@stamhoofd/backend 2.90.3 → 2.92.0

package/src/endpoints/global/registration/RegisterMembersEndpoint.ts

@@ -14,6 +14,7 @@ import { Context } from '../../../helpers/Context';
 import { StripeHelper } from '../../../helpers/StripeHelper';
 import { BalanceItemService } from '../../../services/BalanceItemService';
 import { RegistrationService } from '../../../services/RegistrationService';
+import { PaymentService } from '../../../services/PaymentService';
 type Params = Record<string, never>;
 type Query = undefined;
 type Body = IDRegisterCheckout;
@@ -1047,120 +1048,126 @@ export class RegisterMembersEndpoint extends Endpoint<Params, Query, Body, Respo
 
         let paymentUrl: string | null = null;
 
-        // Update balance items
-        if (payment.method === PaymentMethod.Transfer) {
-            // Send a small reminder email
-            try {
-                await Registration.sendTransferEmail(user, organization, payment);
-            }
-            catch (e) {
-                console.error('Failed to send transfer email');
-                console.error(e);
-            }
-        }
-        else if (payment.method !== PaymentMethod.PointOfSale && payment.method !== PaymentMethod.Unknown) {
-            if (!checkout.redirectUrl || !checkout.cancelUrl) {
-                throw new Error('Should have been caught earlier');
+        try {
+            // Update balance items
+            if (payment.method === PaymentMethod.Transfer) {
+                // Send a small reminder email
+                try {
+                    await Registration.sendTransferEmail(user, organization, payment);
+                }
+                catch (e) {
+                    console.error('Failed to send transfer email');
+                    console.error(e);
+                }
             }
+            else if (payment.method !== PaymentMethod.PointOfSale && payment.method !== PaymentMethod.Unknown) {
+                if (!checkout.redirectUrl || !checkout.cancelUrl) {
+                    throw new Error('Should have been caught earlier');
+                }
 
-            const _redirectUrl = new URL(checkout.redirectUrl);
-            _redirectUrl.searchParams.set('paymentId', payment.id);
-            _redirectUrl.searchParams.set('organizationId', organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
-
-            const _cancelUrl = new URL(checkout.cancelUrl);
-            _cancelUrl.searchParams.set('paymentId', payment.id);
-            _cancelUrl.searchParams.set('cancel', 'true');
-            _cancelUrl.searchParams.set('organizationId', organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
-
-            const redirectUrl = _redirectUrl.href;
-            const cancelUrl = _cancelUrl.href;
-
-            const webhookUrl = 'https://' + organization.getApiHost() + '/v' + Version + '/payments/' + encodeURIComponent(payment.id) + '?exchange=true';
-
-            if (payment.provider === PaymentProvider.Stripe) {
-                const stripeResult = await StripeHelper.createPayment({
-                    payment,
-                    stripeAccount,
-                    redirectUrl,
-                    cancelUrl,
-                    statementDescriptor: organization.name,
-                    metadata: {
-                        organization: organization.id,
-                        user: user.id,
-                        payment: payment.id,
-                    },
-                    i18n: Context.i18n,
-                    lineItems: balanceItemPayments,
-                    organization,
-                    customer: {
-                        name: user.name ?? payMembers[0]?.details.name ?? $t(`bd1e59c8-3d4c-4097-ab35-0ce7b20d0e50`),
-                        email: user.email,
-                    },
-                });
-                paymentUrl = stripeResult.paymentUrl;
-            }
-            else if (payment.provider === PaymentProvider.Mollie) {
-                // Mollie payment
-                const token = await MollieToken.getTokenFor(organization.id);
-                if (!token) {
-                    throw new SimpleError({
-                        code: '',
-                        message: $t(`b77e1f68-8928-42a2-802b-059fa73bedc3`, { method: PaymentMethodHelper.getName(payment.method) }),
+                const _redirectUrl = new URL(checkout.redirectUrl);
+                _redirectUrl.searchParams.set('paymentId', payment.id);
+                _redirectUrl.searchParams.set('organizationId', organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
+
+                const _cancelUrl = new URL(checkout.cancelUrl);
+                _cancelUrl.searchParams.set('paymentId', payment.id);
+                _cancelUrl.searchParams.set('cancel', 'true');
+                _cancelUrl.searchParams.set('organizationId', organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
+
+                const redirectUrl = _redirectUrl.href;
+                const cancelUrl = _cancelUrl.href;
+
+                const webhookUrl = 'https://' + organization.getApiHost() + '/v' + Version + '/payments/' + encodeURIComponent(payment.id) + '?exchange=true';
+
+                if (payment.provider === PaymentProvider.Stripe) {
+                    const stripeResult = await StripeHelper.createPayment({
+                        payment,
+                        stripeAccount,
+                        redirectUrl,
+                        cancelUrl,
+                        statementDescriptor: organization.name,
+                        metadata: {
+                            organization: organization.id,
+                            user: user.id,
+                            payment: payment.id,
+                        },
+                        i18n: Context.i18n,
+                        lineItems: balanceItemPayments,
+                        organization,
+                        customer: {
+                            name: user.name ?? payMembers[0]?.details.name ?? $t(`bd1e59c8-3d4c-4097-ab35-0ce7b20d0e50`),
+                            email: user.email,
+                        },
                     });
+                    paymentUrl = stripeResult.paymentUrl;
                 }
-                const profileId = organization.privateMeta.mollieProfile?.id ?? await token.getProfileId(organization.getHost());
-                if (!profileId) {
-                    throw new SimpleError({
-                        code: '',
-                        message: $t(`5574469f-8eee-47fe-9fb6-1b097142ac75`, { method: PaymentMethodHelper.getName(payment.method) }),
+                else if (payment.provider === PaymentProvider.Mollie) {
+                    // Mollie payment
+                    const token = await MollieToken.getTokenFor(organization.id);
+                    if (!token) {
+                        throw new SimpleError({
+                            code: '',
+                            message: $t(`b77e1f68-8928-42a2-802b-059fa73bedc3`, { method: PaymentMethodHelper.getName(payment.method) }),
+                        });
+                    }
+                    const profileId = organization.privateMeta.mollieProfile?.id ?? await token.getProfileId(organization.getHost());
+                    if (!profileId) {
+                        throw new SimpleError({
+                            code: '',
+                            message: $t(`5574469f-8eee-47fe-9fb6-1b097142ac75`, { method: PaymentMethodHelper.getName(payment.method) }),
+                        });
+                    }
+                    const mollieClient = createMollieClient({ accessToken: await token.getAccessToken() });
+                    const locale = Context.i18n.locale.replace('-', '_');
+                    const molliePayment = await mollieClient.payments.create({
+                        amount: {
+                            currency: 'EUR',
+                            value: (totalPrice / 100).toFixed(2),
+                        },
+                        method: payment.method == PaymentMethod.Bancontact ? molliePaymentMethod.bancontact : (payment.method == PaymentMethod.iDEAL ? molliePaymentMethod.ideal : molliePaymentMethod.creditcard),
+                        testmode: organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production',
+                        profileId,
+                        description,
+                        redirectUrl,
+                        webhookUrl,
+                        metadata: {
+                            paymentId: payment.id,
+                        },
+                        locale: ['en_US', 'en_GB', 'nl_NL', 'nl_BE', 'fr_FR', 'fr_BE', 'de_DE', 'de_AT', 'de_CH', 'es_ES', 'ca_ES', 'pt_PT', 'it_IT', 'nb_NO', 'sv_SE', 'fi_FI', 'da_DK', 'is_IS', 'hu_HU', 'pl_PL', 'lv_LV', 'lt_LT'].includes(locale) ? (locale as any) : null,
                     });
-                }
-                const mollieClient = createMollieClient({ accessToken: await token.getAccessToken() });
-                const locale = Context.i18n.locale.replace('-', '_');
-                const molliePayment = await mollieClient.payments.create({
-                    amount: {
-                        currency: 'EUR',
-                        value: (totalPrice / 100).toFixed(2),
-                    },
-                    method: payment.method == PaymentMethod.Bancontact ? molliePaymentMethod.bancontact : (payment.method == PaymentMethod.iDEAL ? molliePaymentMethod.ideal : molliePaymentMethod.creditcard),
-                    testmode: organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production',
-                    profileId,
-                    description,
-                    redirectUrl,
-                    webhookUrl,
-                    metadata: {
-                        paymentId: payment.id,
-                    },
-                    locale: ['en_US', 'en_GB', 'nl_NL', 'nl_BE', 'fr_FR', 'fr_BE', 'de_DE', 'de_AT', 'de_CH', 'es_ES', 'ca_ES', 'pt_PT', 'it_IT', 'nb_NO', 'sv_SE', 'fi_FI', 'da_DK', 'is_IS', 'hu_HU', 'pl_PL', 'lv_LV', 'lt_LT'].includes(locale) ? (locale as any) : null,
-                });
-                paymentUrl = molliePayment.getCheckoutUrl();
+                    paymentUrl = molliePayment.getCheckoutUrl();
 
-                // Save payment
-                const dbPayment = new MolliePayment();
-                dbPayment.paymentId = payment.id;
-                dbPayment.mollieId = molliePayment.id;
-                await dbPayment.save();
-            }
-            else if (payment.provider === PaymentProvider.Payconiq) {
-                paymentUrl = await PayconiqPayment.createPayment(payment, organization, description, redirectUrl, webhookUrl);
-            }
-            else if (payment.provider == PaymentProvider.Buckaroo) {
-                // Increase request timeout because buckaroo is super slow (in development)
-                Context.request.request?.setTimeout(60 * 1000);
-                const buckaroo = new BuckarooHelper(organization.privateMeta?.buckarooSettings?.key ?? '', organization.privateMeta?.buckarooSettings?.secret ?? '', organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production');
-                const ip = Context.request.getIP();
-                paymentUrl = await buckaroo.createPayment(payment, ip, description, redirectUrl, webhookUrl);
-                await payment.save();
-
-                // TypeScript doesn't understand that the status can change and isn't a const....
-                if ((payment.status as any) === PaymentStatus.Failed) {
-                    throw new SimpleError({
-                        code: 'payment_failed',
-                        message: $t(`b77e1f68-8928-42a2-802b-059fa73bedc3`, { method: PaymentMethodHelper.getName(payment.method) }),
-                    });
+                    // Save payment
+                    const dbPayment = new MolliePayment();
+                    dbPayment.paymentId = payment.id;
+                    dbPayment.mollieId = molliePayment.id;
+                    await dbPayment.save();
+                }
+                else if (payment.provider === PaymentProvider.Payconiq) {
+                    paymentUrl = await PayconiqPayment.createPayment(payment, organization, description, redirectUrl, webhookUrl);
+                }
+                else if (payment.provider == PaymentProvider.Buckaroo) {
+                    // Increase request timeout because buckaroo is super slow (in development)
+                    Context.request.request?.setTimeout(60 * 1000);
+                    const buckaroo = new BuckarooHelper(organization.privateMeta?.buckarooSettings?.key ?? '', organization.privateMeta?.buckarooSettings?.secret ?? '', organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production');
+                    const ip = Context.request.getIP();
+                    paymentUrl = await buckaroo.createPayment(payment, ip, description, redirectUrl, webhookUrl);
+                    await payment.save();
+
+                    // TypeScript doesn't understand that the status can change and isn't a const....
+                    if ((payment.status as any) === PaymentStatus.Failed) {
+                        throw new SimpleError({
+                            code: 'payment_failed',
+                            message: $t(`b77e1f68-8928-42a2-802b-059fa73bedc3`, { method: PaymentMethodHelper.getName(payment.method) }),
+                        });
+                    }
                 }
             }
         }
+        catch (e) {
+            await PaymentService.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
+            throw e;
+        }
 
         return {
             payment,

package/src/endpoints/organization/dashboard/organization/PatchOrganizationEndpoint.ts

@@ -303,7 +303,7 @@ export class PatchOrganizationEndpoint extends Endpoint<Params, Query, Body, Res
                     throw new SimpleError({
                         code: 'invalid_field',
                         message: 'You cannot set the uitpasClientCredentialsStatus manually',
-                        human: $t('Je kan de status van de UiTPAS-credentials niet handmatig instellen'),
+                        human: $t('d8937ba8-6689-4c76-9841-d5a00c99074b'),
                     });
                 }
 

package/src/endpoints/organization/dashboard/organization/SetUitpasClientCredentialsEndpoint.ts

@@ -51,7 +51,7 @@ export class SetUitpasClientCredentialsEndpoint extends Endpoint<Params, Query,
             throw new SimpleError({
                 message: 'You must provide a client id',
                 code: 'missing_client_id',
-                human: $t('Je moet een client id opgeven.'),
+                human: $t('9b9ec483-63b8-4696-ade6-0eb18f9008e6'),
                 field: 'clientId',
             });
         }
@@ -59,7 +59,7 @@ export class SetUitpasClientCredentialsEndpoint extends Endpoint<Params, Query,
             throw new SimpleError({
                 message: 'You must provide a client secret',
                 code: 'missing_client_secret',
-                human: $t('Je moet een client secret opgeven.'),
+                human: $t('58de00fb-3b0a-45a6-9214-7d11b4175779'),
                 field: 'clientSecret',
             });
         }
@@ -67,7 +67,7 @@ export class SetUitpasClientCredentialsEndpoint extends Endpoint<Params, Query,
             throw new SimpleError({
                 message: 'You cannot use the placeholder client secret for a different client id',
                 code: 'invalid_client_secret',
-                human: $t('Je kan niet enkel de client id wijzigen. Geef ook de client secret in.'),
+                human: $t('bbc79280-7ae2-4b8d-a900-2d7cbb552428'),
                 field: 'clientSecret',
             });
         }
@@ -77,7 +77,7 @@ export class SetUitpasClientCredentialsEndpoint extends Endpoint<Params, Query,
             throw new SimpleError({
                 message: 'This organization does not have a uitpas organizer id set',
                 code: 'missing_uitpas_organizer_id',
-                human: $t('Stel eerst een UiTPAS-organisator in.'),
+                human: $t('80fcde9c-c8c7-4fe1-b9a6-51684a23d850'),
             });
         }
 
@@ -88,7 +88,7 @@ export class SetUitpasClientCredentialsEndpoint extends Endpoint<Params, Query,
                 throw new SimpleError({
                     message: 'The provided client credentials are not valid',
                     code: 'invalid_client_credentials',
-                    human: $t('De opgegeven client credentials zijn niet geldig.'),
+                    human: $t('42bbd5c0-8789-4ca1-b667-1c9ecf4d0190'),
                 });
             }
         }

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -1,5 +1,5 @@
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
-import { GroupPrivateSettings, Group as GroupStruct, GroupType, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, PermissionLevel, PermissionsResourceType, ResourcePermissions, Version } from '@stamhoofd/structures';
+import { GroupPrivateSettings, Group as GroupStruct, GroupType, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, PermissionLevel, PermissionsResourceType, ResourcePermissions, SetupStepType, Version } from '@stamhoofd/structures';
 
 import { AutoEncoderPatchType, Decoder, PatchableArrayAutoEncoder, PatchableArrayDecoder, StringDecoder } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';

package/src/endpoints/organization/dashboard/webshops/DeleteWebshopEndpoint.ts

@@ -1,9 +1,10 @@
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
-import { SimpleError } from '@simonbackx/simple-errors';
 import { BalanceItem, Order, Webshop } from '@stamhoofd/models';
 import { PermissionLevel } from '@stamhoofd/structures';
 
 import { Context } from '../../../../helpers/Context';
+import { UitpasService } from '../../../../services/uitpas/UitpasService';
+import { SimpleError } from '@simonbackx/simple-errors';
 
 type Params = { id: string };
 type Query = undefined;
@@ -42,6 +43,14 @@ export class DeleteWebshopEndpoint extends Endpoint<Params, Query, Body, Respons
             throw Context.auth.notFoundOrNoAccess();
         }
 
+        if (await UitpasService.areThereRegisteredTicketSales(webshop.id)) {
+            throw new SimpleError({
+                code: 'webshop_has_registered_ticket_sales',
+                message: `Webshop ${webshop.id} has registered ticket sales`,
+                human: $t(`0b3d6ea1-a70b-428c-9ba4-cc0c327ed415`),
+            });
+        }
+
         const orders = await Order.where({ webshopId: webshop.id });
         await BalanceItem.deleteForDeletedOrders(orders.map(o => o.id));
         await webshop.delete();

package/src/endpoints/organization/dashboard/webshops/PatchWebshopOrdersEndpoint.ts

@@ -7,6 +7,7 @@ import { AuditLogSource, BalanceItemRelation, BalanceItemRelationType, BalanceIt
 
 import { Context } from '../../../../helpers/Context';
 import { AuditLogService } from '../../../../services/AuditLogService';
+import { shouldReserveUitpasNumbers, UitpasService } from '../../../../services/uitpas/UitpasService';
 
 type Params = { id: string };
 type Query = undefined;
@@ -132,6 +133,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
 
                 // TODO: validate before updating stock
                 order.data.validate(webshopGetter.struct, organization.meta, request.i18n, true);
+                order.data.cart = await UitpasService.validateCart(organization.id, webshop.id, order.data.cart);
 
                 try {
                     await order.updateStock(null, true);
@@ -230,6 +232,8 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                 const previousToPay = model.totalToPay;
                 const previousStatus = model.status;
 
+                const shouldReserveBefore = shouldReserveUitpasNumbers(model.status);
+
                 model.status = patch.status ?? model.status;
 
                 // For now, we don't invalidate tickets, because they will get invalidated at scan time (the order status is checked)
@@ -240,13 +244,16 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                 const previousData = model.data.clone();
                 if (patch.data) {
                     model.data.patchOrPut(patch.data);
-
                     if (model.status !== OrderStatus.Deleted) {
                         // Make sure all data is up to date and validated (= possible corrections happen here too)
                         model.data.validate(webshopGetter.struct, organization.meta, request.i18n, true);
                     }
                 }
 
+                if ((patch.data || !shouldReserveBefore) && shouldReserveUitpasNumbers(model.status)) {
+                    model.data.cart = await UitpasService.validateCart(organization.id, webshop.id, model.data.cart, model.id);
+                }
+
                 if (model.status === OrderStatus.Deleted) {
                     model.data.removePersonalData();
 

package/src/endpoints/organization/dashboard/webshops/SearchUitpasEventsEndpoint.ts

@@ -41,7 +41,7 @@ export class SearchUitpasEventsEndpoint extends Endpoint<Params, Query, Body, Re
             throw new SimpleError({
                 code: 'no_uitpas_organizer_id',
                 message: `No UiTPAS organizer ID set for organization`,
-                human: $t(`Deze organisatie heeft nog geen UiTPAS-organisatie ingesteld. Stel dit in via de algemene instellingen.`),
+                human: $t(`aaf56535-c13b-4f92-9ba4-7309cae3e078`),
             });
         }
         const uitpasOrganizersResponse = await UitpasService.searchUitpasEvents(organization.id, organization.meta.uitpasOrganizerId, request.query.text);

package/src/endpoints/organization/webshops/PlaceOrderEndpoint.ts

@@ -3,7 +3,7 @@ import { Decoder } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Email } from '@stamhoofd/email';
-import { BalanceItem, BalanceItemPayment, MolliePayment, MollieToken, Order, PayconiqPayment, Payment, RateLimiter, Webshop, WebshopDiscountCode, WebshopUitpasNumber } from '@stamhoofd/models';
+import { BalanceItem, BalanceItemPayment, MolliePayment, MollieToken, Order, PayconiqPayment, Payment, RateLimiter, Webshop, WebshopDiscountCode } from '@stamhoofd/models';
 import { QueueHandler } from '@stamhoofd/queues';
 import { AuditLogSource, BalanceItemRelation, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, OrderData, OrderResponse, Order as OrderStruct, PaymentCustomer, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, Payment as PaymentStruct, TranslatedString, Version, WebshopAuthType, Webshop as WebshopStruct } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
@@ -133,72 +133,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             request.body.validate(webshopStruct, organization.meta, request.i18n, false, Context.user?.getStructure());
             request.body.update(webshopStruct);
 
-            // UiTPAS numbers validation
-            const articlesWithUitpasSocialTariff = request.body.cart.items.filter(item => item.productPrice.uitpasBaseProductPriceId !== null);
-            for (const item of articlesWithUitpasSocialTariff) {
-                const uitpasNumbersOnly = item.uitpasNumbers.map(p => p.uitpasNumber);
-
-                // verify the amount of UiTPAS numbers
-                if (uitpasNumbersOnly.length !== item.amount) {
-                    throw new SimpleError({
-                        code: 'amount_of_uitpas_numbers_mismatch',
-                        message: 'The number of UiTPAS numbers and items with UiTPAS social tariff does not match',
-                        human: $t('6140c642-69b2-43d6-80ba-2af4915c5837'),
-                        field: 'cart.items.uitpasNumbers',
-                    });
-                }
-
-                // verify the UiTPAS numbers are unique (within the order)
-                if (uitpasNumbersOnly.length !== Formatter.uniqueArray(uitpasNumbersOnly).length) {
-                    throw new SimpleError({
-                        code: 'duplicate_uitpas_numbers',
-                        message: 'Duplicate uitpas numbers used',
-                        human: $t('d9ec27f3-dafa-41e8-bcfb-9da564a4a675'),
-                        field: 'cart.items.uitpasNumbers',
-                    });
-                }
-
-                // verify the UiTPAS numbers are not already used for this product
-                const hasBeenUsed = await WebshopUitpasNumber.areUitpasNumbersUsed(webshop.id, item.product.id, uitpasNumbersOnly);
-                if (hasBeenUsed) {
-                    throw new SimpleError({
-                        code: 'uitpas_number_already_used',
-                        message: 'One or more uitpas numbers are already used',
-                        human: $t('1ef059c2-e758-4cfa-bc2b-16a581029450'),
-                        field: 'cart.items.uitpasNumbers',
-                    });
-                }
-
-                // verify the UiTPAS numbers are valid for social tariff (static check + API call to UiTPAS)
-                if (item.product.uitpasEvent) {
-                    const basePrice = item.product.prices.find(p => p.id === item.productPrice.uitpasBaseProductPriceId)?.price ?? 0;
-                    const reducedPrices = await UitpasService.getSocialTariffForUitpasNumbers(organization.id, uitpasNumbersOnly, basePrice, item.product.uitpasEvent.url);
-                    const expectedReducedPrices = item.uitpasNumbers;
-                    if (reducedPrices.length < expectedReducedPrices.length) {
-                        // should not happen
-                        throw new SimpleError({
-                            code: 'uitpas_social_tariff_price_mismatch',
-                            message: 'UiTPAS wrong number of prices retruned',
-                            human: $t('Het kansentarief voor sommige UiTPAS-nummers kon niet worden opgehaald.'),
-                            field: 'cart.items.uitpasNumbers',
-                        });
-                    }
-                    for (let i = 0; i < expectedReducedPrices.length; i++) {
-                        if (reducedPrices[i].price !== expectedReducedPrices[i].price) {
-                            throw new SimpleError({
-                                code: 'uitpas_social_tariff_price_mismatch',
-                                message: 'UiTPAS social tariff have a different price',
-                                human: $t('Het kansentarief voor deze UiTPAS is {correctPrice} in plaats van {orderPrice}.', { correctPrice: Formatter.price(reducedPrices[i].price), orderPrice: Formatter.price(expectedReducedPrices[i].price) }),
-                                field: 'uitpasNumbers.' + i.toString(),
-                            });
-                        }
-                        item.uitpasNumbers[i].uitpasTariffId = reducedPrices[i].uitpasTariffId;
-                    }
-                }
-                else {
-                    await UitpasService.checkUitpasNumbers(uitpasNumbersOnly); // Throws if invalid
-                }
-            }
+            request.body.cart = await UitpasService.validateCart(organization.id, webshop.id, request.body.cart);
 
             const order = new Order().setRelation(Order.webshop, webshop);
             order.data = request.body; // TODO: validate

package/src/helpers/AdminPermissionChecker.ts

@@ -1,6 +1,6 @@
 import { AutoEncoderPatchType, PatchMap } from '@simonbackx/simple-encoding';
 import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
-import { BalanceItem, CachedBalance, Document, EmailTemplate, Event, EventNotification, Group, Member, MemberPlatformMembership, MemberWithRegistrations, Order, Organization, OrganizationRegistrationPeriod, Payment, Registration, User, Webshop } from '@stamhoofd/models';
+import { BalanceItem, CachedBalance, Document, Email, EmailTemplate, Event, EventNotification, Group, Member, MemberPlatformMembership, MemberWithRegistrations, Order, Organization, OrganizationRegistrationPeriod, Payment, Registration, User, Webshop } from '@stamhoofd/models';
 import { AccessRight, EmailTemplate as EmailTemplateStruct, EventPermissionChecker, FinancialSupportSettings, GroupCategory, GroupStatus, GroupType, MemberWithRegistrationsBlob, PermissionLevel, PermissionsResourceType, Platform as PlatformStruct, RecordSettings, ResourcePermissions } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { MemberRecordStore } from '../services/MemberRecordStore';
@@ -379,11 +379,6 @@ export class AdminPermissionChecker {
             return false;
         }
 
-        // Check permissions aren't scoped to a specific organization, and they mismatch
-        if (!this.checkScope(registration.organizationId)) {
-            return false;
-        }
-
         const organizationPermissions = await this.getOrganizationPermissions(registration.organizationId);
 
         if (!organizationPermissions) {
@@ -714,7 +709,7 @@ export class AdminPermissionChecker {
         }
 
         if (!template.organizationId) {
-            return this.hasPlatformFullAccess();
+            return this.hasPlatformFullAccess() || !!this.platformPermissions?.hasAccessRight(AccessRight.ManageEmailTemplates);
         }
 
         if (await this.hasFullAccess(template.organizationId)) {
@@ -739,6 +734,11 @@ export class AdminPermissionChecker {
             return true;
         }
 
+        const o = await this.getOrganizationPermissions(template.organizationId);
+        if (o && o.hasAccessRight(AccessRight.ManageEmailTemplates)) {
+            return true;
+        }
+
         return false;
     }
 
@@ -850,8 +850,79 @@ export class AdminPermissionChecker {
         return this.hasSomeAccess(organizationId);
     }
 
-    canSendEmails() {
-        return !!this.user.permissions;
+    async canSendEmails(organizationId: Organization | string | null) {
+        if (organizationId) {
+            return (await this.getOrganizationPermissions(organizationId))?.hasAccessRightForSomeResourceOfType(PermissionsResourceType.Senders, AccessRight.SendMessages) ?? false;
+        }
+        return this.platformPermissions?.hasAccessRightForSomeResourceOfType(PermissionsResourceType.Senders, AccessRight.SendMessages) ?? false;
+    }
+
+    /**
+     * Fast check if this user can read at least one email in the system.
+     */
+    async canReadEmails(organizationId: Organization | string | null) {
+        if (await this.canSendEmails(organizationId)) {
+            // A user can reads its own emails, so they can read.
+            return true;
+        }
+        if (organizationId) {
+            return (await this.getOrganizationPermissions(organizationId))?.hasAccessForSomeResourceOfType(PermissionsResourceType.Senders, PermissionLevel.Read) ?? false;
+        }
+        return this.platformPermissions?.hasAccessForSomeResourceOfType(PermissionsResourceType.Senders, PermissionLevel.Read) ?? false;
+    }
+
+    async canReadAllEmails(organizationId: Organization | string | null, senderId = ''): Promise<boolean> {
+        if (organizationId) {
+            return (await this.getOrganizationPermissions(organizationId))?.hasResourceAccess(PermissionsResourceType.Senders, senderId, PermissionLevel.Read) ?? false;
+        }
+        return this.platformPermissions?.hasResourceAccess(PermissionsResourceType.Senders, senderId, PermissionLevel.Read) ?? false;
+    }
+
+    async canAccessEmail(email: Email, level: PermissionLevel = PermissionLevel.Read): Promise<boolean> {
+        if (!this.checkScope(email.organizationId)) {
+            return false;
+        }
+
+        if (email.userId === this.user.id) {
+            // User can always read their own emails
+            // Note; for sending we'll always need to use 'canSendEmailsFrom' externally
+            return true;
+        }
+
+        if (email.organizationId) {
+            const organizationPermissions = await this.getOrganizationPermissions(email.organizationId);
+            if (!organizationPermissions) {
+                return false;
+            }
+            if (!email.senderId) {
+                return organizationPermissions.hasResourceAccess(PermissionsResourceType.Senders, '', level);
+            }
+            return organizationPermissions.hasResourceAccess(PermissionsResourceType.Senders, email.senderId, level);
+        }
+
+        // Platform email
+        const platformPermissions = this.platformPermissions;
+        if (!platformPermissions) {
+            return false;
+        }
+        if (!email.senderId) {
+            return platformPermissions.hasResourceAccess(PermissionsResourceType.Senders, '', level);
+        }
+        return platformPermissions.hasResourceAccess(PermissionsResourceType.Senders, email.senderId, level);
+    }
+
+    async canSendEmail(email: Email): Promise<boolean> {
+        if (email.senderId) {
+            return await this.canSendEmailsFrom(email.organizationId, email.senderId);
+        }
+        return await this.canSendEmails(email.organizationId);
+    }
+
+    async canSendEmailsFrom(organizationId: Organization | string | null, senderId: string): Promise<boolean> {
+        if (organizationId) {
+            return (await this.getOrganizationPermissions(organizationId))?.hasResourceAccessRight(PermissionsResourceType.Senders, senderId, AccessRight.SendMessages) ?? false;
+        }
+        return this.platformPermissions?.hasResourceAccessRight(PermissionsResourceType.Senders, senderId, AccessRight.SendMessages) ?? false;
     }
 
     async canReadEmailTemplates(organizationId: string) {
@@ -914,7 +985,7 @@ export class AdminPermissionChecker {
      */
     async hasSomeAccess(organizationOrId: string | Organization): Promise<boolean> {
         const organizationPermissions = await this.getOrganizationPermissions(organizationOrId);
-        return !!organizationPermissions;
+        return !!organizationPermissions && !organizationPermissions.isEmpty;
     }
 
     async canManageAdmins(organizationId: string) {

package/src/helpers/FlagMomentCleanup.ts

@@ -26,7 +26,9 @@ export class FlagMomentCleanup {
     }
 
     static async getActiveMemberResponsibilityRecordsForOrganizationWithoutRegistrationInCurrentPeriod() {
-        const currentPeriodId = (await Platform.getShared()).periodId;
+        const platform = await Platform.getShared();
+        const currentPeriodId = platform.periodId;
+        const platformResponsibilityIds = platform.config.responsibilities.map(r => r.id);
 
         return await MemberResponsibilityRecord.select()
             .whereNot('organizationId', null)
@@ -62,6 +64,16 @@ export class FlagMomentCleanup {
                         ).where(
                             SQL.column(Group.table, 'type'),
                             GroupType.Membership,
+                        ).where(
+                            SQL.where(
+                                SQL.column(Group.table, 'defaultAgeGroupId'),
+                                '!=',
+                                null,
+                            ).or(
+                                SQL.column(MemberResponsibilityRecord.table, 'responsibilityId'),
+                                '!=',
+                                platformResponsibilityIds,
+                            ),
                         ).where(
                             SQL.column(Group.table, 'deletedAt'),
                             null,