {
-                    await this.unlinkUser(user, member)
+                if (!userEmails.includes(user.email) && !parentAndUnverifiedEmails.includes(user.email)) {
+                    if (!user.hasAccount()) {
+                        await this.unlinkUser(user, member)
+                    } else {
+                        // Make sure only linked as a parent, not as user self
+                        // This makes sure we don't inherit permissions and aren't counted as 'begin' the member
+                        await this.linkUser(user.email, member, true)
+                    }
                 }
             }
         }