PNBR#91001 Probleem bij koppeling Facilitor en Topdesk; bijlagen falen.

svn path=/Website/branches/v2025.2/; revision=70608
UWVA#91043 API2/orders 'externalnr' bewerkbaar met WEB_FACXNR
2025-10-14 10:18:51 +00:00 · 2025-10-13 12:30:34 +00:00 · 2025-10-13 09:04:16 +00:00 · 2025-10-13 08:52:41 +00:00 · 2025-10-06 07:39:27 +00:00 · 2025-10-03 18:20:05 +00:00
760 changed files with 27256 additions and 64955 deletions
--- a/APPL/ALG/alg.inc
+++ b/APPL/ALG/alg.inc
@@ -99,13 +99,6 @@ alg = {

                var autfunctionMAN = "WEB_ALGMAN";
                var autfunctionUSE = "WEB_ALGUSE";
-
-                // Met ALG* bepaal je wat je ziet (Read).
-                rresult.readman  = rresult.canRead (autfunctionMAN);
-                if (onrgoedlvl != "T")
-                  rresult.readuse  = rresult.canRead (autfunctionUSE);
-
-                // Met RUI* en TER* bepaal je wat je kunt wijzigen (Write).
                switch (onrgoedlvl)
                {
                    case "T": autfunctionMAN = "WEB_TERMAN";
@@ -114,14 +107,15 @@ alg = {
                              autfunctionUSE = "WEB_RUIUSE";
                              break;
                }
+
+                // Met ALG* bepaal je wat je ziet (Read).
+                rresult.readman  = rresult.canRead (autfunctionMAN);
+                rresult.readuse = rresult.canRead (autfunctionUSE);
+                // Met RUI* en TER* bepaal je wat je kunt wijzigen (Write).
                rresult.readmgt = rresult.canRead("WEB_ALGMGT");
                rresult.writemgt = rresult.canWrite("WEB_ALGMGT");
                rresult.writeman = rresult.canWrite(autfunctionMAN);
-
-                if (onrgoedlvl != "T")
-                  rresult.writeuse = rresult.canWrite(autfunctionUSE);
-                else
-                  rresult.writeuse = false;
+                rresult.writeuse = rresult.canWrite(autfunctionUSE);
            }
            else // iets meer werk
            {
@@ -143,7 +137,7 @@ alg = {
                                + "WHERE prs_perslid_key = " + user_key
                                + " AND alg_district_key = " + alg_key;
                            break;
-                    case "RG":
+                    case "E":
                            sql = "SELECT MAX(niveau) FROM fac_v_my_regions "
                                + "WHERE prs_perslid_key = " + user_key
                                + " AND alg_regio_key = " + alg_key;
@@ -484,7 +478,7 @@ alg = {
            if (!oRs.eof)
            {
              multiflex = true;
-              v_flexParams.flexlabel = L("lcl_flexlist_alg_b");
+              v_flexParams.flexlabel = L("lcl_flexlist_alg_" + p_niveau.toLowerCase());
              while (!oRs.eof)
              {
                if (oRs("alg_kenmerk_kenmerktype").Value == "M")
@@ -498,6 +492,7 @@ alg = {
          var onrgoed_fld = "";
          switch (p_niveau)
          {
+            case "E": onrgoed_fld = "e.alg_regio_key"; break;
            case "D": onrgoed_fld = "d.alg_district_key"; break;
            case "L": onrgoed_fld = "l.alg_locatie_key"; break;
            case "T": onrgoed_fld = "g.alg_terreinsector_key"; break;
--- a/APPL/ALG/alg_edit_gebouw.asp
+++ b/APPL/ALG/alg_edit_gebouw.asp
@@ -240,6 +240,7 @@ else
                    , { label: L("lcl_calendar")
                      , initKey: kalender_id
                      , emptyOption: ""
+                      , emptyKey: ""
                      , readonly: !this_alg.writeman
                      }
                    );
--- a/APPL/ALG/alg_edit_gebouw_multi.asp
+++ b/APPL/ALG/alg_edit_gebouw_multi.asp
@@ -77,7 +77,7 @@ user.auth_required_or_abort(ingesloten.length); // We klagen niet over enkele we
    </script>
  </head>

-  <body class="modal" id="mod_algmultiedit">
+  <body class="fclt-modal" id="mod_algmultiedit">
  <% MODAL_START(); %>
    <form name="u2" action="alg_edit_gebouw_multi_save.asp?bld_keys=<%=ingesloten.join(",")%>" method="post">
 <%
--- a/APPL/ALG/alg_edit_gebouw_save.asp
+++ b/APPL/ALG/alg_edit_gebouw_save.asp
@@ -37,14 +37,6 @@ var fields =  [ /* { dbs: "alg_gebouw_getekend",       typ: "date",    frm: "bld
                   { dbs: "alg_gebouw_dwgy",           typ: "float",   frm: "bld_dwgy" },   Deze 3 velden worden nergens meegegeven? */
              ];

-if (this_alg.writeuse)
-{
-    fields.push({ dbs: "mld_dienstniveau_key",      typ: "key",     frm: "dienstniveau",  track: L("lcl_mld_dienst_niveau"), foreign: "mld_dienstniveau" },
-    // De gebouwverantwoordelijke(n) moeten eigenlijk nog een PRS-scope test ondergaan alvorens opgeslagen te worden, maar dat is voor nu teveel eer
-                { dbs: "prs_perslid_key_verantw",   typ: "key",     frm: "verantw",       track: L("lcl_alg_verantw"),  foreign: "prs_perslid" },
-                { dbs: "prs_perslid_key_verantw2",  typ: "key",     frm: "verantw2",      track: L("lcl_alg_verantw2"), foreign: "prs_perslid" });
-}
-
 if (user.checkAutorisation("WEB_BEZMGT", true))
 {
    fields.push({ dbs: "alg_gebouw_toon_telefoon",  typ: "number",  frm: "toon_telefoon", track: L("lcl_estate_gebouw_toon_telefoon") },
@@ -72,12 +64,16 @@ if (this_alg.writeman)
                { dbs: "alg_gebouw_image",          typ: "varchar", frm: "bld_image",     track: L("lcl_alg_gebouw_image") },
                { dbs: "mld_adres_key",             typ: "key",     frm: "mld_adres",     track: L("lcl_delivery_address"),  foreign: "mld_v_factuuradres" },
                { dbs: "prs_kostenplaats_key",      typ: "key",     frm: "prs_kstpl",     track: L("lcl_prs_dept_kosten"),   foreign: "prs_kostenplaats" },
+                { dbs: "mld_dienstniveau_key",      typ: "key",     frm: "dienstniveau",  track: L("lcl_mld_dienst_niveau"), foreign: "mld_dienstniveau" },
                { dbs: "alg_gebouw_bez",            typ: "check",   frm: "bld_bez",       track: L("lcl_estate_gebouw_bez") },
                { dbs: "alg_gebouw_mld",            typ: "check",   frm: "bld_mld",       track: L("lcl_estate_gebouw_mld") },
                { dbs: "alg_gebouw_werkdagen",      typ: "check0",  frm: "bld_werkdagen", track: L("lcl_estate_gebouw_werkdagen") },
                { dbs: "alg_gebouw_vervaldatum",    typ: "date",    frm: "vervaldatum",   track: L("lcl_alg_vervaldatum") },
                { dbs: "bez_actie_groep_key",       typ: "key",     frm: "group",         track: L("bez_actie_groep"), foreign: "bez_actie_groep" },
-                { dbs: "mld_vrije_dagen_id",        typ: "varchar", frm: "cal_id",        track: L("lcl_calendar")});
+                { dbs: "mld_vrije_dagen_id",        typ: "varchar", frm: "cal_id",        track: L("lcl_calendar")},
+                // De gebouwverantwoordelijke(n) moeten eigenlijk nog een PRS-scope test ondergaan alvorens opgeslagen te worden, maar dat is voor nu teveel eer
+                { dbs: "prs_perslid_key_verantw",   typ: "key",     frm: "verantw",       track: L("lcl_alg_verantw"),  foreign: "prs_perslid" },
+                { dbs: "prs_perslid_key_verantw2",  typ: "key",     frm: "verantw2",      track: L("lcl_alg_verantw2"), foreign: "prs_perslid" });

    if (beginuur != -2)
        fields.push({ dbs: "alg_gebouw_beginuur",   typ: "float",   val: beginuur,        track: L("lcl_estate_gebouw_beginuur") });
--- a/APPL/ALG/alg_edit_locatie_multi.asp
+++ b/APPL/ALG/alg_edit_locatie_multi.asp
@@ -74,7 +74,7 @@ user.auth_required_or_abort(ingesloten.length); // We klagen niet over enkele we
    </script>
  </head>

-  <body class="modal" id="mod_algmultiedit">
+  <body class="fclt-modal" id="mod_algmultiedit">
  <% MODAL_START(); %>
    <form name="u2" action="alg_edit_locatie_multi_save.asp?loc_keys=<%=ingesloten.join(",")%>" method="post">
 <%
--- a/APPL/ALG/alg_edit_regio.asp
+++ b/APPL/ALG/alg_edit_regio.asp
@@ -18,12 +18,14 @@
 FCLTHeader.Requires({plugins:["suggest","jQuery"], js: []})

 var regio_key = getQParamInt("regio_key");
+var onrgoedlvl = "E";

 var params = { filter:  { id: regio_key,
                          isNew: (regio_key == -1 ? true : false)
                        }
             };
-var regio_array = model_regions.REST_GET(params);              // Roep de API2 GET aan
+var model = new model_regions();
+var regio_array = model.REST_GET(params);              // Roep de API2 GET aan
 var regio_data = (regio_array[0] ? regio_array[0] : {id: -1}); // GET kan meerdere records opleveren, maar we verwachten hier maar 1.
 var this_alg = params.func_enabled;                            // params bevat nu ook waarden die in API2 zijn bepaald.
 var action = (regio_key == -1 ? "I" : "U");
@@ -76,6 +78,14 @@ var action = (regio_key == -1 ? "I" : "U");
          manRWFIELD("reg_oms", "fld", L("lcl_name"), regio_data.name, {required: true, maxlength: 30});

        BLOCK_END();
+
+        generateFlexKenmerkBlock ({
+            onrgoed_key    : regio_key,
+            onrgoed_niveau : onrgoedlvl,
+            reado          : false,
+            this_alg       : this_alg
+        });
+
        IFACE.FORM_END();
 %>
      </form>
--- a/APPL/ALG/alg_edit_regio_save.asp
+++ b/APPL/ALG/alg_edit_regio_save.asp
@@ -18,7 +18,7 @@ protectRequest.validateToken();
 var regio_key = getQParamInt("regio_key");
 var action = getQParam("action", "");

-var onrgoedlvl = "RG";
+var onrgoedlvl = "E";
 var this_alg = alg.func_enabled(regio_key, onrgoedlvl);
 user.auth_required_or_abort(this_alg.writeman || (regio_key > 0 && this_alg.writeuse));

@@ -26,21 +26,22 @@ var formfields = [];
 if (this_alg.writeman)
    formfields.push({ name: "name", frm: "reg_oms" });
 var params = { filter: { "id": regio_key }};
-var jsondata = api2.form2JSONdata(model_regions, params, formfields);
+var model = new model_regions();
+var jsondata = api2.form2JSONdata(model, params, formfields);

 switch (action)
 {
    case "I":
-        var regio_array = model_regions.REST_POST(params, jsondata);
+        var regio_array = model.REST_POST(params, jsondata);
        regio_key = regio_array.key;
        break;
    case "U":
        if (regio_key > 0)
-            var regio_array = model_regions.REST_PUT(params, jsondata, params.filter.id);
+            var regio_array = model.REST_PUT(params, jsondata, params.filter.id);
        break;
    case "D":
        if (regio_key > 0)
-            var regio_array = model_regions.REST_DELETE(params, params.filter.id);
+            var regio_array = model.REST_DELETE(params, params.filter.id);
        break;
    default :
        var regio_array = {warning: L("lcl_cnt_Del_Fails_Auth")};
@@ -51,5 +52,34 @@ var result = { regio_key: regio_key,
               warning: warning,
               keepForm: !!warning,
               success: true };
+
+if (!warning)
+{
+    currentKenmerkenSQL = "SELECT k.alg_kenmerk_key"
+                        + "     , ok.alg_onrgoedkenmerk_waarde"
+                        + "     , k.alg_kenmerk_toonbaar"
+                        + "     , k.fac_functie_key"
+                        + "  FROM alg_onrgoedkenmerk ok"
+                        + "     , alg_kenmerk k"
+                        + " WHERE k.alg_kenmerk_key = ok.alg_kenmerk_key"
+                        + "   AND alg_onrgoedkenmerk_verwijder IS NULL"
+                        + "   AND alg_onrgoed_niveau = 'E'"
+                        + "   AND alg_onrgoed_key = " + regio_key;
+    saveFlexKenmerken(regio_key,
+                        { kenmerkTable: "alg_onrgoedkenmerk",
+                          kenmerkParentKey : "alg_onrgoed_key",
+                          kenmerkWaarde: "alg_onrgoedkenmerk_waarde",
+                          kenmerkKey: "alg_kenmerk_key",
+                          kenmerkToonbaar: "alg_kenmerk_toonbaar",
+                          currentKenmerkenSQL: currentKenmerkenSQL,
+                          requestQF: Request.Form,
+                          flexPath: "ALG/E",
+                          module: "ALG",
+                          moduleName: "alg_onrgoed_niveau",
+                          moduleVal: "E",
+                          isNew: regio_key < 0
+                        });
+}
+
 Response.Write(JSON.stringify(result));
 %><% ASPPAGE_END(); %>
--- a/APPL/ALG/alg_edit_ruimte_multi.asp
+++ b/APPL/ALG/alg_edit_ruimte_multi.asp
@@ -111,7 +111,7 @@ oRs.Close();
    </script>
  </head>

-  <body class="modal" id="mod_algmultiedit">
+  <body class="fclt-modal" id="mod_algmultiedit">
  <% MODAL_START(); %>
    <form name="u2" action="alg_edit_ruimte_multi_save.asp?alg_level=<%=safe.htmlattr(alg_level)%>&alg_keys=<%=ingesloten.join(",")%>" method="post">
 <%
--- a/APPL/ALG/alg_edit_terreinsector_multi.asp
+++ b/APPL/ALG/alg_edit_terreinsector_multi.asp
@@ -78,7 +78,7 @@ user.auth_required_or_abort(tobeedited > 0); // We klagen niet over enkele wel e
    </script>
  </head>

-  <body class="modal" id="mod_algmultiedit">
+  <body class="fclt-modal" id="mod_algmultiedit">
  <% MODAL_START(); %>
    <form name="u2" action="alg_edit_terreinsector_multi_save.asp?ter_keys=<%=ingesloten.join(",")%>" method="post">
 <%
--- a/APPL/ALG/alg_edit_verdieping_multi.asp
+++ b/APPL/ALG/alg_edit_verdieping_multi.asp
@@ -74,7 +74,7 @@ user.auth_required_or_abort(ingesloten.length); // We klagen niet over enkele we
    </script>
  </head>

-  <body class="modal" id="mod_algmultiedit">
+  <body class="fclt-modal" id="mod_algmultiedit">
  <% MODAL_START(); %>
    <form name="u2" action="alg_edit_verdieping_multi_save.asp?flr_keys=<%=ingesloten.join(",")%>" method="post">
 <%
--- a/APPL/ALG/alg_flexkenmerk.inc
+++ b/APPL/ALG/alg_flexkenmerk.inc
@@ -25,22 +25,27 @@ function generateFlexKenmerkBlock(params)
    var advanced = params.advanced; // Geavanceerd
    var hasfilter = params.hasfilter? params.hasfilter : null;

-    function isReadonly (volgnummer)
+    function isReadonly (oRs)
    {
        if (reado)
            return true;
-        if (volgnummer < 100 && !params.this_alg.writeman)
-            return true;
-        if (volgnummer > 100 && !params.this_alg.writeuse)
-            return true;
+        var rolcode = oRs("kenmerk_rolcode").value;
+        var canWrite = (params.this_alg.writeman && (rolcode&1)) || (params.this_alg.writeuse && (rolcode&2));
+
+        return !canWrite;  // readonly
    }

-    function isInvisible(volgnummer, ktype)
+    function isInvisible(oRs)
    {
+        var ktype = oRs("kenmerk_kenmerktype").value;
        if (params.multi)
            return (ktype == 'M' || ktype == 'F' || ktype == 'E'); // onzichtbaar bij multi
    }

+    // Wat mag ik op  basis van mijn autorisatie (potentieel) zien, bepaal mijn rolcode-masker
+    var myreadrolcode = 0 + (params.this_alg.readman ? 1 : 0)
+                          + (params.this_alg.readuse ? 2 : 0);
+
    var sql = "SELECT  k.alg_kenmerk_key              kenmerk_key"
            + "     , 1                              kenmerk_key_count"
            + "     , NULL                           srtkenmerk_key"
@@ -65,6 +70,7 @@ function generateFlexKenmerkBlock(params)
              : "   , " + lcl.xsql("k.alg_kenmerk_default", "k.alg_kenmerk_key")
              ) + "                                  kenmerk_waarde"
            + "     , k.alg_kenmerk_volgnr           kenmerk_volgnr"
+            + "     , k.alg_kenmerk_rolcode          kenmerk_rolcode"
            + "     , " + lcl.xsql("k.alg_kenmerk_dimensie", "k.alg_kenmerk_key") +" kenmerk_dimensie"
            + "     , " + lcl.xsql("k.alg_kenmerk_hint", "k.alg_kenmerk_key") +" kenmerk_hint"
            + "     , " + lcl.xsql("k.alg_kenmerk_default", "k.alg_kenmerk_key") + " kenmerk_default"
@@ -79,12 +85,11 @@ function generateFlexKenmerkBlock(params)
            + "    FROM alg_kenmerk k "
            + "   WHERE k.alg_kenmerk_niveau = " + safe.quoted_sql(onrgoed_niveau)
            + "     AND k.alg_kenmerk_verwijder IS NULL "
-            + (!params.this_alg.readman? " AND alg_kenmerk_volgnr >= 100" : "")
-            + (!params.this_alg.readuse? " AND alg_kenmerk_volgnr <= 100" : "")
+            + "     AND BITAND(alg_kenmerk_rolcode, " + myreadrolcode + ") > 0 "
            + " ORDER BY k.alg_kenmerk_volgnr"
            + "        , " + lcl.xsql("k.alg_kenmerk_omschrijving", "k.alg_kenmerk_key");

-    var trn = 0;
+    var trn = 0;  // fijn, maar waarom?

    listKenmerk(sql,
                "ALG", //module
--- a/APPL/ALG/alg_regio_list.inc
+++ b/APPL/ALG/alg_regio_list.inc
@@ -17,19 +17,6 @@

 <%
 FCLTHeader.Requires({ plugins:["jQuery"] });
-
-
-function fnrowData(oRs)
-{
-    var detail_key = oRs.Fields("id").Value;
-    var key        = oRs.Fields("id").Value;
-    var oms        = oRs.Fields("name").Value;
-
-    var data = {detail_key: detail_key, key: key, oms: oms};
-
-    return JSON.stringify(data);
-}
-
 %>
 <script type="text/javascript">

@@ -42,7 +29,7 @@ function fnrowData(oRs)
    FcltMgr.openDetail(url, L("lcl_district"));
  }

-    function districtEdit(row)
+  function districtEdit(row)
  {
    var algData = JSON.parse(row.getAttribute("ROWDATA"));
    var url = "appl/ALG/alg_regio.asp?mode=viewUpdate&key=" + algData.key;
@@ -54,13 +41,13 @@ function fnrowData(oRs)
    FcltMgr.confirm(L("lcl_alg_del_txt_regio"), { autoconfirm: isMulti }, function() {
      var regKeyString = getKeyString(rowArray);
      var data = { key: regKeyString,
-                   level: "RE"
+                   level: "E"
                 };
      <% protectRequest.dataToken("data"); %>
      $.post("alg_delete.asp", data, FcltCallbackRefresh, "json");
    });
  }
-    </script>
+</script>
 <%

 function regio_list(pautfunction, params)
@@ -75,13 +62,45 @@ function regio_list(pautfunction, params)
  var showall    = params.showall;
  var reg_key    = params.reg_key;

+  function fnrowData(oRs)
+  {
+    var detail_key = oRs.Fields("id").Value;
+    var key        = oRs.Fields("id").Value;
+    var oms        = oRs.Fields("name").Value;
+    var data = {detail_key: detail_key, key: key, oms: oms};
+    return JSON.stringify(data);
+  }
  function fnrowActionEnabler(oRs)
  {
-      var eDelete = false;
-      if (alg.canWriteRegio(oRs.Fields("id").Value, authparams.mALGwritelevel))
-          eDelete = true;
-      return ({eDelete: eDelete})
+    var eDelete = false;
+    if (alg.canWriteRegio(oRs.Fields("id").Value, authparams.mALGwritelevel))
+      eDelete = true;
+    return ({eDelete: eDelete});
  }
+
+  function fnrowFlexParams(oRs)
+  {
+    var reg_key = oRs.Fields("id").Value;
+    var this_alg = alg.func_enabled(reg_key, "E");
+    var flexParams = { readman: this_alg.readman, readuse: this_alg.readuse};
+    return flexParams;
+  }
+
+  function fncolFlexBijlagen(oRs)
+  {
+    var flexval = oRs.Fields("algflex").Value;
+    var alg_key = oRs.Fields("id").Value;
+    var result = ( flexval
+                 ? safe.html(flexval.replace(/\r/g, "\n")+ "\n")
+                 : ""
+                 );
+    if (flexParams.bijlageflex)
+    {
+        result += alg.alg_onroerendgoed_flex_bijlagen("E", alg_key);
+    }
+    return result;
+  }
+
 %>
  <html>
    <head>
@@ -90,16 +109,30 @@ function regio_list(pautfunction, params)
    <body id="listbody">
 <%
    // Ophalen regio`s
+    var flexParams = alg.alg_onroerendgoed_flex_params("E");
    var regio_key = getQParamInt("regiokey");
    var filter = {};
    if (regio_key > -1)
-        var filter = {id: regio_key};
-    var params = { filter: filter };  // Alle regio`s ophalen, behalve de verwijderde.
-    var regio_array = model_regions.REST_GET(params);       // Roep de API2 GET aan
+        filter = {id: regio_key};
+    else
+    {
+      var kenmerk_sql = getKenmerkSql("ALG", "alg_regio.alg_regio_key");
+      if (kenmerk_sql)
+        filter = {kenmerk_sql: kenmerk_sql.substr(4)}; // De "AND" aan het begin eraf halen.
+    }
+      
+    var params = { filter: filter // Alle regio`s ophalen, behalve de verwijderde.
+                 , flexparams: { anyflex: flexParams.anyflex
+                               , bijlageflex: flexParams.bijlageflex
+                               , sql: flexParams.sql.substr(1).replace("e.", "alg_regio.")
+                               , algflex: {"dbs": "algflex", "typ": "varchar"}
+                               }
+                 };
+    var model = new model_regions();
+    var regio_array = model.REST_GET(params);       // Roep de API2 GET aan
    //

    var addurl = "appl/alg/alg_regio.asp";
-    //  addurl += buildTransitParam(["loc_key", "bld_key", "flo_key", "room_key"], params)  // TODO: welke allemaal?

    if (canAdd)
    {
@@ -112,13 +145,17 @@ function regio_list(pautfunction, params)
                                   showAll: showall,
                                   rowData: fnrowData,
                                   rowActionEnabler: fnrowActionEnabler,
+                                   flexModule: "ALG",
+                                   flexId: "alg_regio_key",
+                                   flexParams: fnrowFlexParams,
                                   outputmode: outputmode,
                                   filterParams: params,
                                   buttons: addButton
                                 });

-
    rst.addColumn(new Column({caption: L("lcl_estate_regio_descr"), content: "name"}));
+    if (flexParams.anyflex)
+      rst.addColumn(new Column({caption: flexParams.flexlabel, content: fncolFlexBijlagen, colName: "fncolFlexBijlagen"}));

    rst.addAction({ action: "districtEdit", caption: L("lcl_edit"), isDefault:  true});
    rst.addAction({ action: "doDelete", caption: L("lcl_delete"), enabler: "eDelete", multi: true, multiOnce: true});
--- a/APPL/ALG/alg_regio_search.asp
+++ b/APPL/ALG/alg_regio_search.asp
@@ -24,7 +24,31 @@ var authparams = alg.checkAutorisation();
  <head>
    <%  FCLTHeader.Generate(); %>
    <script type="text/javascript">
-    $(function() {<% if (autosearch) { %> document.forms.u2.submit(); <%}%> });
+      function doSubmit()
+      {
+          // Submitten met kenmerken
+          doSubmitWithKenmerken();
+      }
+      async function myModal(init)
+      {
+        var lvl = "E";
+        var key = 0;
+        var bld_key = "";
+        var url = "load_kenmerk.asp?disc="
+                                + "&urole=bo"
+                                + "&advanced=1"
+                                + "&hasFilter=1"
+                                + "&onrgoed_key=" +bld_key
+                                + "&onrgoed_niveau=" + lvl;
+        var titel = L("lcl_properties");
+        await showKenmerkModal(url, titel, init);
+      }
+
+      $(function() {
+          <% if (autosearch) { %>
+            document.forms.u2.submit(); 
+          <% } %> 
+          });
    </script>
  </head>
  <body id="searchbody">
@@ -39,8 +63,10 @@ var authparams = alg.checkAutorisation();
                                                                  whenEmpty: L("lcl_search_generic")
                                                                });
  SEARCH_BLOCK_END();
-  var buttons =  [{title: L("lcl_overview_list"), action: "document.forms.u2.submit();", id: "bSearch", icon: "fa-clipboard-list" }];
  SIMPLE_BLOCK_START();
+    var buttons = [ {title: L("lcl_overview_list"), action: "doSubmit();", id: "bSearch", icon: "fa-clipboard-list" }
+                  , {title: L("lcl_shared_advanced"), action: "myModal()", id: "bAdvanced", importance: 3, icon: "fa-filter" }
+                  ];
    CreateButtons(buttons, { entersubmit: true, showIcons: true });
  SIMPLE_BLOCK_END();
  SEARCH_PAGE_END(); %>
--- a/APPL/ALG/alg_ruimteafdeling.asp
+++ b/APPL/ALG/alg_ruimteafdeling.asp
@@ -201,7 +201,7 @@ else
          </script>
    </head>

-    <body class="modal" id="mod_ruimteafdeling">
+    <body class="fclt-modal" id="mod_ruimteafdeling">
    <% MODAL_START(); %>
        <form name="u2" method="post" action="alg_ruimteafdeling.asp?submit=1&ruimte_keys=<%=ruimte_key_arr.join(",")%>">
 <%        MODAL_BLOCK_START("alg_ruimteafdeling", L("lcl_alg_geselecteerde_ruimten") + ": " + ruimte_key_arr.length, { icon: "fa-map-marker" }); %>
@@ -298,4 +298,4 @@ IFACE.FORM_END();
  </html>
 <%
 }
-ASPPAGE_END(); %> 
+ASPPAGE_END(); %>
--- a/APPL/ALG/alg_ruimtefunctie.asp
+++ b/APPL/ALG/alg_ruimtefunctie.asp
@@ -51,7 +51,7 @@ FCLTHeader.Requires({plugins:["suggest","jQuery"], js: ["jQuery-ui.js"]})
    </script>
  </head>

-<body class="modal" id="mod_ruimtefunctie">
+<body class="fclt-modal" id="mod_ruimtefunctie">
 <% MODAL_START(); %>
 <%
    var page="alg_edit_ruimtefunctie.asp?srtruimte_lg_key=" + srtruimte_lg_key; // Edit
@@ -65,4 +65,4 @@ FCLTHeader.Requires({plugins:["suggest","jQuery"], js: ["jQuery-ui.js"]})
 <% MODAL_END(); %>
  </body>
 </html>
-<% ASPPAGE_END(); %> 
+<% ASPPAGE_END(); %>
--- a/APPL/ALG/alg_ruimteresscope.asp
+++ b/APPL/ALG/alg_ruimteresscope.asp
@@ -41,7 +41,7 @@ var ruimte_key_arr = getQParamIntArray("ruimte_keys");
    </script>
 </head>

-<body class="modal" id="mod_ruimteresscope">
+<body class="fclt-modal" id="mod_ruimteresscope">
 <% MODAL_START(); %>
    <form name="u2" method="post" action="alg_ruimteresscope_save.asp?ruimte_keys=<%=ruimte_key_arr.join(",")%>">
    <% MODAL_BLOCK_START("alg_ruimteresscope", L("lcl_alg_geselecteerde_ruimten") + ": " + ruimte_key_arr.length, { icon: "fa-map-marker" }); %>
@@ -74,4 +74,4 @@ var ruimte_key_arr = getQParamIntArray("ruimte_keys");
      <% MODAL_END(); %>
  </body>
 </html>
-<% ASPPAGE_END(); %> 
+<% ASPPAGE_END(); %>
--- a/APPL/ALG/alg_show_note2.asp
+++ b/APPL/ALG/alg_show_note2.asp
@@ -47,14 +47,16 @@ var afgehandeld = false;
 var kenmerk_key = -1;
 if (alg_key > 0)
 {
+  // Als ik canReadNotes heb dan heb ik canUSEread en/of canMANread rechten.
+  // Wat mag ik op  basis van mijn autorisatie (potentieel) zien, bepaal mijn rolcode-masker
+  var myreadrolcode = 0 + (this_alg.canMANread ? 1 : 0)
+                        + (this_alg.canUSEread ? 2 : 0);
  // Is er een bijlage kenmerk?
  var sql = "SELECT k.alg_kenmerk_key"
          + "  FROM alg_kenmerk k"
          + " WHERE k.alg_kenmerk_niveau IN ('R','V','G','T','L')"
          + "   AND k.alg_kenmerk_verwijder IS NULL"
-          // Als ik canReadNotes heb dan heb ik canUSEread en/of canMANread rechten.
-          + (!this_alg.canMANread ? "   AND k.alg_kenmerk_volgnr >= 100" : "")
-          + (!this_alg.canUSEread ? "   AND k.alg_kenmerk_volgnr <= 100" : "")
+          + "   AND BITAND(k.alg_kenmerk_rolcode, " + myreadrolcode + ") > 0 "
          + "   AND (  k.alg_kenmerk_verplicht IS NULL"
          + "       OR k.alg_kenmerk_verplicht = 0)"
          + "   AND k.alg_kenmerk_kenmerktype = 'M'"
--- a/APPL/ALG/alg_show_regio.asp
+++ b/APPL/ALG/alg_show_regio.asp
@@ -21,11 +21,14 @@
 FCLTHeader.Requires({plugins:["jQuery"], js: []})

 var regio_key  = getQParamInt("regio_key");
+var onrgoedlvl = "E";

 var regio_params = { filter: { id: regio_key
                             , show_deleted: true // Ook indien verwijderd ophalen.
                             }};
-var regio_array = model_regions.REST_GET(regio_params);         // Roep de API2 GET aan
+//var regio_array = model_regions.REST_GET(regio_params);         // Roep de API2 GET aan
+var model = new model_regions();
+var regio_array = model.REST_GET(regio_params);
 var regio_data  = (regio_array[0] ? regio_array[0] : {id: -1}); // GET kan meerdere records opleveren, maar we verwachten hier maar 1.
 var this_alg    = regio_params.func_enabled;                    // regio_params bevat nu ook waarden die in API2 zijn bepaald.

@@ -85,6 +88,11 @@ var regio_deleted = regio_exists && !!regio_data.deleted;
 <%      BLOCK_START("algInfo", L("lcl_region"), {icon: "fa-globe"});
            ROFIELDTR("fld", L("lcl_name"), regio_data.name);
        BLOCK_END();
+
+        generateFlexKenmerkBlock ({ onrgoed_key    : regio_key,
+                                    onrgoed_niveau : onrgoedlvl,
+                                    reado          : true,
+                                    this_alg       : this_alg });
 %>
      </form>
    <% SUBFRAME_END(); %>
--- a/APPL/API/Exchange/default.asp
+++ b/APPL/API/Exchange/default.asp
@@ -0,0 +1,148 @@
+<%@ language = "JavaScript" %>
+<% /*
+     $Revision$
+     $Id$
+
+     File:          default.asp
+     Description:   Test-pagina om in Exchange te kunnen kijken
+
+     Parameters:
+     Status:
+     Context:
+     Notes:
+*/
+    THIS_FILE = "../api/default.asp";
+%>
+<!-- #include file="../../Shared/common.inc" -->
+<!-- #include file="../../Shared/iface.inc" -->
+<!-- #include file="../../Shared/calendar.inc" -->
+<%
+
+FCLTHeader.Requires({
+    plugins: ["jQuery"]
+});
+
+user.checkAutorisation("WEB_FACTAB");
+%>
+
+<html>
+  <head>
+<%  FCLTHeader.Generate(); %>
+    <style>
+        html, body {
+            height: 100%;
+            margin: 0;
+            padding: 0;
+        }
+        body, #result {
+            display: grid;
+            grid-template-rows: auto 1fr;
+            font-size: 13px;
+        }
+
+        .captions, .content {
+            display: flex;
+            flex-wrap: wrap;
+        }
+
+        .attention-bar {
+            flex-basis: 100%;
+            font-size: 1.25em;
+            font-weight: bold;
+            text-align: center;
+        }
+        .inform {
+            background-color: orange;
+            color: white;
+        }
+
+        .captions > span {
+            height: 2em;
+            flex-basis: 50%;
+            text-align: center;
+        }
+        textarea {
+            overflow: auto;
+            white-space: pre;
+            padding: .5em;
+            flex-basis: 50%;
+        }
+
+    </style>
+    <script>
+        function doSubmit() {
+            $.post(
+                "get_exchange_info.asp",
+                $("[name=exchange]").serialize(),
+                FcltCallbackAndThenAlways(exc_submit_callback),
+                "json"
+            );
+        }
+
+        function exc_submit_callback(json) {
+            $(".host, .room").val("");
+            $(".attention-bar").remove();
+            if (json.success) {
+                if (json.info?.length) { // Als json.success === false, dan wordt de json.info al in een popup weergegeven
+                    for (var i = 0; i < json.info.length; i++) {
+                        $(".captions > .host").before("<div class='attention-bar inform'>" + I("fa-circle-info fa-lg") + " " + safe.html(json.info) + "</div>");
+                    }
+                }
+                $(".host").val(json.host ? JSON.stringify(json.host, null, 4) : "N/A");
+                $(".room").val(json.room ? JSON.stringify(json.room, null, 4) : "N/A");
+            }
+        }
+    </script>
+  </head>
+  <body id="searchbody">
+    <form name="exchange" onsubmit="doSubmit(); return false;">
+<%  SEARCH_PAGE_START({ header: L("lcl_filterblok") });
+
+        SEARCH_BLOCK_START();
+
+            RWFIELDTR("reservering", null, L("lcl_res_number"));
+            RWCHECKBOXTR("compact", null, "Compact", true);
+
+        SEARCH_BLOCK_END();
+
+        SEARCH_BLOCK_START();
+
+            RWFIELDTR("userPrincipalName", null, "Eigenaar van de Exchange agenda", null, { "placeholder": "prs_perslid_email of res_ruimte_extern_id" });
+
+            FCLTcalendar("date_from", {
+                label: L("lcl_period_from"),
+                initEmpty: true,
+                volgnr: 1
+            });
+
+            FCLTcalendar("date_to", {
+                label: L("lcl_period_to"),
+                initEmpty: true,
+                volgnr: 2
+            });
+
+        SEARCH_BLOCK_END();
+
+        var buttons = [{ title: L("lcl_search"), action: "doSubmit()", importance: 1, icon: "fa-search" }];
+        SIMPLE_BLOCK_START();
+            CreateButtons(buttons, { "entersubmit": true });
+        SIMPLE_BLOCK_END();
+
+    SEARCH_PAGE_END();
+    IFACE.FORM_END();
+%>  </form>
+    <div id="result">
+        <div class="captions">
+            <span class="host">Hieronder het Exchange event uit de agenda van de <i>Gastheer</i></span>
+            <span class="room">Hieronder het Exchange event uit de agenda van de <i>Ruimte</i></span>
+        </div>
+        <div class="content">
+            <textarea class="host"></textarea>
+            <textarea class="room"></textarea>
+        </div>
+    </div>
+  </body>
+</html>
+<%
+ASPPAGE_END();
+%>
--- a/APPL/API/Exchange/get_exchange_info.asp
+++ b/APPL/API/Exchange/get_exchange_info.asp
@@ -0,0 +1,243 @@
+<%@language = "javascript" %>
+<% /*
+    $Revision$
+    $Id$
+
+    File:           get_exchange_info.asp
+    Description:    Haalt events uit Exchange op en geeft deze terug
+    Parameters:
+    Context:
+    Note:
+
+*/
+var JSON_Result = true;
+%>
+<!-- #include file="../../Shared/common.inc" -->
+<%
+    Session.Codepage = 65001; // We doen *uitsluitend* utf-8
+    Response.Charset = "UTF-8";
+
+    protectRequest.validateToken();
+
+    user.checkAutorisation("WEB_FACTAB");
+
+    function early_exit(err) {
+        result.success = false;
+        result.warning = err;
+        ASPPAGE_END();
+        Response.Write(JSON.stringify(result));
+        Response.End;
+    }
+
+    function verifyMSGraphResult(response) {
+        if (response === false || response === null) {
+            early_exit("MS Graph [Generic Error] - Zie Logging voor details");
+        }
+    }
+
+    // Minimaliseer het resultaat door alleen zeer relevante velden over te nemen
+    function strip(result) {
+        function _minify(event) {
+            return {
+                "createdDateTime": event.createdDateTime,
+                "id": event.id,
+                "iCalUId": event.iCalUId,
+                "subject": event.subject,
+                "isCancelled": event.isCancelled,
+                "sensitivity": event.sensitivity,
+                "isOnlineMeeting": event.isOnlineMeeting,
+                "responseStatus": event.responseStatus,
+                "start": event.start,
+                "end": event.end,
+                // "locations": event.locations,
+                "attendees": event.attendees
+            }
+        }
+        if (result.host) {
+            if (result.host instanceof Array) {
+                for (var i = 0; i < result.host.length; i++) {
+                    result.host[i] = _minify(result.host[i]);
+                }
+            } else {
+                result.host = _minify(result.host);
+            }
+        }
+        if (result.room) {
+            if (result.room instanceof Array) {
+                for (var i = 0; i < result.room.length; i++) {
+                    result.room[i] = _minify(result.room[i]);
+                }
+            } else {
+                result.room = _minify(result.room);
+            }
+        }
+        return result;
+    }
+
+    // Polyfill
+    if (!Date.prototype.toISOString) {
+        Date.prototype.toISOString = function () {
+            function pad(n) { return n < 10 ? '0' + n : n }
+            return this.getUTCFullYear() + '-'
+                + pad(this.getUTCMonth() + 1) + '-'
+                + pad(this.getUTCDate()) + 'T'
+                + pad(this.getUTCHours()) + ':'
+                + pad(this.getUTCMinutes()) + ':'
+                + pad(this.getUTCSeconds()) + 'Z';
+        };
+    }
+
+    var result = {
+        info: []
+    };
+
+    if (!(S("msgraph_sync_level") > 0)) {
+        result.info = ["S(\"msgraph_sync_level\") staat op '0'"];
+    }
+
+    // Initialize hook
+    var hook = hookfunc.gethook("UTILS/Exchange/res_to_graph.wsc");
+    var DEZE = this;
+    try {
+        var init = hook.initialize({
+            DEZE: DEZE,
+            custabspath: Server.MapPath(custpath)
+        });
+        if (init === null) { // Is alleen null als de exchange.config ontbreekt
+            early_exit("Geen exchange.config aangetroffen");
+        }
+    } catch (e) {
+        early_exit("Hook error: " + e.description);
+    }
+
+    var host_id = null;
+    var room_id = null;
+    var host_email = null;
+    var room_email = null;
+    var res_rsv_ruimte_key = null;
+    var fallback_user = false;
+
+    var compact = getFParam("compact", "off") == "on";
+    var reservering_nr = getFParam("reservering", "");
+    var userPrincipalName = getFParam("userPrincipalName", null);
+    var date_from = getFParamDate("date_from", null);
+    var date_to = getFParamDate("date_to", null);
+    if (reservering_nr != "") {
+        // We gaan het event ophalen met een reserveringsnr als informatie
+        var res_reservering_key = parseInt(reservering_nr.split("/")[0], 10);
+        var res_rsv_ruimte_volgnr = parseInt((reservering_nr.split("/")[1] || 1), 10);
+        if (isNaN(res_reservering_key) || isNaN(res_rsv_ruimte_volgnr)) {
+            early_exit("Ongeldig reserveringsnr, verwachte formaat; 12345/1");
+        }
+        var sql = "SELECT rrr.res_rsv_ruimte_externnr2     host_id,"
+                + "       rrr.res_rsv_ruimte_externnr      room_id,"
+                + "       p_host.prs_perslid_email         host_email,"
+                + "       rr.res_ruimte_extern_id          room_email,"
+                + "       rrr.res_rsv_ruimte_key           res_rsv_ruimte_key,"
+                + "       p_host.prs_perslid_oslogin       host_login"
+                + "  FROM res_rsv_ruimte  rrr"
+                + "       JOIN prs_perslid p_host"
+                + "           ON p_host.prs_perslid_key = rrr.res_rsv_ruimte_host_key"
+                + "       JOIN res_ruimte_opstelling rro"
+                + "           ON rro.res_ruimte_opstel_key = rrr.res_ruimte_opstel_key"
+                + "       JOIN res_ruimte rr ON rr.res_ruimte_key = rro.res_ruimte_key"
+                + " WHERE rrr.res_reservering_key = " + res_reservering_key
+                + "   AND rrr.res_rsv_ruimte_volgnr = " + res_rsv_ruimte_volgnr;
+        var oRs = Oracle.Execute(sql);
+        if (!oRs.EoF) {
+            host_id = oRs("host_id").Value;
+            room_id = oRs("room_id").Value;
+            host_email = oRs("host_email").Value;
+            room_email = oRs("room_email").Value;
+            res_rsv_ruimte_key = oRs("res_rsv_ruimte_key").Value;
+            fallback_user = oRs("host_login").Value === null ? false : !!oRs("host_login").Value.match(/^_MSGRAPH_FALLBACK_/);
+        } else {
+            early_exit("Reservering niet in Facilitor gevonden");
+        }
+        oRs.Close();
+
+        // Wat error-handling
+        if (host_id === null && room_id === null) {
+            if (room_email === null) {
+                early_exit("Ruimte is geen Exchange-gekoppelde ruimte");
+            } else {
+                early_exit("Reservering is niet aan Exchange gekoppeld");
+            }
+        } else if (fallback_user) {
+            early_exit("Deze reservering is geboekt op een fallback user, we kunnen hiervan niets uitlezen op basis van de reservering. Probeer de reservering zelf op te zoeken mbv een datum bereik");
+        }
+
+        // Haal nu de eigenlijke Exchange-events op
+        if (host_id && host_id != "##PENDING##" && host_email) {
+            var method = host_id.match(/^##iCalUId##/) ? "iCalUId" : "id";
+            result.host = hook.getCalendarEvent(method, host_email, host_id);
+            verifyMSGraphResult(result.host);
+        }
+        if (room_id && room_email) {
+            room_id = room_id.split("|")[1] || room_id.split("|")[0];
+            var method = room_id.match(/^##iCalUId##/) ? "iCalUId" : "id";
+            if (method == "iCalUId") {
+                room_id = room_id.slice(11); // Strip de '##iCalUId##'
+            }
+            result.room = hook.getCalendarEvent(method, room_email, room_id);
+            verifyMSGraphResult(result.room);
+        }
+
+        // Niet gevonden, nog eens proberen obv res_rsv_ruimte_key
+        if (!result.host && !result.room) {
+            if (host_id == "##PENDING##" && host_email) {
+                result.info.push("Deze reservering heeft nog geen antwoord van MSGraph ontvangen");
+                result.host = hook.getCalendarEvent("res_rsv_ruimte_key", host_email, res_rsv_ruimte_key);
+                verifyMSGraphResult(result.host);
+                if (!result.host) {
+                    early_exit("Reservering niet in Exchange gevonden op basis van res_rsv_ruimte_key");
+                }
+            } else {
+                result.info.push("Reservering niet in Exchange gevonden");
+            }
+            if (!result.host) {
+                early_exit("Reservering niet in Exchange gevonden");
+            }
+        }
+        // Klaar
+    } else if (userPrincipalName && date_from != null && date_to != null) {
+        // We gaan het event ophalen met een (ruimte of gastheer)email en een datum bereik
+        var id = date_from.toISOString() + "##" + date_to.toISOString();
+        var response = hook.getCalendarEvent("date", userPrincipalName, id);
+        verifyMSGraphResult(response);
+
+        // Verwerk het resultaat
+        if (response.value) {
+            // Convert een javascript Array naar een JSON Array
+            var events = [];
+            for (var x in response.value) {
+                events.push(response.value[x]);
+            }
+            if (events.length != 1) {
+                result.info.push("Er zijn " + events.length + " events gevonden");
+            }
+            var sql = "SELECT 1"
+                    + "  FROM res_ruimte"
+                    + " WHERE UPPER(res_ruimte_extern_id) = " + safe.quoted_sql_upper(userPrincipalName);
+            var oRs = Oracle.Execute(sql);
+            if (oRs.EoF) {
+                result.host = events;
+            } else {
+                result.room = events;
+            }
+            oRs.Close();
+        }
+    } else {
+        early_exit("Onvoldoende parameters meegegeven; zoek op reserveringsnr, of de combinatie; email/datum-van/datum-tot");
+    }
+
+    result.success = true;
+    // Strip onnodige velden
+    if (compact) {
+        result = strip(result);
+    };
+
+    Response.Write(JSON.stringify(result));
+    Response.End;
+%>
+<% ASPPAGE_END(); %>
--- a/APPL/API/api_SOAP.asp
+++ b/APPL/API/api_SOAP.asp
@@ -306,7 +306,6 @@ try
    var xml_content = oRs("xml_blob").Value;
 	oRs.Close();
    __Log("XML blob is {0} karakters.".format(xml_content.length));
-    Oracle.Execute("BEGIN DBMS_SESSION.free_unused_user_memory; END;");

    if (API.apidata.loglevel) __Log2File(xml_content, API.APIname + "_DATA");

--- a/APPL/API/api_hmail.asp
+++ b/APPL/API/api_hmail.asp
@@ -198,16 +198,36 @@ function getEmailSetting(xmlReq, xmlParameters)
        return senderResult;
    }

-    function checkSubject(xmlParameters)
+    // Check the subject against general rules (emlSetting null) or some defined
+    // regular expression from the configuration in emlSetting
+    // return .success true if the subject is okay, false else
+    // If false, a reason is given in .message
+    function checkSubject(emlSetting, xmlParameters)
    {
-        var v_subject_undeliverable = new RegExp(S("mail_subject_undeliverable")).test(xmlParameters.Subject);
-        var v_subject_ignore = new RegExp(S("mail_subject_ignore")).test(xmlParameters.Subject);
-        var senderResult = null;
-        if (v_subject_undeliverable || v_subject_ignore)
+        var subjectResult = { success: true };
+        if (emlSetting == null)
        {
-            senderResult = ( v_subject_undeliverable ? S("mail_subject_undeliverable") : S("mail_subject_ignore"));
+            // generieke onderwerpcheck tegen rubbish
+            var v_subject_undeliverable = new RegExp(S("mail_subject_undeliverable")).test(xmlParameters.Subject);
+            var v_subject_ignore = new RegExp(S("mail_subject_ignore")).test(xmlParameters.Subject);
+            var senderResult = null;
+            if (v_subject_undeliverable || v_subject_ignore)
+            {
+                subjectResult.success = false;
+                subjectResult.message = ( v_subject_undeliverable ? S("mail_subject_undeliverable") : S("mail_subject_ignore"));
+            }
+        } else {
+            // matcht het mailonderwerp wellicht met een specifieke configuratie?
+            if (emlSetting.text)
+            {
+                subjectResult.success = new RegExp(emlSetting.text, "ig").test(xmlParameters.Subject);
+                subjectResult.message = "Subject " + xmlParameters.Subject + (subjectResult.success ? " matches " : " does not match ") + emlSetting.text
+                __Log(subjectResult.message);
+            }
+            else // geen voorwaarde is altijd goed
+                subjectResult.success = true;
        }
-        return senderResult;
+        return subjectResult;
    }

    function setPath(attachpath)
@@ -230,17 +250,23 @@ function getEmailSetting(xmlReq, xmlParameters)
            + "       fac_email_setting_volgnr,"
            + "       fac_email_setting_action,"
            + "       fac_email_setting_expire,"
-            + "       fac_email_setting_from,"
+            + "       fac_email_setting_from,"          // optioneel: waar de afzender aan moet voldoen
            + "       fac_email_setting_frommode,"
+            + "       fac_email_setting_text,"          // optioneel: waar het onderwerp aan moet voldoen
            + "       fac_email_setting_attachpath,"
            + "       fac_email_setting_attachext,"
-            + "       fac_email_setting_reqattachext,"
+            + "       fac_email_setting_reqattachext,"  // optioneel: extensie van de bijlage die verplicht is
            + "       fac_email_setting_attachmaxkb,"
            + "       fac_email_setting_loglevel,"
            + "       prs_perslid_key_auth"
            + "  FROM fac_email_setting"
            + " WHERE upper(fac_email_setting_user) = UPPER("+safe.quoted_sql(xmlParameters.mailuser)+")"
            + " ORDER BY fac_email_setting_volgnr";
+
+            // Als je het zo zou doen vind je organischer de meest specifieke match, met volgnummer slechts beslissend als er meerdere zouden zijn
+            // Het lijkt echter safer om datr aan de gebruiker over te laten en die dat met volgnummer expliciet te kunnen laten definieren.
+            //+ " ORDER BY fac_email_setting_reqattachext NULLS LAST, fac_email_setting_from NULLS LAST, fac_email_setting_text NULLS LAST, fac_email_setting_volgnr";
+
    var oRs = Oracle.Execute(sql);
    if (oRs.eof)
    {   // Er is geen fac_email_setting record gevonden.
@@ -251,11 +277,22 @@ function getEmailSetting(xmlReq, xmlParameters)
                            };
    }
    else
-    {   // Er bestaat minimaal 1 fac_email_setting record.
+    {   // Er bestaat minimaal 1 fac_email_setting record voor deze ontvanger.
        var allowedSetting = {};
        var rejectedAttach = [];
        var hasRequiredAttachment = false;
-        while (!oRs.eof && !hasRequiredAttachment)
+        var hasMatchingFrom       = false;
+        var hasMatchingSubject    = false;
+
+        // Loop door de fac_email_setting records en bepaal welke het beste past bij deze e-mail
+        // Dat is de eerste match op basis van het volgnummer, waarbij de 3 criteria niet conflicteren.
+        // - de afzender matcht of is niet specifiek gedefinieerd
+        // - het onderwerp matcht de conditie of is niet specifiek gedefinieerd
+        // - de verplichte bijlage is present of is niet specifiek gedefinieerd
+        // Het gevonden record levert de aan te roepen mailprocessor en 
+        // (bij de default fac.processemail) de aan te maken standaardmelding
+
+        while (!oRs.eof && !(hasRequiredAttachment && hasMatchingFrom && hasMatchingSubject))
        {
            var emlSetting = {
                key:                    oRs("fac_email_setting_key").Value,
@@ -269,21 +306,29 @@ function getEmailSetting(xmlReq, xmlParameters)
                attach_maxkb:           oRs("fac_email_setting_attachmaxkb").Value,
                fromMode:               oRs("fac_email_setting_frommode").Value,
                from:                   oRs("fac_email_setting_from").Value,
+                text:                   oRs("fac_email_setting_text").Value,
                loglevel:               oRs("fac_email_setting_loglevel").Value
            };
            emlSetting.path = setPath(emlSetting.attachpath);
-            __Log("Scanning e-mail setting: "+emlSetting.volgnr);
+            __Log("Scanning e-mail setting: "+emlSetting.key + " (volgnr "+emlSetting.volgnr+")");

-            var expireResult = checkExpire(emlSetting.expire);
-            var senderResult = checkSender(emlSetting, xmlParameters);
+            var expireResult  = checkExpire(emlSetting.expire);
+            var senderResult  = checkSender(emlSetting, xmlParameters);
+            var subjectResult = checkSubject(emlSetting, xmlParameters);
+            
+            hasMatchingFrom    = senderResult.success;
+            hasMatchingSubject = subjectResult.success;
+            __Log('hasMatchingFrom '+ hasMatchingFrom);
+            __Log('hasMatchingSubject '+ hasMatchingSubject);

-            if (expireResult.success && senderResult.success)
+            // als fron en subject okay zijn, dan kijken we of er een verplicht kenmerk is
+            if (expireResult.success && hasMatchingFrom && hasMatchingSubject)
            {
-                emlSetting.theFrom = senderResult.theFrom;
+                emlSetting.theFrom = senderResult.theFrom;  // verbeter na de uitgevoerde controle
                var attachResult = checkAttach(xmlReq, xmlParameters, emlSetting);
                emlSetting.allowedFiles = attachResult.allowedFiles;
                emlSetting.requiredFound = attachResult.requiredFound;
-                hasRequiredAttachment = attachResult.requiredFound;
+                hasRequiredAttachment = emlSetting.required_attachext == null || attachResult.requiredFound;
                allowedSetting = emlSetting;
                if (attachResult.rejectedFiles.tekst != "")
                {
@@ -301,11 +346,12 @@ function getEmailSetting(xmlReq, xmlParameters)
                    result.rejectMail = (!expireResult.success ? expireResult.rejectMail : senderResult.rejectMail);
                }
            }
+            __Log("hasRequiredAttachment: " + hasRequiredAttachment);
            oRs.MoveNext();
        }
-
+        __Log("Done looking for matching e-mail settings");
        result.emlSetting = allowedSetting;
-        result.silentignoreemail = checkSubject(xmlParameters);
+        result.silentignoreemail = checkSubject(null, xmlParameters).message;
    }
    oRs.Close();
    return result;
@@ -430,6 +476,7 @@ function emailAction(emlSetting, xmlParam, resultParam)
    return result;
 }

+// 
 function checkAttach(xmlReq, xmlParameter, emlSetting)
 {
    var requiredFound = false;
@@ -450,10 +497,14 @@ function checkAttach(xmlReq, xmlParameter, emlSetting)
        {   // Waarschijnlijk een FACILITOR bon gereply'd
            __Log("Bijlage {0} genegeerd.".format(safefilename));
        }
-        else if (attsize < S("flex_min_size"))
+        else if (attsize < S("flex_min_size")) // sowieso te klein
        {
            __Log("Bijlage {0} genegeerd, te klein met {1} bytes.".format(safefilename, attsize));
        }
+        else if (attsize < S("flex_min_imgsize") && new RegExp(S("flex_min_imgsize_ext"), "ig").test(safefilename)) // plaatje te klein (facebook, twitter, X)
+        {
+            __Log("Plaatje {0} genegeerd, te klein met {1} bytes.".format(safefilename, attsize));
+        }
        else if (   emlSetting.attach_maxkb && emlSetting.attach_maxkb > 0  // Er is een maximum bestandsgrootte ingesteld
                 && parseFloat(filesize_MB) > parseFloat(maxsize_MB))       // En die is overschreden
        {
@@ -463,7 +514,7 @@ function checkAttach(xmlReq, xmlParameter, emlSetting)
        }
        else if (!new RegExp(S("flexallowedext"), "ig").test(safefilename))
        {   // Niet ondersteunde bestandstype
-            __DoLog("Onbekende extensie e-mail bijlage: {0} ({1} bytes) van {2}. Bestand is niet opgeslagen.".format(safefilename, attsize, emlSetting.theFrom));
+            __Log("Onbekende extensie e-mail bijlage: {0} ({1} bytes) van {2}. Bestand is niet opgeslagen.".format(safefilename, attsize, emlSetting.theFrom));
        }
        else if (emlSetting.allowed_attachext && !new RegExp(emlSetting.allowed_attachext, "ig").test(safefilename))
        {   // bestand is niet van het opgegeven type
@@ -677,7 +728,7 @@ if (emlResult.emlSetting && !emlResult.rejectMail)
    __Log("htmlBody: "    + xmlParameters.htmlBody);
    __Log("body: "        + xmlParameters.Body);
    __Log("E-mail user ontvankelijk: " + xmlParameters.mailuser);
-    __Log("gebruikt email setting: " + emlSetting.volgnr);
+    __Log("gebruikt email setting: " + emlSetting.key);

    if (emlResult.silentignoreemail)
    {
--- a/APPL/API/api_msgraphnotification.asp
+++ b/APPL/API/api_msgraphnotification.asp
@@ -23,52 +23,12 @@ var API = new API_func();
 // Bij aanmaken van de subscription doet Graph direct aan validatie-aanroep
 // De token parameter moet je teruggeven.
 var validationToken = getQParam("validationToken", "");
-if (validationToken)
-{
+if (validationToken) {
    __Log("Subscribtion validated: " + validationToken);
    Response.ContentType = "text/plain";
    Response.Write(validationToken);
    Response.End;
 }
-else
-{ // We hebben een notificatie ontvangen, stuur direct een 202 conform specificatie
-    Response.Status = "202 - Accepted";
-    Response.Write("");
-    Response.Flush;
-}
-
-function _cleanIncomingOutlookQueue() {
-    Application.Lock();
-    var incomingOutlookQueue = JSON.parse(Application(customerId + "_incomingOutlookQueue") || "{}");
-    for (var x in incomingOutlookQueue) {
-        if (incomingOutlookQueue[x] < new Date().getTime()) { // Verwijder verlopen changes die hier nog in staan
-            delete incomingOutlookQueue[x];
-        }
-    }
-    Application(customerId + "_incomingOutlookQueue") = JSON.stringify(incomingOutlookQueue);
-    Application.UnLock();
-}
-
-function _updateIncomingOutlookQueue(etag, CRUD) { // etag = 'The HTTP entity tag that represents the version of the object'
-    Application.Lock();
-    var incomingOutlookQueue = JSON.parse(Application(customerId + "_incomingOutlookQueue") || "{}");
-    if (CRUD == "C") {
-        if (etag in incomingOutlookQueue) { // We hebben deze al ontvangen en zijn begonnen met verwerken
-            __Log("MS Graph, duplicate notification ignored", "#FFFF44");
-            Application.UnLock();
-            Response.End;
-        }
-        incomingOutlookQueue[etag] = new Date().getTime() + 4 * 60 * 60 * 1000; // Expired in 4 uur
-    } else if (CRUD == "D") {
-        // delete incomingOutlookQueue[etag];
-        // ipv deleten laten we deze expiren over 3s zodat we reeds verwerkte notificaties niet nog eens gaan verwerken als het HTTP verkeer elkaar kruist
-        if (etag in incomingOutlookQueue) {
-            incomingOutlookQueue[etag] = new Date().getTime() + 3 * 1000;
-        }
-    }
-    Application(customerId + "_incomingOutlookQueue") = JSON.stringify(incomingOutlookQueue);
-    Application.UnLock();
-}

 // Als we hier komen hebben we een echte notificatie binnengekregen
 var notidata = RequestJSON(API.apidata.loglevel).value;
@@ -83,12 +43,10 @@ try {
 } catch (e) {
    __DoLog("Malformed MS Graph notification received:", "#FF0000");
    __DoLog(notidata, "#FF0000");
+    Response.Status = "400 - Bad Request";
    Response.End;
 }

-_cleanIncomingOutlookQueue();
-_updateIncomingOutlookQueue(etag, "C");
-
 // {
 //   "value": [
 //     {
@@ -110,8 +68,10 @@ _updateIncomingOutlookQueue(etag, "C");
 // We hebben res_ruimte_key meegegeven in de hookurl. Er zijn meer manieren
 // om de ruimte te achterhalen maar deze is het snelst/ simpelst
 var res_ruimte_key = getQParamInt("res_ruimte", -1);
-if (res_ruimte_key == -1)
-    Response.End; // even geen errors
+if (res_ruimte_key == -1) {
+    Response.Status = "422 - Unprocessable Content";
+    Response.End;
+}
 var sql = "SELECT res_ruimte_extern_id,"
        + "       res_ruimte_graphhooksecret"
        + "  FROM res_ruimte"
@@ -130,20 +90,51 @@ if (zaalemail == null || oRs("res_ruimte_graphhooksecret").Value != notidata.cli
                                                                                                            notidata.subscriptionExpirationDateTime));
    }
    oRs.Close();
+    Response.Status = "422 - Unprocessable Content";
    Response.End;
 }
 oRs.Close();

-var DEZE = this;
-var hook = hookfunc.gethook("utils/exchange/process_webhook.wsc");
-hook.initialize({
-    DEZE: DEZE,
-    custabspath: Server.MapPath(custpath)
-});
-hook.process_webhook(res_ruimte_key, zaalemail, notidata);
-hook = null;
+var fso = Server.CreateObject("Scripting.FileSystemObject");
+var tempFolder = shared.tempFolder();
+if (!fso.FolderExists(tempFolder)) {
+    fso.CreateFolder(tempFolder);
+}
+var exchangeFolder = tempFolder + "/exchange";
+if (!fso.FolderExists(exchangeFolder)) {
+    fso.CreateFolder(exchangeFolder);
+}
+var logfile_path = exchangeFolder + "/" + safe.filename(etag) + ".data";
+if (fso.FileExists(logfile_path)) { // Notificaties zijn uniek obv etag, deze is dus dubbel
+    __Log("MS Graph, duplicate notification ignored", "#FFFF44");
+} else {
+    try {
+        var ts = fso.CreateTextFile(logfile_path, true);
+        ts.Write(JSON.stringify(notidata, null, 2));
+        ts.Close();
+    } catch (e) {
+        __DoLog("Failed writing to {0}\n{1}".format(logfile_path, e.description));
+    }
+    sql = "INSERT INTO fac_notificatie (fac_srtnotificatie_key,"
+        + "                             fac_notificatie_queue,"
+        + "                             fac_notificatie_refkey,"
+        + "                             fac_notificatie_attachments,"
+        + "                             fac_notificatie_naam,"
+        + "                             fac_notificatie_notbefore,"
+        + "                             fac_notificatie_status)"
+        + "    SELECT fac_srtnotificatie_key"
+        + "         , 'EXCHANGE'"
+        + "         , " + res_ruimte_key
+        + "         , " + safe.quoted_sql(logfile_path)
+        + "         , " + safe.quoted_sql(zaalemail)
+        + "         , SYSDATE"
+        + "         , 1" // Met 1 omzeilen we fac.cleannotifications en zorgen we dat fac_t_fac_notificatie_A_IU niet de PUTORDERS inschiet (Wij doen er verder niets mee)
+        + "      FROM fac_srtnotificatie"
+        + "     WHERE fac_srtnotificatie_code = 'RESUPD'";
+    Oracle.Execute(sql);
+}

-_updateIncomingOutlookQueue(etag, "D"); // En verwijder hem maar weer
-Response.Write("");
+Response.Status = "202 - Accepted";
 ASPPAGE_END();
+Response.End;
 %>
--- a/APPL/API/api_opdrsoap.asp
+++ b/APPL/API/api_opdrsoap.asp
@@ -1180,7 +1180,7 @@ function upsertKenmerk(kenmerken, topdr_key, opdr_key)

 function isGoodCurrency(str)
 {
-  var anum = /^([-\+]?\d{1,6}[.,]?|[-\+]?\d{0,6}[.,]\d{1,2})$/
+  var anum = /^([-\+]?\d{1,6}[.,]?|[-\+]?\d{0,6}[.,]\d{1,7})$/
  return anum.test(str);
 }

@@ -1188,6 +1188,7 @@ function upsertOpdrRegels(regels, mld_opdr)
 {
  var opdr_key = mld_opdr.opdr_key;
  var mat_key_list = [];
+  var mat_tracking_arr = [];
  var tracking_key = -1;
  for (var r = 0; r < regels.length; r++)
  {
@@ -1323,18 +1324,18 @@ function upsertOpdrRegels(regels, mld_opdr)
        // Aantal is groter dan 0. Opdrachtregel toevoegen (Update).
        // Als aantal 0 is dan is de materiaalregel al verwijderd en kom je hier niet.
        mat_fields = mat_fields.concat(
-                        [ { dbs: "mld_opdr_materiaal_aantal",      typ: "float",   savewhen: aantal !== null,      val: aantalval },
-                          { dbs: "mld_opdr_materiaal_eenheidcode", typ: "varchar", savewhen: eenheidcode !== null, val: eenheidcode, len: 10 },
-                          { dbs: "mld_opdr_materiaal_eenheid",     typ: "varchar", savewhen: eenheid !== null,     val: eenheid,     len: 30 },
-                          { dbs: "mld_opdr_materiaal_prijs",       typ: "float",   savewhen: prijs !== null,       val: (prijs? prijsval : null) },
-                          { dbs: "mld_opdr_materiaal_code",        typ: "varchar", savewhen: matcode !== null,     val: matcode,     len: 30 },
-                          { dbs: "mld_opdr_materiaal_omschr",      typ: "varchar", savewhen: omschr !== null,      val: omschr,      len: 255 },
-                          { dbs: "mld_opdr_materiaal_info",        typ: "varchar", savewhen: info !== null,        val: info,        len: 4000 },
-                          { dbs: "mld_opdr_materiaal_groep",       typ: "varchar", savewhen: groep !== null,       val: groep,       len: 60 },
-                          { dbs: "mld_opdr_materiaal_extra1",      typ: "varchar", savewhen: extra1 !== null,      val: extra1,      len: 60 },
-                          { dbs: "mld_opdr_materiaal_extra2",      typ: "varchar", savewhen: extra2 !== null,      val: extra2,      len: 60 },
-                          { dbs: "mld_opdr_materiaal_extra3",      typ: "varchar", savewhen: extra3 !== null,      val: extra3,      len: 4000 },
-                          { dbs: "mld_opdr_materiaal_extra4",      typ: "varchar", savewhen: extra4 !== null,      val: extra4,      len: 4000 }
+                        [ { dbs: "mld_opdr_materiaal_aantal",      typ: "float",   savewhen: aantal !== null,      track: L("lcl_mld_opdr_aantal"),      val: aantalval },
+                          { dbs: "mld_opdr_materiaal_eenheidcode", typ: "varchar", savewhen: eenheidcode !== null, track: L("lcl_mld_opdr_eenheidcode"), val: eenheidcode, len: 10 },
+                          { dbs: "mld_opdr_materiaal_eenheid",     typ: "varchar", savewhen: eenheid !== null,     track: L("lcl_mld_opdr_eenheid"),     val: eenheid,     len: 30 },
+                          { dbs: "mld_opdr_materiaal_prijs",       typ: "float",   savewhen: prijs !== null,       track: L("lcl_mld_opdr_prijs"),       val: (prijs? prijsval : null) },
+                          { dbs: "mld_opdr_materiaal_code",        typ: "varchar", savewhen: matcode !== null,     track: L("lcl_mld_opdr_code"),        val: matcode,     len: 30 },
+                          { dbs: "mld_opdr_materiaal_omschr",      typ: "varchar", savewhen: omschr !== null,      track: L("lcl_mld_opdr_omschr"),      val: omschr,      len: 255 },
+                          { dbs: "mld_opdr_materiaal_info",        typ: "varchar", savewhen: info !== null,        track: L("lcl_mld_opdr_info"),        val: info,        len: 4000 },
+                          { dbs: "mld_opdr_materiaal_groep",       typ: "varchar", savewhen: groep !== null,       track: L("lcl_mld_opdr_groep"),       val: groep,       len: 60 },
+                          { dbs: "mld_opdr_materiaal_extra1",      typ: "varchar", savewhen: extra1 !== null,      track: L("lcl_mld_opdr_extra1"),      val: extra1,      len: 60 },
+                          { dbs: "mld_opdr_materiaal_extra2",      typ: "varchar", savewhen: extra2 !== null,      track: L("lcl_mld_opdr_extra2"),      val: extra2,      len: 60 },
+                          { dbs: "mld_opdr_materiaal_extra3",      typ: "varchar", savewhen: extra3 !== null,      track: L("lcl_mld_opdr_extra3"),      val: extra3,      len: 4000 },
+                          { dbs: "mld_opdr_materiaal_extra4",      typ: "varchar", savewhen: extra4 !== null,      track: L("lcl_mld_opdr_extra4"),      val: extra4,      len: 4000 }
                        ]);

        if ((btw || btw == 0) && (!isNaN (btwval) && btwval >= 0))
@@ -1364,20 +1365,14 @@ function upsertOpdrRegels(regels, mld_opdr)
        var matUpd = buildTrackingUpdate("mld_opdr_materiaal", "mld_opdr_materiaal_key = " + materiaal_key, mat_fields, { noValidateToken: true });

        // Zijn er velden die gewijzigd moeten worden? Als matUpd null is, dan waren alle savewhen condities false en hoeft er niets geupdate te worden.
-        if (matUpd && matUpd.sql)
-        { // Er zijn wijzigingen.
+        if (matUpd && matUpd.sql && matUpd.trackarray.length) { // Als trackarray.length === 0 dan is er effectief niets aangepast (we tracken alles)
          Oracle.Execute(matUpd.sql);
-          updatetracking_key = mld.trackopdrachtupdate(opdr_key, L("lcl_ord_is_updatedbysoap") + "\n" + L("lcl_ord_is_upd_material").format(id) + "\n" + matUpd.trackarray.join("\n"));
+          mat_tracking_arr.push(L("lcl_ord_is_upd_material").format(id) + "\n" + matUpd.trackarray.join("\n"));
        }
      }
    }
    oRs.Close();

-    var sql_del = "DELETE mld_opdr_materiaal"
-                + " WHERE mld_opdr_key = " + opdr_key
-                + "   AND mld_opdr_materiaal_key NOT IN (" + mat_key_list.join(",") + ")";
-    Oracle.Execute(sql_del);
-
    // 1) Nieuwe materiaalbedrag in de opdracht opslaan.
    // 2) De totaalwaarde opnieuw berekenen want het materiaalbedrag is aangepast.
    //    Dan hebben we het correctie bedrag ook nodig. Dit correctie bedrag moet hetzelfde blijven.
@@ -1394,6 +1389,19 @@ function upsertOpdrRegels(regels, mld_opdr)
                  + " WHERE mld_opdr_key = " + opdr_key
    Oracle.Execute(sql_total);
  }
+
+  if (mat_tracking_arr.length)
+  { // Er zijn wijzigingen.
+    tracking_key = mld.trackopdrachtupdate(opdr_key, L("lcl_ord_is_updatedbysoap") + "\n" + mat_tracking_arr.join("\n"));
+  }
+
+  if (mat_key_list.length) {
+    var sql_del = "DELETE mld_opdr_materiaal"
+                + " WHERE mld_opdr_key = " + opdr_key
+                + "   AND mld_opdr_materiaal_key NOT IN (" + mat_key_list.join(",") + ")";
+    Oracle.Execute(sql_del);
+  }
+
  return tracking_key;
 }

--- a/APPL/API/shorturl.asp
+++ b/APPL/API/shorturl.asp
@@ -212,7 +212,7 @@ __Log("== Entering shorturl.asp ==");
                if (bookmark_naam != 'faclikedeeplink' && new Perslid(falluser_key).checkAutorisation("WEB_PRSSYS", true))
                {
                    INTERNAL_ERROR_FALLBACK_CANNOT_HAVE_PRSSYS;
-                    // fac_like_deep.asp staan we wel toe, die heeft een Session.Abandon();
+                    // fac_like_deep.asp & fac_like.asp staan we wel toe, die hebben een Session.Abandon();
                }
                Session("fallback_user_key") = falluser_key; // wordt opgepikt door loginTry.asp
            }
--- a/APPL/API2/api2.inc
+++ b/APPL/API2/api2.inc
@@ -808,7 +808,10 @@ api2 = {
                            tables.push(tablesql);
                        }
                        else
-                            tables = tables.concat (incquery.tables);
+                        {
+                            if (!inc.isdetailfor)
+                                tables = tables.concat (incquery.tables);
+                        }
                        wheres = wheres.concat (incquery.wheres);

                        if (inc.model.gparams && inc.model.gparams.GET.tables)
@@ -1236,7 +1239,10 @@ api2 = {
        var spl = api2.splitLOV(LOV);
        var result = [];
        for (var f in filter)
-            result.push(filter[f] + ";" + spl[filter[f]]);
+        {
+            if ( filter[f] in spl)
+               result.push(filter[f] + ";" + spl[filter[f]]);
+        }
        return result.join(";");
    },
    splitLOV: function _splitLOV(LOV, nameprefix)
@@ -1454,7 +1460,21 @@ api2 = {
                                }
                            }
                            if (!incfound)
-                                record[incname].push(api2.sql2jsonfields(params, oRs, incmodel));
+                            {
+                                var data2 = api2.sql2jsonfields(params, oRs, incmodel)
+                                if (model.includes[incname].isdetailfor)
+                                {
+                                    for (detail in data2)
+                                    {
+                                        record[model.includes[incname].isdetailfor][detail] = data2[detail];
+                                    }
+                                    delete record[incname]; // niet meer nodig
+                                }
+                                else
+                                {
+                                    record[incname].push(data2);
+                                }
+                            }
                        }
                        else if (model.includes[incname].func) // include via callback functie zoals reservablerooms/occupation
                        {
--- a/APPL/API2/api2_dispatch.inc
+++ b/APPL/API2/api2_dispatch.inc
@@ -73,6 +73,7 @@ var api2_mapper = {
    "objectproperties"        : { "filename": "appl/mgt/ins_kenmerk.asp" },
    "recurringtasks"          : { "filename": "appl/mgt/ins_srtcontrole.asp" },
    "objectgroups"            : { "filename": "appl/mgt/ins_srtgroep.asp" },
+    "objecttypes"             : { "filename": "appl/mgt/ins_srtdeel.asp" },
    "objectpropertytypes"     : { "filename": "appl/mgt/ins_srtkenmerk.asp" },
    "alldisciplines"          : { "filename": "appl/mgt/ins_tab_discipline.asp" },
    "kpidefinitions"          : { "filename": "appl/mgt/kpi_definitie.asp",                 "module": "KPI" },
@@ -88,6 +89,7 @@ var api2_mapper = {
    "disciplinetypes"         : { "filename": "appl/mgt/mld_srtdiscipline.asp" },
    "issuepropertytypes"      : { "filename": "appl/mgt/mld_srtkenmerk.asp" },
    "callgroups"              : { "filename": "appl/mgt/mld_stdmeldinggroep.asp" },
+    "issuetags"               : { "filename": "appl/mgt/mld_melding_tag.asp" },
    "issueordertypes"         : { "filename": "appl/mgt/mld_typeopdr.asp" },
    "daysoff"                 : { "filename": "appl/mgt/mld_vrije_dagen.asp" },
    "workflows"               : { "filename": "appl/mgt/mld_workflow.asp" },
@@ -145,6 +147,7 @@ var api2_mapper = {
    "reportsx"                : { "filename": "appl/api2/api_reportsx.asp",                 "module": "FAC" },
    "reports"                 : { "filename": "appl/api2/api_reports.asp",                  "module": "FAC", "nodoc": true },
    "invoices"                : { "filename": "appl/api2/api_invoices.asp",                 "module": "FIN" },
+    "invoicelines"            : { "filename": "appl/api2/api_invoicelines.asp",             "module": "FIN" },
    "objects"                 : { "filename": "appl/api2/api_objects.asp",                  "module": "INS" },
    "inspections"             : { "filename": "appl/api2/api_ins_deelsrtcontrole.asp",      "module": "INS" },
    "statehistory"            : { "filename": "appl/mgt/ins_deel_state_history.asp",        "module": "INS" },
@@ -156,8 +159,13 @@ var api2_mapper = {
    "purchaseorder"           : { "filename": "appl/api2/api_purchaseorder.asp",            "module": "BES" },
    "purchaseorderitem"       : { "filename": "appl/api2/api_purchaseorderitem.asp",        "module": "BES" },

+    "messages"                : { "filename": "appl/mgt/msg_message.asp",                   "module": "MSG" },
+
    "generictables"           : { "filename": "appl/mgt/mgt_generic.asp", "hidden": true },
    "genericselect"           : { "filename": "appl/mgt/mgt_generic_select.asp", "hidden": true },
+    "fclttasks"               : { "filename": "appl/mgt/fac_task.asp", "hidden": true },
+    "notifications"           : { "filename": "appl/mgt/fac_notificatie.asp", "hidden": true },
+
    "bestpractices"           : { "filename": "appl/mgt/fac_bestpractices.asp", "hidden": true },
    "systemtables"            : { "filename": "appl/mgt/user_tables.asp", "hidden": true },
    "workflowexpressions"     : { "filename": "appl/mgt/mld_workflow_expression.asp", "hidden": true }  // dit is geen model
--- a/APPL/API2/api2_tools.inc
+++ b/APPL/API2/api2_tools.inc
@@ -13,6 +13,92 @@
 */
 %>
 <%
+    function buildKenmerkRoleCodeLOV(params)
+    {
+        var kenmerkRoleCodeLOV = "";
+        switch (params.module)
+        {
+            case "ALG":  
+                kenmerkRoleCodeLOV = "3;"+ L("mgt_kenmerkrolcodealg_3") + ";" // alles
+                                   + "2;"+ L("mgt_kenmerkrolcodealg_2") + ";" // ALGUSE
+                                   + "1;"+ L("mgt_kenmerkrolcodealg_1");      // ALGMAN
+                break;
+            case "BES":  
+                kenmerkRoleCodeLOV = "5;"+ L("mgt_kenmerkrolcodebes_5") + ";" // alles
+                                   + "4;"+ L("mgt_kenmerkrolcodebes_4") + ";" // ORDSUP
+                                   + "1;"+ L("mgt_kenmerkrolcodebes_1");      // BES*
+                break;
+            case "BESI":  
+                kenmerkRoleCodeLOV = "1;"+ L("mgt_kenmerkrolcodebes_1");      // geen onderscheid in regels
+                break;
+            case "BEZ":  
+                kenmerkRoleCodeLOV = "7;"+ L("mgt_kenmerkrolcodebez_7") + ";" // alles
+                                   + "4;"+ L("mgt_kenmerkrolcodebez_4") + ";" // BEZBOF only
+                                   + "2;"+ L("mgt_kenmerkrolcodebez_2") + ";" // BEZFOF only
+                                   + "3;"+ L("mgt_kenmerkrolcodebez_3"); // BEZFOF/BEZUSE only
+                break;
+            case "CNT":  
+                kenmerkRoleCodeLOV = "3;"+ L("mgt_kenmerkrolcodecnt_3") + ";" // alles
+                                   + "2;"+ L("mgt_kenmerkrolcodecnt_2") + ";" // CNTUSE
+                                   + "1;"+ L("mgt_kenmerkrolcodecnt_1");      // CNTMAN
+                break;
+            case "CTR":  
+                kenmerkRoleCodeLOV = "1;"+ L("mgt_kenmerkrolcodectr_1");      // alles (geen onderscheid)
+                break;
+            case "FAQ":  
+                kenmerkRoleCodeLOV = "1;"+ L("mgt_kenmerkrolcodefaq_1");      // alles (geen onderscheid)
+                break;
+            case "FIN":  
+                kenmerkRoleCodeLOV = "1;"+ L("mgt_kenmerkrolcodefin_1");      // alles (geen onderscheid)
+                break;
+            case "INS":  
+                kenmerkRoleCodeLOV = "7;"+ L("mgt_kenmerkrolcodeins_7") + ";" // alles
+                                   + "4;"+ L("mgt_kenmerkrolcodeins_4") + ";" // INSFOF (uitlenen)
+                                   + "2;"+ L("mgt_kenmerkrolcodeins_2") + ";" // INSUSE
+                                   + "1;"+ L("mgt_kenmerkrolcodeins_1");      // INSMAN
+                break;
+            case "MLD":
+                kenmerkRoleCodeLOV = "7;"+ L("mgt_kenmerkrolcodemld_7") + ";"   // alles
+                                   + "6;"+ L("mgt_kenmerkrolcodemld_6") + ";"   // MLDBOF+MLDFOF
+                                   + "3;"+ L("mgt_kenmerkrolcodemld_3") + ";"   // MLDUSE+MLDBOF
+                                   + "4;"+ L("mgt_kenmerkrolcodemld_4") + ";"   // MLDBOF
+                                   + "2;"+ L("mgt_kenmerkrolcodemld_2");        // MLDFOF
+                break;
+            case "OPD": 
+                kenmerkRoleCodeLOV = "7;"+ L("mgt_kenmerkrolcodeopd_7") + ";"   // alles
+                                   + "5;"+ L("mgt_kenmerkrolcodeopd_5") + ";"
+                                   + "4;"+ L("mgt_kenmerkrolcodeopd_4") + ";"   // ORDSUPonly
+                                   + "3;"+ L("mgt_kenmerkrolcodeopd_3") + ";"   // beide
+                                   + "2;"+ L("mgt_kenmerkrolcodeopd_2") + ";"   // Afmelden? opdrachtnemer
+                                   + "1;"+ L("mgt_kenmerkrolcodeopd_1");        // ORDBOF opdrachtgever
+                break;
+            case "PRS":
+                kenmerkRoleCodeLOV = "7;"+ L("mgt_kenmerkrolcodeprs_7") + ";"   // alles 
+                                   + "6;"+ L("mgt_kenmerkrolcodeprs_6") + ";"   // PRSUSE+PROFIL
+                                   + "3;"+ L("mgt_kenmerkrolcodeprs_3") + ";"   // PRSMAN+PRSUSE
+                                   + "2;"+ L("mgt_kenmerkrolcodeprs_2") + ";"   // PRSUSE
+                                   + "1;"+ L("mgt_kenmerkrolcodeprs_1");        // PRSMAN
+                break;
+            case "REL":
+                kenmerkRoleCodeLOV = "7;"+ L("mgt_kenmerkrolcoderel_7") + ";"   // alles
+                                   + "6;"+ L("mgt_kenmerkrolcoderel_6") + ";"   // RELUSE+EXTREL
+                                   + "3;"+ L("mgt_kenmerkrolcoderel_3") + ";"   // RELMAN+RELUSE
+                                   + "2;"+ L("mgt_kenmerkrolcoderel_2") + ";"   // RELUSE
+                                   + "1;"+ L("mgt_kenmerkrolcoderel_1");        // RELMAN
+                break;
+            case "RES":  // dit lijkt technisch een grappige volgorde, maar is logischer
+                kenmerkRoleCodeLOV = "7;"+ L("mgt_kenmerkrolcoderes_7") + ";"   // iedereen
+                                   + "4;"+ L("mgt_kenmerkrolcoderes_4") + ";"   // RESBOF only, afhandelkenmerken
+                                   + "2;"+ L("mgt_kenmerkrolcoderes_2") + ";"   // RESFOF ony, professionele kenmerken
+                                   + "3;"+ L("mgt_kenmerkrolcoderes_3");        // RESFOF+RESUSE (d.i. geen RESBOF)
+                                   //+ "1;"+ L("mgt_kenmerkrolcoderes_1");      // RESUSE, algemene kenmerken
+                break;
+            default:
+                kenmerkRoleCodeLOV = "?";
+        }
+        return kenmerkRoleCodeLOV;
+    }
+
    function buildKenmerktypeLOV(kenmerktype, params)
    {
        var kenmerktypeLOV = "";
@@ -59,13 +145,13 @@
                break;
            case "L":
                kenmerktypeLOV = "L;" + L("mgt_srtkenmerk_label") + ";"
-                               + "l;" + L("mgt_srtkenmerk_label_i") + ";"
-                               + (params && params.module == "MLD"? "b;" + L("mgt_srtkenmerk_label_ii") : "")
+                               + "l;" + L("mgt_srtkenmerk_label_i")
+                               + (params && params.module == "MLD"? ";b;" + L("mgt_srtkenmerk_label_ii") : "")
                break;
            case "l":
                kenmerktypeLOV = "l;" + L("mgt_srtkenmerk_label_i") + ";"
-                               + "L;" + L("mgt_srtkenmerk_label") + ";"
-                               + (params && params.module == "MLD"? "b;" + L("mgt_srtkenmerk_label_ii") : "")
+                               + "L;" + L("mgt_srtkenmerk_label")
+                               + (params && params.module == "MLD"? ";b;" + L("mgt_srtkenmerk_label_ii") : "")
                break;
            case "b":
                kenmerktypeLOV = "b;" + L("mgt_srtkenmerk_label_ii") + ";"
@@ -113,7 +199,7 @@

    function buildGroepsverplichtingList()
    {   // LOV waarden voor xxx_kenmerk_groep.
-        var s = "0;<" + L("lcl_none") + ">";
+        var s = "0;" + L("mgt_kenmerk_groep0") ;
        for (var i=1; i<=9; i++)
        {
            s = s + ";" + i + ";" + L("mgt_kenmerk_groep") + " " + i;
@@ -351,9 +437,9 @@ function buildStatusList(pniveau)

 function buildHltPropList()
 {
-    var hltPropList = "0;" + L("lcl_No")
-                    + ";1;" + L("lcl_Yes")
-                    + ";2;" + L("lcl_mld_delete_on_resume");
+    var hltPropList = "0;" + L("mld_kenmerk_onderbreken0")
+                    + ";1;" + L("mld_kenmerk_onderbreken1")
+                    + ";2;" + L("mld_kenmerk_onderbreken2");
    return hltPropList;
 }

--- a/APPL/API2/api_invoicelines.asp
+++ b/APPL/API2/api_invoicelines.asp
@@ -0,0 +1,26 @@
+<%@ language = "JavaScript" %>
+<% /*
+    $Revision$
+    $Id$
+
+    File:           api_invoicelines.asp
+
+    Description:    Bestelling API
+    Parameters:
+    Context:
+
+    Notes:          We ondersteunen alleen (nog) het opvragen van de bestelling
+
+*/
+    DOCTYPE_Disable = true;
+    ANONYMOUS_Allowed = 1; // Eigenlijk niet waar. We regelen echter alles zelf
+    THIS_FILE = "appl/api2/api_invoicelines.asp";
+
+%>
+<!-- #include file="../Shared/common.inc" -->
+<!-- #include file="./api2_rest.inc" -->
+<!-- #include file="./model_invoicelines.inc" -->
+<%
+    api2_rest.process(model_invoicelines);
+%>
+<% ASPPAGE_END(); %>
--- a/APPL/API2/api_invoices.asp
+++ b/APPL/API2/api_invoices.asp
@@ -13,7 +13,7 @@
 */
    DOCTYPE_Disable = true;
    ANONYMOUS_Allowed = 1; // Eigenlijk niet waar. We regelen echter alles zelf
-    THIS_FILE = "appl/api/api_invoices.asp";
+    THIS_FILE = "appl/api2/api_invoices.asp";

 %>
 <!-- #include file="../Shared/common.inc" -->
@@ -21,4 +21,4 @@
 <!-- #include file="./model_invoices.inc" -->
 <%
    api2_rest.process(model_invoices);
-%><% ASPPAGE_END(); %> 
+%><% ASPPAGE_END(); %>
--- a/APPL/API2/api_objects.asp
+++ b/APPL/API2/api_objects.asp
@@ -20,5 +20,7 @@
 <!-- #include file="./api2_rest.inc" -->
 <!-- #include file="./model_objects.inc" -->
 <%
+    var mode = "xxxx"; // mode must be defined because of use in model_ins_kenmerk.inc
+
    api2_rest.process(model_objects);
 %><% ASPPAGE_END(); %> 
--- a/APPL/API2/api_reservations.asp
+++ b/APPL/API2/api_reservations.asp
@@ -20,6 +20,8 @@
 <!-- #include file="./api2_rest.inc" -->
 <!-- #include file="./model_reservations.inc" -->
 <%
+    var mode = "xxxx"; // mode must be defined because of use in model_res_kenmerk.inc
+
    api2_rest.process(model_reservations);

    ASPPAGE_END();
--- a/APPL/API2/model_alg_kenmerk.inc
+++ b/APPL/API2/model_alg_kenmerk.inc
@@ -26,8 +26,8 @@ function model_alg_kenmerk(niveau, params)
    this.module = "ALG";

    // overrule titel voor schermen.
-    this.record_title = L("mgt_kenmerk")    + " " + get_real_estate_name(niveau);
-    this.records_title = L("mgt_kenmerk_m") + " " + get_real_estate_name(niveau);
+    this.record_title = L("mgt_kenmerk_of")    + " " + get_real_estate_name(niveau);
+    this.records_title = L("mgt_kenmerk_m_of") + " " + get_real_estate_name(niveau);


    this.fields = {
@@ -50,7 +50,16 @@ function model_alg_kenmerk(niveau, params)
            "dbs": "alg_kenmerk_volgnr",
            "label": L("mgt_kenmerk_volgnummer"),
            "typ": "number",
-            "required": true
+            "len": 3,
+            "required": true // deze zou er straks weer af mogen
+        },
+        "rolecode": {
+            "dbs": "alg_kenmerk_rolcode",
+            "label": L("mgt_kenmerk_rolcode"),
+            "typ": "number",
+            "LOV": buildKenmerkRoleCodeLOV({ module: "ALG" }),
+            "required": true,
+            "multiedit": true
        },
        "name": {
            "dbs": "alg_kenmerk_omschrijving",
@@ -86,6 +95,7 @@ function model_alg_kenmerk(niveau, params)
            "label": L("mgt_kenmerk_verplicht"),
            "typ": "key",
            "LOV": buildVerplichtingList(),
+            "emptyisrealvalue": true,
            "emptyoption": null
        },
        "group": {
@@ -104,7 +114,8 @@ function model_alg_kenmerk(niveau, params)
        "system": {
            "dbs": "alg_kenmerk_systeem",
            "label": L("mgt_srtkenmerk_systeem"),
-            "typ": "check"
+            "typ": "check",
+            "readonly": !user.has("WEB_PRSSYS")
        },
        "inlist": {
            "dbs": "alg_kenmerk_inlijst",
@@ -114,12 +125,14 @@ function model_alg_kenmerk(niveau, params)
                {
                    "name": "",
                    "label": "",
+                    "showasgroup": false,
                    "typ": "check",
                    "mask": 1,
                    "radios": [
                        {
                            "name": "inplan",
-                            "label": (niveau == "G"? L("mgt_kenmerk_systeem_overview_bui") : ""),
+                            //"label": (niveau == "G"? L("mgt_kenmerk_systeem_overview_bui") + " " : "") + L("mgt_kenmerk_systeem_overview"),
+                            "label":  L("mgt_kenmerk_systeem_overview"),
                            "mask": 1,
                            "defaultvalue": 0
                        }
@@ -173,9 +186,9 @@ function model_alg_kenmerk(niveau, params)
        },
        "code": {
            "dbs": "alg_kenmerk_code",
-            "label": L("lcl_alg_code"),
+            "label": L("mgt_kenmerk_code"),
            "typ": "varchar",
-            "readonly": !user.has("WEB_FACTAB")
+            "readonly": !user.has("WEB_PRSSYS")
        },
        "authorization": {
            "dbs": "fac_functie_key",
@@ -204,7 +217,7 @@ function model_alg_kenmerk(niveau, params)
        gparams.GET = { wheres: [ "alg_kenmerk.alg_kenmerk_niveau = " + safe.quoted_sql(niveau) ] };
    }

-    if (niveau == "G")
+    if (niveau == "G")  // en dan ook nog alleen als je MJOB hebt/gebruikt lijkt me TODO?
    {
      this.fields.inlist.bits[0].mask = 3;
      this.fields.inlist.bits[0].radios.push({ "name": "start",
@@ -224,6 +237,7 @@ function model_alg_kenmerk(niveau, params)
        var naam = "";
        switch (niveau)
        {
+            case "E": naam = L("lcl_region"); break;
            case "D": naam = L("lcl_district"); break;
            case "L": naam = L("lcl_location"); break;
            case "T": naam = L("lcl_terra"); break;
@@ -236,7 +250,8 @@ function model_alg_kenmerk(niveau, params)

    function fill_real_estate_level_LOV()
    {
-        return  "D;"+L("lcl_district")
+        return  "E;"+L("lcl_region")
+             + ";D;"+L("lcl_district")
             + ";L;"+L("lcl_location")
             + ";G;"+L("lcl_building")
             + ";R;"+L("lcl_room"); // Moet hier T en V ook nog bij?
--- a/APPL/API2/model_aut_idp_map.inc
+++ b/APPL/API2/model_aut_idp_map.inc
@@ -61,6 +61,7 @@ function model_aut_idp_map(params)
                 + ";11;" + L("lcl_prs_person_mobile")
                 + ";12;" + L("prs_perslid_externid")
                 + ";13;" + L("prs_perslid_externid") + " (case insensitive)"
+                 + ";14;" + L("lcl_prs_person_nr")

                 // De foreign's
                 + ";20;" + L("lcl_prs_person_function")
--- a/APPL/API2/model_bes_disc_params.inc
+++ b/APPL/API2/model_bes_disc_params.inc
@@ -315,6 +315,12 @@ model_bes_disc_params =
            "dbs": "bes_disc_params_deliver_fe",
            "label": L("bes_discipline_fe_deliver"),
            "typ": "check0"
+        },
+        "autodeliver": {
+            "dbs": "bes_disc_params_autodeliverdays",
+            "label": L("bes_discipline_autodeliverdays"),
+            "typ": "number",
+            "len": 4
        }
    }
 }
--- a/APPL/API2/model_bes_discipline.inc
+++ b/APPL/API2/model_bes_discipline.inc
@@ -30,11 +30,6 @@ function model_bes_discipline(disc_key, params)
                                           }
                                       );

-    this.hook_pre_edit = function (obj, fld, params)
-    {
-        fld.costtype.foreign = mgt.pre_edit_kostensoort(obj);
-    }
-
    this.hook_post_post = function (params, obj, key)
    {
        var org_disc_key = getQParamInt("id", -1);
@@ -43,6 +38,11 @@ function model_bes_discipline(disc_key, params)
        {   // Ook de autorisatie van de oude discipline kopieren
            mgt.clone_authorization(key, org_disc_key);
        }
+        var clone_art = getQParamInt("clone_art", 0) == 1;
+        if (clone_art)
+        {   // Ook de autorisatie van de oude discipline kopieren
+            mgt.clone_articles(key, org_disc_key);
+        }
    }

    this.REST_POST   = generic_REST_POST(_model_bes_discipline);
@@ -91,7 +91,6 @@ _model_bes_discipline = // Internal only
            "label": L("prs_kostensoort_key"),
            "typ": "key",
            "foreign": "prs_kostensoort",
-            "LOVinit": "",
            "showtransit": true
        },
        "costcentremandatory": {
--- a/APPL/API2/model_bes_kenmerk.inc
+++ b/APPL/API2/model_bes_kenmerk.inc
@@ -4,7 +4,7 @@

    File:           model_bes_kenmerk.inc

-    Description:    Model voor bes_kenmerk
+    Description:    Model voor bes_kenmerk = Kenmerken van bestelregels

    Context:

@@ -56,12 +56,16 @@ function model_bes_kenmerk(params)
            "foreign": {
                "tbl": "(SELECT bes_srtkenmerk_key"
                     + "      , bes_srtkenmerk_omschrijving"
+                     + (mode != "list"
+                       ? " || ' (' || bes_srtkenmerk_kenmerktype || ')'"
+                       : "")
+                     + " oms"
                     + "      , bes_srtkenmerk_kenmerktype"
                     + "   FROM bes_srtkenmerk"
                     + "  WHERE bes_srtkenmerk_verwijder IS NULL"
                     + "  ORDER by bes_srtkenmerk_omschrijving ASC)",
                "key": "bes_srtkenmerk_key",
-                "desc": "bes_srtkenmerk_omschrijving",
+                "desc": "oms",
                "extravalue": "bes_srtkenmerk_kenmerktype"
            },
            "defaultvalue": null,
@@ -131,6 +135,14 @@ function model_bes_kenmerk(params)
            "dbs": "bes_kenmerk_volgnummer",
            "label": L("mgt_kenmerk_volgnummer"),
            "typ": "number",
+            "len": 3,
+            "required": true
+        },
+        "rolecode": {
+            "dbs": "bes_kenmerk_rolcode",
+            "label": L("mgt_kenmerk_rolcode"),
+            "typ": "number",
+            "LOV": buildKenmerkRoleCodeLOV({ module: "BESI" }),
            "required": true
        },
        "required": {
@@ -138,6 +150,7 @@ function model_bes_kenmerk(params)
            "label": L("mgt_kenmerk_verplicht"),
            "typ": "key",
            "LOV": buildVerplichtingList(),
+            "emptyisrealvalue": true,
            "emptyoption": null
        },
        "group": {
@@ -161,6 +174,7 @@ function model_bes_kenmerk(params)
                {
                    "name": "",
                    "label": "",
+                    "showasgroup": false,
                    "typ": "check",
                    "mask": 3,
                    "radios": [
@@ -208,9 +222,9 @@ function model_bes_kenmerk(params)
        },
        "code": {
            "dbs": "bes_kenmerk_code",
-            "label": L("lcl_bes_code"),
+            "label": L("mgt_kenmerk_code"),
            "typ": "varchar",
-            "readonly": !user.has("WEB_FACTAB")
+            "readonly": !user.has("WEB_PRSSYS")
        },
        "authorization": {
            "dbs": "fac_functie_key",
--- a/APPL/API2/model_bes_kenmerkbestel.inc
+++ b/APPL/API2/model_bes_kenmerkbestel.inc
@@ -4,11 +4,8 @@

    File:           model_bes_kenmerkbestel.inc

-    Description:    Vanuit CodeCharge gegenereerd model voor bes_kenmerkbestel
+    Description:    Model voor bes_kenmerkbestel = Kenmerken van bestelling

-    Context:
-
-    Notes:
 */
 %>
 <%
@@ -58,12 +55,16 @@ function model_bes_kenmerkbestel()
            "foreign": {
                "tbl": "(select bes_srtkenmerk_key"
                     + "      , bes_srtkenmerk_omschrijving"
+                     + (mode != "list"
+                       ? " || ' (' || bes_srtkenmerk_kenmerktype || ')'"
+                       : "")
+                     + " oms"
                     + "      , bes_srtkenmerk_kenmerktype"
                     + "   from bes_srtkenmerk"
                     + "  where bes_srtkenmerk_verwijder is null"
                     + "  order by bes_srtkenmerk_omschrijving asc)",
                "key": "bes_srtkenmerk_key",
-                "desc": "bes_srtkenmerk_omschrijving",
+                "desc": "oms",
                "extravalue": "bes_srtkenmerk_kenmerktype"
            },
            "defaultvalue": null,
@@ -96,6 +97,14 @@ function model_bes_kenmerkbestel()
            "dbs": "bes_kenmerk_volgnummer",
            "label": L("mgt_kenmerk_volgnummer"),
            "typ": "number",
+            "len": 3,
+            "required": true
+        },
+        "rolecode": {
+            "dbs": "bes_kenmerk_rolcode",
+            "label": L("mgt_kenmerk_rolcode"),
+            "typ": "number",
+            "LOV": buildKenmerkRoleCodeLOV({ module: "BES" }),
            "required": true
        },
        "required": {
@@ -126,6 +135,7 @@ function model_bes_kenmerkbestel()
                {
                    "name": "",
                    "label": "",
+                    "showasgroup": false,
                    "typ": "check",
                    "mask": 7,
                    "radios": [
@@ -170,7 +180,19 @@ function model_bes_kenmerkbestel()
            "typ": "memo",
            "translate": true
        },
-        "regexp": {
+        "code": {
+            "dbs": "bes_kenmerk_code",
+            "label": L("mgt_kenmerk_code"),
+            "typ": "varchar",
+            "readonly": !user.has("WEB_PRSSYS")
+        },
+       "authorization": {  // wordt nog niet ondersteund in deze module
+            "dbs": "fac_functie_key",
+            "label": L("mgt_kenmerk_autorisatie"),
+            "typ": "key",
+            "foreign": "fac_functie"
+        },
+       "regexp": {
            "dbs": "bes_kenmerk_regexp",
            "label": L("mgt_kenmerk_regexp"),
            "typ": "varchar"
--- a/APPL/API2/model_bes_srtdeel.inc
+++ b/APPL/API2/model_bes_srtdeel.inc
@@ -259,6 +259,7 @@ function model_bes_srtdeel(disc_key)
                "orderbys": [
                    "ins_discipline_omschrijving",
                    "bes_srtgroep_omschrijving",
+                    "bes_srtdeel_volgnr",
                    "bes_srtdeel_nr"
                ]
            }
--- a/APPL/API2/model_bes_srtkenmerk.inc
+++ b/APPL/API2/model_bes_srtkenmerk.inc
@@ -134,8 +134,8 @@ function model_bes_srtkenmerk(params)
        "code": {
            "dbs": "bes_srtkenmerk_code",
            "typ": "varchar",
-            "label": L("lcl_bes_code"),
-            "readonly": !user.has("WEB_FACTAB")
+            "label": L("mgt_srtkenmerk_code"),
+            "readonly": !user.has("WEB_PRSSYS")
        }
    };

--- a/APPL/API2/model_bez_kenmerk.inc
+++ b/APPL/API2/model_bez_kenmerk.inc
@@ -38,6 +38,7 @@ function model_bez_kenmerk(params)
            "dbs": "bez_kenmerk_volgnr",
            "label": L("mgt_kenmerk_volgnummer"),
            "typ": "number",
+            "len": 3,
            "required": true
        },
        "name": {
@@ -72,6 +73,7 @@ function model_bez_kenmerk(params)
            "label": L("mgt_kenmerk_verplicht"),
            "typ": "key",
            "LOV": buildVerplichtingList(),
+            "emptyisrealvalue": true,
            "emptyoption": null
        },
        "group": {
@@ -82,6 +84,13 @@ function model_bez_kenmerk(params)
            "LOV": buildGroepsverplichtingList(),
            "emptyoption": null
        },
+        "rolecode": {
+            "dbs": "bez_kenmerk_rolcode",
+            "label": L("mgt_kenmerk_rolcode"),
+            "typ": "number",
+            "LOV": buildKenmerkRoleCodeLOV({ module: "BEZ" }),
+            "required": true
+        },
        "readonly": {
            "dbs": "bez_kenmerk_toonbaar",
            "label": L("mgt_kenmerk_toonbaar"),
@@ -95,6 +104,7 @@ function model_bez_kenmerk(params)
                {
                    "name": "",
                    "label": "",
+                    "showasgroup": false,
                    "typ": "check",
                    "mask": 15,
                    "radios": [
@@ -175,9 +185,9 @@ function model_bez_kenmerk(params)
        },
        "code": {
            "dbs": "bez_kenmerk_code",
-            "label": L("lcl_bez_code"),
+            "label": L("mgt_kenmerk_code"),
            "typ": "varchar",
-            "readonly": !user.has("WEB_FACTAB")
+            "readonly": !user.has("WEB_PRSSYS")
        },
        "authorization": {
            "dbs": "fac_functie_key",
--- a/APPL/API2/model_buildings.inc
+++ b/APPL/API2/model_buildings.inc
@@ -12,6 +12,7 @@
 */

 %>
+<!-- #include file="../alg/alg.inc"-->
 <!-- #include file="../Shared/discxalg3d.inc"-->
 <!-- #include file="./model_custom_fields.inc"-->
 <!-- #include file="./model_alg_kenmerk.inc"-->
@@ -64,9 +65,14 @@ function model_buildings()

    this.REST_GET = function _GET(params)
        {
-            var urole = "fe"; // TODO: Moet echt niet ter zake doen
-            var autfunction = urole == "fe"? "WEB_ALGUSE" : "WEB_ALGMAN";
+            var autfunction = ["WEB_ALGUSE","WEB_ALGMAN"];
            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch
+            if (params.filter.id)
+            {
+                var bld_key = params.filter.id;
+                var this_alg = alg.func_enabled(bld_key, "G");
+                user.auth_required_or_abort(this_alg.readman || this_alg.readuse);
+            }

            // TODO: Add authorization
            var query = api2.sqlfields(params, this);
--- a/APPL/API2/model_cad_tekening.inc
+++ b/APPL/API2/model_cad_tekening.inc
@@ -65,7 +65,7 @@ function model_cad_tekening(niveau, params)

        // Save in DB (link file to floor)
        var cadfields = [
-            { dbs: "cad_tekening_filenaam", typ: "varchar", val: safefilename.replace(/.dwf$/i, "") }
+            { dbs: "cad_tekening_filenaam", typ: "varchar", val: safefilename.replace(/\.dwf$/i, "") }
        ];
        var sql = buildUpdate("cad_tekening", cadfields, { noValidateToken: true }) + " cad_tekening_key = " + the_key;
        Oracle.Execute(sql);
@@ -116,7 +116,7 @@ function model_cad_tekening(niveau, params)
        // Save in DB (link file to floor)
        var cadfields = [
            { dbs: "cad_tekening_key",      typ: "key",     seq: "cad_s_cad_tekening_key" },
-            { dbs: "cad_tekening_filenaam", typ: "varchar", val: safefilename.replace(/.dwf$/i, "") },
+            { dbs: "cad_tekening_filenaam", typ: "varchar", val: safefilename.replace(/\.dwf$/i, "") },
            { dbs: "alg_locatie_key",       typ: "key",     val: getLocation(jsondata.floor) },
            { dbs: "alg_verdieping_key",    typ: "key",     val: jsondata.floor },
            { dbs: "cad_tekening_type",     typ: "varchar", val: "P" }
--- a/APPL/API2/model_cht_discipline.inc
+++ b/APPL/API2/model_cht_discipline.inc
@@ -66,7 +66,6 @@ function model_cht_discipline(disc_key, params)
            "label": L("prs_kostensoort_key"),
            "typ": "key",
            "foreign": "prs_kostensoort",
-            "LOVinit": "",
            "multiedit": true,
            "showtransit": true
        },
--- a/APPL/API2/model_cnt_disc_params.inc
+++ b/APPL/API2/model_cnt_disc_params.inc
@@ -144,6 +144,18 @@ model_cnt_disc_params =
            "label": L("cnt_discipline_verlengbaar"),
            "typ": "check0",
            "defaultvalue": 0
+        },
+        "costtypemandatory": {
+            "dbs": "cnt_disc_params_ksverplicht",
+            "label": L("cnt_discipline_ksverplicht"),
+            "typ": "check0",
+            "defaultvalue": 0
+        },
+        "approvenew": {
+            "dbs": "cnt_disc_params_approve_new",
+            "label": L("cnt_discipline_approve_new"),
+            "typ": "check0",
+            "defaultvalue": 0
        }
 /*      // Voor als in cnt_disc_params_opties meerdere bits worden gebruikt om verschillende opties aan te geven:
        "options": {
--- a/APPL/API2/model_cnt_discipline.inc
+++ b/APPL/API2/model_cnt_discipline.inc
@@ -20,11 +20,6 @@ function model_cnt_discipline(disc_key, params)
    // E<>n model voor de buitenwereld
    api2.merge_disc_params_model(this, _model_cnt_discipline);

-    this.hook_pre_edit = function (obj, fld, params)
-    {
-        fld.costtype.foreign = mgt.pre_edit_kostensoort(obj);
-    }
-
    this.hook_post_post = function (params, obj, key)
    {
        var org_disc_key = getQParamInt("id", -1);
@@ -88,8 +83,7 @@ _model_cnt_discipline = // Internal only
            "dbs": "prs_kostensoort_key",
            "label": L("prs_kostensoort_key"),
            "typ": "key",
-            "foreign": "prs_kostensoort",
-            "LOVinit": ""
+            "foreign": "prs_kostensoort"
        },
        "email": {
            "dbs": "ins_discipline_email",
--- a/APPL/API2/model_cnt_kenmerk.inc
+++ b/APPL/API2/model_cnt_kenmerk.inc
@@ -45,12 +45,16 @@ function model_cnt_kenmerk(params)
            "foreign": {
                "tbl": "(select cnt_srtkenmerk_key"
                     + "      , cnt_srtkenmerk_omschrijving"
+                     + (mode != "list"
+                       ? " || ' (' || cnt_srtkenmerk_kenmerktype || ')'"
+                       : "")
+                     + " oms"
                     + "      , cnt_srtkenmerk_kenmerktype"
                     + "   from cnt_srtkenmerk"
                     + "  where cnt_srtkenmerk_verwijder is null"
                     + "  order by cnt_srtkenmerk_upper asc)",
                "key": "cnt_srtkenmerk_key",
-                "desc": "cnt_srtkenmerk_omschrijving",
+                "desc": "oms",
                "extravalue": "cnt_srtkenmerk_kenmerktype"
            },
            "defaultvalue": null,
@@ -69,7 +73,8 @@ function model_cnt_kenmerk(params)
            "dbs": "cnt_srtkenmerk.cnt_srtkenmerk_kenmerktype",
            "label": L("mgt_srtkenmerk_kenmerktype"),
            "typ": "varchar",
-            "hidden_fld": true,
+            //"hidden_fld": true,
+            "readonly" : true,
            "LOV": buildKenmerktypeLOV(),
            "showtransit": true
        },
@@ -87,6 +92,7 @@ function model_cnt_kenmerk(params)
                "desc": "ins_discipline_omschrijving"
            },
            "LOVinit": "",
+            "insertonly" : true,
            "showtransit": true
        },
        "level": {
@@ -101,6 +107,14 @@ function model_cnt_kenmerk(params)
            "dbs": "cnt_kenmerk_volgnummer",
            "label": L("mgt_kenmerk_volgnummer"),
            "typ": "number",
+            "len": 3,
+            "required": true
+        },
+        "rolecode": {
+            "dbs": "cnt_kenmerk_rolcode",
+            "label": L("mgt_kenmerk_rolcode"),
+            "typ": "number",
+            "LOV": buildKenmerkRoleCodeLOV({ module: "CNT" }),
            "required": true
        },
        "required": {
@@ -108,6 +122,7 @@ function model_cnt_kenmerk(params)
            "label": L("mgt_kenmerk_verplicht"),
            "typ": "key",
            "LOV": buildVerplichtingList(),
+            "emptyisrealvalue": true,
            "emptyoption": null
        },
        "group": {
@@ -153,9 +168,9 @@ function model_cnt_kenmerk(params)
        },
        "code": {
            "dbs": "cnt_kenmerk_code",
-            "label": L("lcl_cnt_code"),
+            "label": L("mgt_kenmerk_code"),
            "typ": "varchar",
-            "readonly": !user.has("WEB_FACTAB")
+            "readonly": !user.has("WEB_PRSSYS")
        },
        "authorization": {
            "dbs": "fac_functie_key",
--- a/APPL/API2/model_cnt_srtkenmerk.inc
+++ b/APPL/API2/model_cnt_srtkenmerk.inc
@@ -92,8 +92,8 @@ function model_cnt_srtkenmerk(params)
        "code": {
            "dbs": "cnt_srtkenmerk_code",
            "typ": "varchar",
-            "label": L("lcl_cnt_code"),
-            "readonly": !user.has("WEB_FACTAB")
+            "label": L("mgt_srtkenmerk_code"),
+            "readonly": !user.has("WEB_PRSSYS")
        }
    };

--- a/APPL/API2/model_companies.inc
+++ b/APPL/API2/model_companies.inc
@@ -99,6 +99,17 @@ function model_companies()
    this.REST_GET = function _GET(params)
        {
            var autfunction = "WEB_RELMAN";
+            var bedrijf_key = (!params.isNew && params && params.filter && params.filter.id ? params.filter.id : -1);
+            if (bedrijf_key > 0) {
+                var sql = "SELECT NVL(prs_bedrijf_intern, 0) intern"
+                        + "  FROM prs_bedrijf"
+                        + " WHERE prs_bedrijf_key = " + bedrijf_key;
+                var oRs = Oracle.Execute(sql);
+                if (!oRs.EOF && oRs("intern").Value != 0) { // Extern systeem
+                    autfunction = "WEB_PRSMAN";
+                }
+                oRs.Close();
+            }
            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch

            // TODO: Add authorization
--- a/APPL/API2/model_custom_fields.inc
+++ b/APPL/API2/model_custom_fields.inc
@@ -42,6 +42,8 @@ function model_custom_fields(formodel, flexModel, flexParams)
            var sqlModule = flexModule;
            if (flexModule == 'MLD' && flexParams.pNiveau == 'O')
                sqlModule = 'OPDR';
+            if (flexModule == 'FIN' && flexParams.pNiveau == 'R')
+                sqlModule = 'FINR';
            var theSqlFlex = getSqlFlex(sqlModule, formodel.primary, flexParams);
            // enigszins undocumented maar met parameter '&custom_fields=' kun je het aantal opgeleverde velden beperken
            // (net zoals je met '&fields=' de gewone vaste velden kunt beperken)
@@ -56,6 +58,8 @@ function model_custom_fields(formodel, flexModel, flexParams)
            var sqlModule = flexModule;
            if (flexModule == 'MLD' && flexParams.pNiveau == 'O')
                sqlModule = 'OPDR';
+            if (flexModule == 'FIN' && flexParams.pNiveau == 'R')
+                sqlModule = 'FINR';

            var theSqlFlex = "SELECT * FROM ({0}) ".format(getSqlFlex(sqlModule, formodel.primary, flexParams));
            return theSqlFlex;
@@ -84,6 +88,7 @@ function model_custom_fields(formodel, flexModel, flexParams)
        "sequence": {
            "dbs": "volgnummer",
            "label": L("mgt_kenmerk_volgnummer"),
+            "len": 3,
            "typ": "number" },
        "label": {
            "dbs": "omschrijving",
@@ -279,10 +284,15 @@ function model_custom_fields(formodel, flexModel, flexParams)

        if (typ != "M" && parent_key > 0)
        {
-          var sql = "BEGIN flx.setflex({0}".format(this.module == "MLD" && flexParams.pNiveau == "O" ? "'OPD'" : safe.quoted_sql(this.module))
+          var setFlexModule = this.module;
+          if (this.module == 'MLD' && flexParams.pNiveau == 'O')
+              setFlexModule = 'OPD';
+          if (this.module == 'FIN' && flexParams.pNiveau == 'R')
+              setFlexModule = 'FINR';
+          var sql = "BEGIN flx.setflex({0}".format(safe.quoted_sql(setFlexModule))
                  + "                , {0}".format(the_key) // == jsondata.propertyid
                  + "                , {0}".format(parent_key)
-                  + "                , {0}".format(this.module == "MLD" ? "NULL" : safe.quoted_sql(flexParams.pNiveau))
+                  + "                , {0}".format(this.module == "MLD" || this.module == "FIN"? "NULL" : safe.quoted_sql(flexParams.pNiveau))
                  + "                , {0});".format(safe.quoted_sql(jsondata.value))
                  + "END;"
          var err = Oracle.Execute(sql, true);
--- a/APPL/API2/model_fac_email_setting.inc
+++ b/APPL/API2/model_fac_email_setting.inc
@@ -19,7 +19,7 @@ function model_fac_email_setting()
    this.record_name = "emailsetting";
    this.table = "fac_email_setting";
    this.primary = "fac_email_setting_key";
-    this.autfunction = "WEB_FACTAB";
+    this.autfunction = "WEB_MLDMGT";  // de ernstige velden zijn blijven WEB_FACTAB
    this.record_title = L("fac_email_setting");
    this.records_title = L("fac_email_setting_m");

@@ -36,7 +36,7 @@ function model_fac_email_setting()
            "dbs": "fac_email_setting_volgnr",
            "label": L("fac_email_setting_volgnr"),
            "typ": "number",
-            "required": true
+            "required": true  // de database zorgt voor defaultvalue 10
        },
        "name": {
            "dbs": "fac_email_setting_user",
@@ -50,19 +50,34 @@ function model_fac_email_setting()
            "typ": "varchar",
            "multiedit": true
        },
+        "reqtext": {
+            "dbs": "fac_email_setting_text",
+            "label": L("fac_email_setting_text"),
+            "typ": "varchar",
+            "multiedit": true
+        },
        "frommode": {
            "dbs": "fac_email_setting_frommode",
            "label": L("fac_email_setting_frommode"),
            "typ": "number",
            "required": true,
            "LOV": L("fac_email_setting_frommodeLOV"),
-            "multiedit": true
+            "emptyoption": null,
+            "readonly": !(user.has("WEB_FACTAB"))
        },
        "action": {
            "dbs": "fac_email_setting_action",
            "label": L("fac_email_setting_action"),
            "typ": "varchar",
-            "multiedit": true
+            "defaultvalue" : "fac.processemail",
+            "multiedit": true,
+            "readonly": !(user.has("WEB_FACTAB"))
+        },
+        "stdmelding": {
+            "dbs": "mld_stdmelding_key",
+            "label": L("fac_email_setting_stdmelding_key"),
+            "typ": "key",
+            "foreign": "mld_stdmelding"
        },
        "expire": {
            "dbs": "fac_email_setting_expire",
@@ -74,12 +89,15 @@ function model_fac_email_setting()
            "dbs": "fac_email_setting_attachpath",
            "label": L("fac_email_setting_attachpath"),
            "typ": "varchar",
-            "multiedit": true
+            "multiedit": true,
+            "placeholder": "*flexfilespath",
+            "readonly": !(user.has("WEB_FACTAB"))
        },
        "attachext": {
            "dbs": "fac_email_setting_attachext",
            "label": L("fac_email_setting_attachext"),
            "typ": "varchar",
+            "placeholder": S("flexAllowedExt"),
            "multiedit": true
        },
        "reqattachext": {
@@ -100,7 +118,8 @@ function model_fac_email_setting()
            "typ": "number",
            "required": true,
            "defaultvalue": 0,
-            "multiedit": true
+            "multiedit": true,
+            "readonly": !(user.has("WEB_FACTAB"))
        },
        "person": {
            "dbs": "prs_perslid_key_auth",
--- a/APPL/API2/model_fac_faq.inc
+++ b/APPL/API2/model_fac_faq.inc
@@ -27,8 +27,8 @@ function model_fac_faq()

    this.table = "fac_faq";
    this.primary = "fac_faq_key";
-    this.records_name = "faqs";
-    this.record_name = "faq";
+    this.records_name = "knowledgebase";
+    this.record_name = "knowledgebase";
    this.record_title = L("fac_faq");
    this.records_title = L("fac_faq_m");
    this.module = "FAQ";
@@ -162,7 +162,6 @@ function model_fac_faq()
                tables: [],
                wheres: [
                    where_auth, where_lang,
-                    "ROWNUM < " + S("faq_max_results"),
                    "fac_faq.fac_faq_datum < SYSDATE"
                ],
                orderbys: [
--- a/APPL/API2/model_fac_gebruikersgroep.inc
+++ b/APPL/API2/model_fac_gebruikersgroep.inc
@@ -171,6 +171,24 @@ function model_fac_gebruikersgroep(params)

    this.hook_pre_edit = function(obj, fld)
    {
+        var prs_arr = getQParamIntArray("prsarr", []);
+        if (prs_arr.length > 0)
+        {   // multiedit mode
+            // Sluit de groepen die alle gebruikers overeenkomstig hebben uit van de lijst.
+            // Als er maar 1 gebruiker geselecteerd is dan wordt de standaard where-clause gebruikt
+            // die wordt gegenereerd obv "field.uniquewith" in scaffolding_edit.inc.
+            prs_arr.push(obj.person.id);
+            fld.authorizationgroup.foreign.where = "fac_groep_key NOT IN"
+                                                 + "(SELECT fac_groep_key"
+                                                 + "   FROM (SELECT fac_groep_key, COUNT(prs_perslid_key)"
+                                                         + "   FROM fac_gebruikersgroep"
+                                                         + "  WHERE prs_perslid_key IN (" + prs_arr.join(",") + ")"
+                                                         + "  GROUP BY fac_groep_key"
+                                                         + " HAVING COUNT(prs_perslid_key) = " + prs_arr.length
+                                                 + "        )"
+                                                 + ")";
+        }
+
        if (obj.id > 0) { // Bestaand record
            fld.authorizationgroup.readonly = true;
            fld.person.readonly = true;
--- a/APPL/API2/model_fac_groep.inc
+++ b/APPL/API2/model_fac_groep.inc
@@ -56,7 +56,10 @@ function model_fac_groep(groep_key, params)
      "substitutes": {
        "dbs": "fac_groep_collega",
        "label": L("lcl_prs_substitutes"),
-        "typ": "check0"
+        "typ": "key",
+        "LOV": L("lcl_prs_substitutesLOV"),
+        "defaultvalue": "0",
+        "emptyoption": null
      },
      "externalid": {
          "dbs": "fac_groep_externid",
@@ -69,7 +72,7 @@ function model_fac_groep(groep_key, params)
        "label": L("fac_groep_nn_leden"),
        "typ": "number"
      },
-        "created": {
+      "created": {
        "dbs": "fac_groep_aanmaak",
        "label": "Aanmaakdatum",
        "typ": "datetime",
--- a/APPL/API2/model_fac_nieuws_groep.inc
+++ b/APPL/API2/model_fac_nieuws_groep.inc
@@ -18,8 +18,10 @@ function model_fac_nieuws_groep()
    this.table = "fac_nieuws_groep";
    this.primary = "fac_nieuws_groep_key";
    this.autfunction = "WEB_MSGBOF";
-    this.record_name = L("fac_nieuws_groep");
-    this.records_name = L("fac_nieuws_groep_m");
+    this.record_name = "messagecategory";
+    this.records_name = "messagecategories";
+    this.record_title = L("fac_nieuws_groep");
+    this.records_title = L("fac_nieuws_groep_m");
    this.fields = {
        "id": {
            "dbs": "fac_nieuws_groep_key",
--- a/APPL/API2/model_fac_notificatie_job.inc
+++ b/APPL/API2/model_fac_notificatie_job.inc
@@ -108,11 +108,13 @@ function model_fac_notificatie_job(params) // J voor Jobs, S voor Scheduled mail
            "label": L("fac_notificatie_job_interval"),
            "typ": "number"
        },
+/* Alleen sensor updates wat nooit is uitgekristalliseerd
        "seconds": {
            "dbs": "fac_notificatie_job_seconds",
            "label": L("fac_notificatie_job_seconds"),
            "typ": "number"
        },
+*/
        "lastrun": {
            "dbs": "fac_notificatie_job_lastrun",
            "label": L("fac_notificatie_job_lastrun"),
@@ -124,12 +126,14 @@ function model_fac_notificatie_job(params) // J voor Jobs, S voor Scheduled mail
            "label": L("fac_notificatie_job_nextrun"),
            "typ": "datetime"
        },
+/* Alleen sensor updates wat nooit is uitgekristalliseerd
        "queueid": {
            "dbs": "fac_notificatie_job_queue",
            "label": L("fac_notificatie_job_queue"),
            "typ": "varchar",
            "defaultvalue": "DEFAULT"
        },
+*/
        "fac_usrrap_key": {
            dbs: "fac_usrrap_key",
            typ: "key",
@@ -176,7 +180,7 @@ function model_fac_notificatie_job(params) // J voor Jobs, S voor Scheduled mail
                    wheres: ["fac_notificatie_job_view IS NOT NULL"]
                }
            };
-        
+
        if (user.has("WEB_PRSSYS"))
        {
            this.REST_POST   = generic_REST_POST(this);
--- a/APPL/API2/model_fac_srtnotificatie.inc
+++ b/APPL/API2/model_fac_srtnotificatie.inc
@@ -11,8 +11,8 @@
    Notes:
 */
 %>
+<!-- #include file="../api2/model_prs_bedrijfadres_srtnoti.inc" -->
 <%
-
 function model_fac_srtnotificatie(cust)
 {
    this.records_name = "notificationtypes";
@@ -201,6 +201,16 @@ function model_fac_srtnotificatie(cust)
        }
    };

+      this.includes = {
+        "srtnotifications": {
+            "model": new model_prs_bedrijfadres_srtnoti(),
+            "joinfield": "srtnotification"
+        }
+      };
+      delete this.includes["srtnotifications"].model["REST_POST"];
+      delete this.includes["srtnotifications"].model["REST_PUT"];
+      delete this.includes["srtnotifications"].model["REST_DELETE"];
+
    if (!S("puo_smsaccount"))
        this.fields.notificationmode.bits[0].radios.splice(2, 1);

--- a/APPL/API2/model_faq_kenmerk.inc
+++ b/APPL/API2/model_faq_kenmerk.inc
@@ -33,7 +33,7 @@ function model_faq_kenmerk(params)
            "typ": "key",
            "seq": "faq_s_faq_kenmerk_key"
        },
-        "facdiscipline": {
+        "facdiscipline": { // NULL betekent alle disciplines (denk ik)
            "dbs": "faq_discipline_key",
            "label": L("faq_discipline_key"),
            "typ": "key",
@@ -49,6 +49,7 @@ function model_faq_kenmerk(params)
            "dbs": "faq_kenmerk_volgnr",
            "label": L("mgt_kenmerk_volgnummer"),
            "typ": "number",
+            "len": 3,
            "required": true
        },
        "name": {
@@ -83,6 +84,7 @@ function model_faq_kenmerk(params)
            "label": L("mgt_kenmerk_verplicht"),
            "typ": "key",
            "LOV": buildVerplichtingList(),
+            "emptyisrealvalue": true,
            "emptyoption": null
        },
        "group": {
@@ -93,6 +95,13 @@ function model_faq_kenmerk(params)
            "LOV": buildGroepsverplichtingList(),
            "emptyoption": null
        },
+        "rolecode": {
+            "dbs": "faq_kenmerk_rolcode",
+            "label": L("mgt_kenmerk_rolcode"),
+            "typ": "number",
+            "LOV": buildKenmerkRoleCodeLOV({ module: "FAQ" }),
+            "required": true
+        },
        "readonly": {
            "dbs": "faq_kenmerk_toonbaar",
            "label": L("mgt_kenmerk_toonbaar"),
@@ -154,9 +163,9 @@ function model_faq_kenmerk(params)
        },
        "code": {
            "dbs": "faq_kenmerk_code",
-            "label": L("lcl_faq_code"),
+            "label": L("mgt_kenmerk_code"),
            "typ": "varchar",
-            "readonly": !user.has("WEB_FACTAB")
+            "readonly": !user.has("WEB_PRSSYS")
        },
        "authorization": {
            "dbs": "fac_functie_key",
--- a/APPL/API2/model_fin_kenmerk.inc
+++ b/APPL/API2/model_fin_kenmerk.inc
@@ -13,7 +13,7 @@
 %>
 <%

-function model_fin_kenmerk(params)
+function model_fin_kenmerk(niveau, params)
 {
    params = params || {};
    this.records_name = "invoiceproperties";
@@ -21,9 +21,9 @@ function model_fin_kenmerk(params)
    this.table = "fin_kenmerk";
    this.primary = "fin_kenmerk_key";
    this.soft_delete = "fin_kenmerk_verwijder";
-    this.autfunction = params.internal?false:"WEB_FINMGT";
-    this.record_title = L("fin_kenmerk");
-    this.records_title = L("fin_kenmerk_m");
+    this.autfunction = params.internal? false : "WEB_FINMGT";
+    this.record_title = L("fin_kenmerk")    + " " + get_fin_type_name(niveau); // dit niveau lijkt niet te werken?
+    this.records_title = L("fin_kenmerk_m") + " " + get_fin_type_name(niveau);
    this.module = "FIN";

    this.fields = {
@@ -38,6 +38,7 @@ function model_fin_kenmerk(params)
            "dbs": "fin_kenmerk_volgnr",
            "label": L("mgt_kenmerk_volgnummer"),
            "typ": "number",
+            "len": 3,
            "required": true
        },
        "name": {
@@ -74,11 +75,19 @@ function model_fin_kenmerk(params)
            "LOV": fill_fin_type_LOV(),
            "emptyoption": null
        },
+        "rolecode": {  // heeft voor deze module nog geen werking
+            "dbs": "fin_kenmerk_rolcode",
+            "label": L("mgt_kenmerk_rolcode"),
+            "typ": "number",
+            "LOV": buildKenmerkRoleCodeLOV({ module: "FIN" }),
+            "required": true
+        },
        "required": {
            "dbs": "fin_kenmerk_verplicht",
            "label": L("mgt_kenmerk_verplicht"),
            "typ": "key",
            "LOV": buildVerplichtingList(),
+            "emptyisrealvalue": true,
            "emptyoption": null
        },
        "group": {
@@ -102,6 +111,7 @@ function model_fin_kenmerk(params)
                {
                    "name": "",
                    "label": "",
+                    "showasgroup": false,
                    "typ": "check",
                    "mask": 15,
                    "radios": [
@@ -180,9 +190,9 @@ function model_fin_kenmerk(params)
        },
        "code": {
            "dbs": "fin_kenmerk_code",
-            "label": L("lcl_fin_code"),
+            "label": L("mgt_kenmerk_code"),
            "typ": "varchar",
-            "readonly": !user.has("WEB_FACTAB")
+            "readonly": !user.has("WEB_PRSSYS")
        },
        "authorization": {
            "dbs": "fac_functie_key",
@@ -213,6 +223,11 @@ function model_fin_kenmerk(params)
    <%
    }

+    var gparams = {"GET": {}};
+    if (niveau)
+    {
+        gparams.GET = { wheres: [ "fin_kenmerk.fin_kenmerk_type = " + safe.quoted_sql(niveau) ] };
+    }

    this.REST_GET    = generic_REST_GET(this);
    this.REST_POST   = generic_REST_POST(this);
@@ -224,5 +239,16 @@ function model_fin_kenmerk(params)
        return  "F;"+L("fin_invoice")
             + ";R;"+L("fin_invoicerows");
    }
+
+    function get_fin_type_name(niveau)
+    {
+        var naam = "";
+        switch (niveau)
+        {
+            case "F": naam = L("fin_invoice"); break;
+            case "R": naam = L("fin_invoicerows"); break;
+        }
+        return naam;
+    }
 }
 %>
--- a/APPL/API2/model_floors.inc
+++ b/APPL/API2/model_floors.inc
@@ -12,6 +12,7 @@
 */

 %>
+<!-- #include file="../alg/alg.inc"-->
 <!-- #include file="../Shared/discxalg3d.inc"-->
 <!-- #include file="./model_cad_tekening.inc"-->
 <!-- #include file="./model_alg_kenmerk.inc"-->
@@ -47,9 +48,14 @@ function model_floors() {
        }
    };
    this.REST_GET = function _GET(params) {
-            var urole = "fe"; // TODO: Moet echt niet ter zake doen
-            var autfunction = urole == "fe"? "WEB_ALGUSE" : "WEB_ALGMAN";
+            var autfunction = ["WEB_ALGUSE", "WEB_ALGMAN"];
            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch
+            if (params.filter.id)
+            {
+                var flr_key = params.filter.id;
+                var this_alg = alg.func_enabled(flr_key, "V");
+                user.auth_required_or_abort(this_alg.readman || this_alg.readuse);
+            }

            var query = api2.sqlfields(params, this);
            query.wheres.push("alg_verdieping_verwijder IS NULL");
--- a/APPL/API2/model_ins_discipline.inc
+++ b/APPL/API2/model_ins_discipline.inc
@@ -20,11 +20,6 @@ function model_ins_discipline(disc_key, params)
    // E<>n model voor de buitenwereld
    api2.merge_disc_params_model(this, _model_ins_discipline);

-    this.hook_pre_edit = function (obj, fld, params)
-    {
-        fld.costtype.foreign = mgt.pre_edit_kostensoort(obj);
-    }
-
    this.hook_post_post = function (params, obj, key)
    {
        var org_disc_key = getQParamInt("id", -1);
@@ -88,8 +83,7 @@ _model_ins_discipline = // Internal only
            "dbs": "prs_kostensoort_key",
            "label": L("prs_kostensoort_key"),
            "typ": "key",
-            "foreign": "prs_kostensoort",
-            "LOVinit": ""
+            "foreign": "prs_kostensoort"
        },
        "colors": {
            "dbs": "ins_discipline_color",
--- a/APPL/API2/model_ins_kenmerk.inc
+++ b/APPL/API2/model_ins_kenmerk.inc
@@ -49,12 +49,16 @@ function model_ins_kenmerk(niveau, params)
            "foreign": {
                "tbl": "(SELECT ins_srtkenmerk_key"
                     + "      , ins_srtkenmerk_omschrijving"
+                     + (mode != "list"
+                       ? " || ' (' || ins_srtkenmerk_kenmerktype || ')'"
+                       : "")
+                     + " oms"
                     + "      , ins_srtkenmerk_kenmerktype"
                     + "   FROM ins_srtkenmerk"
                     + "  WHERE ins_srtkenmerk_verwijder IS NULL"
                     + "  ORDER by ins_srtkenmerk_omschrijving ASC)",
                "key": "ins_srtkenmerk_key",
-                "desc": "ins_srtkenmerk_omschrijving",
+                "desc": "oms",
                "extravalue": "ins_srtkenmerk_kenmerktype"
            },
            "showtransit": true
@@ -101,6 +105,14 @@ function model_ins_kenmerk(niveau, params)
            "showtransit": true,
            "infoPointer": { Url: "appl/ins/ins_srtdeel.asp?srtdeel_key=" }
        },
+//        "attributetypehide": { //het datatype van het kenmerksoort, zal-wel gekopieerd van CNT
+//            "dbs": "ins_srtkenmerk.ins_srtkenmerk_kenmerktype",
+//            "label": L("mgt_srtkenmerk_kenmerktype"),
+//            "typ": "varchar",
+//            "hidden_fld": true,
+//            "LOV": buildKenmerktypeLOV(),
+//            "showtransit": true
+//        },
        "level": {
            "dbs": "ins_kenmerk_niveau",
            "label": L("mgt_kenmerk_niveau"),
@@ -154,13 +166,16 @@ function model_ins_kenmerk(niveau, params)
            "dbs": "ins_kenmerk_volgnummer",
            "label": L("ins_kenmerk_volgnummer"),
            "typ": "number",
+            "len": 3,
            "required": true
        },
        "required": {
            "dbs": "ins_kenmerk_verplicht",
            "label": L("ins_kenmerk_verplicht"),
            "typ": "key",
-            "LOV": fill_verplicht_LOV(),
+            "LOV": buildVerplichtingList(),
+            "emptyisrealvalue": true,
+            "emptyoption": null,
            "listfunction": function(oRs) {
                var val = oRs.Fields("required.name").Value;
                if (val === null) {
@@ -168,7 +183,6 @@ function model_ins_kenmerk(niveau, params)
                }
                return val;
            },
-            "emptyoption": L("lcl_mld_niet_verplicht"),
            "multiedit": true
        },
        "requiredstatus": {
@@ -178,12 +192,19 @@ function model_ins_kenmerk(niveau, params)
            "LOV": L("ins_kenmerk_requiredstatusLOV"),
            "emptyoption": null
        },
+        "rolecode": {
+            "dbs": "ins_kenmerk_rolcode",
+            "label": L("mgt_kenmerk_rolcode"),
+            "typ": "number",
+            "LOV": buildKenmerkRoleCodeLOV({ module: (isTaakKenmerk ? "CTR" : "INS") }),
+            "required": true
+        },
        "group": {
            "dbs": "ins_kenmerk_groep",
-            "label": L("ins_kenmerk_groep"),
+            "label": L("mgt_kenmerk_groep"),
            "typ": "key",
            "required": true,
-            "LOV": fill_groepsverplichting_LOV(),
+            "LOV": buildGroepsverplichtingList(),
            "defaultvalue": "0",
            "multiedit": true
        },
@@ -201,17 +222,20 @@ function model_ins_kenmerk(niveau, params)
                {
                    "name": "",
                    "label": "",
+                    "showasgroup": false,
                    "typ": "check",
                    "mask": 3,
                    "radios": [
                        {
-                            "name": "inplan",
-                            "label": L("mgt_kenmerk_systeem_overview_obj"),
+                            "name": "listobj",
+                            //"label": L("mgt_kenmerk_systeem_overview_obj") + " " + L("mgt_kenmerk_systeem_overview"),
+                            "label": L("mgt_kenmerk_systeem_overview"),
                            "mask": 1,
                            "defaultvalue": 0
                        },
                        {
-                            "name": "start",
+                            "name": "listmjob",
+                            //"label": L("mgt_kenmerk_systeem_overview_mjob") + " " + L("mgt_kenmerk_systeem_overview"),
                            "label": L("mgt_kenmerk_systeem_overview_mjob"),
                            "mask": 2,
                            "defaultvalue": 0
@@ -236,11 +260,6 @@ function model_ins_kenmerk(niveau, params)
            "emptyoption": null,
            "multiedit": true
        },
-        "location": {
-            "dbs": "ins_kenmerk_locatiekolom",
-            "label": L("ins_kenmerk_locatiekolom"),
-            "typ": "varchar"
-        },
        "propertydefault": {
            "dbs": "ins_kenmerk_default",
            "label": L("mgt_kenmerk_default"),
@@ -265,9 +284,9 @@ function model_ins_kenmerk(niveau, params)
        },
        "code": {
            "dbs": "ins_kenmerk_code",
-            "label": L("lcl_ins_code"),
+            "label": L("mgt_kenmerk_code"),
            "typ": "varchar",
-            "readonly": !user.has("WEB_FACTAB")
+            "readonly": !user.has("WEB_PRSSYS")
        },
        "authorization": {
            "dbs": "fac_functie_key",
@@ -324,6 +343,22 @@ function model_ins_kenmerk(niveau, params)
                             , "ins_kenmerk.ins_kenmerk_verwijder IS NULL"
                             ]
                    };
+      this.fields.inlist.bits = [
+                                  {
+                                    "name": "",
+                                    "label": "",
+                                    "typ": "check",
+                                    "mask": 1,
+                                    "radios": [
+                                                {
+                                                  "name": "listctr",
+                                                  "label": L("mgt_kenmerk_systeem_overview_ctr"),
+                                                  "mask": 1,
+                                                  "defaultvalue": 0
+                                                }
+                                              ]
+                                  }
+                                ]
    }
    else
    {   //kenmerk_niveau: D | G | S
@@ -338,25 +373,7 @@ function model_ins_kenmerk(niveau, params)
                             ]
                    };
    }
-
-    function fill_verplicht_LOV()
-    { // Listbox verplicht vullen. Bij het veld is de emptyoption gezet.
-      // Hierdoor is er altijd een waarde geselecteerd.
-      return  "1;" + L("lcl_mld_altijd_verplicht")
-           + ";2;" + L("lcl_mld_groepsverplichting");
-    }
-
-    function fill_groepsverplichting_LOV()
-    { // Listbox groepsverplichting vullen.
-      var groep_array = ["0", "<"+L("lcl_none")+">"];
-      for (i=1; i<=9; i++)
-      {
-        groep_array.push(i)
-        groep_array.push(L("ins_kenmerk_groep")+" "+i);
-      }
-      return groep_array.join(";");
-    }
-
+  
    this.REST_GET    = generic_REST_GET(this, gparams);
    this.REST_POST   = generic_REST_POST(this);
    this.REST_PUT    = generic_REST_PUT(this);
--- a/APPL/API2/model_ins_srtdeel.inc
+++ b/APPL/API2/model_ins_srtdeel.inc
@@ -31,23 +31,9 @@ function model_ins_srtdeel()
            "label": L("lcl_key"),
            "typ": "key",
            "required": true,
-            "seq": "ins_s_ins_srtdeel_key",
+            "seq": "ins_s_ins_srtinst_keys",
            "defaultvalue": null
        },
-        "objectdiscipline": {
-            "dbs": "ins_discipline_key",
-            "label": L("lcl_discipline"),
-            "typ": "key",
-            "foreign": {
-                "tbl": "ins_v_aanwezigdiscipline",
-                "key": "ins_discipline_key",
-                "desc": "ins_discipline_omschrijving"
-            },
-            "LOVinit": "",
-            "defaultvalue": null,
-            "showtransit": true,
-            "onchange": "onChangeDiscipline()"
-        },
        "objectgroup": {
            "dbs": "ins_srtgroep_key",
            "label": L("lcl_obj_group"),
@@ -56,7 +42,7 @@ function model_ins_srtdeel()
            "insertonly": true,
            "foreign": {
                "tbl": "ins_v_aanwezigsrtgroep",
-                "key": "inssrtgroep_key",
+                "key": "ins_srtgroep_key",
                "desc": "ins_srtgroep_omschrijving"
            },
            "LOVinit": "",
--- a/APPL/API2/model_ins_srtkenmerk.inc
+++ b/APPL/API2/model_ins_srtkenmerk.inc
@@ -97,8 +97,8 @@ function model_ins_srtkenmerk(params)
        "code": {
            "dbs": "ins_srtkenmerk_code",
            "typ": "varchar",
-            "label": L("lcl_ins_code"),
-            "readonly": !user.has("WEB_FACTAB")
+            "label": L("mgt_srtkenmerk_code"),
+            "readonly": !user.has("WEB_PRSSYS")
        }
    };

--- a/APPL/API2/model_ins_tab_discipline.inc
+++ b/APPL/API2/model_ins_tab_discipline.inc
@@ -79,8 +79,7 @@ function model_ins_tab_discipline(disc_key, params)
            "dbs": "prs_kostensoort_key",
            "label": L("prs_kostensoort_key"),
            "typ": "key",
-            "foreign": "prs_kostensoort",
-            "LOVinit": ""
+            "foreign": "prs_kostensoort"
        },
        "costcentremandatory": {
            "dbs": "ins_discipline_kpnverplicht",
--- a/APPL/API2/model_invoicelines.inc
+++ b/APPL/API2/model_invoicelines.inc
@@ -15,77 +15,105 @@
 %>
 <!-- #include file="../Shared/discxalg3d.inc"-->
 <!-- #include file="../fin/fin.inc" -->
+<!-- #include file="./model_custom_fields.inc"-->
+<!-- #include file="./model_fac_tracking.inc"-->
+<!-- #include file="./model_fin_kenmerk.inc"-->
 <%

-model_invoicelines =
+function model_invoicelines()
 {
-    module: "FIN",
-    table: "fin_factuurregel",
-    primary: "fin_factuurregel_key",
-    records_name: "invoicelines",
-    record_name: "invoiceline",
-    fields: { "id"       : { dbs: "fin_factuurregel_key",          typ: "key" },
-              "name"     : { dbs: "fin_factuurregel_omschrijving", typ: "varchar",                                track: true, label: L("lcl_descr"),                    filter: "like"  },
-              "line"     : { dbs: "fin_factuurregel_nr",           typ: "number"                                                                                            },
-              "total"    : { dbs: "fin_factuurregel_totaal",       typ: "float",   "iscurrency": true,            track: true, label: L("lcl_fin_total_sum_exBTW")                       },
-              "vat"      : { dbs: "fin_factuurregel_btw",          typ: "float",   "iscurrency": true,            track: true, label: L("lcl_fin_total_sum_inBTW")                       },
-              "reference": { dbs: "fin_factuurregel_referentie",   typ: "varchar",                                track: true, label: L("lcl_fin_referencecode"),        filter: "like"  },
-              "vatvalue" : { dbs: "fin_btwtabelwaarde_key",        typ: "key",     foreign: "fin_btwtabelwaarde", track: true, label: L("lcl_fin_btwtarief")},
-              "costtype" : { dbs: "prs_kostensoort_key",           typ: "key",     foreign: "prs_kostensoort",    track: true, label: L("lcl_shared_charge_type") },
-              "fin_factuur_key": { dbs: "fin_factuur_key",         typ: "key" }
-            },
+    this.module = "FIN";
+    this.table = "fin_factuurregel";
+    this.primary = "fin_factuurregel_key";
+    this.records_name = "invoicelines";
+    this.record_name = "invoiceline";
+    this.fields = { "id"          : { dbs: "fin_factuurregel_key",          typ: "key" },
+                    "name"        : { dbs: "fin_factuurregel_omschrijving", typ: "varchar",                                track: true, label: L("lcl_descr"),                    filter: "like" },
+                    "line"        : { dbs: "fin_factuurregel_nr",           typ: "number" },
+                    "total"       : { dbs: "fin_factuurregel_totaal",       typ: "float",   iscurrency: true,              track: true, label: L("lcl_fin_total_sum_exBTW") },
+                    "vat"         : { dbs: "fin_factuurregel_btw",          typ: "float",   iscurrency: true,              track: true, label: L("lcl_fin_total_sum_inBTW") },
+                    "reference"   : { dbs: "fin_factuurregel_referentie",   typ: "varchar",                                track: true, label: L("lcl_fin_referencecode"),        filter: "like" },
+                    "vatvalue"    : { dbs: "fin_btwtabelwaarde_key",        typ: "key",     foreign: "fin_btwtabelwaarde", track: true, label: L("lcl_fin_btwtarief")},
+                    "costtype"    : { dbs: "prs_kostensoort_key",           typ: "key",     foreign: "prs_kostensoort",    track: true, label: L("lcl_shared_charge_type") },
+                    "invoice"     : { dbs: "fin_factuur_key",               typ: "key",     foreign: "fin_factuur",        insertonly: true },
+                    "code"        : { dbs: "fin_factuurregel_code",         typ: "varchar",                                track: true, label: L("lcl_fin_article_code") },
+                    "amount"      : { dbs: "fin_factuurregel_aantal",       typ: "float",                                  track: true, label: L("lcl_fin_amount") },
+                    "unit"        : { dbs: "fin_factuurregel_eenheid",      typ: "varchar",                                track: true, label: L("lcl_fin_unit") },
+                    "orderlineid" : { dbs: "fin_factuurregel_id",           typ: "number",                                 track: true, label: L("lcl_fin_orderline_id") }
+                  };

-    _pre_analyze_fields: function (params, jsondata) /* analyseer inkomende jsondata, common voor PUT en POST */
+    this.includes = {
+        "custom_fields" : {
+            model: new model_custom_fields(this, new model_fin_kenmerk("R", { internal: true }), { pNiveau: "R", readman: true, readuse: true }),
+            joinfield: "flexparentkey",
+            enable_update: true
+        },
+        "tracking": {
+            model: new model_tracking(["factuur"]),
+            joinfield: "trackingrefkey"
+        }
+    };
+
+    function _pre_analyze_fields(params, jsondata) /* analyseer inkomende jsondata, common voor PUT en POST */
    {
        delete jsondata.line; // factuurregelnummer niet door de gebruiker laten zetten.
-    },
+    };

-    _analyze_fields: function (dbfields, params, jsondata) /* analyseer inkomende data, common voor PUT en POST */
+    function _analyze_fields(dbfields, params, jsondata) /* analyseer inkomende data, common voor PUT en POST */
    {
-    },
+    };

-    _validate_fields: function (dbfields, params, jsondata) /* valideer dbfields, alle constraints die niet door de database worden afgevangen */
+    function _validate_fields(dbfields, params, jsondata) /* valideer dbfields, alle constraints die niet door de database worden afgevangen */
    {
      //__Log(jsondata);
      //var factuurregel_key = parseInt(jsondata.id);
-    },
+    };

-    _synchronize_totals_sql: function (factuur_key)
+    function _synchronize_totals_sql(factuur_key)
    {
        // Redundante info bijwerken. Door dat hier te doen hebben we redelijk consistentie-garantie.
        var sql = " UPDATE fin_factuur ff"
                + "    SET fin_factuur_totaal = (SELECT SUM(fin_factuurregel_totaal)"
-                                             + "   FROM fin_factuurregel fr"
-                                             + "  WHERE fr.fin_factuur_key = ff.fin_factuur_key)"
+                + "                                FROM fin_factuurregel fr"
+                + "                               WHERE fr.fin_factuur_key = ff.fin_factuur_key)"
                + "      , fin_factuur_totaal_btw = (SELECT SUM(fin_factuurregel_btw)"
-                                                  + "  FROM fin_factuurregel fr"
-                                                  + " WHERE fr.fin_factuur_key = ff.fin_factuur_key)"
+                + "                                    FROM fin_factuurregel fr"
+                + "                                   WHERE fr.fin_factuur_key = ff.fin_factuur_key)"
                + "  WHERE fin_factuur_key = " + factuur_key;
        return sql;
-    },
+    };

-    _renumber_invoicelines_sql: function (factuur_key)
+    function _renumber_invoicelines_sql(factuur_key)
    {
        // Regels hernummeren zodat ze weer opeenvolgend zijn.
        var sql = "UPDATE fin_factuurregel"
                + "   SET fin_factuurregel_nr = ROWNUM"
                + " WHERE fin_factuur_key = " + factuur_key;
        return sql;
-    },
+    };


-    REST_GET: function _GET(params)
+    this.REST_GET = function _GET(params)
    {
-        var scope = params.filter.scope || "fe";
-        var autfunction = { fe: "WEB_EXTFIN", fo: "WEB_FINFOF", bo: "WEB_FINBOF" } [scope];
+        var scope = params.filter.scope;
+        if (scope)
+        {
+          var autfunction = { fe: "WEB_EXTFIN", fo: "WEB_FINFOF", bo: "WEB_FINBOF" } [scope];
+        }
+        else
+        {
+          var autfunction = ["WEB_EXTFIN", "WEB_FINFOF", "WEB_FINBOF"];
+          var authparamsFINFOF = user.checkAutorisation("WEB_FINFOF", true);
+          var authparamsFINBOF = user.checkAutorisation("WEB_FINBOF", true);
+        }
        params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch

-        var query = api2.sqlfields(params, model_invoicelines );
+        var query = api2.sqlfields(params, this);
        var parentexists = ["f.fin_factuur_verwijder IS NULL"];

-        if (scope == "fe")
-        {
-            parentexists.push("f.prs_perslid_key_user=" + user_key);
+        if (scope == "fe" || (!scope && !authparamsFINFOF && !authparamsFINBOF))
+        { // Frontend.
+          parentexists.push("f.prs_perslid_key_user=" + user_key);
        }
        else
        {
@@ -101,25 +129,25 @@ model_invoicelines =
            query.wheres.push(sqlparent);
        }

-        var wheres = api2.sqlfilter(params, model_invoicelines);
+        var wheres = api2.sqlfilter(params, this);
        query.wheres = query.wheres.concat(wheres);

        var sql = "SELECT " + query.selects.join(", ")
                + "  FROM " + query.tables.join(", ")
                + " WHERE " + query.wheres.join(" AND " )
                + " ORDER BY fin_factuurregel_nr";
-        var json = api2.sql2json (params, sql, model_invoicelines );
+        var json = api2.sql2json (params, sql, this);

        return json;
-    },
+    };

-    REST_PUT: function (params, jsondata, the_key) /* update invoiceline */
+    this.REST_PUT = function (params, jsondata, the_key) /* update invoiceline */
    {
        var finregel_key = the_key;
-        model_invoicelines._pre_analyze_fields(params, jsondata);
-        var dbfields = api2.update_fields(params, model_invoicelines, jsondata); // Build updater
-        model_invoicelines._analyze_fields(dbfields, params, jsondata);
-        model_invoicelines._validate_fields(dbfields, params, jsondata);
+        _pre_analyze_fields(params, jsondata);
+        var dbfields = api2.update_fields(params, this, jsondata); // Build updater
+        _analyze_fields(dbfields, params, jsondata);
+        _validate_fields(dbfields, params, jsondata);
        //
        var sql = "SELECT fin_factuur_key"
                + "  FROM fin_factuurregel"
@@ -128,6 +156,7 @@ model_invoicelines =
        var fin_factuur_key = oRs("fin_factuur_key").value;
        oRs.Close();

+        var fin_factuur_old = fin.factuur_info(fin_factuur_key);
        var this_fin = fin.func_enabled_factuur(fin_factuur_key);
        user.auth_required_or_abort(this_fin.canChange);  // Geen wijzigingen toestaan bij onvoldoende rechten.

@@ -136,21 +165,44 @@ model_invoicelines =

        var sql = "BEGIN "
                + finUpd.sql + ";"
-                + model_invoicelines._synchronize_totals_sql(fin_factuur_key) + ";"
+                + _synchronize_totals_sql(fin_factuur_key) + ";"
                + "END;";
        var err = Oracle.Execute(sql, true);
        if (err.friendlyMsg)
            abort_with_warning(err.friendlyMsg);

-        return { key: finregel_key };
-    },
+        var finUpdTrackarray = []; // Alle tracking van elke afzondelijke regel verzamelen.
+        if (finUpd.trackarray.length > 0)
+        {
+          if (jsondata.name != "")
+            finUpdTrackarray = finUpdTrackarray.concat([jsondata.name + ": "]); // Omschrijving van de regel noteren zodat ik weet welke regel is aangepast.
+          finUpdTrackarray = finUpdTrackarray.concat(finUpd.trackarray);
+        }

-    REST_POST: function (params, jsondata, parent_key) /* new invoiceline */
+        var fin_factuur_new = fin.factuur_info(fin_factuur_key);
+        if (fin_factuur_old.fin_totaal != fin_factuur_new.fin_totaal)
+          finUpdTrackarray.push(L("lcl_fin_total_sum_inBTW") + ": " + safe.curr(fin_factuur_old.fin_totaal + fin_factuur_old.fin_totaal_btw) + " => " + safe.curr(fin_factuur_new.fin_totaal + fin_factuur_new.fin_totaal_btw))
+        if (fin_factuur_old.fin_totaal_btw != fin_factuur_new.fin_totaal_btw)
+          finUpdTrackarray.push(L("lcl_fin_BTW_total_sum") + ": " + safe.curr(fin_factuur_old.fin_totaal_btw) + " => " + safe.curr(fin_factuur_new.fin_totaal_btw))
+
+        var fintrack = api2.process_includes(params, this, jsondata, the_key);
+
+        // update nog tracken
+        if (fin_factuur_key > 0)
+        {
+          fin.trackfactuurupdate(fin_factuur_key, L("lcl_fin_is_finupdtrack").format(fin_factuur_key) + ((finUpdTrackarray.length + fintrack.length) > 0? "\n" : "") + finUpdTrackarray.concat(fintrack).join("\n"));
+        };
+
+        return { key: finregel_key };
+    };
+
+    this.REST_POST = function (params, jsondata) /* new invoiceline */
    {
        params.isNew = true;

        var trackarray  = [];
-        var factuur_key = (parent_key && parent_key > -1 ? parent_key : jsondata.invoice);
+        var factuur_key = (typeof jsondata.invoice == "object" ? jsondata.invoice.id : jsondata.invoice);
+
        var this_fin    = fin.func_enabled_factuur(factuur_key); // Wat heb ik zoal aan rechten op deze specifieke factuur
        var auth = ( (params.filter && params.filter.api2 && params.filter.api2 == "invoices"
                                    && params.include && inArray("invoicelines",params.include)
@@ -160,10 +212,10 @@ model_invoicelines =
                   );
        user.auth_required_or_abort(auth);

-        model_invoicelines._pre_analyze_fields(params, jsondata);
-        var dbfields = api2.update_fields(params, model_invoicelines, jsondata); // Build updater
-        model_invoicelines._analyze_fields(dbfields, params, jsondata);
-        model_invoicelines._validate_fields(dbfields, params, jsondata);
+        _pre_analyze_fields(params, jsondata);
+        var dbfields = api2.update_fields(params, this, jsondata); // Build updater
+        _analyze_fields(dbfields, params, jsondata);
+        _validate_fields(dbfields, params, jsondata);

        // Zet volgnummer van de nieuwe factuurregel.
        var sql = "SELECT COALESCE(MAX(fin_factuurregel_nr),0) volgnr"
@@ -185,20 +237,22 @@ model_invoicelines =

        var sql = "BEGIN "
                + finIns.sql + ";"
-                + model_invoicelines._synchronize_totals_sql(factuur_key) + ";"
+                + _synchronize_totals_sql(factuur_key) + ";"
                + "END;";
        var err = Oracle.Execute(sql, true);
        if (err.friendlyMsg)
            abort_with_warning(err.friendlyMsg);

+        var fintrack = api2.process_includes(params, this, jsondata, factuurregel_key);
+
        // Tracking toevoegen.
        trackarray.push(L("lcl_fin_invoicerow_add") + ": " + safe.quoted_sql(jsondata.name) + "/" + jsondata.total);
        shared.trackaction("FINNEW", factuur_key, trackarray.join("\n"));
        //
        return { key: factuurregel_key };
-    },
+    };

-    REST_DELETE: function (params, the_key) /* delete invoiceline */
+    this.REST_DELETE = function (params, the_key) /* delete invoiceline */
    {
        var trackarray  = [];
        var factuurregel_key = the_key;
@@ -221,8 +275,8 @@ model_invoicelines =
        fin.deleteFactuurregel(factuurregel_key);

        var sql = "BEGIN "
-                + model_invoicelines._synchronize_totals_sql(factuur_key) + ";"
-                + model_invoicelines._renumber_invoicelines_sql(factuur_key) + ";"
+                + _synchronize_totals_sql(factuur_key) + ";"
+                + _renumber_invoicelines_sql(factuur_key) + ";"
                + "END;"
        var err = Oracle.Execute(sql, true);
        if (err.friendlyMsg)
@@ -232,6 +286,6 @@ model_invoicelines =
            trackarray.push(L("lcl_fin_regel_del") + ": " + safe.quoted_sql(desc) + "/" + total);
            //shared.trackaction("FINDEL", factuur_key, trackarray.join("\n")); // srtnotificatie FINDEL bestaat (nog) niet
        }
-    }
+    };
 }
 %>
--- a/APPL/API2/model_invoices.inc
+++ b/APPL/API2/model_invoices.inc
@@ -36,42 +36,50 @@ function model_invoices(fin_key, params)
    this.primary = "fin_factuur_key";
    this.records_name = "invoices";
    this.record_name = "invoice";
+    this.soft_delete = "fin_factuur_verwijder";

              // Het interne factuurnr is de id, het externe nummer is name
    this.fields =
-            {"id"              : { dbs: "fin_factuur_key",          typ: "key" },
-             "invoicedate"     : { dbs: "fin_factuur_datum",        typ: "datetime",                               track: true, label: L("lcl_fin_findate"),             filter: "range" },
-/*readonly*/ "creditor"        : { dbs: "prs_bedrijf_key",          typ: "key",     foreign: "prs_bedrijf",        track: true, label: L("lcl_ord_company_uit"),
+            {"id"              : { dbs: "fin_factuur_key",            typ: "key" },
+             "invoicedate"     : { dbs: "fin_factuur_datum",          typ: "datetime",                               track: true, label: L("lcl_fin_findate"),           filter: "range" },
+/*readonly*/ "creditor"        : { dbs: "prs_bedrijf_key",            typ: "key",     foreign: "prs_bedrijf",        track: true, label: L("lcl_ord_company_uit"),
                                   sql: "COALESCE(mld_opdr.mld_uitvoerende_keys, bes_bestelopdr.prs_bedrijf_key, cnt_contract.cnt_prs_bedrijf_key)" },
-/*readonly*/ "referencetype"   : { dbs: "dummy",                    typ: "varchar",
+/*readonly*/ "referencetype"   : { dbs: "dummy",                      typ: "varchar",
                                   sql: "DECODE(fin_factuur.mld_opdr_key, NULL, DECODE(fin_factuur.bes_bestelopdr_key, NULL, DECODE(fin_factuur.cnt_contract_key, NULL, '?', 'C'), 'B'), 'O')" },
-/*readonly*/ "accountholder"   : { dbs: "prs_perslid_key",          typ: "key",     foreign: "prs_perslid",        track: true, label: L("lcl_prs_budgethouder"),
+/*readonly*/ "accountholder"   : { dbs: "prs_perslid_key",            typ: "key",     foreign: "prs_perslid",        track: true, label: L("lcl_prs_budgethouder"),
                                   sql: "fin.getfiatteur(fin_factuur.fin_factuur_key)" },
-             "name"            : { dbs: "fin_factuur_nr",           typ: "varchar",                                track: true, label: L("lcl_fin_invoice_nr_extern") },
-             "order"           : { dbs: "mld_opdr_key",             typ: "key",     foreign: "mld_opdr"},
-             "contract"        : { dbs: "cnt_contract_key",         typ: "key",     foreign: "cnt_contract"},
-             "purchaseorder"   : { dbs: "bes_bestelopdr_key",       typ: "key",     foreign: "bes_bestelopdr"},
-             "total"           : { dbs: "fin_factuur_totaal",       typ: "float",   "iscurrency": true,            track: true, label: L("lcl_fin_totaal_bedrag") },
-             "vat"             : { dbs: "fin_factuur_totaal_btw",   typ: "float",   "iscurrency": true,            track: true, label: L("lcl_fin_totaal_bedrag_btw") },
-             "finstatus"       : { dbs: "fin_factuur_statuses_key", typ: "key",     foreign: fin.getfinstatustext, track: true, label: L("lcl_fin_fin_status")},
-             "accountingperiod": { dbs: "fin_factuur_boekmaand",    multiedit: true, typ: "varchar",                                track: true, label: L("lcl_fin_divide_period") },
-             "debiteur_nr"     : { dbs: "fin_factuur_debiteur_nr",  multiedit: true, typ: "varchar",                                track: true, label: L("lcl_fin_debtor_nr"),           filter: "like" },
-             "costtype"        : { dbs: "prs_kostensoort_key",      multiedit: true, typ: "key",     foreign: "prs_kostensoort",    track: true, label: L("lcl_shared_charge_type") },
-             "contact"         : { dbs: "prs_perslid_key_user",     multiedit: true, typ: "key",     foreign: "prs_perslid",        track: true, label: L("lcl_mld_name") },
-             "validater"       : { dbs: "prs_perslid_key_goedkeur", typ: "key",     foreign: "prs_perslid",        track: true, label: L("lcl_fin_goedkeurder") },
-             "remark"          : { dbs: "fin_factuur_opmerking",    typ: "varchar",                                track: true, label: L("lcl_fin_remark"),              filter: "like" },
-             "externnr"        : { dbs: "fin_factuur_externnr",     typ: "varchar",                                             label: L("extern_nr"),       readonly: !(user.has("WEB_FACTAB") || user.has("WEB_FACXNR")) },
-             "externsyncdate"  : { dbs: "fin_factuur_externsyncdate", typ: "datetime",                                          label: L("extern_syncdate"), readonly: !(user.has("WEB_FACTAB") || user.has("WEB_FACXNR")) }
+             "name"            : { dbs: "fin_factuur_nr",             typ: "varchar",                                track: true, label: L("lcl_fin_invoice_nr_extern") },
+             "order"           : { dbs: "mld_opdr_key",               typ: "key",     foreign: "mld_opdr"},
+             "contract"        : { dbs: "cnt_contract_key",           typ: "key",     foreign: "cnt_contract"},
+             "purchaseorder"   : { dbs: "bes_bestelopdr_key",         typ: "key",     foreign: "bes_bestelopdr"},
+             "total"           : { dbs: "fin_factuur_totaal",         typ: "float",   iscurrency: true,              track: true, label: L("lcl_fin_totaal_bedrag") },
+             "vat"             : { dbs: "fin_factuur_totaal_btw",     typ: "float",   iscurrency: true,              track: true, label: L("lcl_fin_totaal_bedrag_btw") },
+             "blockedaccount"  : { dbs: "fin_factuur_gbedrag",        typ: "float",   iscurrency: true,              track: true, label: L("lcl_fin_gbedrag") },
+             "status"          : { dbs: "fin_factuur_statuses_key",   typ: "key",     foreign: fin.getfinstatustext, track: true, label: L("lcl_fin_fin_status")},
+             "accountingperiod": { dbs: "fin_factuur_boekmaand",      typ: "varchar",                                track: true, label: L("lcl_fin_divide_period"),                     multiedit: true },
+             "debiteur_nr"     : { dbs: "fin_factuur_debiteur_nr",    typ: "varchar",                                track: true, label: L("lcl_fin_debtor_nr"),         filter: "like", multiedit: true },
+             "costtype"        : { dbs: "prs_kostensoort_key",        typ: "key",     foreign: "prs_kostensoort",    track: true, label: L("lcl_shared_charge_type"),                    multiedit: true },
+             "contact"         : { dbs: "prs_perslid_key_user",       typ: "key",     foreign: "prs_perslid",        track: true, label: L("lcl_mld_name"),                              multiedit: true },
+             "validater"       : { dbs: "prs_perslid_key_goedkeur",   typ: "number",  foreign: "prs_perslid",        track: true, label: L("lcl_fin_goedkeurder") },
+             "source"          : { dbs: "fin_factuur_bron",           typ: "number",                                 track: true, label: L("lcl_fin_invoice_source") },
+             "advice"          : { dbs: "fin_factuur_advies",         typ: "date",                                   track: true, label: L("lcl_fin_adviesdatum") },
+             "flag"            : { dbs: "fin_factuur_flag",           typ: "number",                                 track: true, label: L("lcl_fin_flags") },
+             "contractplace"   : { dbs: "cnt_contract_plaats_key",    typ: "number",                                 track: true, label: L("lcl_fin_location_scope") },
+             "remark"          : { dbs: "fin_factuur_opmerking",      typ: "varchar",                                track: true, label: L("lcl_fin_remark"),            filter: "like" },
+             "remarkreject"    : { dbs: "fin_factuur_opmerking_afw",  typ: "varchar",                                track: true, label: L("lcl_fin_remark_reject"),     filter: "like" },
+             "externnr"        : { dbs: "fin_factuur_externnr",       typ: "varchar",                                             label: L("extern_nr"),                 readonly: !(user.has("WEB_FACTAB") || user.has("WEB_FACXNR")) },
+             "externsyncdate"  : { dbs: "fin_factuur_externsyncdate", typ: "datetime",                                            label: L("extern_syncdate"),           readonly: !(user.has("WEB_FACTAB") || user.has("WEB_FACXNR")) },
+             "contractplace"   : { dbs: "bes_bestellevr_key",         typ: "number",                                 track: true, label: L("lcl_bes_bestellevr_pakbon") }
            };

    this.includes = {
        "invoicelines": {
-            model: model_invoicelines,
-            joinfield: "fin_factuur_key",
+            model: new model_invoicelines(),
+            joinfield: "invoice",
            enable_update: true
        },
        "custom_fields" : {
-            model: new model_custom_fields(this, new model_fin_kenmerk({ internal: true }), { readman: true, readuse: true }),
+            model: new model_custom_fields(this, new model_fin_kenmerk("F", { internal: true }), { pNiveau: "F", readman: true, readuse: true }),
            joinfield: "flexparentkey",
            enable_update: true
        },
@@ -81,23 +89,28 @@ function model_invoices(fin_key, params)
        }
    };

-    function _pre_analyze_fields (params, jsondata) /* analyseer inkomende jsondata, common voor PUT en POST */
+    function _pre_analyze_fields(params, jsondata) /* analyseer inkomende jsondata, common voor PUT en POST */
    {
        // De factuurbedragen worden berekend uit de factuurregels. Eventuele waarden die hier gezet zijn negeren.
-        jsondata.total = 0;
-        jsondata.vat = 0;
+        if (params.method != "POST")
+        {
+          delete jsondata.total;
+          delete jsondata.vat;
+        }

+        if (jsondata.status)
+        { // Er is een status meegegeven.
+          jsondata.status = typeof jsondata.status == "object"? jsondata.status.id : jsondata.status;
+        }
        // Status van 3 (foute import) moet bij saven op 2 worden gezet.
-        var fin_status_key = jsondata.status;
-        if (fin_status_key == 3) fin_status_key = 2;
-
        // Status 6 (Akkoord) moet bij saven op 2 (Ingevoerd) worden gezet. Factuur dient indien nodig weer gefiatteerd te worden.
-        if (fin_status_key == 6) fin_status_key = 2;
-
-        jsondata.status = fin_status_key;
+        if (jsondata.status == 3 || jsondata.status == 6)
+        {
+          jsondata.status = 2;
+        }
    };

-    function _analyze_fields (dbfields, params, jsondata) /* analyseer inkomende data, common voor PUT en POST */
+    function _analyze_fields(dbfields, params, jsondata) /* analyseer inkomende data, common voor PUT en POST */
    {
        if (jsondata.purchaseorder_name && !dbfields.purchaseorder)
        {
@@ -119,7 +132,7 @@ function model_invoices(fin_key, params)
        }
    };

-    function _validate_fields (dbfields, params, jsondata) /* valideer fields, alle constraints die niet door de database worden afgevangen */
+    function _validate_fields(dbfields, params, jsondata) /* valideer fields, alle constraints die niet door de database worden afgevangen */
    {
    };

@@ -166,26 +179,138 @@ function model_invoices(fin_key, params)
    {
        var fin_key = the_key;
        var this_fin = fin.func_enabled_factuur(fin_key);
+
        user.auth_required_or_abort(this_fin.canChange);  // Geen wijzigingen toestaan bij onvoldoende rechten.
-        //
+
        _pre_analyze_fields(params, jsondata);
-        var dbfields = api2.update_fields(params, this, jsondata); // Build updater
-        _analyze_fields(dbfields, params, jsondata);
-        _validate_fields(dbfields, params, jsondata);
-        //
-        var wheres = [" fin_factuur_key = " + fin_key];
-        var finUpd = buildTrackingUpdate("fin_factuur", wheres.join(" AND " ), dbfields, { noValidateToken: true });
-        var err = Oracle.Execute(finUpd.sql, true);
-        if (err.friendlyMsg)
-            abort_with_warning(err.friendlyMsg);

-        var fintrack = api2.process_includes(params, this, jsondata, the_key);
+        //if ("filter" in params && "mode" in params.filter)
+        //  this_fin.canFlexChange = this_fin.canReadAny && params.filter.mode == "attachment"; // Deze mag altijd
+        // Geen wijzigingen toestaan bij onvoldoende rechten.
+        user.auth_required_or_abort(this_fin.canChange ||
+                                    (this_fin.canReject && jsondata.status == 1) ||                              // Afwijzen.
+                                    ((this_fin.canUnReject || this_fin.canUnapprove) && jsondata.status == 2) || // On-Afwijzen, On-Fiatteren of On-Goedkeuren.
+                                    (this_fin.canAccept && jsondata.status == 5) ||                              // Fiatteren.
+                                    (this_fin.canGoedkeur && jsondata.status == 6))                              // Goedkeuren.

-        // update nog tracken
-        if (fin_key > 0)
+
+        if (jsondata.status == 1 && this_mld.canReject)
+        { // Afwijzen.
+          var fields = [ { dbs: "fin_factuur_opmerking_afw", typ: "varchar", val: jsondata.remark, track: L("lcl_fin_remark_reject"), len: 4000} ];
+
+          var finUpd = buildTrackingUpdate("fin_factuur", "fin_factuur_key = " + fin_key, fields);
+          oRs = Oracle.Execute(finUpd.sql);
+          if (finUpd.trackarray.length)
+          {
+            fin.trackfactuurupdate(fin_key, L("lcl_fin_is_finupdtrack").format(fin_key) + "\n" + finUpd.trackarray.join("\n"));
+          }
+
+          // Status naar Afgewezen(1).
+          var sql = "UPDATE fin_factuur"
+                  + " SET fin_factuur_statuses_key = 1"
+                  + " WHERE fin_factuur_key = " + fin_key
+                  + " AND (mld_opdr_key IS NOT NULL OR cnt_contract_key IS NOT NULL OR bes_bestelopdr_key IS NOT NULL)";
+          Oracle.Execute(sql);
+          shared.trackaction(this_fin.canAccept? "FINFNO" : "FINGNO", fin_key);
+
+          var pResult = new HookResult();
+          // Klantspecifieke check functie (hookfunction) voor de invoer.
+          if (!custfunc.fin_postsave(fin_key, pResult))
+          {
+             abort_with_warning(pResult.errmsg);
+          }
+        }
+        else if (jsondata.status == 2 && (this_fin.canUnReject || this_fin.canUnapprove))
+        { // On-Afwijzen, On-Fiatteren of On-Goedkeuren.
+          // Huidige status opvragen.
+          sql = "SELECT fin_factuur_statuses_key"
+              + "  FROM fin_factuur"
+              + " WHERE fin_factuur_key = " + fin_key;
+          oRs = Oracle.Execute(sql);
+          var fin_status_old = oRs("fin_factuur_statuses_key").Value;
+          oRs.Close();
+
+          var fields = [ { dbs: "fin_factuur_opmerking_afw", typ: "varchar", val: jsondata.remark, track: L("lcl_fin_remark_reject"), len: 4000} ];
+
+          var finUpd = buildTrackingUpdate("fin_factuur", "fin_factuur_key = " + fin_key, fields);
+          oRs = Oracle.Execute(finUpd.sql);
+          if (finUpd.trackarray.length)
+          {
+            fin.trackfactuurupdate(fin_key, L("lcl_fin_is_finupdtrack").format(fin_key) + "\n" + finUpd.trackarray.join("\n"));
+          }
+
+          // Status terugzetten naar Ingevoerd(2).
+          sql = "UPDATE fin_factuur"
+              + " SET fin_factuur_statuses_key = 2"
+              + " WHERE fin_factuur_key = " + fin_key
+              + " AND (mld_opdr_key IS NOT NULL OR cnt_contract_key IS NOT NULL OR bes_bestelopdr_key IS NOT NULL)";
+          Oracle.Execute(sql);
+
+          shared.trackaction((fin_status_old == 5? "FINGUN" : "FINFUN"), fin_key); // Vanuit status Afgewezen(1) en Akkoord(6) FINFUN en vanuit status Ter Goedkeuring(5) FINGUN.
+        }
+        else if (jsondata.status == 5 && this_fin.canAccept)
+        { // Fiatteren.
+          var fin_enable_goedkeuren = S("fin_enable_goedkeuren");
+          var fin_status_new = fin_enable_goedkeuren != 0
+                               ? "CASE WHEN prs_perslid_key_goedkeur IS NOT NULL THEN 5 ELSE 6 END"
+                               : "6";
+          sql = "UPDATE fin_factuur"
+              + " SET fin_factuur_statuses_key = " + fin_status_new
+              + " WHERE fin_factuur_key = " +  fin_key
+              + " AND (mld_opdr_key IS NOT NULL OR cnt_contract_key IS NOT NULL OR bes_bestelopdr_key IS NOT NULL)";
+          Oracle.Execute(sql);
+
+          shared.trackaction("FINFOK", fin_key);
+
+          var sql = "SELECT prs_perslid_key_goedkeur"
+                  + " FROM fin_factuur f"
+                  + " WHERE fin_factuur_key = " + fin_key;
+          oRs = Oracle.Execute(sql);
+          if (fin_enable_goedkeuren != 0 && oRs("prs_perslid_key_goedkeur").Value > 0)
+          { // Factuur is naar status Ter goedkeuring(5) gegaan.
+            // Notificatie aan de goedkeurder.
+            fin.sendNeedApprovalNotification(fin_key, oRs("prs_perslid_key_goedkeur").Value);
+          }
+          //else // Factuur is naar status Akkoord(6) gegaan.
+          oRs.Close();
+        }
+        else if (jsondata.status == 6 && this_fin.canGoedkeur)
+        { // Fiatteren.
+          var sql = "UPDATE fin_factuur"
+                  + " SET fin_factuur_statuses_key = 6"
+                  + " WHERE fin_factuur_key = " + fin_key
+                  + " AND (mld_opdr_key IS NOT NULL OR cnt_contract_key IS NOT NULL OR bes_bestelopdr_key IS NOT NULL)";
+          Oracle.Execute(sql);
+
+          shared.trackaction("FINGOE", fin_key);
+
+          var pResult = new HookResult();
+          // Klantspecifieke check functie (hookfunction) voor de invoer
+          if (!custfunc.fin_postsave(fin_key, pResult))
+          {
+             abort_with_warning(pResult.errmsg);
+          }
+        }
+        else
        {
-          fin.trackfactuurupdate(fin_key, L("lcl_fin_is_finupdtrack").format(fin_key) + (finUpd.trackarray.length > 0? "\n" : "") + finUpd.trackarray.join("\n"));
-        };
+          var dbfields = api2.update_fields(params, this, jsondata); // Build updater
+          _analyze_fields(dbfields, params, jsondata);
+          _validate_fields(dbfields, params, jsondata);
+
+          var wheres = [" fin_factuur_key = " + fin_key];
+          var finUpd = buildTrackingUpdate("fin_factuur", wheres.join(" AND " ), dbfields, { noValidateToken: true });
+          var err = Oracle.Execute(finUpd.sql, true);
+          if (err.friendlyMsg)
+              abort_with_warning(err.friendlyMsg);
+
+          var fintrack = api2.process_includes(params, this, jsondata, the_key);
+
+          // update nog tracken
+          if (fin_key > 0)
+          {
+            fin.trackfactuurupdate(fin_key, L("lcl_fin_is_finupdtrack").format(fin_key) + (finUpd.trackarray.length > 0? "\n" : "") + finUpd.trackarray.join("\n"));
+          };
+        }

        return { key: fin_key };
    };
@@ -206,9 +331,7 @@ function model_invoices(fin_key, params)
        var finIns = buildInsert("fin_factuur", dbfields, { noValidateToken: true} );
        var factuur_key = finIns.sequences["fin_factuur_key"];

-        var sql = finIns.sql;
-
-        var err = Oracle.Execute(sql, true);
+        var err = Oracle.Execute(finIns.sql, true);
        if (err.friendlyMsg)
            abort_with_warning(err.friendlyMsg);

@@ -218,9 +341,7 @@ function model_invoices(fin_key, params)
        shared.trackaction("FINNEW", factuur_key);

        // factuurmatching
-        var sql_fm = "BEGIN"
-                   + "   fin.autoapprovefactuur(" + factuur_key + ");"
-                   + " END;";
+        var sql_fm = "BEGIN fin.autoapprovefactuur(" + factuur_key + "); END;";
        Oracle.Execute(sql_fm);

        return { key: factuur_key };
@@ -241,7 +362,7 @@ function model_invoices(fin_key, params)
                    + "   AND fin_factuur_key = " + factuur_key;
            oRs = Oracle.Execute(sql);
        }
-    }
+    };

    if (fin_key > 0)
    {
--- a/APPL/API2/model_issues.inc
+++ b/APPL/API2/model_issues.inc
@@ -824,7 +824,7 @@ function model_issues(mld_key, params)
            mld.nextworkflowstep(new_key, -1);  // -1 = initial (the originating call)

            // Controleer of er automatisch een opdracht aangemaakt moet worden.
-            var sql = "BEGIN mld.mld_addautoorder(" + new_key + "); END;"
+            var sql = "BEGIN mld.mld_addautoorder(" + new_key + "); END;"; // Notificeert eventueel ook de ORDNEW naar uitvoerende
            Oracle.Execute(sql);

            return { key: new_key };
--- a/APPL/API2/model_issues_mini.inc
+++ b/APPL/API2/model_issues_mini.inc
@@ -0,0 +1,35 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_issues_mini.inc
+
+    Description:    Melding mini model
+    Parameters:
+    Context:        Minimaal aantal velden. Puur voor 'include' bij model_mld_opdr.inc
+
+    Notes:
+*/
+
+%>
+<%
+
+function model_issues_mini(mld_key)
+{
+    this.module =       "MLD";
+    this.table =        "mld_melding";
+    this.primary =      "mld_melding_key";
+    this.records_name = "issues";
+    this.record_name =  "issue";
+    this.fields =
+            {
+             "id"         : { dbs: "mld_melding_key",                              typ: "key" },
+             "contact"    : { dbs: "prs_perslid_key",                              typ: "key",      foreign: "prs_perslid",                label: L("lcl_mld_name")  },
+             "location"   : { dbs: "mld_alg_locatie_key",                          typ: "key",      foreign: "alg_locatie",                label: L("lcl_location")  },
+             "building"   : { dbs: "alg_v_allonroerendgoed.alg_gebouw_key",        typ: "key",      foreign: "alg_gebouw",                 label: L("lcl_building")  },
+             "floor"      : { dbs: "alg_v_allonroerendgoed.alg_verdieping_key",    typ: "key",      foreign: "alg_verdieping",             label: L("lcl_floor")    },
+             "room"       : { dbs: "alg_v_allonroerendgoed.alg_ruimte_key",        typ: "key",      foreign: "alg_ruimte",                 label: L("lcl_room")     },
+             "terrain"    : { dbs: "alg_v_allonroerendgoed.alg_terreinsector_key", typ: "key",      foreign: "alg_terreinsector",          label: L("lcl_room")     }
+            };
+}
+%>
--- a/APPL/API2/model_locations.inc
+++ b/APPL/API2/model_locations.inc
@@ -61,6 +61,8 @@ function model_alg_locatie()
            switch (method)
            {
                case "GET":
+                    var autfunction = ["WEB_ALGUSE","WEB_ALGMAN"];
+                    params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch
                    if (params.filter.id)
                    {
                        var loc_key = params.filter.id;
--- a/APPL/API2/model_mld_discipline.inc
+++ b/APPL/API2/model_mld_discipline.inc
@@ -12,6 +12,7 @@
 */
 %>
 <!-- #include file="model_mld_disc_params.inc" -->
+<!-- #include file="model_mld_discipline_discipline.inc" -->
 <!-- #include file="../mgt/mgt.inc"-->
 <%
 function model_mld_discipline(disc_key, params)
@@ -19,11 +20,6 @@ function model_mld_discipline(disc_key, params)
    // E<>n model voor de buitenwereld
    api2.merge_disc_params_model(this, _model_mld_discipline);

-    this.hook_pre_edit = function (obj, fld, params)
-    {
-        fld.costtype.foreign = mgt.pre_edit_kostensoort(obj);
-    }
-
    this.hook_post_post = function (params, obj, key)
    {
        var org_disc_key = getQParamInt("id", -1);
@@ -157,6 +153,25 @@ _model_mld_discipline = // Internal only
    "disc_params": {
        "model": model_mld_disc_params,
        "joinfield": "issuediscipline"
+    },
+
+    "includes": {
+        "disciplines1": {
+            "model": new model_mld_discipline_discipline(),
+            "joinfield": "discipline1",
+            "label": L("mld_discipline_discipline_m"),
+            "enable_update": true,
+            "multiadd": "discipline2",
+            "notransport": true // te ingewikkeld
+        },
+        "disciplines2": {
+            "model": new model_mld_discipline_discipline(),
+            "joinfield": "discipline2",
+            "label": L("mld_discipline_discipline_m2"),
+            "enable_update": "true",
+            "multiadd": "discipline1",
+            "notransport": true
+        }
    }
 }
 %>
--- a/APPL/API2/model_mld_discipline_discipline.inc
+++ b/APPL/API2/model_mld_discipline_discipline.inc
@@ -12,7 +12,7 @@
 */
 %>
 <%
-function model_mld_discipline_discipline(functie, params)
+function model_mld_discipline_discipline()
 {
    this.records_name = "issuediscdisciplines";
    this.record_name = "issuediscdiscipline";
@@ -35,74 +35,57 @@ function model_mld_discipline_discipline(functie, params)
            "label": L("lcl_mld_vakgroep"),
            "typ": "key",
            "required": true,
+            "insertonly": true,
            "foreign": {
                "tbl": "(SELECT ins_discipline_key, ins_discipline_omschrijving"
-                     + "  FROM ins_tab_discipline td, mld_disc_params dp"
-                     + " WHERE td.ins_discipline_key = dp.mld_ins_discipline_key"
-                     + (params.disc > -1 ? " and td.ins_discipline_key = " + params.disc : "")
-                     + "   AND BITAND(dp.mld_disc_params_srtgroep, 5) = 5)",
+                     + "  FROM ins_srtdiscipline isd, ins_tab_discipline td, mld_disc_params dp"
+                     + " WHERE isd.ins_srtdiscipline_key = td.ins_srtdiscipline_key"
+                     + "   AND td.ins_discipline_key = dp.mld_ins_discipline_key"
+                     + "   AND BITAND(dp.mld_disc_params_srtgroep, 5) = 5)", // 1+4 primair+kan behandelen
                "key": "ins_discipline_key",
                "desc": "ins_discipline_omschrijving"
-            }
+            },
+            "uniquewith": "discipline2"
        },
        "discipline2": {
            "dbs": "mld_discipline_key2",
            "label": L("mld_processing_group"),
            "typ": "key",
            "required": true,
+            "insertonly": true,
            "foreign": {
                "tbl": "(SELECT ins_discipline_key, ins_discipline_omschrijving"
-                     + "  FROM ins_tab_discipline td, mld_disc_params dp"
-                     + " WHERE ins_discipline_key = mld_ins_discipline_key"
-                     + (mode == "edit" ? "   AND ins_discipline_key NOT IN (select mld_discipline_key2 from mld_discipline_discipline where mld_discipline_key1 = " + params.disc + ")" : "")
+                     + "  FROM ins_srtdiscipline isd, ins_tab_discipline td, mld_disc_params dp"
+                     + " WHERE isd.ins_srtdiscipline_key = td.ins_srtdiscipline_key"
+                     + "   AND td.ins_discipline_key = dp.mld_ins_discipline_key"
                     + "   AND BITAND(mld_disc_params_srtgroep, 2) = 2)",
                "key": "ins_discipline_key",
                "desc": "ins_discipline_omschrijving",
                "multiselect": true
-            }
+            },
+            "uniquewith": "discipline1"
        }
    };

-    this.hook_post_post = function (params, jsondata, key)
-    {
-        var nextdata = { id:-1, discipline1:jsondata.discipline1 };
-        for (var i=1; i<jsondata.discipline2.length;i++)
-        {
-            nextdata.discipline2 = jsondata.discipline2[i];
-            var restresult = this.REST_POST(params, nextdata);
-        }
-    }
+    this.list = {
+            "columns": [
+                "id",
+                "discipline1",
+                "discipline2"
+            ],
+            "orderby": [
+                "discipline1",
+                "discipline2"
+            ]
+        };

-    this.hook_pre_edit = function (obj, fld)
-    {
-        if (mode == "edit" && !add)
-        {
-            this.fields.discipline1.readonly = true;
-        }
-        else
-        {
-%>
-            <script type="text/javascript">
-            setTimeout(function() {
-                var discipline1 = document.getElementById("discipline1");
-                if (discipline1 && discipline1.length) {
-                    discipline1.style.display = "none";
-                    var selected = discipline1.options[discipline1.selectedIndex];
-                    var span = document.createElement("span");
-                    span.setAttribute('title', 'Key: ' + selected.value);
-                    span.setAttribute('class', 'fld');
-                    span.innerHTML = selected.text;
-                    discipline1.after(span);
-                }
-            }, 250);
-            </script>
-<%
-        }
-    }
+    this.edit = {
+        modal: true
+    };

-    this.REST_GET    = generic_REST_GET(this, { GET: { wheres: (params.disc > -1 ? [" mld_discipline_key1 = " + params.disc] : []) } });
+    this.REST_GET    = generic_REST_GET(this);
    this.REST_POST   = generic_REST_POST(this);
-    //this.REST_PUT    = generic_REST_PUT(this);
+    this.REST_PUT    = generic_REST_PUT(this);
    this.REST_DELETE = generic_REST_DELETE(this);
 }
 %>
--- a/APPL/API2/model_mld_kenmerk.inc
+++ b/APPL/API2/model_mld_kenmerk.inc
@@ -91,6 +91,14 @@ function model_mld_kenmerk(niveau, params)
            "dbs": "mld_kenmerk_volgnummer",
            "label": L("mgt_kenmerk_volgnummer"),
            "typ": "number",
+            "len": 3,
+            "required": true
+        },
+        "rolecode": {
+            "dbs": "mld_kenmerk_rolcode",
+            "label": L("mgt_kenmerk_rolcode"),
+            "typ": "number",
+            "LOV": buildKenmerkRoleCodeLOV({ module: (isOpdrachtKenmerk ? "OPD" : "MLD") }),
            "required": true
        },
        "group": {
@@ -106,6 +114,7 @@ function model_mld_kenmerk(niveau, params)
            "label": L("mgt_kenmerk_verplicht"),
            "typ": "key",
            "LOV": buildVerplichtingList(),
+            "emptyisrealvalue": true,
            "emptyoption": null
        },
        "requiredstatus": {
@@ -120,11 +129,11 @@ function model_mld_kenmerk(niveau, params)
            "label": (isOpdrachtKenmerk ? L("mgt_kenmerk_toonbaar") : L("lcl_mld_kenmerk_readonly") ),
            "typ": "check"
        },
-        "inlist": {
-            "dbs": "mld_kenmerk_inlijst",
-            "label": L("mgt_kenmerk_systeem_overview"),
-            "typ": "check0",
-            "multiedit": true
+        "code": {
+            "dbs": "mld_kenmerk_code",
+            "label": L("mgt_kenmerk_code"),
+            "typ": "varchar",
+            "readonly": !user.has("WEB_PRSSYS")
        },
        "clear": {
            "dbs": "mld_kenmerk_wissen",
@@ -134,6 +143,7 @@ function model_mld_kenmerk(niveau, params)
                {
                    "name": "",
                    "label": "",
+                    "showasgroup": false,
                    "typ": "check",
                    "mask": 0,      // Afhankelijk van mld/opdr en setting: wordt straks gezet.
                    "radios": []    // Afhankelijk van mld/opdr en setting: wordt straks toegevoegd.
@@ -196,7 +206,7 @@ function model_mld_kenmerk(niveau, params)
        fields_main.clear.bits[0].mask = 1;
        fields_main.clear.bits[0].radios.push(
                {"name": "copy_on",
-                 "label": L("opd_kenmerk_wissen_copy_on"),
+                 "label": L("mld_kenmerk_wissen_label") + " " + L("opd_kenmerk_wissen_copy_on"),
                 "mask": 1,
                 "defaultvalue": 1
                });
@@ -206,13 +216,13 @@ function model_mld_kenmerk(niveau, params)
        fields_main.clear.bits[0].mask = 3;
        fields_main.clear.bits[0].radios.push(
                {"name": "copy_on",
-                 "label": L("mld_kenmerk_wissen_copy_on"),
+                 "label": L("mld_kenmerk_wissen_label") + " " + L("mld_kenmerk_wissen_copy_on"),
                 "mask": 1,
                 "defaultvalue": 1
                });
        fields_main.clear.bits[0].radios.push(
                {"name": "fwd_on",
-                 "label": L("mld_kenmerk_wissen_fwd_on"),
+                 "label": L("mld_kenmerk_wissen_label") + " " + L("mld_kenmerk_wissen_fwd_on"),
                 "mask": 2,
                 "defaultvalue": 1
                });
@@ -248,12 +258,6 @@ function model_mld_kenmerk(niveau, params)
            "insertonly": !is_clone,
            "LOV": buildKenmerktypeLOV(null, { module: "MLD" })
        },
-        "code": {
-            "dbs": "mld_kenmerk_code",
-            "label": L("lcl_mld_code"),
-            "typ": "varchar",
-            "readonly": !user.has("WEB_FACTAB")
-        },
        "disciplinetype": {
            "dbs": "view_mld_kenmerk.ins_srtdiscipline_key", //"mld_discipline.ins_srtdiscipline_key",
            "label": L("lcl_mld_vakgroeptype"),
@@ -289,6 +293,34 @@ function model_mld_kenmerk(niveau, params)
            "showtransit": true,
            "insertonly": !is_clone,
            "search": false
+        },
+        "inlist": {
+            "dbs": "mld_kenmerk_inlijst",
+            "label": L("lcl_mld_kenmerk_visibility"),
+            "typ": "key",
+            "bits": [
+                {
+                    "name": "",
+                    "label": "",
+                    "typ": "check",
+                    "mask": 3,
+                    "radios": [
+                        {
+                            "name": "in_list",
+                            "label": L("mgt_kenmerk_systeem_overview"),
+                            "mask": 1,
+                            "defaultvalue": 0
+                        },
+                        {
+                            "name": "in_bord",
+                            "label": L("lcl_mld_kenmerk_in_bord"),
+                            "mask": 2,
+                            "defaultvalue": 1
+                        }
+                    ]
+                }
+            ],
+            "multiedit": true
        }
    };

@@ -321,6 +353,12 @@ function model_mld_kenmerk(niveau, params)
            "typ": "key",
            "LOV": buildHltPropList(),
            "emptyoption": null
+        },
+        "inlist": {
+            "dbs": "mld_kenmerk_inlijst",
+            "label": L("mgt_kenmerk_systeem_overview"),
+            "typ": "check0",
+            "multiedit": true
        }
    };

@@ -366,7 +404,7 @@ function model_mld_kenmerk(niveau, params)
    function get_issuepropertytype_srttype(obj)
    {
        var issuepropertytype = getQParamInt("issuepropertytype", ( (obj.issuepropertytype && obj.issuepropertytype.id) ? obj.issuepropertytype.id : -1));
-        var mld_opdr_readonly = (isOpdrachtKenmerk ? L("mgt_kenmerk_toonbaar") : L("lcl_mld_kenmerk_readonly") );
+        var mld_opdr_readonly = (isOpdrachtKenmerk ? L("mgt_kenmerk_toonbaar") : L("lcl_mld_kenmerk_readonly"));
        var result = { lbl_default:  L("mgt_kenmerk_default")
                     , lbl_readonly: mld_opdr_readonly
                     };
@@ -376,9 +414,11 @@ function model_mld_kenmerk(niveau, params)
                    + "  FROM mld_srtkenmerk"
                    + " WHERE mld_srtkenmerk_key = " + issuepropertytype;
            var oRs = Oracle.Execute(sql);
-            if (!oRs.eof)
-                result.lbl_default  = (oRs("mld_srtkenmerk_kenmerktype").Value == "l" || oRs("mld_srtkenmerk_kenmerktype").Value == "b"? L("mgt_kenmerk_icon") : L("mgt_kenmerk_default"));
-                result.lbl_readonly = (oRs("mld_srtkenmerk_kenmerktype").Value == "l" || oRs("mld_srtkenmerk_kenmerktype").Value == "b"? L("mgt_kenmerk_collapsed") : mld_opdr_readonly);
+            if (!oRs.eof) {
+                result.ktype = oRs("mld_srtkenmerk_kenmerktype").Value;
+                result.lbl_default  = (result.ktype == "l" || result.ktype == "b" ? L("mgt_kenmerk_icon") : L("mgt_kenmerk_default"));
+                result.lbl_readonly = (result.ktype == "l" || result.ktype == "b" ? L("mgt_kenmerk_collapsed") : mld_opdr_readonly);
+            }
            oRs.Close();
        }
        return  result;
@@ -415,6 +455,13 @@ function model_mld_kenmerk(niveau, params)
        var srttype = get_issuepropertytype_srttype(obj);
        fld["default"].label = srttype.lbl_default;
        fld["readonly"].label = srttype.lbl_readonly;
+        if (obj.id > 0 && !isOpdrachtKenmerk) { // Nieuwe kenmerken togglen zelf via clientside code
+            if (srttype.ktype && inArray(srttype.ktype, ['R', 'r', 'S'])) {
+                // Alles staat al goed
+            } else {
+                fld.inlist.bits[0].radios.splice(1, 1);
+            }
+        }

        if (obj.attributetype && (obj.attributetype.id == "b" || obj.attributetype.id == "l"))
            fld["default"].typ = "icon";
@@ -455,6 +502,13 @@ function model_mld_kenmerk(niveau, params)
        var srttype = get_issuepropertytype_srttype(obj);
        fld["default"].label = srttype.lbl_default;
        fld["readonly"].label = srttype.lbl_readonly;
+        if (!isOpdrachtKenmerk) {
+            if (srttype.ktype && inArray(srttype.ktype, ['R', 'r', 'S'])) {
+                // Alles staat al goed
+            } else {
+                fld.inlist.bits[0].radios.splice(1, 1);
+            }
+        }
    }

    this.hook_pre_post = function (params, obj)
@@ -465,8 +519,7 @@ function model_mld_kenmerk(niveau, params)
        var oRs = Oracle.Execute(sql);
        var kenmerktype = oRs("mld_srtkenmerk_kenmerktype").Value;
        oRs.Close();
-        if (kenmerktype != "b")
-        {
+        if (kenmerktype != "b") {
            obj.treatmentteam = null;
        }
    }
--- a/APPL/API2/model_mld_melding_tag.inc
+++ b/APPL/API2/model_mld_melding_tag.inc
@@ -0,0 +1,194 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_mld_melding_tag.inc
+
+    Description:    Model voor mld_melding_tag (mijlpalen, releasekalender)
+
+    Context:        Er wordt goed gelet op MLDTAG-schrijfrechten, maar leesrechten lijkt nog alles of niks. TODO denk ik.
+
+    Notes:    Hoe gaan we normaal om met verwijderdatum? Wat mij betreft is weg=weg, en dat is standaard?
+*/
+%>
+<%
+
+function model_mld_melding_tag()
+{
+    this.records_name = "issuetags";
+    this.record_name = "issuetag";
+    this.table = "mld_melding_tag";
+    this.primary = "mld_melding_tag_key";
+    this.autfunction = "WEB_MLDTAG";
+    this.soft_delete = "mld_melding_tag_verwijder";
+    this.record_title = L("mld_melding_tag");
+    this.records_title = L("mld_melding_tag_m");
+
+    var tag_key = getQParamInt("id", -1);
+    var auth_mode = getQParamSafe("mode", "show") === "edit" ? "write" : "read";
+
+    this.fields = {
+        "id": {
+            "dbs": "mld_melding_tag_key",
+            "label": "Key",
+            "typ": "key",
+            "hidden_fld": true,
+            "required": true,
+            "seq": "mld_s_mld_melding_tag_key",
+            "defaultvalue": null
+        },
+        "disciplinetype": {
+            "dbs": "ins_srtdiscipline_key",
+            "label": L("ins_srtdiscipline"),
+            "typ": "key",
+            "xhidden_fld": true,
+            "required": true,
+            "foreign": { // tags zijn alleen relevant als er standaardmeldingen zijn die tags gebruiken
+                "tbl": "(SELECT ins_srtdiscipline_key"
+                     + "      , ins_srtdiscipline_omschrijving"  // lcl
+                     + "   FROM ins_srtdiscipline"
+                     + "  WHERE ins_srtdiscipline_module = 'MLD'"
+                     + "    AND ins_srtdiscipline_verwijder IS NULL"
+                     + "    AND ins_srtdiscipline_key IN "
+                     + "        (SELECT ins_srtdiscipline_key"
+                     + "           FROM mld_discipline"
+                     + "          WHERE ins_discipline_key IN "
+                     + "                (SELECT mld_ins_discipline_key"
+                     + "                   FROM mld_stdmelding"
+                     + "                  WHERE mld_stdmelding_taggable > 0)"
+                     + "            AND ins_discipline_key IN"
+                     + "                (SELECT w.ins_discipline_key"
+                     + "                   FROM fac_v_webgebruiker w"
+                     + "                  WHERE w.prs_perslid_key = " + user_key
+                     + "                    AND fac_functie_key = " + F(this.autfunction)
+                     + "                    AND w.fac_gebruiker_prs_level_" + auth_mode + " < 9 AND w.fac_gebruiker_alg_level_" + auth_mode + " < 9))"
+                     + ")",
+                "key": "ins_srtdiscipline_key",
+                "desc": "ins_srtdiscipline_omschrijving"
+            }
+        },
+        "name": {
+            "dbs": "mld_melding_tag_naam",
+            "label": L("mld_melding_tag_naam"),
+            "typ": "varchar",
+            "required": true
+        },
+        "description": {
+            "dbs": "mld_melding_tag_oms",
+            "label": L("mld_melding_tag_oms"),
+            "typ": "varchar",
+            "translate": true
+        },
+        "issuegroup": {
+            "dbs": "mld_stdmeldinggroep_key",
+            "typ": "key",
+            "label": L("lcl_mld_meldinggroep"),
+            "foreign": { // alleen meldinggroepen van standaardmeldingen die tags gebruiken
+                "tbl": "(SELECT g.mld_stdmeldinggroep_key"
+                     + ", " + lcl.xsqla("g.mld_stdmeldinggroep_naam", "g.mld_stdmeldinggroep_key")
+                     + " FROM mld_stdmeldinggroep g"
+                     + " WHERE g.mld_stdmeldinggroep_key IN "
+                     + "       (SELECT mld_stdmeldinggroep_key "
+                     + "          FROM mld_stdmelding "
+                     + "         WHERE mld_stdmelding_taggable > 0"
+                     + "           AND mld_ins_discipline_key IN "
+                     + "              (SELECT w.ins_discipline_key "
+                     + "                 FROM fac_v_webgebruiker w"
+                     + "                  WHERE w.prs_perslid_key = " + user_key
+                     + "                    AND fac_functie_key = " + F(this.autfunction)
+                     + "                    AND w.fac_gebruiker_prs_level_" + auth_mode + " < 9 AND w.fac_gebruiker_alg_level_" + auth_mode + " < 9)))",
+                "key": "mld_stdmeldinggroep_key",
+                "desc": "mld_stdmeldinggroep_naam"
+            },
+            "emptyoption": "",
+            "showtransit": true,
+            "multiedit": true
+        },
+        "person": {
+            "dbs": "prs_perslid_key",
+            "label": L("mld_melding_tag_person"),
+            "typ": "key",
+            "foreign": "prs_perslid",
+            "defaultvalue" : user_key /* werk dit? */
+        },
+        "begindate": {
+            "dbs": "mld_melding_tag_datum_van",
+            "label": L("mld_melding_tag_startdatum"),
+            "typ": "date",
+            "multiedit": true
+        },
+        "accdate": {
+            "dbs": "mld_melding_tag_datum_acc",
+            "label": L("mld_melding_tag_accdatum"),
+            "typ": "date",
+            "multiedit": true
+        },
+        "enddate": {
+            "dbs": "mld_melding_tag_datum_tot",
+            "label": L("mld_melding_tag_einddatum"),
+            "typ": "date",
+            "required": true,
+            "multiedit": true
+        }
+    };
+
+    this.autclause = function _autclause(rw) {
+        rw = (rw === "write" ? "write" : "read"); // Whitelisten voor de zekerheid
+        return "     ins_srtdiscipline_key IN"
+             + "         (SELECT ins_srtdiscipline_key"
+             + "            FROM mld_discipline"
+             + "           WHERE     ins_discipline_key IN"
+             + "                         (SELECT mld_ins_discipline_key"
+             + "                            FROM mld_stdmelding"
+             + "                           WHERE mld_stdmelding_taggable > 0)"
+             + "                 AND ins_discipline_key IN"
+             + "                         (SELECT w.ins_discipline_key"
+             + "                            FROM fac_v_webgebruiker w"
+             + "                           WHERE     w.prs_perslid_key = " + user_key
+             + "                                 AND fac_functie_key = " + F(this.autfunction)
+             + "                                 AND w.fac_gebruiker_prs_level_" + rw + " < 9"
+             + "                                 AND w.fac_gebruiker_alg_level_" + rw + " < 9))"
+             + " AND (   mld_stdmeldinggroep_key IS NULL"
+             + "      OR (mld_stdmeldinggroep_key IN"
+             + "              (SELECT mld_stdmeldinggroep_key"
+             + "                 FROM mld_stdmelding"
+             + "                WHERE     mld_stdmelding_taggable > 0"
+             + "                      AND mld_ins_discipline_key IN"
+             + "                              (SELECT w.ins_discipline_key"
+             + "                                 FROM fac_v_webgebruiker w"
+             + "                                WHERE     w.prs_perslid_key = " + user_key
+             + "                                      AND fac_functie_key = " + F(this.autfunction)
+             + "                                      AND w.fac_gebruiker_prs_level_" + rw + " < 9"
+             + "                                      AND w.fac_gebruiker_alg_level_" + rw + " < 9))))";
+    }
+
+    this.REST_GET = generic_REST_GET(this, { "GET": { "wheres": this.autclause() }});
+    var autparams = user.checkAutorisation(this.autfunction);
+    var canWrite  = (autparams.PRSwritelevel < 9 && autparams.ALGwritelevel < 9);
+
+    /* Dit lost het multi-gebeuren nog niet op .. */
+
+    if (canWrite) {
+        if (tag_key > -1) {
+            var sql = "SELECT 'canWrite'"
+                    + "  FROM mld_melding_tag"
+                    + " WHERE mld_melding_tag_key = " + tag_key
+                    + "   AND " + this.autclause("write");
+            var oRs = Oracle.Execute(sql);
+            if (!oRs.EOF) { // Ik heb schrijfrechten op deze specifieke tag
+                this.REST_POST   = generic_REST_POST(this);
+                this.REST_PUT    = generic_REST_PUT(this);
+                this.REST_DELETE = generic_REST_DELETE(this);
+            }
+            oRs.Close();
+        } else {
+            this.REST_POST   = generic_REST_POST(this);
+            // Geen multi-acties, wel door kunnen klikken
+            this.list = {
+                "default_action": "scf_show",
+                "default_url": "appl/mgt/mld_melding_tag.asp?id={0}"
+            };
+        }
+    }
+}
+%>
--- a/APPL/API2/model_mld_opdr.inc
+++ b/APPL/API2/model_mld_opdr.inc
@@ -15,8 +15,10 @@
 <!-- #include file="../api2/model_fin_factuur.inc" -->
 <!-- #include file="./model_custom_fields.inc"-->
 <!-- #include file="./model_mld_kenmerk.inc"-->
+<!-- #include file="./model_notes.inc" -->
+<!-- #include file="./model_issues_mini.inc" -->
+<!-- #include file="./model_mld_opdr_materiaal.inc" -->
 <!-- #include file="../bgt/bgt_tools.inc" -->
-<!-- #include file="./model_notes.inc"-->
 <%

 function model_mld_opdr()
@@ -259,7 +261,6 @@ function model_mld_opdr()
            "typ": "key",
            "foreign": "prs_kostensoort",
            "readonly": S("mld_opdr_alt_kostensoort") == 1? false : true,
-            "LOVinit": "",
            "track": true
        },
        "hours": {
@@ -386,13 +387,13 @@ function model_mld_opdr()
            "dbs": "mld_opdr_externnr",
            "label": "externalnr",
            "typ": "key",
-            "hidden_fld": true
+            "readonly": S("bgt_enabled") || !(user.has("WEB_FACTAB") || user.has("WEB_FACXNR"))
        },
        "externalsyncdate": {
            "dbs": "mld_opdr_externsyncdate",
            "label": "externalsyncdate",
            "typ": "datetime",
-            "hidden_fld": true
+            "readonly": S("bgt_enabled") || !(user.has("WEB_FACTAB") || user.has("WEB_FACXNR"))
        }
    };

@@ -416,8 +417,22 @@ function model_mld_opdr()
                        "model": new model_custom_fields(this, new model_mld_kenmerk('O', { internal: true }), { pNiveau: "O" }),
                        "joinfield": "flexparentkey",
                        "enable_update": true
+                    },
+                    "materials": {
+                        "model": new model_mld_opdr_materiaal(),
+                        joinfield: "order"
+                    },
+                    "issuedetails": {
+                        "model": new model_issues_mini(),
+                        "isdetailfor": "issue",
+                        "joinfunction": function ()
+                            {
+                                return { tables: ["mld_melding m2"],
+                                         where: "mld_opdr.mld_melding_key = m2.mld_melding_key"
+                                       }
+                            }
                    }
-                   }
+    };

    this.hook_pre_show = function(obj, fld, scf_params)
    {
@@ -1593,8 +1608,6 @@ obj._is_clone=2 --> nieuwe sub-opdracht
      delete_fld(jsondata, "module", true);
      delete_fld(jsondata, "additional", true);
      delete_fld(jsondata, "offer", true);
-      delete_fld(jsondata, "externalnr", true);
-      delete_fld(jsondata, "externalsyncdate", true);
    }

    this.REST_PUT = function (params, jsondata, the_key)
@@ -1779,6 +1792,21 @@ obj._is_clone=2 --> nieuwe sub-opdracht
        // Status en tracking altijd met de functie setopdrachtstatus.
        // Zetten van de status van een nieuwe opdracht op nieuw en afhandelen van de tracking (status + uitvoerende tracking) en daarmee notificatie.
        var company = typeof jsondata.company == "object"? jsondata.company.id : jsondata.company;
+
+        params.mld_opdr = {}; // Zet hier de gegevens uit mld.mld_opdr_info() in.
+        params.mld_opdr.uitvoerende = (jsondata.company? api2.get_jdata_refkey(jsondata.company) : -1);
+        params.mld_opdr.opdr_type = (jsondata.issueordertype? jsondata.issueordertype : -1);
+
+        // Gegevens van het opdrachttype ophalen.
+        var sql = "SELECT mld_typeopdr_confirm_for_send"
+                + "     , mld_typeopdr_isofferte"
+                + "  FROM mld_typeopdr"
+                + " WHERE mld_typeopdr_key = " + params.mld_opdr.opdr_type;
+        oRs = Oracle.Execute(sql);
+        params.mld_opdr.typeopdr_confirm_for_send = oRs("mld_typeopdr_confirm_for_send").Value;
+        params.mld_opdr.mld_typeopdr_isofferte = oRs("mld_typeopdr_isofferte").Value;
+        oRs.Close();
+
        mld.setopdrachtstatus(opdr_key, setopdrstatus, company);

        if (S("bgt_enabled") != 1)  // BGT doet niets met mld_melding; mld_opdr heeft zelfs geen mld_melding_key!
@@ -1789,26 +1817,27 @@ obj._is_clone=2 --> nieuwe sub-opdracht

        if (!S("bgt_enabled"))
        {
-          params.mld_opdr = {}; // Zet hier de gegevens uit mld.mld_opdr_info() in.
-          params.mld_opdr.uitvoerende = (jsondata.company? api2.get_jdata_refkey(jsondata.company) : -1);
-          params.mld_opdr.opdr_type = (jsondata.issueordertype? jsondata.issueordertype : -1);
-
-          // Bepaal of de opdracht een offerte is.
-          var sql = "SELECT mld_typeopdr_isofferte"
-                  + "  FROM mld_typeopdr"
-                  + " WHERE mld_typeopdr_key = " + params.mld_opdr.opdr_type;
-          oRs = Oracle.Execute(sql);
-          params.mld_opdr.mld_typeopdr_isofferte = oRs("mld_typeopdr_isofferte").Value;
-          oRs.Close();
-
          // Vooralsnog alleen voor nieuwe meldingen (POST).
          // Opdracht direct electronisch versturen of door putorders laten oppikken (te verzenden veld zetten) bij nieuwe opdrachten.
          // Nooit als er een activiteits key is meegegeven omdat het dan eigenlijk geen opdracht is. Bij de api is de fac_activiteit_key niet gevuld.
+
          if (params.mld_opdr.mld_typeopdr_isofferte == 1)
          { // Offerte opdracht.
-            // putorders.sendMLDorders doen we hier niet, altijd scheduled via putorders
-            sql = "UPDATE mld_opdr SET mld_opdr_teverzenden = 1 WHERE mld_opdr_key = " + opdr_key;
-            Oracle.Execute(sql);
+            if (params.mld_opdr.typeopdr_confirm_for_send < 2)
+            { // Zonder bevestiging versturen.
+              sql = "UPDATE mld_opdr SET mld_opdr_teverzenden = 1 WHERE mld_opdr_key = " + opdr_key;
+              Oracle.Execute(sql);
+
+              if (setopdrstatus == 5)
+              { // Bij ORDNEW tracking wordt er niet genotificeerd. Dat moet als je mld_opdr_teverzenden op 1 zet nog gebeuren.
+                Oracle.Execute("BEGIN fac.notifytrackingbedrijven ('ORDNEW', " + opdr_key + "); END;");
+              }
+            }
+            else if (params.mld_opdr.typeopdr_confirm_for_send == 2)
+            { // Nog niet laten oppikken door achtergrond putorders alleen uitstellen.
+              sql = "UPDATE mld_opdr SET mld_opdr_teverzenden = NULL WHERE mld_opdr_key = " + opdr_key;
+              Oracle.Execute(sql);
+            }
          }
          else
          { // Opdrachten
@@ -1821,10 +1850,20 @@ obj._is_clone=2 --> nieuwe sub-opdracht
            var oRs = Oracle.Execute(sql);
            // Als (1) externe uitvoerder met (2) prs_bedrijfadres_url type O dan vragen
            // of de opdracht elektrisch verstuurd moet worden. Zo ja, dan
-            if (!oRs.eof && S("mld_opdr_confirm_for_send") != 1)
+            if (!oRs.eof && params.mld_opdr.typeopdr_confirm_for_send == 0)
            { // Er is een mldorder_adres en zonder bevestiging versturen.
              sql = "UPDATE mld_opdr SET mld_opdr_teverzenden = 1 WHERE mld_opdr_key = " + opdr_key;
              Oracle.Execute(sql);
+
+              if (setopdrstatus == 5)
+              { // Bij ORDNEW tracking wordt er niet genotificeerd. Dat moet als je mld_opdr_teverzenden op 1 zet nog gebeuren.
+                Oracle.Execute("BEGIN fac.notifytrackingbedrijven ('ORDNEW', " + opdr_key + "); END;");
+              }
+            }
+            else if (!oRs.eof && params.mld_opdr.typeopdr_confirm_for_send == 2)
+            { // Er is een mldorder_adres maar nog niet laten oppikken door achtergrond putorders alleen uitstellen.
+              sql = "UPDATE mld_opdr SET mld_opdr_teverzenden = NULL WHERE mld_opdr_key = " + opdr_key;
+              Oracle.Execute(sql);
            }
            //else geen mldorder_adres, dan niet versturen.
            oRs.Close();
--- a/APPL/API2/model_mld_opdr_materiaal.inc
+++ b/APPL/API2/model_mld_opdr_materiaal.inc
@@ -0,0 +1,141 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_mld_opdr_materiaal.inc
+
+    Description:
+
+    Context:        Alleen voor gebruik als include.
+
+    Notes:
+*/
+%>
+<%
+
+function model_mld_opdr_materiaal()
+{
+    this.records_name = "issueordermaterials";
+    this.record_name = "issueordermaterial";
+    this.table = "mld_opdr_materiaal";
+    this.primary = "mld_opdr_materiaal_key";
+    this.record_title = L("mld_opdr_materiaal");
+    this.records_title = L("mld_opdr_materiaal_m");
+
+
+    this.fields = {
+        "id": {
+            "dbs": "mld_opdr_materiaal_key",
+            "label": L("lcl_key"),
+            "typ": "key",
+            "required": true,
+            "seq": "mld_s_mld_opdr_materiaal_key"
+        },
+        "order": {
+            "dbs": "mld_opdr_key",
+            "label": L("lcl_mld_opdr"),
+            "typ": "key"
+        },
+        "seq": {
+            "dbs": "mld_opdr_materiaal_id",  // materiaal volgnummer binnen opdracht
+            "label": L("lcl_mld_opdr_id"),
+            "typ": "number"
+        },
+        "code": {
+            "dbs": "mld_opdr_materiaal_code",
+            "label": L("lcl_mld_opdr_code"),
+            "typ": "varchar"
+        },
+        "group": {
+            "dbs": "mld_opdr_materiaal_groep",
+            "label": L("lcl_mld_opdr_groep"),
+            "typ": "varchar"
+        },
+        "listdefined": {
+            "dbs": "fac_usrdata_key",
+            "label": L("mld_opdr_materiaal_oms"),
+            "typ": "key",
+            "foreign": {
+                "tbl": "fac_usrdata",
+                "key": "fac_usrdata_key",
+                "desc": "fac_usrdata_omschr"
+            }
+        },
+        "userdefined": {
+            "dbs": "mld_opdr_materiaal_omschr",
+            "label": L("lcl_mld_opdr_omschr"),
+            "typ": "varchar",
+            "required": true
+        },
+        "price": {
+            "dbs": "mld_opdr_materiaal_prijs",
+            "label": L("lcl_mld_opdr_prijs"),
+            "typ": "currency"
+        },
+        "vat_perc": {
+            "dbs": "fin_btwtabelwaarde_key",
+            "sql": "(SELECT fin_btwtabelwaarde_perc FROM fin_btwtabelwaarde where fin_btwtabelwaarde_key = mld_opdr_materiaal.fin_btwtabelwaarde_key)",
+            "label": L("lcl_fin_btwtabelwaarde_perc"),
+            "typ": "float"
+        },
+        "quantity": {
+            "dbs": "mld_opdr_materiaal_aantal",
+            "label": L("lcl_mld_opdr_aantal"),
+            "typ": "float"
+        },
+        "unit": {
+            "dbs": "mld_opdr_materiaal_eenheid",
+            "label": L("lcl_mld_opdr_eenheid"),
+            "typ": "varchar"
+        },
+        "unitcode": {
+            "dbs": "mld_opdr_materiaal_eenheidcode",
+            "label": L("lcl_mld_opdr_eenheidcode"),
+            "typ": "varchar"
+        },
+        "info": {
+            "dbs": "mld_opdr_materiaal_info",
+            "label": L("lcl_mld_opdr_info"),
+            "typ": "memo"
+        },
+        "extra1": {
+            "dbs": "mld_opdr_materiaal_extra1",
+            "label": L("lcl_mld_opdr_extra1"),
+            "typ": "varchar"
+        },
+        "extra2": {
+            "dbs": "mld_opdr_materiaal_extra2",
+            "label": L("lcl_mld_opdr_extra2"),
+            "typ": "varchar"
+        },
+        "extra3": {
+            "dbs": "mld_opdr_materiaal_extra3",
+            "label": L("lcl_mld_opdr_extra3"),
+            "typ": "memo"
+        },
+        "extra4": {
+            "dbs": "mld_opdr_materiaal_extra4",
+            "label": L("lcl_mld_opdr_extra4"),
+            "typ": "memo"
+        },
+        "externnr": {
+            "dbs": "mld_opdr_materiaal_externnr",
+            "label": L("extern_nr"),
+            "typ": "varchar",
+            "readonly": !(user.has("WEB_FACTAB") || user.has("WEB_FACXNR"))
+        },
+        "externsyncdate": {
+            "dbs": "mld_opdr_materiaal_extsyncdate",
+            "label": L("extern_syncdate"),
+            "typ": "datetime",
+            "readonly": !(user.has("WEB_FACTAB") || user.has("WEB_FACXNR"))
+        }
+    };
+
+
+    this.REST_GET    = generic_REST_GET(this);
+    //this.REST_POST   = generic_REST_POST(this);
+    //this.REST_PUT    = generic_REST_PUT(this);
+    //this.REST_DELETE = generic_REST_DELETE(this);
+}
+%>
--- a/APPL/API2/model_mld_srtkenmerk.inc
+++ b/APPL/API2/model_mld_srtkenmerk.inc
@@ -122,8 +122,8 @@ function model_mld_srtkenmerk(params)
        "code": {
            "dbs": "mld_srtkenmerk_code",
            "typ": "varchar",
-            "label": L("lcl_mld_code"),
-            "readonly": !user.has("WEB_FACTAB")
+            "label": L("mgt_srtkenmerk_code"),
+            "readonly": !user.has("WEB_PRSSYS")
      }
    };

--- a/APPL/API2/model_mld_stdmelding.inc
+++ b/APPL/API2/model_mld_stdmelding.inc
@@ -139,7 +139,6 @@ function model_mld_stdmelding()
            "typ": "key",
            "label": L("lcl_charge_type"),
            "foreign": "prs_kostensoort",
-            "emptyoption": "",
            "multiedit": true
        },
        "costcentre": {
@@ -214,8 +213,10 @@ function model_mld_stdmelding()
            "LOV": "0;" + L("lcl_mld_onzichtbaar") + ";"
                 + "1;" + L("lcl_mld_optioneel")   + ";"
                 + "2;" + L("lcl_mld_verplicht")
-                 + (S("ai_enabled") & 1 ? ";3;" : ";##DISABLED##;")
-                        + L("lcl_mld_ai_generated"),
+                 + ( ((S("ai_enabled") & 1) || mode == "api2") 
+                   ? ";3;" 
+                   : ";##DISABLED##;"
+                   ) + L("lcl_mld_ai_generated"),
            "emptyoption": null,
            "multiedit": true
        },
@@ -570,6 +571,16 @@ function model_mld_stdmelding()
            "label": L("lcl_mld_stdpriomatrix"),
            "multiedit": true
        },
+        "bytag": {
+            "dbs": "mld_stdmelding_taggable",
+            "typ": "number",
+            "label": L("lcl_mld_stdtaggable"),
+            "LOV": "0;" + L("lcl_mld_stdtaggable0")  + ";"
+                 + "1;" + L("lcl_mld_stdtaggable1")  + ";"
+                 + "3;" + L("lcl_mld_stdtaggable3"),
+            "emptyoption": null,
+            "multiedit": true
+        },
        "enddateempty": {
            "dbs": "mld_stdmelding_enddate_empty",
            "typ": "check0",
--- a/APPL/API2/model_mld_typeopdr.inc
+++ b/APPL/API2/model_mld_typeopdr.inc
@@ -188,6 +188,15 @@ function model_mld_typeopdr()
            "label": L("mld_typeopdr_afhandeling"),
            "typ": "check0"
        },
+        "confirmforsend": {
+            "dbs": "mld_typeopdr_confirm_for_send",
+            "label": L("mld_typeopdr_confirmforsend"),
+            "typ": "number",
+            "multiedit": true,
+            "defaultvalue": "0",
+            "LOV": L("mld_typeopdr_confirmforsendLOV"),
+            "emptyoption": null
+        },
        "mandatorycosts": {
            "dbs": "mld_typeopdr_kosten_verplicht",
            "label": L("mld_typeopdr_kosten_verplicht"),
@@ -250,6 +259,12 @@ function model_mld_typeopdr()
                }
            ],
            "track": true
+        },
+        "code": {
+            "dbs": "mld_typeopdr_code",
+            "label": L("lcl_mld_code"),
+            "typ": "varchar",
+            "readonly": !user.has("WEB_FACTAB")
        }
    };

--- a/APPL/API2/model_msg_message.inc
+++ b/APPL/API2/model_msg_message.inc
@@ -0,0 +1,98 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_msg_message.inc
+
+    Description:    Bericht versturen
+    Parameters:
+    Context:
+
+    Notes:
+*/
+%>
+<%
+
+function model_msg_message()
+{
+    this.table = "msg_message";
+    this.primary = "msg_message_key";
+    this.autfunction = "WEB_MSGBOF";
+    this.autfunction_add = "-"; // unsupported via SCF
+    this.record_name = "message";
+    this.records_name = "messages";
+    this.fields = {
+        "id": {
+            "dbs": "msg_message_key",
+            "label": L("lcl_key"),
+            "typ": "key",
+            "required": true,
+            "seq": "msg_s_msg_message_key"
+        },
+        "sender": {
+            "dbs": "prs_perslid_key",
+            "label": L("lcl_prs_bedrijfadres_afzender"), // LCL TODO
+            "typ": "key",
+            "foreign": "PRS_PERSLID",
+            "hidden_fld": true,
+            "defaultvalue": user_key
+        },
+        "subject": {
+            "dbs": "msg_message_onderwerp",
+            "label": L("lcl_mes_subject"),
+            "typ": "varchar",
+            "required": true
+        },
+        "description": {
+            "dbs": "msg_message_oms",
+            "label": L("lcl_mes_message"),
+            "typ": "memo",
+            "bb_codes": true,
+            "module": "MES",
+            "required": true
+        },
+        "priority": {
+            "dbs": "msg_message_prioriteit",
+            "label": L("lcl_mes_priority"),
+            "typ": "varchar",
+            "required": true,
+            "LOV": priorityLOV(), /* 1=high, 2=normal, 3=low */
+            "defaultvalue": 2 // Geet dit goed?
+        },
+        /* Doen de 2 onderstaande velden nog ergens ooit iets .. ?
+        "url": {
+            "dbs": "msg_message_url",
+            "label": L("lcl_mes_link"),
+            "typ": "varchar"
+        },
+        "reply_key": {
+            "dbs": "msg_message_replykey",
+            "label": L("lcl_mes_message_send"),
+            "typ": "key",
+            "foreign": {
+               "tbl": "msg_message",
+               "key": "msg_message_key",
+               "desc": "msg_message_oms"
+            },
+            "readonly": true
+        }, */
+        "created": {
+            "dbs": "msg_message_aanmaak",
+            "label": L("lcl_mes_send_date_time"),
+            "typ": "datetime",
+            "readonly": true
+        }
+    };
+
+    function priorityLOV() {
+        return "1;" + L("lcl_mes_high")
+            + ";2;" + L("lcl_mes_normaal")
+            + ";3;" + L("lcl_mes_low");
+    }
+
+    this.REST_GET    = generic_REST_GET(this);
+    // this.REST_POST   = generic_REST_POST(this);
+    // this.REST_PUT    = generic_REST_PUT(this);
+    // this.REST_DELETE = generic_REST_DELETE(this);
+}
+%>
--- a/APPL/API2/model_objects.inc
+++ b/APPL/API2/model_objects.inc
@@ -22,7 +22,7 @@
 function model_objects(ins_key, params)
 {
    params = params || {};
-    this.table = "ins_deel";
+    this.table = "ins_v_deelenonderdeel"; // Bij een update (PUT) en een insert (POST) is aangegeven dat het in de "ins_deel" tabel moet.
    this.primary = "ins_deel_key";
    this.records_name = "objects";
    this.record_name = "object";
@@ -37,19 +37,20 @@ function model_objects(ins_key, params)
        "placeholdertype":  { dbs: "ins_alg_ruimte_type",                       typ: "varchar", track: true },
        "placeholderkey":   { dbs: "ins_alg_ruimte_key",                        typ: "number",  track: true},
        "placeholderloc":   { dbs: "ins_alg_locatie_key",                       typ: "key",     foreign: "alg_locatie",       label: L("lcl_location")},
-        "location":         { dbs: "ins_v_deel_gegevens.alg_locatie_key",       typ: "key",     foreign: "alg_locatie",       label: L("lcl_location")},
-        "terrain":          { dbs: "ins_v_deel_gegevens.alg_terreinsector_key", typ: "key",     foreign: "alg_terreinsector", label: L("lcl_obj_bind_t")},
-        "building":         { dbs: "ins_v_deel_gegevens.alg_gebouw_key",        typ: "key",     foreign: "alg_gebouw",        label: L("lcl_building")},
-        "floor":            { dbs: "ins_v_deel_gegevens.alg_verdieping_key",    typ: "key",     foreign: "alg_verdieping",    label: L("lcl_floor")},
-        "room":             { dbs: "ins_v_deel_gegevens.alg_ruimte_key",        typ: "key",     foreign: "alg_ruimte",        label: L("lcl_room")},
-        "workplace":        { dbs: "ins_v_deel_gegevens.prs_werkplek_key",      typ: "key",     foreign: "prs_werkplek",      label: L("lcl_obj_bind_w")},
-        "owner":            { dbs: "ins_v_deel_gegevens.prs_perslid_key",       typ: "key",     foreign: "prs_perslid",       label: L("lcl_obj_bind_p")},
-        "department":       { dbs: "ins_v_deel_gegevens.prs_afdeling_key",      typ: "key",     foreign: "prs_afdeling",      label: L("lcl_obj_bind_a")},
+        "location":         { dbs: "ins_v_deelenonderdeel_gegevens.alg_locatie_key",       typ: "key",     foreign: "alg_locatie",       label: L("lcl_location")},
+        "terrain":          { dbs: "ins_v_deelenonderdeel_gegevens.alg_terreinsector_key", typ: "key",     foreign: "alg_terreinsector", label: L("lcl_obj_bind_t")},
+        "building":         { dbs: "ins_v_deelenonderdeel_gegevens.alg_gebouw_key",        typ: "key",     foreign: "alg_gebouw",        label: L("lcl_building")},
+        "floor":            { dbs: "ins_v_deelenonderdeel_gegevens.alg_verdieping_key",    typ: "key",     foreign: "alg_verdieping",    label: L("lcl_floor")},
+        "room":             { dbs: "ins_v_deelenonderdeel_gegevens.alg_ruimte_key",        typ: "key",     foreign: "alg_ruimte",        label: L("lcl_room")},
+        "workplace":        { dbs: "ins_v_deelenonderdeel_gegevens.prs_werkplek_key",      typ: "key",     foreign: "prs_werkplek",      label: L("lcl_obj_bind_w")},
+        "owner":            { dbs: "ins_v_deelenonderdeel_gegevens.prs_perslid_key",       typ: "key",     foreign: "prs_perslid",       label: L("lcl_obj_bind_p")},
+        "department":       { dbs: "ins_v_deelenonderdeel_gegevens.prs_afdeling_key",      typ: "key",     foreign: "prs_afdeling",      label: L("lcl_obj_bind_a")},
        "state":            { dbs: "ins_deel_state",                            typ: "varchar",                               label: L("lcl_deel_state")},
        "statedate":        { dbs: "ins_deel_statedate",                        typ: "datetime",                              label: L("lcl_deel_statedate")},
        "expiration":       { dbs: "ins_deel_vervaldatum",                      typ: "date",                                  label: L("lcl_ins_vervaldatum"), track: true},
        "active":           { dbs: "ins_deel_actief",                           typ: "check0",                                label: L("lcl_ins_active"),      track: true},
        "manager":          { dbs: "prs_perslid_key_beh",                       typ: "key",     foreign: "prs_perslid",       label: L("lcl_ins_manager"),     track: true},
+        "parent":           { dbs: "ins_deel_parent_key",                       typ: "key",     foreign: "ins_deel",          label: L("lcl_ins_parentobject")},
        // TODO if MJB
        "score1":           { dbs: "ins_deel_mjb_score1",                       typ: "varchar", track: true,                  label: L("lcl_ins_deel_mjb_score1")},
        "score2":           { dbs: "ins_deel_mjb_score2",                       typ: "varchar", track: true,                  label: L("lcl_ins_deel_mjb_score2")},
@@ -151,7 +152,7 @@ function model_objects(ins_key, params)
        {
            if (!jsondata.name || !jsondata.type) //  || !jsondata.objectdiscipline)
            {
-                params.message = "Missing required fields";
+                params.message = L("lcl_missing_required_fields");
                status = false;
            }
            if (status)
@@ -159,6 +160,11 @@ function model_objects(ins_key, params)
                params.message = setPlaceholder(ins_key, jsondata);
                status = (params.message == "");
            }
+            if (status)
+            {
+                params.message = checkWithParent(ins_key, jsondata);
+                status = (params.message == "");
+            }
        }
        //PUT:
        if (method == "PUT")
@@ -172,6 +178,11 @@ function model_objects(ins_key, params)
                params.message = setPlaceholder(ins_key, jsondata);
                status = (params.message == "");
            }
+            if (status)
+            {
+                params.message = checkWithParent(ins_key, jsondata);
+                status = (params.message == "");
+            }
        }

        if (!status)
@@ -180,6 +191,54 @@ function model_objects(ins_key, params)
        }
    };

+    function checkWithParent(ins_key, jsondata)
+    {
+        var msg = "";
+        if (jsondata.parent > 0)
+        {
+            var child_type = jsondata.type;
+            if (ins_key > 0)
+            {   // srtdeel_key mag niet gewijzigd worden dus lees deze uit het bestaande record.
+                var sql = "SELECT ins_srtdeel_key"
+                        + "  FROM ins_deel"
+                        + " WHERE ins_deel_key = " + ins_key;
+                var oRs = Oracle.Execute(sql);
+                child_type = oRs("ins_srtdeel_key").Value;
+                oRs.Close();
+            }
+
+            var sql = "SELECT ins_srtdeel_key"
+                    + "  FROM ins_v_aanwezigdeel"
+                    + " WHERE ins_deel_key = " + jsondata.parent;
+            var oRs = Oracle.Execute(sql);
+            if (!oRs.EOF) {
+                var parent_type = oRs("ins_srtdeel_key").Value;
+                var sql_b = "SELECT (SELECT BITAND(ins_srtdeel_binding, 32)"
+                          + "          FROM ins_srtdeel"
+                          + "         WHERE ins_srtdeel_key = " + parent_type
+                          + "       ) parent_child"
+                          + "     , (SELECT BITAND(ins_srtdeel_binding, 32)"
+                          + "          FROM ins_srtdeel"
+                          + "         WHERE ins_srtdeel_key = " + child_type
+                          + "       ) part_child"
+                          + "  FROM DUAL";
+                var oRs_b = Oracle.Execute(sql_b);
+                if (oRs_b("parent_child").Value != 32) { // Het deel mag onderdelen hebben
+                    msg = L("lcl_obj_allow_parts");
+                }
+                else if (oRs_b("part_child").Value != 0) { // Het onderdeel mag geen onderdelen hebben
+                    msg = L("lcl_obj_nested_parts");
+                }
+                oRs_b.Close();
+            }
+            else {
+                msg = L("lcl_obj_not_found");
+            }
+            oRs.Close();
+        }
+        return msg;
+    }
+
    function setPlaceholder(ins_key, jsondata)
    {
        // Bepaal met binding of het juiste veld voor plaats/eigenaar zijn ingevuld.
@@ -302,7 +361,7 @@ function model_objects(ins_key, params)
                }
                else
                {
-                    msg = "Unknown placeholder " + placeholder.ruimte_type + ":" + placeholder.ruimte_key;
+                    msg = L("lcl_obj_unknown_placeholder").format(placeholder.ruimte_type, placeholder.ruimte_key);
                }
                oRs_l.Close();
            }
@@ -312,7 +371,7 @@ function model_objects(ins_key, params)
            }
        }
        else
-            msg = "No objectbinding found";
+            msg = L("lcl_obj_unknown_binding");
        oRs.Close();

        return msg;
@@ -321,6 +380,14 @@ function model_objects(ins_key, params)

    this.REST_GET = function _GET(params)
    {
+        var withcomponents = true; // default 2025.1 gedrag
+        if (params.filter.components == "0")
+            withcomponents = false; // oude 2024.3 gedrag (geen onderdelen)
+        if (!withcomponents)
+        {
+            this.tablesql = "ins_deel ins_v_deelenonderdeel";  // voor het gemak alias ins_v_deelenonderdeel
+        }
+
        _check_authorization(params, "GET");
        var query = api2.sqlfields(params, this);

@@ -328,11 +395,11 @@ function model_objects(ins_key, params)
        // Toon standaard alleen de niet vervallen objecten, behalve als specifiek op object identificatie wordt gezocht.
        if (!params.filter.expired && !params.filter.name)
        {
-            query.wheres.push(" (ins_deel.ins_deel_vervaldatum IS NULL OR ins_deel.ins_deel_vervaldatum > TRUNC(SYSDATE))");
+            query.wheres.push(" (ins_v_deelenonderdeel.ins_deel_vervaldatum IS NULL OR ins_v_deelenonderdeel.ins_deel_vervaldatum > TRUNC(SYSDATE))");
        }

        query.tables.push("ins_srtdeel");
-        query.wheres.push("ins_deel.ins_srtdeel_key = ins_srtdeel.ins_srtdeel_key");
+        query.wheres.push("ins_v_deelenonderdeel.ins_srtdeel_key = ins_srtdeel.ins_srtdeel_key");

        // Als Uitgegeven of Beschikbaar is meegegeven dan overzicht uitleenmodule.
        if (params.filter.lentout || params.filter.avail)
@@ -350,7 +417,7 @@ function model_objects(ins_key, params)

        // TODO: Add 3D authorization
        // Alleen nog maar simpele 1D autorisatie
-        query.wheres.push(" ins_deel.ins_discipline_key IN"
+        query.wheres.push(" ins_v_deelenonderdeel.ins_discipline_key IN"
                        + " (SELECT ins_discipline_key"
                        + "    FROM fac_v_webgebruiker"
                        + "   WHERE fac_functie_key = " + params.authparams.autfunctionkey
@@ -359,9 +426,17 @@ function model_objects(ins_key, params)
                        + "     AND fac_gebruiker_alg_level_read < 9)");

        // TODO: We ondersteunen uitsluitend ruimte- werkplek- en persoonsgebonden objecten
-        query.tables.push("ins_v_deel_gegevens");
-        query.wheres.push("ins_deel.ins_alg_ruimte_type IN ('R', 'W', 'P') ");
-        query.wheres.push("ins_v_deel_gegevens.ins_deel_key = ins_deel.ins_deel_key");
+        // MGE: Let op dat de view "ins_v_deel_gegevens" geen onderdelen oplevert omdat de view afdwingt dat ins_deel_parent_key "NULL" moet zijn.
+        if (withcomponents)
+        {
+            query.tables.push("ins_v_deelenonderdeel_gegevens");
+        }
+        else
+        {
+            query.tables.push("ins_v_deel_gegevens ins_v_deelenonderdeel_gegevens"); // voor het gemak alias ins_v_deelenonderdeel_gegevens
+        }
+        query.wheres.push("ins_v_deelenonderdeel.ins_alg_ruimte_type IN ('R', 'W', 'P') ");
+        query.wheres.push("ins_v_deelenonderdeel_gegevens.ins_deel_key = ins_v_deelenonderdeel.ins_deel_key");

        var wheres = api2.sqlfilter(params, this)
        query.wheres = query.wheres.concat(wheres);
@@ -438,4 +513,3 @@ function model_objects(ins_key, params)
 }

 %>
-
--- a/APPL/API2/model_orders.inc
+++ b/APPL/API2/model_orders.inc
@@ -240,17 +240,20 @@ function model_orders(opdr_key, params)
      var sql = "SELECT mld_typeopdr_materiaal"
              + "     , mld_typeopdr_slamode"
              + "     , mld_typeopdr_isofferte"
+              + "     , mld_typeopdr_confirm_for_send"
              + "     , mld_typeopdr_gvs"
              + "     , mld_typeopdr_fvs"
              + "     , mld_typeopdr_kosten"
              + "  FROM mld_typeopdr"
              + " WHERE mld_typeopdr_key = " + params.mld_opdr.opdr_type;
      oRs = Oracle.Execute(sql);
-      params.mld_opdr.mld_typeopdr_materiaal = oRs("mld_typeopdr_materiaal").Value;
-      params.mld_opdr.mld_typeopdr_slamode   = oRs("mld_typeopdr_slamode").Value;
-      params.mld_opdr.mld_typeopdr_isofferte = oRs("mld_typeopdr_isofferte").Value;
-      params.mld_opdr.mld_typeopdr_gvs       = oRs("mld_typeopdr_gvs").Value || 0;
-      params.mld_opdr.mld_typeopdr_fvs       = oRs("mld_typeopdr_fvs").Value || 0;
+      params.mld_opdr.mld_typeopdr_materiaal    = oRs("mld_typeopdr_materiaal").Value;
+      params.mld_opdr.mld_typeopdr_slamode      = oRs("mld_typeopdr_slamode").Value;
+      params.mld_opdr.mld_typeopdr_isofferte    = oRs("mld_typeopdr_isofferte").Value;
+      params.mld_opdr.mld_typeopdr_confirm_for_send = oRs("mld_typeopdr_confirm_for_send").Value;
+
+      params.mld_opdr.mld_typeopdr_gvs          = oRs("mld_typeopdr_gvs").Value || 0;
+      params.mld_opdr.mld_typeopdr_fvs          = oRs("mld_typeopdr_fvs").Value || 0;
      var needKostenplaats = oRs("mld_typeopdr_kosten").Value == 1;
      oRs.Close();

@@ -1040,8 +1043,7 @@ function model_orders(opdr_key, params)
                     + "                         AND k.mld_srtkenmerk_key = t.mld_srtkenmerk_key"
                     + "                         AND t.mld_srtkenmerk_verwijder IS NULL"
                     + "                         AND t.mld_srtkenmerk_kenmerktype <> 'M'"
-                     + "                         AND (k.mld_kenmerk_volgnummer <= 100"
-                     + "                              OR k.mld_kenmerk_volgnummer >= 900)" // Alleen bij of na afmelden mogen afmeld-kenmerken tussen de 100..900
+                     + "                         AND BITAND(k.mld_kenmerk_rolcode, 5) > 0" // Alleen bij of na afmelden mogen afmeld-kenmerken 0x0
                     + "                         AND " + sql_kenmerkwaarde + " IS NOT NULL";
          Oracle.Execute(sql_insert);
        }
@@ -1199,9 +1201,23 @@ function model_orders(opdr_key, params)
          if (upd_params.initopdrkey < 0 && params.filter.copyorder_key < 0 && params.mld_opdr.mld_typeopdr_isofferte == 1)
          { // Meerdere offerte opdrachten aanmaken
            for (var u = 0; u < upd_params.uitvkeyArray.length; u++)
-            { // putorders.sendMLDorders doen we hier niet, altijd scheduled via putorders
-              sql = "UPDATE mld_opdr SET mld_opdr_teverzenden = 1 WHERE mld_opdr_key = " + upd_params.opdrkeyArray[u];
-              Oracle.Execute(sql);
+            {
+              if (params.mld_opdr.mld_typeopdr_confirm_for_send < 2)
+              { // Zonder bevestiging versturen.
+                // Oppikken door achtergrond putorders
+                sql = "UPDATE mld_opdr SET mld_opdr_teverzenden = 1 WHERE mld_opdr_key = " + upd_params.opdrkeyArray[u];
+                Oracle.Execute(sql);
+
+                if (params.mld_opdr.opdr_status == 5)
+                { // Bij ORDNEW tracking wordt er niet genotificeerd. Dat moet als je mld_opdr_teverzenden op 1 zet nog gebeuren.
+                  Oracle.Execute("BEGIN fac.notifytrackingbedrijven ('ORDNEW', " + upd_params.opdrkeyArray[u] + "); END;");
+                }
+              }
+              else if (params.mld_opdr.mld_typeopdr_confirm_for_send == 2)
+              { // Nog niet laten oppikken door achtergrond putorders alleen uitstellen.
+                sql = "UPDATE mld_opdr SET mld_opdr_teverzenden = NULL WHERE mld_opdr_key = " + upd_params.opdrkeyArray[u];
+                Oracle.Execute(sql);
+              }
            }
          }
          else
@@ -1217,20 +1233,30 @@ function model_orders(opdr_key, params)
            // of de opdracht elektrisch verstuurd moet worden. Zo ja, dan
            if (!oRs.eof)
            {
-              if (autoorder || S("mld_opdr_confirm_for_send") != 1) // meldracht
+              if (autoorder || params.mld_opdr.mld_typeopdr_confirm_for_send == 0) // meldracht
              { // Code uit order_mail.asp komen we anders niet.
-                var puo_result = putorders.sendMLDorders(opdr_key);
-                if (!puo_result)
-                { // mld_opdr_teverzenden is op 1 gezet door sendMLDorders, putorders schedule probeert wel weer
-                  doneParams.warning = L("lcl_puo_order_failfirst");
+                // Oppikken door achtergrond putorders
+                sql = "UPDATE mld_opdr SET mld_opdr_teverzenden = 1 WHERE mld_opdr_key = " + opdr_key;
+                Oracle.Execute(sql);
+
+                if (params.mld_opdr.opdr_status == 5)
+                { // Bij ORDNEW tracking wordt er niet genotificeerd. Dat moet als je mld_opdr_teverzenden op 1 zet nog gebeuren.
+                  Oracle.Execute("BEGIN fac.notifytrackingbedrijven ('ORDNEW', " + opdr_key + "); END;");
                }
+
+                var puo_result = putorders.sendMLDorders(opdr_key);
              }
-              else if (S("mld_opdr_confirm_for_send") == 1)
+              else if (params.mld_opdr.mld_typeopdr_confirm_for_send == 1)
              { // Gaat straks vragen: "Zal ik electronisch versturen?"
                // Let op: zelfs gevraagd als nog gefiatteerd moet worden
                // Putorders negeert hem nog zolang hij ter fiattering staat!
                doneParams.asksend = true;
              }
+              else if (params.mld_opdr.mld_typeopdr_confirm_for_send == 2)
+              { // Nog niet laten oppikken door achtergrond putorders alleen uitstellen.
+                sql = "UPDATE mld_opdr SET mld_opdr_teverzenden = NULL WHERE mld_opdr_key = " + opdr_key;
+                Oracle.Execute(sql);
+              }
            }
            else
            { // Als via setting mogelijkheid/workaround enabled om zelfs als er geen mldorder_adres
--- a/APPL/API2/model_prs_afdeling.inc
+++ b/APPL/API2/model_prs_afdeling.inc
@@ -129,6 +129,16 @@ function model_prs_afdeling()
    this.REST_GET    = generic_REST_GET(this, gparams);
    this.REST_POST   = generic_REST_POST(this);
    this.REST_PUT    = generic_REST_PUT(this);
-    this.REST_DELETE = generic_REST_DELETE(this);
+    this.REST_DELETE = function (params, the_key)
+                        {
+                            var autparams = user.checkAutorisation(this.autfunction);
+                            user.auth_required_or_abort(autparams.PRSwritelevel < 9 && autparams.ALGwritelevel < 9);
+                            var sql = "BEGIN prs.set_afdeling_verwijder({0}); END;".format(the_key);
+                            var err = Oracle.Execute(sql, true);
+                            if (err.friendlyMsg)
+                                api2.error(400, err.friendlyMsg); // Veronderstel Bad Request
+
+                            return { key: the_key, warning: "" };
+                        }
 }
 %>
--- a/APPL/API2/model_prs_bedrijfadres.inc
+++ b/APPL/API2/model_prs_bedrijfadres.inc
@@ -4,13 +4,19 @@

    File:           model_prs_bedrijfadres.inc

-    Description:
+    Description:    De technische adressen van bedrijven of systemen waar Facilitor berichten naar toe kan sturen.
+                    Dit kunnen bijvoorbeeld emailadressen zijn, maar ook URL's voor SOAP of REST services.
+                    Er zijn drie categorie<69>n van adressen, afhankelijk van prs_bedrijf_intern van het bijbehorende "bedrijf"
+                        NULL: een externe partij (het bedrijf dat opdrachten krijgt)
+                        1: een interne partij (het bedrijf van de melder enzo)
+                        2: een systeem  (een generiek kanaal)

    Context:

    Notes:
 */
 %>
+<!-- #include file="../api2/model_prs_bedrijfadres_srtnoti.inc" -->
 <%

 function model_prs_bedrijfadres()
@@ -23,6 +29,7 @@ function model_prs_bedrijfadres()
    this.records_title = L("lcl_prs_bedrijfadres_title");
    this.autfunction = "WEB_PRSMGT";
    this.defaultIcon = "fa-address-card";
+    this.trackcode = "PRSUPT";

    this.fields = {
        "id": {
@@ -37,190 +44,286 @@ function model_prs_bedrijfadres()
            "typ": "key",
            "label": L("prs_bedrijf_naam2"), /* label obv prs_bedrijf_bedrijf, lijkt onlogisch, is goed */
            "foreign": {
-                "tbl": "prs_bedrijf",
+                "tbl": "prs_bedrijf",  // or 2??
                "key": "prs_bedrijf_key",
                "desc": "prs_bedrijf_naam"
-            }
+            },
+            "infoPointer": {
+                "Url": "appl/prs/prs_bedrijf.asp?bedrijf_key="
+            },
+            "insertonly": true
+
        },
        "company2": {
            "dbs": "prs_bedrijf_key2",
            "typ": "key",
            "label": L("prs_bedrijf_naam1"),/* label obv prs_bedrijf_bedrijf, lijkt onlogisch, is goed */
            "foreign": {
-                "tbl": "prs_bedrijf",
+                "tbl": "(SELECT prs_bedrijf_key, prs_bedrijf_naam FROM prs_bedrijf WHERE prs_bedrijf_intern=1)",
                "key": "prs_bedrijf_key",
                "desc": "prs_bedrijf_naam"
            }
        },
-        "channel": {
+/*      We houden deze toch nog even onder de pet, omdat we voor type 2 bedrijfsnaam als systeemnaam gebruiken
+        "name": {
+            "dbs": "prs_bedrijfadres_omschrijving",
+            "label": L("lcl_prs_bedrijfadres_omschrijving"),
+            "typ": "varchar",
+            "required": false,  // wmb required als bedrijf_intern = 2/kanaal = generiek TODO
+            "filter": "like"
+        },
+*/        "channel": {
            "dbs": "prs_bedrijfadres_type",
            "typ": "varchar",
+            "required": true,
            "label": L("lcl_prs_bedrijfadres_type"),
            "LOV": bedrijfadrestypeLOV(),
            "track": true
        },
-        "ordertype": {
+        "ordertype": {      // alleen relevant voor kanaal Opdrachten
            "dbs": "mld_typeopdr_key",
            "typ": "key",
            "label": L("lcl_mld_typeopdr"),
            "foreign": "mld_typeopdr",
+            "multiedit": true,
+            "track": true
+        },
+        "discipline": {
+            "dbs": "ins_discipline_key",
+            "typ": "key",
+            "label": L("mgt_discipline"),
+            "foreign": "mld_typeopdr",
+            "multiedit": true,
            "track": true
        },
        "address": {
            "dbs": "prs_bedrijfadres_url",  // = protocol + url
            "typ": "varchar",
+            "required": true,
            "label": L("lcl_prs_bedrijfadres_url"),
+            "multiedit": true,
            "track": true
        },
        "sender": {
            "dbs": "prs_bedrijfadres_sender",
            "typ": "varchar",
            "label": L("lcl_prs_bedrijfadres_afzender"),
+            "placeholder": S("puo_fromaddress"),
+            "multiedit": true,
            "track": true
        },
        "replyaddress": {
            "dbs": "prs_bedrijfadres_replyaddress",
            "typ": "varchar",
            "label": L("lcl_prs_bedrijfadres_replyadres"),
+            "placeholder": S("puo_replyaddress"),
+            "multiedit": true,
            "track": true
        },
        "district": {
            "dbs": "alg_district_key",
            "typ": "key",
            "label": L("lcl_district"),
-            "foreign": "alg_district",
+            "foreign": { tbl: "alg_district",
+                         key: "alg_district_key",
+                         desc: "alg_district_omschrijving",
+                         where: "alg_district_verwijder IS NULL"
+                        },
+            "multiedit": true,
            "track": true
        },
        "location": {
            "dbs": "alg_locatie_key",
            "typ": "key",
            "label": L("lcl_location"),
-            "foreign": "alg_locatie",
+            "foreign": { tbl: "alg_locatie",
+                         key: "alg_locatie_key",
+                         desc: "alg_locatie_code",
+                         name: "alg_locatie_omschrijving",
+                         where: "alg_locatie_verwijder IS NULL" },  // TODO lijkt onafhankelijk van district
+            "multiedit": true,
            "track": true
        },
        "username": {
            "dbs": "prs_bedrijfadres_username",
            "typ": "varchar",
            "label": L("lcl_prs_bedrijfadres_username"),
+            "multiedit": true,
            "track": true
        },
        "password": {
            "dbs": "prs_bedrijfadres_password",
            "typ": "varchar",
            "label": L("lcl_prs_bedrijfadres_wachtwoord"),
-            "track": true
+            "multiedit": true,
+            "track": true,
+            "secret": true
        },
        "authmode": {
            "dbs": "prs_bedrijfadres_authmethod",
            "typ": "number",
+            "defaultvalue": 0,
+            "multiedit": true,
            "label": L("lcl_prs_bedrijfadres_authmethod"),
-            "LOV": L("lcl_prs_bedrijfadres_authmethodLOV")
+            "LOV": L("lcl_prs_bedrijfadres_authmethodLOV"),
+            "required": true
+        },
+        "oa_token_url": {
+            "dbs": "prs_bedrijfadres_oa_token_url",
+            "typ": "varchar",
+            "multiedit": true,
+            "label": L("lcl_prs_bedrijfadres_oa_token_url")
+        },
+        "oa_scope": {
+            "dbs": "prs_bedrijfadres_oa_scope",
+            "typ": "varchar",
+            "multiedit": true,
+            "label": L("lcl_prs_bedrijfadres_oa_scope")
+        },
+        "oa_resource": {
+            "dbs": "prs_bedrijfadres_oa_resource",
+            "typ": "varchar",
+            "multiedit": true,
+            "label": L("lcl_prs_bedrijfadres_oa_resource")
        },
        "ordermode": {
            "dbs": "prs_bedrijfadres_ordermode",
            "typ": "number",
            "label": L("lcl_prs_companies_order_mode"),
-            "track": true
+            "multiedit": true,
+            "track": true,
+            "LOV": ordermodeLOV()
        },
+/* future use
        "soapversion": {
            "dbs": "prs_bedrijfadres_soapversion",
            "typ": "varchar",
            "label": L("lcl_prs_bedrijfadres_soapversion"),
+            "multiedit": true,
            "track": true
        },
+*/
        "soapaction": {
            "dbs": "prs_bedrijfadres_soapaction",
            "typ": "varchar",
            "label": L("lcl_prs_bedrijfadres_soapaction"),
+            "multiedit": true,
            "track": true
        },
        "certificate": {
            "dbs": "prs_bedrijfadres_certificate",
            "typ": "varchar",
            "label": L("lcl_prs_companies_order_certificate"),
+            "multiedit": true,
            "track": true
        },
        "stylesheet": {
            "dbs": "prs_bedrijfadres_xsl",
            "typ": "varchar",
            "label": L("lcl_prs_companies_xsl"),
+            "multiedit": true,
            "track": true
        },
        "xslerrorhandler": {
            "dbs": "prs_bedrijfadres_error_handler",
            "typ": "check0",
            "label": L("lcl_prs_companies_error_handler"),
+            "multiedit": true,
            "track": true
        },
        "extension": {
            "dbs": "prs_bedrijfadres_ext",
            "typ": "varchar",
            "label": L("lcl_prs_bedrijfadres_ext"),
+            "multiedit": true,
            "track": true
        },
        "sendattachment": {
            "dbs": "prs_bedrijfadres_flexfiles",
            "typ": "number",
+            "defaultvalue": 0,
            "label": L("lcl_puo_order_flexfiles"),
-            "LOV": bijlagemeesturenLOV()
+            "multiedit": true,
+            "LOV": bijlagemeesturenLOV(),
+            "required": true
        },
        "encoding": {
            "dbs": "prs_bedrijfadres_encoding",
            "typ": "number",
+            "defaultvalue": 0,
            "label": L("lcl_prs_bedrijfadres_encoding"),
-            "LOV": encodingLOV()
+            "multiedit": true,
+            "LOV": encodingLOV(),
+            "required": true
        },
        "lockuser": {
            "dbs": "prs_bedrijfadres_lockuser_key",
            "typ": "key",
            "label": L("lcl_prs_bedrijfadres_lockuser"),
            "foreign": "prs_perslid",
+            "multiedit": true,
            "track": true
        },
        "locksecret": {
            "dbs": "prs_bedrijfadres_locksecret",
            "typ": "varchar",
            "label": L("lcl_prs_bedrijfadres_locksecret"),
-            "track": true
+            "hidden_fld": true, // Met de combinatie hidden_fld en readonly wordt de waarde in het veld bij bewaren niet opgeslagen.
+            "readonly": true,   // Als met de resetknop dit veld wordt gewist wordt de oude waarde dus niet weer opgeslagen bij bewaren van het bedrijfadres.
+            "multiedit": true,
+            "track": true,
+            "secret": true
        },
        "lockexpire": {
            "dbs": "prs_bedrijfadres_lockexpire",
            "typ": "number",
            "label": L("lcl_prs_bedrijfadres_lockexpire"),
+            "multiedit": true,
            "track": true
        },
        "loglevel": {
            "dbs": "prs_bedrijfadres_loglevel",
            "typ": "number",
+            "defaultvalue": 0,
            "label": L("lcl_prs_bedrijfadres_loglevel"),
-            "track": true
+            "track": true,
+            "required": true
        },
        "charset": {
            "dbs": "prs_bedrijfadres_charset",
            "typ": "varchar",
+            "multiedit": true,
            "label": L("lcl_prs_bedrijfadres_charset"),
            "LOV": L("lcl_prs_bedrijfadres_charsetLOV")
        },
        "attachfile": {
            "dbs": "prs_bedrijfadres_attachfile",
-            "typ": "varchar",
+            "typ": "file",
+            "module": "BDRADR",
+            "icon": "fa-file-lines",
+            "defaultValue": L("lcl_prs_bedrijfadres_bijlage"),
            "label": L("lcl_prs_bedrijfadres_bijlage"),
+            "multiedit": true,
            "track": true
        },
        "plugin": {
            "dbs": "prs_bedrijfadres_plugin",
            "typ": "varchar",
+            "multiedit": true,
            "label": L("prs_bedrijfadres_plugin")
        },
        "plugindata": {
            "dbs": "prs_bedrijfadres_plugindata",
            "typ": "memo",
+            "multiedit": true,
            "label": L("prs_bedrijfadres_plugindata")
        },
        "startdate": {
            "dbs": "prs_bedrijfadres_startdatum",
            "label": L("prs_bedrijf_startdatum"),
            "typ": "date",
+            "multiedit": true,
+            "defaultvalue": new Date(),
            "track": true
        }
    };
@@ -228,12 +331,18 @@ function model_prs_bedrijfadres()

    function bedrijfadrestypeLOV()
    {
-        return  "B;"+ L("lcl_prs_bedrijfadres_type_b")
-             + ";C;"+ L("lcl_prs_bedrijfadres_type_c")
-             + ";N;"+ L("lcl_prs_bedrijfadres_type_n")
-             + ";O;"+ L("lcl_prs_bedrijfadres_type_o")
-             + ";V;"+ L("lcl_prs_bedrijfadres_type_v")
-             + ";I;"+ L("lcl_prs_bedrijfadres_type_i");
+        return  "B;" + L("lcl_prs_bedrijfadres_type_b")
+             + ";C;" + L("lcl_prs_bedrijfadres_type_c")
+             + ";N;" + L("lcl_prs_bedrijfadres_type_n")
+             + ";O;" + L("lcl_prs_bedrijfadres_type_o")
+             + ";R;" + L("lcl_prs_bedrijfadres_type_r")
+             + ";E;" + L("lcl_prs_bedrijfadres_type_e_intern")   // enige waarde als prs_bedrijf_intern = 1, niet voor de rest
+             + ";G;" + L("lcl_prs_bedrijfadres_type_g")           // tbd, komt overeen met prs_bedrijf_intern = 2
+             + ";V;" + L("lcl_prs_bedrijfadres_type_v") // BES voorraad of MARX planrequest
+             + ";I;" + L("lcl_prs_bedrijfadres_type_i")
+             + ";S;" + L("lcl_prs_bedrijfadres_type_s")
+             //+ ";P;" + L("lcl_prs_bedrijfadres_type_p") // planrequests
+             ;
    };

    function bijlagemeesturenLOV(prs_type)
@@ -258,14 +367,29 @@ function model_prs_bedrijfadres()
        return  "0;" + L("lcl_encoding_text_xml")
             + ";1;" + L("lcl_encoding_multipart_form")
             + ";2;" + L("lcl_encoding_application_json")
+             + ";4;" + L("lcl_encoding_form_urlencoded")
    };

+    function ordermodeLOV()
+    {   // Initi<74>el leeg, wordt onLoad gevuld door onChangeAddress
+        return  "0;0"
+             + ";1;1"
+             + ";5;5"
+             + ";13;13"
+    };
+
+    this.hook_pre_edit = this.hook_pre_multi_edit = function (obj, fld) { %>
+    <script type="text/javascript">
+        var email_regexp = new RegExp("<%=safe.jsstring(S("email_regexp"))%>", "ig");
+    </script>
+<%  }
+
    this._pre_analyze_fields = function(params, jsondata) /* analyseer inkomende jsondata, common voor PUT en POST */
    {
        var authparams = user.checkAutorisation(this.autfunction, true);
        user.auth_required_or_abort(authparams && (authparams.ALGwritelevel < 9 || authparams.PRSwritelevel < 9));

-        if (jsondata.channel != "O")
+        if (jsondata.channel && jsondata.channel != "O")
            jsondata.ordertype = -1;
    };

@@ -275,18 +399,27 @@ function model_prs_bedrijfadres()

    this._validate_fields = function(dbfields, params, jsondata) /* valideer fields, alle constraints die niet door de database worden afgevangen */
    {
-        if (jsondata.channel == "B" && jsondata.sendattachment == 2)
-            abort_with_warning(L("mgt_validation_error_1").format(L("lcl_puo_order_flexfiles")));
-
-        if (jsondata.encoding < 1 || jsondata.encoding > 3)
-            abort_with_warning(L("mgt_validation_error_1").format(L("lcl_prs_bedrijfadres_encoding")));
-
-        var fout_adres = true;
-        if (jsondata.address && jsondata.address != "")
+        if (   ("channel" in jsondata) && ("sendattachment" in jsondata)
+            && jsondata.channel == "B" && jsondata.sendattachment == 2)
        {
+            abort_with_warning(L("mgt_validation_error_1").format(L("lcl_puo_order_flexfiles")));
+        }
+
+        if (("encoding" in jsondata) && (jsondata.encoding < 0 || jsondata.encoding > 4)) {
+            abort_with_warning(L("mgt_validation_error_1").format(L("lcl_prs_bedrijfadres_encoding")));
+        }
+
+        if (("address" in jsondata) && jsondata.address != "")
+        {
+            var fout_adres = true;
            var protocol = "";
            var arr = (jsondata.address||"").split(":");
-            if (arr.length > 1)
+            if (arr.length == 1 && new RegExp(S("email_regexp"), "ig").test(jsondata.address))
+            {
+                jsondata.address = 'mailto:' + jsondata.address;
+                fout_adres = false;
+            }
+            else if (arr.length > 1)
            {
                switch (arr[0])
                {
@@ -294,14 +427,16 @@ function model_prs_bedrijfadres()
                    case "file":   protocol = arr[0] + ":"; break;
                    case "https":
                    case "http":
-                    case "ftp":    protocol = arr[0] + "://"; break;
+                    case "ftp":
+                    case "sftp":   protocol = arr[0] + "://"; break;
                    default:       protocol = jsondata.address; // Geen van bovengenoemde protocollen: levert straks fout_adres=true.
                }
                fout_adres = jsondata.address.substr(protocol.length) == "";
            }
+            if (fout_adres) {
+                abort_with_warning(L("mgt_validation_error_1").format(L("lcl_prs_bedrijfadres_url")));
+            }
        }
-        if (fout_adres)
-            abort_with_warning(L("mgt_validation_error_1").format(L("lcl_prs_bedrijfadres_url")));

        // bestaat de ingevulde xsl-file
        var fso = Server.CreateObject("Scripting.FileSystemObject")
@@ -310,6 +445,17 @@ function model_prs_bedrijfadres()
            abort_with_warning(xsl + " not found");
    };

+    this.includes = {
+        "srtnotifications": {
+            "model": new model_prs_bedrijfadres_srtnoti(),
+            "joinfield": "companyconnect",
+            "multiadd": "srtnotification",
+            "enable_update": true,
+            "required": true,
+            "notransport": true // TRIGGER prs_t_prs_bedrijfadres_A_I maakt al wat srtnoti aan, met clonen zou dat tot dubbelen leiden.
+        }
+    };
+
    this.REST_GET    = generic_REST_GET(this);
    this.REST_POST   = function _POST(params, jsondata)
        {
@@ -330,5 +476,6 @@ function model_prs_bedrijfadres()
            return generic_REST_PUT(this)(params, jsondata, the_key);
        };
    this.REST_DELETE = generic_REST_DELETE(this);
+
 }
 %>
--- a/APPL/API2/model_prs_bedrijfadres_srtnoti.inc
+++ b/APPL/API2/model_prs_bedrijfadres_srtnoti.inc
@@ -0,0 +1,96 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_prs_bedrijfadres_srtnoti.inc
+
+    Description:
+
+    Context:
+
+    Notes:
+*/
+%>
+<%
+
+function model_prs_bedrijfadres_srtnoti()
+{
+    this.records_name = "companyconnectsrtnotis";
+    this.record_name = "companyconnectsrtnoti";
+    this.table = "prs_bedrijfadres_srtnoti";
+    this.primary = "prs_bedrijfadres_srtnoti_key";
+    this.record_title = L("lcl_prs_bedrijfadres_srtnoti_frame");
+    this.records_title = L("lcl_prs_bedrijfadres_srtnoti_title");
+    this.autfunction = "WEB_PRSMGT";
+    this.defaultIcon = "fa-address-card";
+
+    this.fields = {
+        "id": {
+            "dbs": "prs_bedrijfadres_srtnoti_key",
+            "seq": "prs_s_prs_bedrijfadres_srtnoti_key",
+            "typ": "key",
+            "label": L("lcl_key"),
+            "required": true
+        },
+        "companyconnect": {
+            "dbs": "prs_bedrijfadres_key",
+            "typ": "key",
+            "label": L("lcl_prs_companies_name_sys"),
+            "insertonly": true,
+            "foreign": {
+                "tbl": "(SELECT prs_bedrijfadres_key, prs_bedrijf_naam"
+                     + "   FROM prs_bedrijfadres pba, prs_bedrijf pb"
+                     + "  WHERE pba.prs_bedrijf_key = pb.prs_bedrijf_key)",
+                "key": "prs_bedrijfadres_key",
+                "desc": "prs_bedrijf_naam"
+            }
+        },
+        "srtnotification": {
+            "dbs": "fac_srtnotificatie_key",
+            "typ": "key",
+            "insertonly": true,
+            "label": L("fac_srtnotificatie_code"),
+            "uniquewith": "companyconnect",
+            "multiaddsize": 10,
+            "foreign": {
+                "tbl": "fac_srtnotificatie",
+                "key": "fac_srtnotificatie_key",
+                "desc": "fac_srtnotificatie_code || DECODE(fac_srtnotificatie_oms, NULL, '', ' (' || lcl.l(fac_srtnotificatie_oms) || ')')",
+                "where": "fac_srtnotificatie_code NOT LIKE '%TRK'"
+            }
+        },
+/*
+        "address": {
+            "dbs": "prs_bedrijfadres_url",  // = protocol + url
+            "typ": "varchar",
+            "label": L("lcl_prs_bedrijfadres_url"),  // als overrule
+            "track": true
+        },
+        "method": {
+            "dbs": "prs_bedrijfadres_method",  // = PUT/PATCH/POST enz.
+            "typ": "varchar",
+            "label": L("lcl_prs_bedrijfadres_method"),  // als overrule
+            "track": true
+        },
+*/
+        "created": {
+            "dbs": "prs_bedrijfadres_srtnoti_aanmaak",
+            "label": L("aut_sp_aanmaak"),
+            "typ": "date",
+            "readonly": true
+        }
+    };
+
+    this.edit = {
+            "modal": true
+        };
+    this.list = {
+        "columns": ["srtnotification", "companyconnect", "created"]
+    };
+
+    this.REST_GET    = generic_REST_GET(this);
+    this.REST_PUT    = generic_REST_PUT(this);
+    this.REST_POST   = generic_REST_POST(this);
+    this.REST_DELETE = generic_REST_DELETE(this);
+}
+%>
--- a/APPL/API2/model_prs_kenmerk.inc
+++ b/APPL/API2/model_prs_kenmerk.inc
@@ -20,9 +20,9 @@ function model_prs_kenmerk(niveau, params)
    this.table = "prs_kenmerk";
    this.primary = "prs_kenmerk_key";
    this.soft_delete = "prs_kenmerk_verwijder";
-    this.autfunction = params.internal?false:"WEB_PRSMGT";
-    this.record_title = L("mgt_kenmerk") + " " + get_prs_naam(niveau);
-    this.records_title = L("mgt_kenmerk_m") + " " + get_prs_naam(niveau);
+    this.autfunction = params.internal ? false : "WEB_PRSMGT";
+    this.record_title = L("mgt_kenmerk_of") + " " + get_prs_naam(niveau);
+    this.records_title = L("mgt_kenmerk_m_of") + " " + get_prs_naam(niveau);
    this.module = "PRS";

    this.fields = {
@@ -45,8 +45,17 @@ function model_prs_kenmerk(niveau, params)
            "dbs": "prs_kenmerk_volgnr",
            "label": L("mgt_kenmerk_volgnummer"),
            "typ": "number",
+            "len": 3,
            "required": true
        },
+        "rolecode": {
+            "dbs": "prs_kenmerk_rolcode",
+            "label": L("mgt_kenmerk_rolcode"),
+            "typ": "number",
+            "LOV": buildKenmerkRoleCodeLOV({ module: ( niveau == "C" ? "REL" : "PRS") }),
+            "required": true,
+            "multiedit": true
+        },
        "name": {
            "dbs": "prs_kenmerk_omschrijving",
            "label": L("mgt_kenmerk_omschrijving"),
@@ -79,6 +88,7 @@ function model_prs_kenmerk(niveau, params)
            "label": L("mgt_kenmerk_verplicht"),
            "typ": "key",
            "LOV": buildVerplichtingList(),
+            "emptyisrealvalue": true,
            "emptyoption": null
        },
        "group": {
@@ -89,10 +99,39 @@ function model_prs_kenmerk(niveau, params)
            "LOV": buildGroepsverplichtingList(),
            "emptyoption": null
        },
+//        "readonly": {
+//            "dbs": "prs_kenmerk_toonbaar",
+//            "label": L("mgt_kenmerk_toonbaar"),
+//            "typ": "check",
+//            "multiedit": true
+//        },
        "readonly": {
            "dbs": "prs_kenmerk_toonbaar",
            "label": L("mgt_kenmerk_toonbaar"),
-            "typ": "check"
+            "typ": "number",
+            "multiedit": true,
+            "bits": [
+                {
+                    "name": "ktoon",
+                    "label": "",
+                    "showasgroup": false,
+                    "typ": "check",
+                    "mask": 3,
+                    "radios": [
+                        {
+                            "name": "ktoon1",
+                            "label": L("mgt_kenmerk_toonbaar"),
+                            "mask": 1,
+                            "defaultvalue": 0
+                        },
+                        {
+                            "name": "ktoon2",
+                            "label": L("lcl_prs_in_profile"),
+                            "mask": 2,
+                            "defaultvalue": 0
+                        }
+                    ]
+                }]
        },
        "system": {
            "dbs": "prs_kenmerk_systeem",
@@ -102,6 +141,7 @@ function model_prs_kenmerk(niveau, params)
                {
                    "name": "",
                    "label": "",
+                    "showasgroup": false,
                    "typ": "check",
                    "mask": 15,
                    "radios": [
@@ -155,7 +195,7 @@ function model_prs_kenmerk(niveau, params)
            "label": L("mgt_srtkenmerk_nmax"),
            "typ": "number"
        },
-        "position": {
+        "position": {  // rare tag, position, dit is de functie
            "dbs": "prs_srtperslid_key",
            "label": L("prs_srtperslid_key"),
            "typ": "key",
@@ -163,7 +203,8 @@ function model_prs_kenmerk(niveau, params)
                "tbl": "prs_srtperslid",
                "key": "prs_srtperslid_key",
                "desc": "prs_srtperslid_omschrijving"
-            }        },
+            }
+        },
        "domain": {
            "dbs": "fac_kenmerkdomein_key",
            "label": L("mgt_kenmerkdomein_key"),
@@ -189,9 +230,9 @@ function model_prs_kenmerk(niveau, params)
        },
        "code": {
            "dbs": "prs_kenmerk_code",
-            "label": L("lcl_prs_code"),
+            "label": L("mgt_kenmerk_code"),
            "typ": "varchar",
-            "readonly": !user.has("WEB_FACTAB")
+            "readonly": !user.has("WEB_PRSSYS")
        },
        "authorization": {
            "dbs": "fac_functie_key",
--- a/APPL/API2/model_prs_perslid.inc
+++ b/APPL/API2/model_prs_perslid.inc
@@ -52,6 +52,11 @@ function model_prs_perslid(params)
    this.records_title = L("prs_perslid_m");
    this.autfunction = params.internal?false:"WEB_PRSSYS"; // we controleren zelf

+    if ((typeof mode != "undefined") && (params.extra_auth.length > 0))
+    {
+        this.autfunction = [this.autfunction].concat(params.extra_auth);
+    }
+
    this.fields = {
        "id": {
            "dbs": "prs_perslid_key",
@@ -130,7 +135,7 @@ function model_prs_perslid(params)
            "dbs": "prs_perslid_oslogin",
            "label": L("lcl_prs_person_login"),
            "typ": "varchar",
-            "len": 30,
+            "len": 256,
            "filter": "exact",
            "caseinsensitive": true,
            "hasupper": "prs_perslid_oslogin"
@@ -314,11 +319,13 @@ function model_prs_perslid(params)
            query.wheres.push("prs_perslid.prs_perslid_verwijder IS NULL");
            var authparamsUSE = user.checkAutorisation("WEB_PRSUSE", true);
            if (hasPRSSYS)
-			{
+            {
                /* zijn we verder klaar */
-			}
+            }
            else if (!authparamsUSE) // PAS OP: Dit verwacht AAFM-API niet!!!
+            {
                query.wheres.push("prs_perslid.prs_perslid_key = " + user_key);
+            }
            else
            {
 				// Zonder PRSSYS heb je hier niets mee te maken
--- a/APPL/API2/model_regions.inc
+++ b/APPL/API2/model_regions.inc
@@ -12,32 +12,43 @@
 */

 %>
-<!-- #include file="../Shared/discxalg3d.inc"-->
+<!-- #include file="../Shared/discxalg3d.inc" -->
 <!-- #include file="../ALG/alg.inc" -->
 <!-- #include file="./model_districts.inc" -->
+<!-- #include file="./model_alg_kenmerk.inc" -->
 <%
-model_regions =
+function model_regions(regio_key, params)
 {
-    table: "alg_regio",
-    primary: "alg_regio_key",
-    records_name: "regions",
-    record_name: "region",
-    fields: {"id":             { dbs: "alg_regio_key",            typ: "key" },
-             "name":           { dbs: "alg_regio_omschrijving",   typ: "varchar",  label: L("lcl_estate_regio_descr"), track: true},
-             "externnr":       { dbs: "alg_regio_externnr",       typ: "varchar",  label: L("extern_nr"),       readonly: !(user.has("WEB_FACTAB") || user.has("WEB_FACXNR"))},
-             "externsyncdate": { dbs: "alg_regio_externsyncdate", typ: "datetime", label: L("extern_syncdate"), readonly: !(user.has("WEB_FACTAB") || user.has("WEB_FACXNR"))},
-             "deleted":        { dbs: "alg_regio_verwijder",      typ: "datetime", label: L("lcl_deleted")}
-            },
-    includes: { "districts": { model: model_districts, joinfield: "region" }
-              },
+    this.table = "alg_regio";
+    this.primary = "alg_regio_key";
+    this.records_name = "regions";
+    this.record_name = "region";
+    this.fields = {
+        "id":             { dbs: "alg_regio_key",            typ: "key" },
+        "name":           { dbs: "alg_regio_omschrijving",   typ: "varchar",  label: L("lcl_estate_regio_descr"), track: true},
+        "externnr":       { dbs: "alg_regio_externnr",       typ: "varchar",  label: L("extern_nr"),       readonly: !(user.has("WEB_FACTAB") || user.has("WEB_FACXNR"))},
+        "externsyncdate": { dbs: "alg_regio_externsyncdate", typ: "datetime", label: L("extern_syncdate"), readonly: !(user.has("WEB_FACTAB") || user.has("WEB_FACXNR"))},
+        "deleted":        { dbs: "alg_regio_verwijder",      typ: "datetime", label: L("lcl_deleted")}
+    };
+    this.includes = {
+        "districts": {
+            model: new model_districts(this),
+            joinfield: "region" 
+        },
+        "custom_fields" : {
+            "model": new model_custom_fields(this, new model_alg_kenmerk("E", { internal: true }), { readman: true, readuse: true }),
+            "joinfield": "flexparentkey",
+            "enable_update": true
+        }
+    };

-    _check_authorization: function(params, method)
-        {
+    _check_authorization = function(params, method)
+    {
            var scope = params.filter.scope || "fe";
            var autfunction = (scope == "fe"? "WEB_ALGUSE" : "WEB_ALGMAN");
            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch

-            var onrgoedlvl = "RG";
+            var onrgoedlvl = "E";
            if (method == "GET")
            {
                if (params.filter.id)
@@ -60,14 +71,23 @@ model_regions =
                user.auth_required_or_abort(this_alg.writeman);
            }
            params.func_enabled = this_alg || {};
-        },
-    _pre_analyze_fields: function (params, jsondata) /* analyseer inkomende jsondata voor PUT en POST */
+    };
+
+    _pre_analyze_fields = function (params, jsondata) /* analyseer inkomende jsondata voor PUT en POST */
+    {
+    };
+
+    this.REST_GET = function _GET(params, jsondata)
        {
-        },
-    REST_GET: function _GET(params, jsondata)
-        {
-            model_regions._check_authorization(params, "GET");
-            var query = api2.sqlfields(params, model_regions);
+            _check_authorization(params, "GET");
+
+            var query = api2.sqlfields(params, this);
+
+            if (params.flexparams && params.flexparams.anyflex)
+            {
+                this.fields.algflex = params.flexparams.algflex;
+                query.selects.push(params.flexparams.sql);
+            }
            if (!params.filter.show_deleted)
                query.wheres.push("alg_regio_verwijder IS NULL");

@@ -82,24 +102,26 @@ model_regions =

            if (params.filter.isNew)
                query.wheres.push("alg_regio_key = -1");  // Forceer leeg record.
+            if (params.filter.kenmerk_sql)
+                query.wheres.push(params.filter.kenmerk_sql);

-            var wheres = api2.sqlfilter(params, model_regions);
+            var wheres = api2.sqlfilter(params, this);
            query.wheres = query.wheres.concat(wheres);

            var sql = "SELECT " + query.selects.join(", ")
                    + "  FROM " + query.tables.join(", ")
                    + (query.wheres.length ? " WHERE " + query.wheres.join(" AND " ) : "")
                    + " ORDER BY alg_regio_key, alg_regio_omschrijving";
-            var json = api2.sql2json (params, sql, model_regions);
-
+            var json = api2.sql2json (params, sql, this);
            return json;
-        },
-    REST_PUT: function (params, jsondata, the_key) /* update region */
+        };
+
+    this.REST_PUT = function (params, jsondata, the_key) /* update region */
        {
-            model_regions._check_authorization(params, "PUT");
+            _check_authorization(params, "PUT");
            if (!jsondata.id) jsondata.id = the_key;
            var reg_key = the_key;
-            var dbfields = api2.update_fields(params, model_regions, jsondata); // Build updater
+            var dbfields = api2.update_fields(params, this, jsondata); // Build updater
            var wheres = [" alg_regio_key = " + reg_key];
            var regUpd = buildTrackingUpdate("alg_regio", wheres.join(" AND " ), dbfields, { noValidateToken: true });

@@ -114,13 +136,14 @@ model_regions =
            }

            return { key: reg_key, warning: warning };
-        },
-    REST_POST: function (params, jsondata) /* new region */
+        };
+
+    this.REST_POST = function (params, jsondata) /* new region */
        {
            params.isNew = true;
-            model_regions._check_authorization(params, "POST");
+            _check_authorization(params, "POST");

-            var dbfields = api2.update_fields(params, model_regions, jsondata); // Build updater
+            var dbfields = api2.update_fields(params, this, jsondata); // Build updater
            dbfields["id"] = {dbs: "alg_regio_key", typ: "key", seq: "alg_s_alg_regio_key" };
            var regIns = buildInsert("alg_regio", dbfields, { noValidateToken: true });
            var reg_key = regIns.sequences["alg_regio_key"];
@@ -131,10 +154,11 @@ model_regions =
                warning = err.friendlyMsg;

            return { key: reg_key, warning: warning };
-        },
-    REST_DELETE: function (params, the_key) /* delete region */
+        };
+
+    this.REST_DELETE = function (params, the_key) /* delete region */
        {
-            model_regions._check_authorization(params, "DELETE");
+            _check_authorization(params, "DELETE");
            var regio_key = params.filter.id;
            var sql = "UPDATE alg_regio"
                    + "   SET alg_regio_verwijder = SYSDATE"
@@ -145,6 +169,6 @@ model_regions =
                params.warning = err.friendlyMsg;

            return { key: regio_key, warning: warning };
-        }
+        };
 }
 %>
--- a/APPL/API2/model_reportcolumns.inc
+++ b/APPL/API2/model_reportcolumns.inc
@@ -359,6 +359,11 @@ function model_reportcolumns(usrrap_key, params)
            return { key: col_key, warning: "" };
        }

+    if (params.internal || hasFACTAB || hasUDRMAN)
+    {
+        this.REST_POST = this._REST_POST;
+    }
+
    if (rap_key > 0)
    {
        // var rap_data = model_reportsx(rap_key); te veel recursie
@@ -368,13 +373,10 @@ function model_reportcolumns(usrrap_key, params)
        var oRs = Oracle.Execute(sql);
        var functie = oRs("fac_usrrap_functie").Value || 0;
        oRs.Close();
-        if (functie & 32) // template
+        if (functie & 32) { // template
            this.REST_PUT = false;
-    }
-
-    if (params.internal || hasFACTAB || hasUDRMAN)
-    {
-        this.REST_POST = this._REST_POST;
+            this.REST_POST = false;
+        }
    }
 }

--- a/APPL/API2/model_reports.inc
+++ b/APPL/API2/model_reports.inc
@@ -294,8 +294,7 @@ function model_reports(fac_usrrap_key)
        oRs.Close();
    }

-    var url_column = [];
-    var url_groupby = [];
+    var url_column, url_groupby;
    for (var i = 0; i < usrrap.columns.length; i++)
    {
        var label = safe.html(usrrap.columns[i].caption); // (lcl) Labels worden altijd geacht html-safe te zijn
@@ -338,9 +337,8 @@ function model_reports(fac_usrrap_key)
                    };
        // Voor gewone rapporten zijn expressies via tablesql opgelost
        // Styled rapporten gaan echter via xml.make_xml2 welke tablesql niet gebruikt
-        if (model.styling && (model.styling & 1))
-        {
-            field.sql = usrrap.columns[i].expression;
+        if (model.styling && (model.styling & 1) && usrrap.columns[i].expression) {
+            field.sql = usrrap.columns[i].expression.format(usrrap.viewname);
        }

        if (usrrap.columns[i].urllink)
@@ -419,8 +417,8 @@ function model_reports(fac_usrrap_key)
        { // V=Zichtbaar, S=Zichtbaar, verberg herhalingen, U=Klik-actie, "C"=Visible combine, "I"=onzichtbaar, "H"=verborgen
          if (usrrap.columns[i].visible.id == "U") // kolom wordt als url gebruikt.
          { // Als de kolom als url-key kolom wordt gebruikt dan deze als laatste kolom toevoegen zodat deze nooit als x-as genomen kan worden.
-            url_column.push(fld);
-            url_groupby.push(field.group.id);
+            url_column = fld;
+            url_groupby = field.group.id;
          }
          else
          {
@@ -448,11 +446,10 @@ function model_reports(fac_usrrap_key)
    }

    // De url-key kolom altijd als laatste kolom toevoegen zodat deze geen invloed heeft op de orderby en nooit als x-as genomen kan worden.
-    if (url_column.length)
-    { // Er kan maar 1 kolom als url-key kolom optreden. We pakken de eerste.
-      model.list.columns.push(url_column[0]);
-      model.list.groupby.push(url_groupby[0]);
-      keyfield = url_column[0];
+    if (url_column) {
+        model.list.columns.push(url_column);
+        model.list.groupby.push(url_groupby);
+        keyfield = url_column;
    }

    return model;
@@ -668,7 +665,7 @@ function report_GET(params)
            }
            else
            {
-              if  (params.groupby[0] != "U" && this.fields[fld].dbs.match(/^hide_f/)) // Doorgaans meenemen om te sorteren
+              if (params.groupby[0] != "U" && this.fields[fld].dbs.match(/^hide_f/)) // Doorgaans meenemen om te sorteren
              {
                this.fields[fld].hidden = false;
                params.columns.splice(0, 0, fld);
@@ -677,6 +674,9 @@ function report_GET(params)
              else
              {
                this.fields[fld].hidden = true; // Onnodige velden niet ophalen
+                if (this.fields[fld].visible != "H") { // Hidden velden mogen meedingen in de volgorde, uitgevinkte velden niet
+                    this.fields[fld].exclForOrder = true;
+                }
              }
            }
          }
@@ -830,104 +830,137 @@ function report_GET(params)
    var autosorting = true; // uitsluitend autosorting?
    for (var fld in this.fields)
    {
-      var field = this.fields[fld]
+      var field = this.fields[fld];

-      // Als er een kolom niet in de select aanwezig is (die we willen/gaan zien) dan deze kolom niet meenemen in de sortering.
-      var inselect = false;
-      for (var i = 0; i < params.columns.length; i++)
-      {
-        if (params.columns[i] === fld)
-          inselect = true;
-      }
-
-      if (inselect && field.sorting) // is er niet voor scf_count/scf_ratio
+      if (field.sorting) // is er niet voor scf_count/scf_ratio
        autosorting = autosorting && (field.sorting.id == 3)
    }

-    if (autosorting)
-    {
-        for (var i=0; i < query.selects.length; i++)
-        {
-            var colname = query.selects[i].split(".").pop().toUpperCase(); // achterste stuk
-            if (!isclob[colname])
-                order.push(i+1);
+    // Probeer deze (potentieel) afgeleide expressie terug te herleiden tot de eigenlijke kolomnaam
+    function _unpackFieldName(fld) {
+        var unpackedFld = fld;
+        if (fld.indexOf("TO_CHAR(") > -1) {
+            unpackedFld = fld.replace("TO_CHAR(", "").split(",")[0];
+        } else if (fld.indexOf("TRUNC(") > -1) {
+            unpackedFld = fld.replace("TRUNC(", "").split(",")[0];
+        } else if (fld.indexOf("DISTINCT(") > -1) {
+            unpackedFld = fld.replace("DISTINCT(", "").split(")")[0];
+        } else if (fld.indexOf("SUM(") > -1) {
+            unpackedFld = fld.replace("SUM(", "").split(")")[0];
+        } else if (fld.indexOf("COUNT(") > -1) {
+            unpackedFld = fld.replace("COUNT(", "").split(")")[0];
+        } else if (fld.indexOf("AVG(") > -1) {
+            unpackedFld = fld.replace("AVG(", "").split(")")[0];
+        }
+        return unpackedFld;
+    }
+
+    function _orderPushFieldDB(fieldsIndex) {
+        var fld = thisFields[fieldsIndex].fld;
+        if (!params.filter.distinct || params.filter.distinct && fld == params.filter.distinct) {
+            var field = this.fields[fld];
+            if (field.sorting && !isclob[field.dbs.toUpperCase()])
+            {
+                // Sortering op x-as of y-as gebeurt nu verder op.
+                // TODO: case 1 en 2 kunnen nu samen genomen worden.
+                switch (field.sorting.id)
+                {
+                    case 1:
+                        order.push(field.dbs);
+                        break;
+                    case 2:
+                        order.push(field.dbs + " DESC");
+                        break;
+                    case 3: // Als er geen specifieke sortering voor een filter is gegeven moet dit veld wel in de order_by staan
+                        if (params.filter.distinct || autosorting)
+                            order.push(field.dbs);
+                        break;
+                }
+            }
+            else
+            {
+                if (params.filter.distinct || autosorting)
+                    order.push(field.dbs);
+            }
+
+            // Voeg dit veld nu ook toe aan de GROUP BY als het er nog niet in zit.
+            var found = false;
+            // strip DESC and ASC from orderby-fieldname
+            var fieldstr;
+            if (fld === "id") { // = Keyfield
+                fieldstr = field.dbs;
+            } else {
+                fieldstr = fld.split(" ")[0];
+            }
+            if (!inArray((params.groupby[fieldsIndex] || "G"), ["S", "C", "A"])) { // Geen aggregate functie
+                for (var j = 0; j < groupbys.length && !found; j++) {
+                    // remove a TO_CHAR expression to enable field - field comparison, preventing double group-by fields
+                    found = fieldstr == _unpackFieldName(groupbys[j]);
+                }
+                if (!found) { // De orderby waarde bestaat niet in de groupby array. Voeg de orderby waarde dan toe aan de groupby.
+                    groupbys.push(fieldstr);
+                }
+            }
        }
    }
-    else
-    {
-        for (var fld in this.fields)
-        {
-            // Alleen de aangevinkte kolommen, die zijn meegegeven in de link (params.columns), aan de ORDER BY (order) toevoegen.
-            var found = false;
-            for (var j = 0; j < params.columns.length; j++)
-            {
-              found = found || (params.columns[j] == fld);
-            }

-            if (found && (!params.filter.distinct || (params.filter.distinct && (fld == params.filter.distinct))))
-            {
-                var field = this.fields[fld];
-                if (field.sorting && !isclob[field.dbs.toUpperCase()])
-                {
-                    // Sortering op x-as of y-as gebeurt nu verder op.
-                    // TODO: case 1 en 2 kunnen nu samen genomen worden.
-                    switch (field.sorting.id)
-                    {
-                        case 1:
-                            order.push(field.dbs);
-                            break;
-                        case 2:
-                            order.push(field.dbs + " DESC");
-                            break;
-                        case 3: // Als er geen specifieke sortering voor een filter is gegeven moet dit veld wel in de order_by staan
-                            if (params.filter.distinct)
-                                order.push(field.dbs);
-                            break;
-                    }
-                }
-                else
-                {
-                    if (params.filter.distinct)
-                        order.push(field.dbs);
-                }
+    // Alle(en) de zichtbare kolommen moeten meedingen in de sortering vd query, evenzo de ^hide_f, en keyfield-kolommen
+    var thisFields = []; // Arrays kennen een volgorde, objecten niet ..
+    for (var fld in this.fields) {
+        if (
+                this.fields[fld].exclForOrder                                   // Ik ben uitgevinkt
+            || (inArray(this.fields[fld].visible, ["I", "H"]) &&                // Ik ben een hidden veld
+                this.fields[fld].sorting.id == 3)                               // en er wordt niet expliciet op mij gesorteerd (op-/aflopend)
+            || (this.fields[fld].sql &&                                         // Ik ben een berekend veld,
+                this.fields[fld].dbs != _unpackFieldName(this.fields[fld].sql)) // maar ik weet niet van welk originele veld ik afgeleid ben
+        ) {
+            continue; // Skip
+        }
+        thisFields.push(this.fields[fld]);
+        thisFields[thisFields.length - 1].fld = fld;
+        for (var x = 0; x < params.columns.length; x++) {
+            if (fld === params.columns[x]) {
+                thisFields[thisFields.length - 1].inColumns = true;
+                break;
            }
        }
+    }

-        // De parameters van orderby moeten ook in de groupby zitten. Ander krijg je de foutmelding "Geen GROUP BY-uitdrukking."
-        for (var i = 0; i < order.length; i++)
-        {
-          var found = false;
-          // strip DESC and ASC from orderby-fieldname
-          var orderstr = order[i].split(" ")[0];
-          for (var j = 0; j < groupbys.length; j++)
-          {
-            // remove a TO_CHAR expression to enable field - field comparison, preventing double group-by fields
-            var groupbystr = groupbys[j];
-            if (groupbys[j].indexOf("TO_CHAR(") > -1)
-              groupbystr = groupbys[j].replace("TO_CHAR(", "").split(",")[0];
-            else if (groupbys[j].indexOf("TRUNC(") > -1)
-              groupbystr = groupbys[j].replace("TRUNC(", "").split(",")[0];
-            else if (groupbys[j].indexOf("DISTINCT(") > -1)
-              groupbystr = groupbys[j].replace("DISTINCT(", "").split(")")[0];
-            else if (groupbys[j].indexOf("SUM(") > -1)
-              groupbystr = groupbys[j].replace("SUM(", "").split(")")[0];
-            else if (groupbys[j].indexOf("COUNT(") > -1)
-              groupbystr = groupbys[j].replace("COUNT(", "").split(")")[0];
-            else if (groupbys[j].indexOf("AVG(") > -1)
-              groupbystr = groupbys[j].replace("AVG(", "").split(")")[0];
-            found = found || (orderstr == groupbystr);
-          }
-          if (!found)
-          { // De orderby waarde bestaat niet in de groupby array. Voeg de orderby waarde dan toe aan de groupby.
-            groupbys.push(orderstr)
-          }
+    // Sortering mede mogelijk gemaakt door ChatGPT; behoudt de positie van evt. onzichtbare kolommen,
+    // maar pas de positie (voor de sortering) van de zichtbare kolommen aan naar de werkelijke volgorde
+    var columnsArray = [];
+    var positions = [];
+    for (var i = 0; i < thisFields.length; i++) {
+        if (thisFields[i].inColumns) {
+            columnsArray.push(thisFields[i]);
+            positions.push(i); // Onthoud de originele posities
        }
    }

+    columnsArray.sort(function(a, b) {
+        var indexA = sharedIndexOf(a.fld, params.columns);
+        var indexB = sharedIndexOf(b.fld, params.columns);
+
+        // Als indexA of indexB niet in params.columns zit, behandel dat als -1
+        if (indexA === -1) indexA = params.columns.length;
+        if (indexB === -1) indexB = params.columns.length;
+
+        return indexA - indexB;
+    });
+
+    // Zet de gesorteerde objecten terug op hun originele posities
+    for (var i = 0; i < positions.length; i++) {
+        thisFields[positions[i]] = columnsArray[i];
+    }
+
+    for (var x = 0; x < thisFields.length; x++) {
+        _orderPushFieldDB.call(this, x);
+    }
+
    if (groupbys.length && hasAggregate)
        sql += " GROUP BY " + groupbys.join(", ");
    if (order.length)
-      sql += " ORDER BY " + order.join(", ");
+        sql += " ORDER BY " + order.join(", ");
    if (params.filter.limit > 0)
        maxcnt = parseInt(params.filter.limit, 10);
    else
--- a/APPL/API2/model_reportsx.inc
+++ b/APPL/API2/model_reportsx.inc
@@ -255,6 +255,12 @@ function model_reportsx(usrrap_key, rapparams)
                                        typ: "varchar",
                                        label: L("lcl_usrrap_parameters"),
                                        multiedit: true
+                                     },
+                    "created"       : { "dbs": "fac_usrrap_aanmaak",
+                                        "label": L("lcl_usrrap_aanmaak"),
+                                        "typ": "datetime",
+                                        "clone": false,
+                                        "readonly": true
                                     }
                  };

@@ -299,7 +305,8 @@ function model_reportsx(usrrap_key, rapparams)
            "model": new model_fac_notificatie_job({ niveau: "S"}),
            "joinfield": "fac_usrrap_key",
            "enable_update": true,
-            "label": L("lcl_schedule_frm_report")
+            "label": L("lcl_schedule_frm_report"),
+            "notransport": true // te ingewikkeld, ook geen cloning
        }
    };

--- a/APPL/API2/model_res_activiteit_discipline.inc
+++ b/APPL/API2/model_res_activiteit_discipline.inc
@@ -67,7 +67,7 @@ function model_res_activiteit_discipline()
    };
    this.list = {
        "columns": [
-            "id",
+  //          "id",
            "bookingdiscipline",
            "bookingactivity"
        ]
--- a/APPL/API2/model_res_discipline.inc
+++ b/APPL/API2/model_res_discipline.inc
@@ -24,11 +24,6 @@ function model_res_discipline(disc_key, params)
    // E<>n model voor de buitenwereld
    api2.merge_disc_params_model(this, _model_res_discipline);

-    this.hook_pre_edit = function (obj, fld, params)
-    {
-        fld.costtype.foreign = mgt.pre_edit_kostensoort(obj);
-    }
-
    this.hook_post_post = function (params, obj, key)
    {
        var org_disc_key = getQParamInt("id", -1);
@@ -112,7 +107,6 @@ _model_res_discipline = // Internal only
            "label": L("prs_kostensoort_key"),
            "typ": "key",
            "foreign": "prs_kostensoort",
-            "LOVinit": "",
            "multiedit": true,
            "showtransit": true
        },
--- a/APPL/API2/model_res_kenmerk.inc
+++ b/APPL/API2/model_res_kenmerk.inc
@@ -44,12 +44,16 @@ function model_res_kenmerk(niveau, params)
            "foreign": {
                "tbl": "(SELECT res_srtkenmerk_key"
                     + "      , res_srtkenmerk_omschrijving"
+                     + (mode != "list"
+                       ? " || ' (' || res_srtkenmerk_kenmerktype || ')'"
+                       : "")
+                     + " oms"
                     + "      , res_srtkenmerk_kenmerktype"
                     + "   FROM res_srtkenmerk"
                     + "  WHERE res_srtkenmerk_verwijder is null"
                     + "  ORDER BY res_srtkenmerk_omschrijving ASC)",
                "key": "res_srtkenmerk_key",
-                "desc": "res_srtkenmerk_omschrijving",
+                "desc": "oms",
                "extravalue": "res_srtkenmerk_kenmerktype"
            },
            "LOVinit": "",
@@ -76,8 +80,17 @@ function model_res_kenmerk(niveau, params)
            "dbs": "res_kenmerk_volgnummer",
            "label": L("res_kenmerk_volgnummer"),
            "typ": "number",
+            "len": 3,
            "required": true
        },
+        "rolecode": { 
+            "dbs": "res_kenmerk_rolcode",
+            "label": L("mgt_kenmerk_rolcode"),
+            "typ": "number",
+            "LOV": buildKenmerkRoleCodeLOV({ module: "RES" }),
+            "required": true,
+            "multiedit": true
+        },
        "bookingactivity": {
            "dbs": "res_activiteit_key",
            "label": L("res_activiteit_key"),
@@ -129,6 +142,7 @@ function model_res_kenmerk(niveau, params)
            "label": L("res_kenmerk_verplicht"),
            "typ": "key",
            "LOV": buildVerplichtingList(),
+            "emptyisrealvalue": true,
            "emptyoption": null,
            "multiedit": true
        },
@@ -177,9 +191,9 @@ function model_res_kenmerk(niveau, params)
        },
        "code": {
            "dbs": "res_kenmerk_code",
-            "label": L("lcl_res_code"),
+            "label": L("mgt_kenmerk_code"),
            "typ": "varchar",
-            "readonly": !user.has("WEB_FACTAB")
+            "readonly": !user.has("WEB_PRSSYS")
        },
        "authorization": {
            "dbs": "fac_functie_key",
@@ -287,14 +301,6 @@ function model_res_kenmerk(niveau, params)
        return result;
    }

-    function buildVerplichtingList()
-    {   // LOV waarden voor required.
-        var s = ";"   + L("res_kenmerk_verplicht_0")
-              + ";1;" + L("res_kenmerk_verplicht_1")
-              + ";2;" + L("res_kenmerk_verplicht_2");
-        return s;
-    }
-
    function buildLevelList()
    {   // LOV waarden voor required.
        var s = "A;" + L("res_activiteit_key")
@@ -303,16 +309,6 @@ function model_res_kenmerk(niveau, params)
        return s;
    }

-    function buildGroepsverplichtingList()
-    {   // LOV waarden voor group.
-        var s = "0;" + "<" + L("lcl_none") + ">";
-        for (var i=1; i<=9; i++)
-        {
-            s = s + ";" + i + ";" + L("res_kenmerk_groep") + " " + i;
-        }
-        return s;
-    }
-

    this.REST_GET    = generic_REST_GET(this, gparams);
    this.REST_POST   = generic_REST_POST(this);
--- a/APPL/API2/model_res_ruimte.inc
+++ b/APPL/API2/model_res_ruimte.inc
@@ -28,6 +28,8 @@ function model_res_ruimte()
    this.record_title = L("res_ruimte");
    this.records_title = L("res_ruimte_m");

+    var hasRESMGT = user.has("WEB_RESMGT");
+
    this.fields = {
        "id": {
            "dbs": "res_ruimte_key",
@@ -276,7 +278,8 @@ function model_res_ruimte()
        "externalid": {
            "dbs": "res_ruimte_extern_id",
            "label": L("res_ruimte_extern_id"),
-            "typ": "varchar"
+            "typ": "varchar",
+            "readonly": !hasRESMGT
        },
        "externalsyncdate": {
            "dbs": "res_ruimte_externsyncdate",
@@ -305,6 +308,7 @@ function model_res_ruimte()
            "label": L("res_ruimte_microsoft_teams"),
            "typ": "number",
            "LOV": L("res_ruimte_microsoft_teamsLOV"),
+            "readonly": !hasRESMGT,
            "required": true,
            "defaultvalue": 0,
            "multiedit": true
@@ -317,16 +321,15 @@ function model_res_ruimte()
            "defaultvalue": 0,
            "hidden_fld": !user.has("WEB_FACTAB"),
            "multiedit": true
+        },
+        "maxhorizon": {
+            "dbs": "res_ruimte_limiet",
+            "label": L("res_ruimte_limiet"),
+            "typ": "number",
+            "multiedit": true
        }
    };

-    // veld "res_ruimte_extern_id" alleen te wijzigen met PRSSYS rechten.
-    var authparams = user.checkAutorisation("WEB_PRSSYS", true);
-    if (!authparams) {
-        this.fields.externalid.readonly = true;
-        this.fields.onlineMeetingProviders.readonly = true;
-    }
-
    this.includes = {
        "physicalrooms": {
            "model": new model_res_alg_ruimte(),
--- a/APPL/API2/model_res_srtkenmerk.inc
+++ b/APPL/API2/model_res_srtkenmerk.inc
@@ -119,8 +119,8 @@ function model_res_srtkenmerk(params)
        "code": {
            "dbs": "res_srtkenmerk_code",
            "typ": "varchar",
-            "label": L("lcl_res_code"),
-            "readonly": !user.has("WEB_FACTAB")
+            "label": L("mgt_srtkenmerk_code"),
+            "readonly": !user.has("WEB_PRSSYS")
        }
    };

--- a/APPL/API2/model_reservationequipment.inc
+++ b/APPL/API2/model_reservationequipment.inc
@@ -176,7 +176,7 @@ model_reservationequipment =
            }
            var sql = "BEGIN "
                    + resIns.sql + ";"
-                    + "  res.set_delen_dirty (" + rsv_deel_key + "); "
+                    + "  res.set_delen_dirty (" + rsv_ruimte_key + "); "
                    + check_fail_sql
                    + "END;";
            var err = Oracle.Execute(sql, true);
--- a/APPL/API2/model_rooms.inc
+++ b/APPL/API2/model_rooms.inc
@@ -98,9 +98,8 @@ function model_rooms(room_key, params)
    function _check_authorization (params, method)
        {
            params.message = "";
-            var autfunction = (params.filter.scope == "fe"? "WEB_ALGUSE" : "WEB_ALGMAN");
+            var autfunction = ["WEB_RUIUSE", "WEB_RUIMAN"];
            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch
-
            switch (method)
            {
                case "GET":
--- a/APPL/AUT/Login.inc
+++ b/APPL/AUT/Login.inc
@@ -103,7 +103,7 @@ function doLogin(prs_key, params)
               + "     fac_session_expire,"
               + "     fac_session_useragent,"
               + "     fac_session_ip)"
-               + " VALUES(fac.makehash(" + safe.quoted_sql(Session("FACSESSIONID")) + "), "
+               + " VALUES(" + safe.quoted_sql(shared.makehash(Session("FACSESSIONID"))) + ", "
               +        user_key + ","
               + "      SYSDATE+1, " // 24 uur is genoeg
               +        safe.quoted_sql(agent, 256) + ","
@@ -117,7 +117,8 @@ function doLogin(prs_key, params)
    }
    var registersql = "UPDATE prs_perslid"
                    + "   SET prs_perslid_login = SYSDATE"
-                    + " WHERE prs_perslid_key=" + user_key;
+                    + " WHERE prs_perslid_key=" + user_key
+                    + "   AND (prs_perslid_login IS NULL OR prs_perslid_login < SYSDATE - 1/24/60)"; // Eens per minuut bijwerken is genoeg
    Oracle.Execute(registersql);

    Session("user_key") = user_key; // Nu ben je pas *echt* ingelogd
@@ -239,10 +240,11 @@ function setUserFromSession (p_session)
 {
    // TODO: Hier wil ik ooit de user_key eigenlijk ook hebben uit
    //       een cookie zodat deze query efficienter wordt.
-    var sql = "SELECT prs_perslid_key, fac_session_data "
+    var sql = "SELECT fac_session_key, prs_perslid_key, fac_session_data "
            + "  FROM fac_session "
            + " WHERE fac_session_expire > sysdate "
-            + "   AND fac_session_sessionid_hash = fac.makehash(" + safe.quoted_sql(p_session) + ")";
+            + "   AND fac_session_sessionid_hash IN ({0}, {1})".format(safe.quoted_sql(shared.makehashMD5(p_session)),  // 30 dagen na de release mag de makehashMD5 weg
+                                                                       safe.quoted_sql(shared.makehash(p_session)));
    var oRs = Oracle.Execute( sql );
    if (!oRs.eof)
    {
@@ -251,8 +253,7 @@ function setUserFromSession (p_session)

       // verwijder de huidige sessie
       sql = "DELETE fac_session"
-           + " WHERE prs_perslid_key = " + user_key // index-performance
-           + "   AND fac_session_sessionid_hash = fac.makehash(" + safe.quoted_sql(p_session) + ")";
+           + " WHERE fac_session_key = " + oRs("fac_session_key").Value;
       Oracle.Execute(sql);
       // makeSessionCookie(sessionData); aanroeper bepaalt maar of er een nieuwe sessie komt
    }
@@ -275,7 +276,7 @@ function makeSessionCookie (sessionData)
       + "   fac_session_useragent,"
       + "   fac_session_ip) "
       + " VALUES ( "
-       +     "fac.makehash(" + safe.quoted_sql(sessionId) + "), "
+       +     safe.quoted_sql(shared.makehash(sessionId)) + ", "
       +     user_key + ", "
       +     safe.quoted_sql(sessionData) + ", "
       + "   sysdate + " + S("login_remember_days") + ", " // sessie timeout op 30 dagen.
@@ -305,7 +306,7 @@ function deleteSessionCookie (cookiename)
    {
        var sql = "DELETE fac_session"
                + " WHERE prs_perslid_key = " + user_key // index-performance
-                + "   AND fac_session_sessionid_hash = fac.makehash(" + safe.quoted_sql(session) + ")";
+                + "   AND fac_session_sessionid_hash = " + safe.quoted_sql(shared.makehash(session));
        Oracle.Execute(sql);
    }

@@ -449,17 +450,7 @@ function testpassword(prs_key, wachtwoord, params)
    var arr = passhash.split("$");
    if (arr.length == 1) // Old style
    {
-        var sql = "SELECT 1"
-                + "  FROM prs_perslid"
-                + " WHERE prs.testpassword(prs_perslid_key, " + safe.quoted_sql(wachtwoord) + ") = 1"
-                + "   AND prs_perslid_key = " + prs_key
-        var oRs = Oracle.Execute(sql);
-        var found = !oRs.Eof;
-        oRs.Close();
-        if (!found)
-            return false;
-        // else iets verderop upgraden!
-        var workfactor = 0;
+        return false; // die is altijd ongeldig en kan alleen via 'wachtwoord vergeten' aangepast worden
    }
    else // new style
    {
@@ -526,7 +517,7 @@ function setpassword(prs_key, wachtwoord, expired, upgrade)
                + "   SET prs_perslid_wachtwoord_exp = " + newexpire
                + "     , prs_perslid_salt = " + safe.quoted_sql(passsalt)
                + "     , prs_perslid_wachtwoord_hash = " + safe.quoted_sql('1${0}${1}'.format(workfactor, new_hash))
-                + "     , prs_perslid_credentials_datum = SYSDATE" // doet 2023.3 trigger niet goed als S("login_use_email") == 1
+                + "     , prs_perslid_credentials_datum = SYSDATE"
                + " WHERE prs_perslid_key = " + prs_key;
        Oracle.Execute(sql);
    }
@@ -793,15 +784,9 @@ function getIdentity(username, wachtwoord, params)

    var logins = [];
    logins.push(" prs_perslid_apikey = " + safe.quoted_sql(username, 128)); // Die mag altijd wel
-    if (S("login_use_email"))
-    {
-        logins.push(" upper(prs_perslid_email) = " + safe.quoted_sql_upper(username));
-    }
-    else
-    {
-        logins.push(" prs_perslid_oslogin = " + safe.quoted_sql_upper(username, 30));
-        logins.push(" prs_perslid_oslogin2 = " + safe.quoted_sql_upper(username, 30));
-    }
+    logins.push(" upper(prs_perslid_email) = " + safe.quoted_sql_upper(username));
+    logins.push(" prs_perslid_oslogin = " + safe.quoted_sql_upper(username, 256));
+    logins.push(" prs_perslid_oslogin2 = " + safe.quoted_sql_upper(username, 256));

    var block_flags = 4+8; // Niet grouped of blocked, 2==unconfirmed staan we nog heel even toe
    if (!params.stateless)
@@ -1250,6 +1235,7 @@ function jwt_warn(claim, subject)
        var body = JSON.stringify(claim.payload, null, 4);
        __DoLog(subject, "#FF0080")
        __DoLog(body);
+        __DoLog("Bovenstaande wordt per e-mail gestuurd naar iedereen met WEB_PRSSYS");
        // Naar iedereen met PRSSYS
        var sql = "BEGIN fac.putsystemnotification({0}, 3); END;".format(safe.quoted_sql(subject + "<br><pre>" + body + "</pre>")); // 3=portal+email
        Oracle.Execute(sql);
@@ -1390,11 +1376,9 @@ function process_claim(claim, idp_data, params)
        switch (idpm.name.id) // zie model_aut_idp_map.inc voor codering
        {
            case 1: // login
-                settings.overrule_setting("login_use_email", 0);
                tryLogin(claim[idpm.from], null, { noPassword: true, idp_code: idp_data.code, stateless: params.by_bearer, isFACFACinternal: isFACFACinternal });
                break;
            case 9: // email
-                settings.overrule_setting("login_use_email", 1);
                tryLogin(claim[idpm.from], null, { noPassword: true, idp_code: idp_data.code, stateless: params.by_bearer, isFACFACinternal: isFACFACinternal });
                break;
           case 12: // externalid, geen break
@@ -1544,7 +1528,9 @@ function process_claim_update(claim, idp_data, params)
        var idpm = idp_data.idpmappings[i];
        var val = idpm["default"];
        if (idpm.from in claim)
+        {
            val = claim[idpm.from];
+        }

        switch (idpm.name.id) // zie model_aut_idp_map.inc voor codering
        {
@@ -1561,12 +1547,28 @@ function process_claim_update(claim, idp_data, params)
            case 11: persdata["mobile"]        = val; break;
            case 12: // externalid, geen break
            case 13: persdata["externalid"]    = val; break;
+            case 14: persdata["employeenumber"]= val; break;
            // de foreigns
-            case 20: if (val)
-                        persdata["function"]   = { name: val }; break; // Kan omdat fields.function.desc_is_unique is gezet
+            case 20: if (val) // functie (=srtperslid)
+            {   // Bestaat de functie
+                var sql = "SELECT prs_srtperslid_omschrijving"
+                        + "  FROM prs_srtperslid"
+                        + " WHERE prs_srtperslid_verwijder IS NULL"
+                        + "   AND prs_srtperslid_upper = " + safe.quoted_sql_upper(val);
+                var oRs = Oracle.Execute(sql);
+                if (oRs.eof)
+                {   // Niet gevonden dus toevoegen
+                    var sql_ins = "INSERT INTO prs_srtperslid"
+                                + " (prs_srtperslid_omschrijving)"
+                                + " VALUES (" + safe.quoted_sql(val) + ")";
+                    Oracle.Execute(sql_ins);
+                }
+                oRs.Close();
+                persdata["function"] = { name: val };
+                break; // Kan omdat fields.function.foreign.desc_is_unique is gezet
+            }
            case 21: if (val) // afdeling
-            {
-                // Zoek afdeling
+            {   // Zoek afdeling
                var sql = "SELECT prs_afdeling_key"
                        + "  FROM prs_v_afdeling"
                        + " WHERE prs_afdeling_verwijder IS NULL"
@@ -1581,16 +1583,48 @@ function process_claim_update(claim, idp_data, params)
                        sql += " AND prs_bedrijf_key = " + idp_data.company.id;
                }
                var oRs = Oracle.Execute(sql);
-                if (oRs.Eof)
-                {
-                    __Log("Claimed department {0} not found".format(val));
-                    // Er komt eventueel wel een fallback naar idp_data.department.id
+                if (oRs.eof)
+                {   // Niet gevonden dus toevoegen
+                    // department of company moet bekend zijn (uit idp_data)
+                    var afd_fld = "";
+                    var afd_val = "";
+                    if (idp_data.department && idp_data.department.id)
+                    {
+                        afd_fld += ", prs_afdeling_parentkey";
+                        afd_val += ", " + idp_data.department.id;
+                    }
+                    else if (idp_data.company && idp_data.company.id)
+                    {
+                        afd_fld += ", prs_bedrijf_key";
+                        afd_val += ", " + idp_data.company.id;
+                    }
+
+                    if (afd_fld != "")
+                    {
+                        var sql = "SELECT prs_s_prs_afdeling_key.nextval FROM DUAL";
+                        var oRs_seq = Oracle.Execute(sql);
+                        var afd_key = oRs_seq(0).Value;
+                        oRs_seq.Close();
+                        var sql_ins = "INSERT INTO prs_afdeling"
+                                    + "( prs_afdeling_key, prs_afdeling_naam" + afd_fld + ")"
+                                    + "VALUES"
+                                    + "( " + afd_key
+                                    + ", " + safe.quoted_sql(val)
+                                           + afd_val
+                                    + ")";
+                        Oracle.Execute(sql_ins);
+                        persdata["department"] = afd_key;
+                    }
+                    else
+                    {   // Geen bedrijf en parent-afdeling bekend
+                        __Log("Claimed department {0} not inserted: no company and parent department".format(val));
+                    }
                }
                else
-                {
+                {   // Bestaande afdeling
                    var afd_key = oRs("prs_afdeling_key").Value;
                    oRs.MoveNext();
-                    if (!oRs.Eof)
+                    if (!oRs.eof)
                        shared.internal_error("Claimed department {0} not unique".format(val));

                    persdata["department"] = afd_key;
--- a/APPL/AUT/SAML/default.asp
+++ b/APPL/AUT/SAML/default.asp
@@ -47,8 +47,8 @@ else
    // Als je dit punt bereikt ben je al geauthenticeerd door SAML
    var issuer = String(Request.ServerVariables("HTTP_SHIBIDENTITYPROVIDER"));
 if (DEBUGMODE)
-{
-    issuer = "https://sts.aareon.com/adfs/services/trust";
+{   // zie tabel aut_idp, veld aut_idp_issuer!
+    issuer = "https://sts.windows.net/eecdf8ce-039d-4c8a-8";
 }

    __Log("Detected SAML identity provider (entityId): " + issuer);
@@ -93,9 +93,13 @@ if (DEBUGMODE)
        "jti": "#j.grootlipman3@facilitorxxxx.nl#1609773359696",
        "aud": "logc.facilitor.nl",
        "iss": "PROVTEST",
-        "HTTP_MAIL": "j.grootlipman3@facilitorxxxx.nl",
-        "voornaam": "Jos",
-        "afdeling": "Onbekend",
+        "HTTP_FCLTEMAIL": "naam_a.mail@facilitorxxxx.nl",
+        "HTTP_FCLTNAME": "_FACILITOR", // Login
+        "HTTP_FCLTSURNAME": "Facilitor",
+        "HTTP_FCLTGIVENNAME": "voornaam_a",
+        "HTTP_FCLTDEPARTMENT": "afdeling_a",
+        "HTTP_FCLTJOBTITLE": "functie_a",
+        "HTTP_PERSOONNR": "1234567",
        "ver": "1.0"
    }
 }
--- a/Show More
+++ b/Show More