@stamhoofd/backend 2.81.0 → 2.82.0

package/src/endpoints/organization/dashboard/users/CreateApiUserEndpoint.test.ts

@@ -0,0 +1,106 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+
+import { testServer } from '../../../../../tests/helpers/TestServer';
+import { PatchApiUserEndpoint } from './PatchApiUserEndpoint';
+import { SHExpect, TestUtils } from '@stamhoofd/test-utils';
+import { ApiUser, ApiUserRateLimits, PermissionLevel, Permissions, UserMeta, UserPermissions } from '@stamhoofd/structures';
+import { CreateApiUserEndpoint } from './CreateApiUserEndpoint';
+
+describe('Endpoint.CreateApiUserEndpoint', () => {
+    // Test endpoint
+    const endpoint = new CreateApiUserEndpoint();
+
+    beforeEach(() => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
+    test('Only a platform admin can set the rate limits of a key', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            globalPermissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+            meta: UserMeta.create({
+                rateLimits: ApiUserRateLimits.High,
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+        const response = await testServer.test(endpoint, createRequest);
+
+        expect(response.body).toBeDefined();
+        expect(response.body.meta?.rateLimits).toEqual(ApiUserRateLimits.High);
+    });
+
+    test('An organization admin cannot set rate limits', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+            meta: UserMeta.create({
+                rateLimits: ApiUserRateLimits.High,
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+
+        await expect(testServer.test(endpoint, createRequest)).rejects.toThrow(SHExpect.simpleError({
+            code: 'permission_denied',
+        }));
+    });
+
+    test('An API-key cannot have permissions outside its organization', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                    ['other', Permissions.create({ level: PermissionLevel.Full })],
+                ]),
+                globalPermissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, createRequest);
+
+        expect(response.body).toBeDefined();
+        expect(response.body.permissions).toEqual(
+            UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+                globalPermissions: null,
+            }),
+        );
+    });
+});

package/src/endpoints/organization/dashboard/users/CreateApiUserEndpoint.ts

@@ -2,15 +2,15 @@ import { Decoder } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Token, User } from '@stamhoofd/models';
-import { ApiUser, ApiUserWithToken, UserPermissions } from '@stamhoofd/structures';
+import { ApiUser, ApiUserWithToken, UserMeta, UserPermissions } from '@stamhoofd/structures';
 
 import { Context } from '../../../../helpers/Context';
 type Params = Record<string, never>;
 type Query = undefined;
 type Body = ApiUser;
-type ResponseBody = ApiUser;
+type ResponseBody = ApiUserWithToken;
 
-export class CreateAdminEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+export class CreateApiUserEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
     bodyDecoder = ApiUser as Decoder<ApiUser>;
 
     protected doesMatch(request: Request): [true, Params] | [false] {
@@ -56,6 +56,19 @@ export class CreateAdminEndpoint extends Endpoint<Params, Query, Body, ResponseB
         }
 
         admin.permissions = UserPermissions.limitedAdd(null, request.body.permissions, organization.id);
+
+        if (request.body.meta) {
+            const rateLimits = request.body.meta.rateLimits;
+            if (rateLimits) {
+                if (!Context.auth.hasPlatformFullAccess()) {
+                    throw Context.auth.error($t('Je hebt geen rechten om de rate limits van API-keys te wijzigen'));
+                }
+
+                admin.meta = admin.meta ?? UserMeta.create({});
+                admin.meta.rateLimits = rateLimits;
+            }
+        }
+
         await admin.save();
 
         // Set id

package/src/endpoints/organization/dashboard/users/PatchApiUserEndpoint.test.ts

@@ -0,0 +1,247 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+
+import { testServer } from '../../../../../tests/helpers/TestServer';
+import { PatchApiUserEndpoint } from './PatchApiUserEndpoint';
+import { SHExpect, TestUtils } from '@stamhoofd/test-utils';
+import { ApiUser, ApiUserRateLimits, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions, UserMeta, UserPermissions } from '@stamhoofd/structures';
+import { CreateApiUserEndpoint } from './CreateApiUserEndpoint';
+import { PatchMap } from '@simonbackx/simple-encoding';
+
+describe('Endpoint.PatchApiUserEndpoint', () => {
+    // Test endpoint
+    const createEndpoint = new CreateApiUserEndpoint();
+    const endpoint = new PatchApiUserEndpoint();
+
+    beforeEach(() => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
+    test('Only a platform admin can alter the rate limits of a key', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            globalPermissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+        const createResponse = await testServer.test(createEndpoint, createRequest);
+
+        const apiUserId = createResponse.body.id;
+
+        const r = Request.buildJson('PATCH', '/api-keys/' + apiUserId, organization.getApiHost(), ApiUser.patch({
+            id: apiUserId,
+            meta: UserMeta.patch({
+                rateLimits: ApiUserRateLimits.High,
+            }),
+        }));
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, r);
+        expect(response.body).toBeDefined();
+        expect(response.body.id).toEqual(apiUserId);
+        expect(response.body.meta?.rateLimits).toEqual(ApiUserRateLimits.High);
+    });
+
+    test('An organization admin cannot alter rate limits', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+        const createResponse = await testServer.test(createEndpoint, createRequest);
+
+        const apiUserId = createResponse.body.id;
+
+        const r = Request.buildJson('PATCH', '/api-keys/' + apiUserId, organization.getApiHost(), ApiUser.patch({
+            id: apiUserId,
+            meta: UserMeta.patch({
+                rateLimits: ApiUserRateLimits.High,
+            }),
+        }));
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        await expect(testServer.test(endpoint, r)).rejects.toThrow(SHExpect.simpleError({
+            code: 'permission_denied',
+        }));
+    });
+
+    test('You cannot grant an API-key permissions outside its organization using a put', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+        const createResponse = await testServer.test(createEndpoint, createRequest);
+        const apiUserId = createResponse.body.id;
+
+        const r = Request.buildJson('PATCH', '/api-keys/' + apiUserId, organization.getApiHost(), ApiUser.patch({
+            id: apiUserId,
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                    ['other', Permissions.create({ level: PermissionLevel.Full })],
+                ]),
+                globalPermissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }),
+        }));
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, r);
+        expect(response.body).toBeDefined();
+        expect(response.body.id).toEqual(apiUserId);
+        expect(response.body.permissions).toEqual(
+            UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+                globalPermissions: null,
+            }),
+        );
+    });
+
+    test('You cannot grant an API-key permissions outside its organization using a patch', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+        const createResponse = await testServer.test(createEndpoint, createRequest);
+        const apiUserId = createResponse.body.id;
+
+        const r = Request.buildJson('PATCH', '/api-keys/' + apiUserId, organization.getApiHost(), ApiUser.patch({
+            id: apiUserId,
+            permissions: UserPermissions.patch({
+                organizationPermissions: new PatchMap([
+                    ['other', Permissions.create({ level: PermissionLevel.Full })],
+                ]),
+                globalPermissions: Permissions.create({
+                    level: PermissionLevel.Full,
+                }),
+            }),
+        }));
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, r);
+        expect(response.body).toBeDefined();
+        expect(response.body.id).toEqual(apiUserId);
+        expect(response.body.permissions).toEqual(
+            UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+                globalPermissions: null,
+            }),
+        );
+    });
+
+    test('You can grant an API-key permissions using a patch', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+        const createResponse = await testServer.test(createEndpoint, createRequest);
+        const apiUserId = createResponse.body.id;
+
+        const r = Request.buildJson('PATCH', '/api-keys/' + apiUserId, organization.getApiHost(), ApiUser.patch({
+            id: apiUserId,
+            permissions: UserPermissions.patch({
+                organizationPermissions: new PatchMap([
+                    [organization.id, Permissions.patch({
+                        resources: new PatchMap([[
+                            PermissionsResourceType.Groups,
+                            new Map([
+                                ['group-id', ResourcePermissions.create({
+                                    level: PermissionLevel.Full,
+                                })],
+                            ]),
+                        ]]),
+                    })],
+                ]),
+            }),
+        }));
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, r);
+        expect(response.body).toBeDefined();
+        expect(response.body.id).toEqual(apiUserId);
+        expect(response.body.permissions).toEqual(
+            UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({
+                        level: PermissionLevel.Read,
+                        resources: new Map([[
+                            PermissionsResourceType.Groups,
+                            new Map([
+                                ['group-id', ResourcePermissions.create({
+                                    level: PermissionLevel.Full,
+                                })],
+                            ]),
+                        ]]),
+                    })],
+                ]),
+                globalPermissions: null,
+            }),
+        );
+    });
+});

package/src/endpoints/{auth → organization/dashboard/users}/PatchApiUserEndpoint.ts

@@ -1,17 +1,16 @@
-import { AutoEncoderPatchType, Decoder } from '@simonbackx/simple-encoding';
+import { AutoEncoderPatchType, Decoder, isPatch } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Token, User } from '@stamhoofd/models';
-import { ApiUser, PermissionLevel, UserPermissions } from '@stamhoofd/structures';
-
-import { Context } from '../../helpers/Context';
+import { ApiUser, PermissionLevel, UserMeta, UserPermissions } from '@stamhoofd/structures';
+import { Context } from '../../../../helpers/Context';
 
 type Params = { id: string };
 type Query = undefined;
 type Body = AutoEncoderPatchType<ApiUser>;
 type ResponseBody = ApiUser;
 
-export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+export class PatchApiUserEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
     bodyDecoder = ApiUser.patchType() as Decoder<AutoEncoderPatchType<ApiUser>>;
 
     protected doesMatch(request: Request): [true, Params] | [false] {
@@ -85,6 +84,26 @@ export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBod
             }
         }
 
+        if (request.body.meta) {
+            if (!isPatch(request.body.meta)) {
+                throw new SimpleError({
+                    code: 'invalid_request',
+                    message: 'Invalid request: meta is not a patch',
+                    statusCode: 400,
+                });
+            }
+
+            const rateLimits = request.body.meta.rateLimits;
+            if (rateLimits && rateLimits !== editUser.meta?.rateLimits) {
+                if (!Context.auth.hasPlatformFullAccess()) {
+                    throw Context.auth.error($t('Je hebt geen rechten om de rate limits van API-keys te wijzigen'));
+                }
+
+                editUser.meta = editUser.meta ?? UserMeta.create({});
+                editUser.meta.rateLimits = rateLimits;
+            }
+        }
+
         await editUser.save();
 
         return new Response(await Token.getAPIUserWithToken(editUser));

package/src/endpoints/organization/shared/auth/GetOrganizationEndpoint.test.ts

@@ -2,6 +2,7 @@ import { Request } from '@simonbackx/simple-endpoints';
 import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
 import { Organization, PermissionLevel, Permissions } from '@stamhoofd/structures';
 
+import { TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../../tests/helpers/TestServer';
 import { GetOrganizationEndpoint } from './GetOrganizationEndpoint';
 
@@ -9,6 +10,10 @@ describe('Endpoint.GetOrganization', () => {
     // Test endpoint
     const endpoint = new GetOrganizationEndpoint();
 
+    beforeEach(async () => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
     test('Get organization as signed in user', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();

package/src/endpoints/organization/webshops/GetWebshopEndpoint.test.ts

@@ -1,7 +1,8 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { OrganizationFactory, Token, UserFactory, WebshopFactory } from '@stamhoofd/models';
-import { PermissionLevel, Permissions, PrivateWebshop, Webshop as WebshopStruct } from '@stamhoofd/structures';
+import { PermissionLevel, Permissions } from '@stamhoofd/structures';
 
+import { TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer';
 import { GetWebshopEndpoint } from './GetWebshopEndpoint';
 
@@ -9,6 +10,10 @@ describe('Endpoint.GetWebshop', () => {
     // Test endpoint
     const endpoint = new GetWebshopEndpoint();
 
+    beforeEach(async () => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
     test('Get webshop as signed in user', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();

package/src/helpers/AuthenticatedStructures.ts

@@ -423,6 +423,14 @@ export class AuthenticatedStructures {
             }
         }
 
+        if (includeContextOrganization && STAMHOOFD.singleOrganization && !Context.auth.organization) {
+            const found = organizations.get(STAMHOOFD.singleOrganization);
+            if (!found) {
+                const organization = await Context.auth.getOrganization(STAMHOOFD.singleOrganization);
+                organizations.set(organization.id, organization);
+            }
+        }
+
         const memberBlobs: MemberWithRegistrationsBlob[] = [];
         for (const member of members) {
             for (const registration of member.registrations) {

package/src/helpers/CheckSettlements.ts

@@ -23,7 +23,7 @@ type MolliePaymentJSON = {
 let lastSettlementCheck: Date | null = null;
 
 export async function checkAllStripePayouts(checkAll = false) {
-    if (STAMHOOFD.environment !== 'production') {
+    if (STAMHOOFD.environment !== 'production' || !STAMHOOFD.STRIPE_SECRET_KEY) {
         console.log('Skip settlement check');
         return;
     }

package/src/helpers/Context.ts

@@ -4,29 +4,42 @@ import { I18n } from '@stamhoofd/backend-i18n';
 import { Organization, Platform, RateLimiter, Token, User } from '@stamhoofd/models';
 import { AsyncLocalStorage } from 'async_hooks';
 
+import { AutoEncoder, Decoder, field, StringDecoder } from '@simonbackx/simple-encoding';
+import { ApiUserRateLimits } from '@stamhoofd/structures';
 import { AdminPermissionChecker } from './AdminPermissionChecker';
-import { AutoEncoder, field, Decoder, StringDecoder } from '@simonbackx/simple-encoding';
 
 export const apiUserRateLimiter = new RateLimiter({
     limits: [
         {
-            // Block heavy bursts (5req/s for 5s)
-            limit: 25,
+            limit: {
+                '': 25, // (5req/s for 5s)
+                [ApiUserRateLimits.Medium]: 10 * 5, // (10req/s for 5s)
+                [ApiUserRateLimits.High]: 25 * 5, // (100req/s for 5s)
+            },
             duration: 5 * 1000,
         },
         {
-            // max 1req/s during 150s
-            limit: 150,
-            duration: 150 * 1000,
+            limit: {
+                '': 120, // max 1req/s during 150s
+                [ApiUserRateLimits.Medium]: 240, // (2req/s for 150s)
+                [ApiUserRateLimits.High]: 480, // (4req/s for 150s)
+            },
+            duration: 120 * 1000,
         },
         {
-            // 1000 requests per hour
-            limit: 1000,
+            limit: {
+                '': 1000, // ± 0.27 request/s sustained for an hour = 3.6s between each request
+                [ApiUserRateLimits.Medium]: 2000, // ± 0.56 request/s sustained for an hour
+                [ApiUserRateLimits.High]: 4000, // ± 1.11 request/s sustained for an hour
+            },
             duration: 60 * 1000 * 60,
         },
         {
-            // 2000 requests per day
-            limit: 2000,
+            limit: {
+                '': 2_000, // max 2000 requests per day
+                [ApiUserRateLimits.Medium]: 14_400, // max 4000 requests per day
+                [ApiUserRateLimits.High]: 18_000, // max 10 requests per minute, sustained for a full day
+            },
             duration: 24 * 60 * 1000 * 60,
         },
     ],
@@ -169,7 +182,10 @@ export class ContextInstance {
             return await this.authenticate({ allowWithoutAccount });
         }
         catch (e) {
-            return {};
+            if (e.code === 'not_authenticated') {
+                return {};
+            }
+            throw e;
         }
     }
 
@@ -235,7 +251,7 @@ export class ContextInstance {
 
         // Rate limits for api users
         if (token.user.isApiUser) {
-            apiUserRateLimiter.track(this.organization?.id ?? token.user.id);
+            apiUserRateLimiter.track(this.organization?.id ?? token.user.id, 1, token.user.meta?.rateLimits ?? undefined);
         }
 
         const user = token.user;

package/src/helpers/StripeHelper.ts

@@ -6,7 +6,18 @@ import { Formatter } from '@stamhoofd/utility';
 import Stripe from 'stripe';
 
 export class StripeHelper {
+    static get notConfiguredError() {
+        return new SimpleError({
+            code: 'not_configured',
+            message: 'Stripe is not yet configured for this platform',
+            human: $t('Stripe is nog niet geconfigureerd voor dit platform'),
+        });
+    }
+
     static getInstance(accountId: string | null = null) {
+        if (!STAMHOOFD.STRIPE_SECRET_KEY) {
+            throw this.notConfiguredError;
+        }
         return new Stripe(STAMHOOFD.STRIPE_SECRET_KEY, { apiVersion: '2024-06-20', typescript: true, maxNetworkRetries: 0, timeout: 10000, stripeAccount: accountId ?? undefined });
     }
 
@@ -81,7 +92,7 @@ export class StripeHelper {
     }
 
     static async getStatus(payment: Payment, cancel = false, testMode = false): Promise<PaymentStatus> {
-        if (testMode && !STAMHOOFD.STRIPE_SECRET_KEY.startsWith('sk_test_')) {
+        if (testMode && !STAMHOOFD.STRIPE_SECRET_KEY?.startsWith('sk_test_')) {
             // Do not query anything
             return payment.status;
         }