@stamhoofd/backend 2.127.0 → 2.128.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.127.0",
+    "version": "2.128.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -57,20 +57,20 @@
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.127.0",
-        "@stamhoofd/backend-i18n": "2.127.0",
-        "@stamhoofd/backend-middleware": "2.127.0",
-        "@stamhoofd/crons": "2.127.0",
-        "@stamhoofd/email": "2.127.0",
-        "@stamhoofd/excel-writer": "2.127.0",
-        "@stamhoofd/logging": "2.127.0",
-        "@stamhoofd/models": "2.127.0",
-        "@stamhoofd/object-differ": "2.127.0",
-        "@stamhoofd/queues": "2.127.0",
-        "@stamhoofd/sql": "2.127.0",
-        "@stamhoofd/structures": "2.127.0",
-        "@stamhoofd/types": "2.127.0",
-        "@stamhoofd/utility": "2.127.0",
+        "@stamhoofd/backend-env": "2.128.0",
+        "@stamhoofd/backend-i18n": "2.128.0",
+        "@stamhoofd/backend-middleware": "2.128.0",
+        "@stamhoofd/crons": "2.128.0",
+        "@stamhoofd/email": "2.128.0",
+        "@stamhoofd/excel-writer": "2.128.0",
+        "@stamhoofd/logging": "2.128.0",
+        "@stamhoofd/models": "2.128.0",
+        "@stamhoofd/object-differ": "2.128.0",
+        "@stamhoofd/queues": "2.128.0",
+        "@stamhoofd/sql": "2.128.0",
+        "@stamhoofd/structures": "2.128.0",
+        "@stamhoofd/types": "2.128.0",
+        "@stamhoofd/utility": "2.128.0",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.127.0",
+        "@stamhoofd/test-utils": "2.128.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "c3c61a7728293f5fe7b4b639f95b3cc79166265f"
+    "gitHead": "77c7e13c592a4d51542716d204c3b39dd9d28ec7"
 }

package/src/crons/stripe-invoices.ts

@@ -44,6 +44,6 @@ async function createStripeInvoices() {
     const invoicer = new StripeInvoicer({
         secretKey: STAMHOOFD.STRIPE_SECRET_KEY,
     });
-    await invoicer.generateAllInvoices(membershipOrganization);
+    await invoicer.generateAllInvoices(membershipOrganization, { forceLast: Formatter.dateIso(today) === '2026-07-03' });
     lastStripeInvoice = new Date();
 }

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.ts

@@ -1012,27 +1012,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
     }
 
     static async checkCanAccessMember(member: MemberWithUsersRegistrationsAndGroups, securityCode: string | null | undefined, type: 'put' | 'patch') {
-        // do not check security code for user mode organization (throw error if not allowed)
-        if (STAMHOOFD.userMode === 'organization') {
-            if ((type === 'put' && await member.isSafeToMergeDuplicateWithoutSecurityCode()) || await Context.auth.canAccessMember(member, PermissionLevel.Write)) {
-                console.log('checkSecurityCode: allowed for ' + member.id);
-                return;
-            }
-
-            if (type === 'patch') {
-                throw Context.auth.memberNotFoundOrNoAccess();
-            }
-
-            throw new SimpleError({
-                code: 'known_member_missing_rights',
-                message: 'Creating known member without sufficient access rights',
-                // different message for userMode organization because security codes are not available in that mode
-                human: $t(`%1Oz`, { member: member.details.firstName }),
-                statusCode: 400,
-            });
-        }
-
-        if ((type === 'put' && await member.isSafeToMergeDuplicateWithoutSecurityCode()) || await Context.auth.canAccessMember(member, PermissionLevel.Write)) {
+        if ((type === 'put' && await member.isSafeToMergeDuplicateWithoutSecurityCode(Context.auth.user.email)) || await Context.auth.canAccessMember(member, PermissionLevel.Write)) {
             console.log('checkSecurityCode: without security code: allowed for ' + member.id);
         } else if (securityCode) {
             await this.checkSecurityCode(member, securityCode);
@@ -1044,7 +1024,10 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
             throw new SimpleError({
                 code: 'known_member_missing_rights',
                 message: 'Creating known member without sufficient access rights',
-                human: $t(`%1BA`, { member: member.details.firstName }),
+                human: $t(`%ZbD`, {
+                    member: member.details.firstName,
+                    email: Context.auth.user.email,
+                }),
                 statusCode: 400,
             });
         }

package/src/endpoints/global/members/SendMemberSecurityCodeEndpoint.test.ts

@@ -0,0 +1,410 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { EmailMocker } from '@stamhoofd/email';
+import type { RateLimiter } from '@stamhoofd/models';
+import { EmailTemplateFactory, Member, MemberFactory, OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { EmailTemplateType, MemberDetails, Parent, ParentType, SecurityCodeSendMethod, SendMemberSecurityCodeRequest } from '@stamhoofd/structures';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
+import { Formatter } from '@stamhoofd/utility';
+import type { SMSMocker } from '../../../../tests/helpers/SMSMocker.js';
+import { testServer } from '../../../../tests/helpers/TestServer.js';
+import { initSMSApi } from '../../../../tests/init/index.js';
+import { memberPhoneLookupLimiter, memberSecurityCodeSendLimiter, nameSecurityCodeSendLimiter, SendMemberSecurityCodeEndpoint, smsOrganizationLimiter, userSecurityCodeSendLimiter } from './SendMemberSecurityCodeEndpoint.js';
+
+const baseUrl = `/members/security-code`;
+const endpoint = new SendMemberSecurityCodeEndpoint();
+
+const securityCode = 'ABCD1234WXYZ5678';
+const formattedCode = 'ABCD-1234-WXYZ-5678';
+const memberPhone = '+32 470 12 34 56'; // -> 32470123456
+const parentPhone = '+32 471 98 76 54'; // -> 32471987654
+
+function resetLimiter(limiter: RateLimiter) {
+    for (const window of limiter.windows) {
+        window.windows.clear();
+        window.start = new Date();
+    }
+}
+
+describe('Endpoint.SendMemberSecurityCode', () => {
+    beforeEach(() => {
+        TestUtils.setEnvironment('userMode', 'organization');
+
+        // Rate limiters are in-memory singletons, reset them between tests
+        resetLimiter(memberSecurityCodeSendLimiter);
+        resetLimiter(nameSecurityCodeSendLimiter);
+        resetLimiter(userSecurityCodeSendLimiter);
+        resetLimiter(smsOrganizationLimiter);
+        resetLimiter(memberPhoneLookupLimiter);
+    });
+
+    async function setup(overrides: { phone?: string | null; parents?: Parent[] } = {}) {
+        const organization = await new OrganizationFactory({}).create();
+        await new EmailTemplateFactory({ type: EmailTemplateType.MemberSecurityCode }).create();
+
+        const user = await new UserFactory({ organization }).create();
+        const token = await Token.createToken(user);
+
+        const details = MemberDetails.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            email: 'kid@example.com',
+            phone: overrides.phone !== undefined ? overrides.phone : memberPhone,
+            securityCode,
+            parents: overrides.parents !== undefined
+                ? overrides.parents
+                : [
+                        Parent.create({
+                            type: ParentType.Mother,
+                            firstName: 'Anna',
+                            lastName: 'Testman',
+                            email: 'parent@example.com',
+                            phone: parentPhone,
+                        }),
+                    ],
+        });
+
+        const member = await new MemberFactory({ organization, details }).create();
+        return { organization, user, token, member };
+    }
+
+    function buildRequest(host: string, token: Token, body: SendMemberSecurityCodeRequest) {
+        const request = Request.buildJson('POST', baseUrl, host, body);
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+        return request;
+    }
+
+    test('sends the code via email to all known email addresses', async () => {
+        const { organization, token } = await setup();
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.Email,
+        }));
+
+        const response = await testServer.test(endpoint, request);
+        expect(response.body.method).toBe(SecurityCodeSendMethod.Email);
+
+        const emails = await EmailMocker.transactional.getSucceededEmails();
+        expect(emails.length).toBe(2);
+        const recipients = emails.map(e => e.to).join(', ');
+        expect(recipients).toContain('kid@example.com');
+        expect(recipients).toContain('parent@example.com');
+        for (const email of emails) {
+            expect(email.text).toContain(formattedCode);
+        }
+    });
+
+    test('sends the code via SMS to the member phone number', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        const { organization, token } = await setup();
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.SMS,
+        }));
+
+        const response = await testServer.test(endpoint, request);
+
+        expect(response.body.method).toBe(SecurityCodeSendMethod.SMS);
+        expect(response.body.maskedRecipient).toBe('•••• 56');
+
+        expect(mocker.sentMessages.length).toBe(1);
+        expect(mocker.lastMessage!.recipient).toEqual(32470123456);
+        expect(mocker.lastMessage!.message).toContain(formattedCode);
+
+        // No emails should have been sent
+        expect(await EmailMocker.transactional.getSucceededCount()).toBe(0);
+    });
+
+    test('cycles to the next phone number on retries', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        const { organization, token } = await setup();
+
+        const body = SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.SMS,
+            tryCount: 0,
+        });
+
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body));
+        expect(mocker.lastMessage!.recipient).toEqual(32470123456);
+
+        // Allow a new send for the same member (5 minute limit)
+        resetLimiter(memberSecurityCodeSendLimiter);
+
+        const retry = SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.SMS,
+            tryCount: 1,
+        });
+        const response = await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, retry));
+
+        expect(mocker.sentMessages.length).toBe(2);
+        expect(mocker.lastMessage!.recipient).toEqual(32471987654);
+        expect(response.body.maskedRecipient).toBe('•••• 54');
+    });
+
+    test('only sends to the provided phone number when it matches a known number', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        const { organization, token } = await setup();
+
+        // Provide the parent number in national format. Even though tryCount 0 would normally select the
+        // member number, an exact (normalized) match must win.
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.SMS,
+            tryCount: 0,
+            phone: '0471 98 76 54',
+        }));
+
+        const response = await testServer.test(endpoint, request);
+
+        expect(mocker.sentMessages.length).toBe(1);
+        expect(mocker.lastMessage!.recipient).toEqual(32471987654);
+        expect(response.body.maskedRecipient).toBe('•••• 54');
+    });
+
+    test('throws when the provided phone number is not known for the member', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        const { organization, token } = await setup();
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.SMS,
+            phone: '+32 490 00 00 00',
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('phone_not_found'));
+
+        // No SMS may be sent to an unknown number
+        expect(mocker.sentMessages.length).toBe(0);
+    });
+
+    test('rate limits phone number lookups per member to prevent enumeration', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        const { organization, token, member } = await setup();
+
+        // Simulate that the hourly phone lookup limit for this member is already reached
+        for (let i = 0; i < 10; i++) {
+            memberPhoneLookupLimiter.track(member.id, 1);
+        }
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.SMS,
+            phone: '+32 490 00 00 00',
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('too_many_requests'));
+        expect(mocker.sentMessages.length).toBe(0);
+    });
+
+    test('can look up the member by id', async () => {
+        const { organization, token, member } = await setup();
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.Email,
+        }));
+
+        const response = await testServer.test(endpoint, request);
+        expect(response.body.method).toBe(SecurityCodeSendMethod.Email);
+        expect(await EmailMocker.transactional.getSucceededCount()).toBe(2);
+    });
+
+    test('generates a security code if the member has none', async () => {
+        const { organization, token, member } = await setup();
+
+        // Simulate an organization-mode member without a security code
+        member.details.securityCode = null;
+        await member.save();
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.Email,
+        }));
+
+        await testServer.test(endpoint, request);
+
+        const updated = await Member.getByID(member.id);
+        expect(updated!.details.securityCode).toBeTruthy();
+        expect(updated!.details.securityCode!.length).toBe(16);
+
+        const formatted = Formatter.spaceString(updated!.details.securityCode!, 4, '-');
+        const emails = await EmailMocker.transactional.getSucceededEmails();
+        expect(emails.length).toBe(2);
+        expect(emails[0].text).toContain(formatted);
+    });
+
+    test('throws when no member is found', async () => {
+        const { organization, token } = await setup();
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            firstName: 'Unknown',
+            lastName: 'Person',
+            birthDay: new Date(Date.UTC(2000, 0, 1)),
+            method: SecurityCodeSendMethod.Email,
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('member_not_found'));
+    });
+
+    test('throws when the member has no phone number for SMS', async () => {
+        initSMSApi();
+        const { organization, token } = await setup({ phone: null, parents: [] });
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.SMS,
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('no_phone'));
+    });
+
+    test('rate limits sending per member', async () => {
+        const { organization, token } = await setup();
+
+        const body = () => SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.Email,
+        });
+
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body()));
+
+        await expect(testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body())))
+            .rejects
+            .toThrow(STExpect.errorWithCode('too_many_requests'));
+    });
+
+    test('rate limits sending SMS per member', async () => {
+        const mocker: SMSMocker = initSMSApi();
+
+        const { organization, token } = await setup();
+
+        const body = () => SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.SMS,
+        });
+
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body()));
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body()));
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body()));
+
+        await expect(testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body())))
+            .rejects
+            .toThrow(STExpect.errorWithCode('too_many_requests'));
+        expect(mocker.sentMessages.length).toBe(3);
+    });
+
+    test('rate limits by member name and organization to prevent birthday guessing', async () => {
+        const { organization, token } = await setup();
+
+        // Simulate that the hourly limit for this member name in this organization is already reached
+        const nameKey = organization.id + ':jef testman';
+        for (let i = 0; i < 10; i++) {
+            nameSecurityCodeSendLimiter.track(nameKey, 1);
+        }
+
+        // Even with a wrong birth day, the request is blocked before the member lookup happens
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(1990, 0, 1)),
+            method: SecurityCodeSendMethod.Email,
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('too_many_requests'));
+    });
+
+    test('rate limits SMS per organization to 25 per day', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        const { organization, token, member } = await setup();
+
+        // Simulate that the organization already sent 25 SMS today
+        for (let i = 0; i < 25; i++) {
+            smsOrganizationLimiter.track(member.organizationId ?? organization.id, 1);
+        }
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.SMS,
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('too_many_sms'));
+        expect(mocker.sentMessages.length).toBe(0);
+    });
+
+    test('rate limits per user to prevent enumeration', async () => {
+        const { organization, user, token } = await setup();
+
+        // Simulate that the user already reached the hourly limit
+        for (let i = 0; i < 20; i++) {
+            userSecurityCodeSendLimiter.track(user.id, 1);
+        }
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.Email,
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('too_many_requests'));
+    });
+
+    test('reports an error when the SMS gateway fails', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        mocker.forceFailure();
+        const { organization, token } = await setup();
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            method: SecurityCodeSendMethod.SMS,
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('sms_failed'));
+    });
+});