@stamhoofd/backend 2.127.1 → 2.128.0

package/src/endpoints/global/members/SendMemberSecurityCodeEndpoint.ts

@@ -0,0 +1,462 @@
+import type { Decoder } from '@simonbackx/simple-encoding';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import type { Organization } from '@stamhoofd/models';
+import { Member, Platform, RateLimiter, sendEmailTemplate } from '@stamhoofd/models';
+import { EmailTemplateType, Recipient, Replacement, SecurityCodeSendMethod, SendMemberSecurityCodeRequest, SendMemberSecurityCodeResponse } from '@stamhoofd/structures';
+import type { Country } from '@stamhoofd/types/Country';
+import { Formatter } from '@stamhoofd/utility';
+
+import { Context } from '../../../helpers/Context.js';
+import { SMSService } from '../../../services/SMSService.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = SendMemberSecurityCodeRequest;
+type ResponseBody = SendMemberSecurityCodeResponse;
+
+/**
+ * Only allow to send a code a limited number of times for the same member.
+ */
+export const memberSecurityCodeSendLimiter = new RateLimiter({
+    limits: [
+        {
+            limit: 3,
+            duration: 5 * 60 * 1000,
+        },
+        {
+            limit: 6,
+            duration: 12 * 60 * 60 * 1000,
+        },
+        {
+            limit: 9,
+            duration: 3 * 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
+/**
+ * Email limit is lower because no reason to send multiple times
+ */
+export const memberEmailSecurityCodeSendLimiter = new RateLimiter({
+    limits: [
+        {
+            limit: 1,
+            duration: 5 * 60 * 1000,
+        },
+        {
+            limit: 2,
+            duration: 12 * 60 * 60 * 1000,
+        },
+        {
+            limit: 3,
+            duration: 3 * 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
+/**
+ * Limit per member name + organization, so a birth day cannot be guessed or detected by
+ * trying different birth days for a known member name.
+ */
+export const nameSecurityCodeSendLimiter = new RateLimiter({
+    limits: [
+        {
+            // Max 10 requests per hour
+            limit: 10,
+            duration: 60 * 60 * 1000,
+        },
+        {
+            // Max 20 requests per day
+            limit: 20,
+            duration: 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
+/**
+ * Limit per user to avoid member enumeration attacks.
+ */
+export const userSecurityCodeSendLimiter = new RateLimiter({
+    limits: [
+        {
+            // Max 20 requests per hour
+            limit: 20,
+            duration: 60 * 60 * 1000,
+        },
+        {
+            // Max 30 requests per day
+            limit: 30,
+            duration: 24 * 60 * 60 * 1000,
+        },
+        {
+            // Max 100 requests per week
+            limit: 100,
+            duration: 7 * 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
+/**
+ * Limit the number of SMS messages per organization (SMS costs money).
+ */
+export const smsOrganizationLimiter = new RateLimiter({
+    limits: [
+        {
+            // Max 25 SMS per day
+            limit: 25,
+            duration: 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
+/**
+ * Limit how often the provided phone number can be checked against a member's known numbers. Because a
+ * wrong number returns an error, this would otherwise be an oracle to enumerate a member's phone numbers.
+ */
+export const memberPhoneLookupLimiter = new RateLimiter({
+    limits: [
+        {
+            // Max 10 attempts per hour
+            limit: 10,
+            duration: 60 * 60 * 1000,
+        },
+        {
+            // Max 30 attempts per day
+            limit: 30,
+            duration: 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
+/**
+ * Send the security code of a member to the member (or its parents), so an authenticated user can gain
+ * access to a member that is already known in the system but not yet linked to their account.
+ */
+export class SendMemberSecurityCodeEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    bodyDecoder = SendMemberSecurityCodeRequest as Decoder<SendMemberSecurityCodeRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/members/security-code', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        const organization = await Context.setOptionalOrganizationScope();
+        const { user } = await Context.authenticate();
+
+        const body = request.body;
+
+        // Enumeration defense: always consume the per-user rate limit first, before revealing anything.
+        try {
+            userSecurityCodeSendLimiter.track(user.id, 1);
+        } catch (e) {
+            throw new SimpleError({
+                code: 'too_many_requests',
+                message: 'Too many security code requests for this user',
+                human: $t(`%ZbM`),
+                statusCode: 429,
+            });
+        }
+
+        const member = await this.findMember(body, organization);
+        if (!member) {
+            throw new SimpleError({
+                code: 'member_not_found',
+                message: 'No member found for the given details',
+                human: $t(`%ZbF`),
+                statusCode: 404,
+            });
+        }
+
+        if (body.method === SecurityCodeSendMethod.SMS) {
+            return new Response(await this.sendViaSMS(member, organization, body.tryCount, body.phone));
+        }
+
+        return new Response(await this.sendViaEmail(member, organization));
+    }
+
+    /**
+     * Look up the member by id, or by the combination of first name, last name and birth day.
+     * String matching relies on the case- and accent-insensitive collation of the database.
+     */
+    private async findMember(body: SendMemberSecurityCodeRequest, organization: Organization | null): Promise<Member | undefined> {
+        if (body.memberId) {
+            return (await Member.getByID(body.memberId)) ?? undefined;
+        }
+
+        if (!body.firstName || !body.lastName || !body.birthDay) {
+            throw new SimpleError({
+                code: 'invalid_field',
+                message: 'Either memberId or firstName, lastName and birthDay are required',
+                human: $t(`%Zb9`),
+                statusCode: 400,
+            });
+        }
+
+        // Rate limit by member name + organization (checked before the lookup, so a birth day cannot be
+        // guessed or detected by trying different birth days for a known member name).
+        const nameKey = (organization?.id ?? 'platform') + ':' + body.firstName.toLowerCase().trim() + ' ' + body.lastName.toLowerCase().trim();
+        try {
+            nameSecurityCodeSendLimiter.track(nameKey, 1);
+        } catch (e) {
+            throw new SimpleError({
+                code: 'too_many_requests',
+                message: 'Too many security code requests for this member name',
+                human: $t(`%ZbM`),
+                statusCode: 429,
+            });
+        }
+
+        const query: { firstName: string; lastName: string; birthDay: string; organizationId?: string } = {
+            firstName: body.firstName,
+            lastName: body.lastName,
+            birthDay: Formatter.dateIso(body.birthDay),
+        };
+
+        // In organization mode members are scoped to a single organization
+        if (organization && STAMHOOFD.userMode !== 'platform') {
+            query.organizationId = organization.id;
+        }
+
+        const members = await Member.where(query);
+        if (members.length === 0) {
+            return undefined;
+        }
+
+        // Prefer a member that already has a security code set
+        return members.find(m => m.details.securityCode) ?? members[0];
+    }
+
+    /**
+     * Make sure the member has a security code, generating one if needed.
+     */
+    private async ensureSecurityCode(member: Member): Promise<string> {
+        if (member.details.securityCode === null) {
+            member.details.securityCode = await Member.generateSecurityCode();
+            await member.save();
+        }
+        return member.details.securityCode;
+    }
+
+    private async sendViaEmail(member: Member, organization: Organization | null): Promise<SendMemberSecurityCodeResponse> {
+        const emails = Formatter.uniqueArray([
+            ...member.details.getMemberEmails(),
+            ...member.details.getParentEmails(),
+            ...member.details.unverifiedEmails,
+        ].map(e => e.toLowerCase().trim()));
+
+        if (emails.length === 0) {
+            throw new SimpleError({
+                code: 'no_email',
+                message: 'No email address is known for this member',
+                human: $t(`%Zb1`),
+                statusCode: 400,
+            });
+        }
+
+        // Once every 5 minutes per member
+        this.trackMemberLimit(member, SecurityCodeSendMethod.Email);
+
+        const code = await this.ensureSecurityCode(member);
+        const formattedCode = Formatter.spaceString(code, 4, '-');
+
+        await sendEmailTemplate(organization, {
+            recipients: emails.map(email => Recipient.create({
+                firstName: member.details.firstName,
+                lastName: member.details.lastName,
+                email,
+                replacements: [
+                    Replacement.create({ token: 'requesterEmail', value: Context.auth.user.email }),
+                    Replacement.create({ token: 'firstNameMember', value: member.details.firstName }),
+                    Replacement.create({ token: 'lastNameMember', value: member.details.lastName }),
+                    Replacement.create({
+                        token: 'securityCode',
+                        value: formattedCode,
+                        html: `<p class="style-code-large">${Formatter.escapeHtml(formattedCode)}</p>`,
+                    }),
+                ],
+            })),
+            template: {
+                type: EmailTemplateType.MemberSecurityCode,
+            },
+            type: 'transactional',
+        });
+
+        return SendMemberSecurityCodeResponse.create({
+            method: SecurityCodeSendMethod.Email,
+            maskedRecipient: '',
+        });
+    }
+
+    private async sendViaSMS(member: Member, organization: Organization | null, tryCount: number, requestedPhone: string | null): Promise<SendMemberSecurityCodeResponse> {
+        // Collect candidate phone numbers, member first, then parents.
+        const uniquePhones = member.details.getPhoneNumbersForVerification();
+
+        if (uniquePhones.length === 0) {
+            throw new SimpleError({
+                code: 'no_phone',
+                message: 'No phone number is known for this member',
+                human: $t(`%Zal`),
+                statusCode: 400,
+            });
+        }
+
+        const defaultCountry = member.details.address?.country ?? organization?.address?.country;
+
+        let phone: string;
+        if (requestedPhone !== null && requestedPhone.trim().length > 0) {
+            // The user filled in a phone number: only send to it if we already know it for this member.
+            // We never send to an arbitrary number (that would leak the code), and this lookup is rate
+            // limited per member so it cannot be used to enumerate a member's phone numbers.
+            try {
+                memberPhoneLookupLimiter.track(member.id, 1);
+            } catch (e) {
+                throw new SimpleError({
+                    code: 'too_many_requests',
+                    message: 'Too many phone number lookups for this member',
+                    human: $t(`%ZbL`),
+                    statusCode: 429,
+                });
+            }
+
+            const requestedE164 = this.normalizePhone(requestedPhone, defaultCountry);
+            const match = requestedE164 === null
+                ? undefined
+                : uniquePhones.find(p => this.normalizePhone(p, defaultCountry) === requestedE164);
+
+            if (!match) {
+                throw new SimpleError({
+                    code: 'phone_not_found',
+                    message: 'The provided phone number is not linked to this member',
+                    human: $t(`%Zar`),
+                    statusCode: 404,
+                });
+            }
+
+            phone = match;
+        } else {
+            // No phone number provided: cycle through the known phone numbers based on the number of previous tries.
+            phone = uniquePhones[Math.abs(tryCount) % uniquePhones.length];
+        }
+
+        // Once every 5 minutes per member
+        this.trackMemberLimit(member, SecurityCodeSendMethod.SMS);
+
+        // Max 25 SMS per organization per day
+        const organizationKey = member.organizationId ?? organization?.id ?? 'platform';
+        try {
+            smsOrganizationLimiter.track(organizationKey, 1);
+        } catch (e) {
+            throw new SimpleError({
+                code: 'too_many_sms',
+                message: 'The daily SMS limit for this organization has been reached',
+                human: $t(`%Zat`),
+                statusCode: 429,
+            });
+        }
+
+        const code = await this.ensureSecurityCode(member);
+        const formattedCode = Formatter.spaceString(code, 4, '-');
+
+        let message = Context.user?.name && !Context.auth.hasSomePlatformAccess()
+            ? $t(`%Zav`, {
+                    organization: organization?.name ?? (await Platform.getShared()).config.name,
+                    firstName: member.details.firstName,
+                    securityCode: formattedCode,
+                    user: Context.user.name,
+                })
+            : $t(`%Zao`, {
+                    organization: organization?.name ?? (await Platform.getShared()).config.name,
+                    firstName: member.details.firstName,
+                    securityCode: formattedCode,
+                });
+
+        if (message.length > 160) {
+            message = Context.user?.firstName && !Context.auth.hasSomePlatformAccess()
+                ? $t(`%Zaz`, {
+                        organization: organization?.name ?? (await Platform.getShared()).config.name,
+                        firstName: member.details.firstName,
+                        securityCode: formattedCode,
+                        user: Context.user.firstName,
+                    })
+                : $t(`%Zaq`, {
+                        organization: organization?.name ?? (await Platform.getShared()).config.name,
+                        firstName: member.details.firstName,
+                        securityCode: formattedCode,
+                    });
+        }
+
+        if (message.length > 160) {
+            message = Context.user?.firstName && !Context.auth.hasSomePlatformAccess()
+                ? $t(`%Zb2`, {
+                        organization: organization?.name ?? (await Platform.getShared()).config.name,
+                        firstName: member.details.firstName,
+                        securityCode: formattedCode,
+                        user: Context.user.firstName,
+                    })
+                : $t(`%Zas`, {
+                        organization: organization?.name ?? (await Platform.getShared()).config.name,
+                        firstName: member.details.firstName,
+                        securityCode: formattedCode,
+                    });
+        }
+
+        await SMSService.send({
+            to: phone,
+            message,
+            defaultCountry: member.details.address?.country ?? organization?.address?.country,
+        });
+
+        return SendMemberSecurityCodeResponse.create({
+            method: SecurityCodeSendMethod.SMS,
+            maskedRecipient: this.maskPhone(phone),
+        });
+    }
+
+    private trackMemberLimit(member: Member, method: SecurityCodeSendMethod) {
+        try {
+            if (method === SecurityCodeSendMethod.Email) {
+                memberEmailSecurityCodeSendLimiter.track(member.id, 1);
+            } else {
+                memberSecurityCodeSendLimiter.track(member.id, 1);
+            }
+        } catch (e) {
+            throw new SimpleError({
+                code: 'too_many_requests',
+                message: 'A security code was already sent for this member recently',
+                human: $t(`%Zaw`),
+                statusCode: 429,
+            });
+        }
+    }
+
+    /**
+     * Normalize a phone number to E.164 for comparison, returning null when it cannot be parsed.
+     */
+    private normalizePhone(phone: string, defaultCountry: Country | undefined): string | null {
+        try {
+            return SMSService.toE164(phone, defaultCountry);
+        } catch (e) {
+            return null;
+        }
+    }
+
+    /**
+     * Return a masked version of a phone number that is safe to show to the user, e.g. "•••• 89".
+     */
+    private maskPhone(phone: string): string {
+        const digits = phone.replace(/\D/g, '');
+        const last = digits.substring(Math.max(0, digits.length - 2));
+        return '•••• ' + last;
+    }
+}

package/src/endpoints/global/registration/PatchUserMembersEndpoint.test.ts

@@ -39,6 +39,8 @@ describe('Endpoint.PatchUserMembersEndpoint', () => {
                 birthDay,
                 generateData: true,
             }).create();
+            existingMember.details.nationalRegisterNumber = '123454123';
+            await existingMember.save();
 
             const token = await Token.createToken(user);
 

package/src/endpoints/global/registration/PatchUserMembersEndpoint.ts

@@ -6,7 +6,7 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import type { Group, Registration } from '@stamhoofd/models';
 import { Document, Member, RateLimiter } from '@stamhoofd/models';
 import type { MemberDetails, MembersBlob } from '@stamhoofd/structures';
-import { MemberWithRegistrationsBlob } from '@stamhoofd/structures';
+import { BooleanStatus, MemberWithRegistrationsBlob } from '@stamhoofd/structures';
 
 import type { OneToManyRelation } from '@simonbackx/simple-database';
 import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures.js';
@@ -112,6 +112,7 @@ export class PatchUserMembersEndpoint extends Endpoint<Params, Query, Body, Resp
                 const previousUitpasNumber = member.details.uitpasNumberDetails?.uitpasNumber ?? null;
 
                 const originalReviewTimes = member.details.reviewTimes;
+
                 member.details.patchOrPut(struct.details);
 
                 if (struct.details.uitpasNumberDetails || didUitpasReviewChange(struct.details.reviewTimes, originalReviewTimes)) {
@@ -120,6 +121,20 @@ export class PatchUserMembersEndpoint extends Endpoint<Params, Query, Body, Resp
 
                 member.details.cleanData();
                 this.throwIfInvalidDetails(member.details);
+
+                // give the parents access to the member they are patching if they would loose access
+                if (
+                    // if the parents have no access after the patch
+                    !member.details.calculatedParentsHaveAccess
+                    // and the parent access is not yet configured
+                    && member.details.parentsHaveAccess === null
+                    // and the user is one of the parents
+                    && member.details.parents.find(p => p.email === user.email)) {
+                    // grant parents access
+                    member.details.parentsHaveAccess = BooleanStatus.create({
+                        value: true,
+                    });
+                }
             }
 
             if (!member.details) {

package/src/endpoints/organization/dashboard/webshops/PatchWebshopOrdersEndpoint.ts

@@ -155,12 +155,9 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                         payment.method = struct.data.paymentMethod;
 
                         // quick throw to prevent payment from being saved
-                        if (payment.method === PaymentMethod.Transfer && !webshop.meta.paymentConfiguration.transferSettings.iban) {
-                            throw new SimpleError({
-                                code: 'missing_iban',
-                                message: 'Missing IBAN',
-                                human: $t(`%w2`),
-                            });
+                        if (payment.method === PaymentMethod.Transfer) {
+                            // will throw if iban is missing
+                            order.getTransferSettings({ shouldThrowIfNoIban: true });
                         }
 
                         payment.status = PaymentStatus.Created;

package/src/helpers/MemberUserSyncer.ts

@@ -5,25 +5,8 @@ import { SQL } from '@stamhoofd/sql';
 import type { MemberDetails, PermissionRole } from '@stamhoofd/structures';
 import { AuditLogSource, Permissions, ReceivableBalanceType, UserPermissions } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
-import basex from 'base-x';
-import crypto from 'crypto';
 import { AuditLogService } from '../services/AuditLogService.js';
 
-const ALPHABET = '123456789ABCDEFGHJKMNPQRSTUVWXYZ'; // Note: we removed 0, O, I and l to make it easier for humans
-const customBase = basex(ALPHABET);
-
-async function randomBytes(size: number): Promise<Buffer> {
-    return new Promise((resolve, reject) => {
-        crypto.randomBytes(size, (err: Error | null, buf: Buffer) => {
-            if (err) {
-                reject(err);
-                return;
-            }
-            resolve(buf);
-        });
-    });
-}
-
 export class MemberUserSyncerStatic {
     /**
      * Call when:
@@ -97,12 +80,10 @@ export class MemberUserSyncerStatic {
                 }
 
                 // Generate security code (only for userMode platform)
-                if (STAMHOOFD.userMode !== 'organization' && member.details.securityCode === null) {
+                if (member.details.securityCode === null) {
                     console.log('Generating security code for member ' + member.id);
 
-                    const length = 16;
-                    const code = customBase.encode(await randomBytes(100)).toUpperCase().substring(0, length);
-                    member.details.securityCode = code;
+                    member.details.securityCode = await Member.generateSecurityCode();
                     await member.save();
                 }
             });

package/src/migrations/1783097842-default-member-security-code-email-template.sql

@@ -0,0 +1,3 @@
+INSERT INTO `email_templates` (`id`, `subject`, `groupId`, `webshopId`, `organizationId`, `type`, `text`, `html`, `json`, `updatedAt`, `createdAt`) VALUES
+('7c9e6a41-2b8d-4f3a-9e21-5a1c3b4d5e6f', 'Beveiligingscode voor {{firstNameMember}}', NULL, NULL, NULL, 'MemberSecurityCode', '{{greeting}}\n\nJij of een gezinslid ({{requesterEmail}}) vroeg de beveiligingscode op van {{firstNameMember}} bij {{organizationName}}. Met deze code kan je toegang krijgen tot dit lid:\n\n{{securityCode}}Heb je dit niet aangevraagd? Dan kan je deze e-mail veilig negeren.\n\nMet vriendelijke groeten,\n{{organizationName}}\n\nIk wil deze mails niet meer ontvangen ({{unsubscribeUrl}})', '<!DOCTYPE html>\n<html>\n\n<head>\n<meta charset=\"utf-8\" />\n<meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0\" />\n<title>Beveiligingscode voor {{firstNameMember}}</title>\n<style type=\"text/css\">body {\n  color: #000716;\n  color: var(--color-dark, #000716);\n  font-family: -apple-system-body, -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, Helvetica, Arial, sans-serif, \"Apple Color Emoji\", \"Segoe UI Emoji\", \"Segoe UI Symbol\";\n  font-size: 12pt;\n  line-height: 1.4;\n}\n\np {\n  margin: 0;\n  padding: 0;\n  line-height: 1.4;\n}\n\np.description {\n  color: var(--color-gray-4, #5e5e5e);\n  font-size: 10pt;\n}\np.description a, p.description a:link, p.description a:visited, p.description a:active, p.description a:hover {\n  text-decoration: underline;\n  color: var(--color-gray-4, #5e5e5e);\n}\n\nstrong {\n  font-weight: bold;\n}\n\nem {\n  font-style: italic;\n}\n\nh1 {\n  font-size: 30px;\n  font-weight: bold;\n  line-height: 1.2;\n}\n@media (max-width: 350px) {\n  h1 {\n    font-size: 24px;\n  }\n}\nh1 {\n  margin: 0;\n  padding: 0;\n}\n\nh2 {\n  font-size: 20px;\n  line-height: 1.2;\n  font-weight: bold;\n  margin: 0;\n  padding: 0;\n}\n\nh3 {\n  font-size: 16px;\n  line-height: 1.2;\n  font-weight: bold;\n  margin: 0;\n  padding: 0;\n}\n\nh4 {\n  line-height: 1.2;\n  font-weight: 500;\n  margin: 0;\n  padding: 0;\n}\n\nol, ul {\n  list-style-position: outside;\n  padding-left: 30px;\n}\n\nhr {\n  height: 1px;\n  background: var(--color-border, var(--color-gray-2, #dcdcdc));\n  border-radius: 1px;\n  padding: 0;\n  margin: 20px 0;\n  outline: none;\n  border: 0;\n}\n\n.button {\n  touch-action: inherit;\n  user-select: auto;\n  cursor: pointer;\n  display: inline-block !important;\n  line-height: 42px;\n  font-size: 16px;\n  font-weight: bold;\n  text-box-trim: none;\n}\n.button:active {\n  transform: none;\n}\n\nimg {\n  max-width: 100%;\n  height: auto;\n}\n\na, a:link, a:visited, a:active, a:hover {\n  text-decoration: underline;\n  color: blue;\n}\n\n.email-data-table {\n  width: 100%;\n  border-collapse: collapse;\n}\n.email-data-table th, .email-data-table td {\n  text-align: left;\n  padding: 10px 10px 10px 0;\n  border-bottom: 1px solid var(--color-border, var(--color-gray-2, #dcdcdc));\n  vertical-align: middle;\n}\n.email-data-table th:last-child, .email-data-table td:last-child {\n  text-align: right;\n  padding-right: 0;\n}\n.email-data-table td.price {\n  white-space: nowrap;\n}\n.email-data-table thead {\n  font-weight: bold;\n}\n.email-data-table thead th {\n  font-size: 10pt;\n}\n.email-data-table h4 ~ p {\n  padding-top: 3px;\n  opacity: 0.8;\n  font-size: 11pt;\n}\n\n.style-inline-code {\n  font-family: monospace;\n  white-space: pre-wrap;\n  display: inline-block;\n  letter-spacing: 1%;\n}\n\n.style-code-large {\n  font-family: monospace;\n  white-space: pre-wrap;\n  font-size: 16pt;\n  letter-spacing: 2px;\n  background: #f2f2f2;\n  padding: 6px 10px;\n  border-radius: 6px;\n  display: inline-block;\n}\n\n.email-style-description-small {\n  font-size: 14px;\n  line-height: 1.5;\n  font-weight: normal;\n  color: var(--color-gray-4, #5e5e5e);\n  font-variation-settings: \"opsz\" 19;\n}\n\n.email-style-title-list {\n  font-size: 16px;\n  line-height: 1.3;\n  font-weight: 500;\n}\n.email-style-title-list + p {\n  padding-top: 3px;\n}\n\n.email-style-title-prefix-list {\n  font-size: 11px;\n  line-height: 1.5;\n  font-weight: bold;\n  color: {{primaryColor}};\n  text-transform: uppercase;\n  margin-bottom: 3px;\n}\n.email-style-title-prefix-list.error {\n  color: #f0153d;\n}\n\n.email-style-price-base, .email-style-discount-price, .email-style-discount-old-price, .email-style-price {\n  font-size: 15px;\n  line-height: 1.4;\n  font-weight: 500;\n  font-variant-numeric: tabular-nums;\n}\n.email-style-price-base.disabled, .disabled.email-style-discount-price, .disabled.email-style-discount-old-price, .disabled.email-style-price {\n  opacity: 0.6;\n}\n.email-style-price-base.negative, .negative.email-style-discount-price, .negative.email-style-discount-old-price, .negative.email-style-price {\n  color: #f0153d;\n}\n\n.email-style-price {\n  font-weight: bold;\n  color: {{primaryColor}};\n}\n\n.email-style-discount-old-price {\n  text-decoration: line-through;\n  color: var(--color-gray-4, #5e5e5e);\n}\n\n.email-style-discount-price {\n  font-weight: bold;\n  color: #ff4747;\n  margin-left: 5px;\n}\n\n.pre-wrap {\n  white-space: pre-wrap;\n} hr {height: 2px;background: #e7e7e7; border-radius: 1px; padding: 0; margin: 20px 0; outline: none; border: 0;} .button.primary { margin: 0; text-decoration: none; font-size: 16px; font-weight: bold; color: {{primaryColorContrast}}; padding: 0 27px; line-height: 42px; background: {{primaryColor}}; text-align: center; border-radius: 7px; touch-action: manipulation; display: inline-block; transition: 0.2s transform, 0.2s opacity; } .button.primary:active { transform: scale(0.95, 0.95); }  .inline-link, .inline-link:link, .inline-link:visited, .inline-link:active, .inline-link:hover { margin: 0; text-decoration: underline; font-size: inherit; font-weight: inherit; color: inherit; touch-action: manipulation; } .inline-link:active { opacity: 0.5; }  .description { color: #5e5e5e; } </style>\n</head>\n\n<body>\n<p style=\"margin: 0; padding: 0; line-height: 1.4;\">{{greeting}}</p><p style=\"margin: 0; padding: 0; line-height: 1.4;\"><br></p><p style=\"margin: 0; padding: 0; line-height: 1.4;\">Jij of een gezinslid ({{requesterEmail}}) vroeg de beveiligingscode op van {{firstNameMember}} bij {{organizationName}}. Met deze code kan je toegang krijgen tot dit lid:</p><p style=\"margin: 0; padding: 0; line-height: 1.4;\"><br></p><div data-type=\"smartVariableBlock\" data-id=\"securityCode\">{{securityCode}}</div><p class=\"description\" style=\"color: #5e5e5e;\">Heb je dit niet aangevraagd? Dan kan je deze e-mail veilig negeren.</p><p style=\"margin: 0; padding: 0; line-height: 1.4;\"><br></p><p style=\"margin: 0; padding: 0; line-height: 1.4;\">Met vriendelijke groeten,</p><p style=\"margin: 0; padding: 0; line-height: 1.4;\">{{organizationName}}</p><p style=\"margin: 0; padding: 0; line-height: 1.4;\"><br></p><hr style=\"height: 2px;background: #e7e7e7; border-radius: 1px; padding: 0; margin: 20px 0; outline: none; border: 0;\"><p style=\"margin: 0; padding: 0; line-height: 1.4;\"><a class=\"inline-link\" href=\"{{unsubscribeUrl}}\" target=\"\" style=\"margin: 0; text-decoration: underline; font-size: inherit; font-weight: inherit; color: inherit; touch-action: manipulation;\">Ik wil deze mails niet meer ontvangen</a></p><p style=\"margin: 0; padding: 0; line-height: 1.4;\"><br></p>\n</body>\n\n</html>', '{\"value\": {\"type\": \"doc\", \"content\": [{\"type\": \"paragraph\", \"content\": [{\"type\": \"smartVariable\", \"attrs\": {\"id\": \"greeting\"}}]}, {\"type\": \"paragraph\"}, {\"type\": \"paragraph\", \"content\": [{\"text\": \"Jij of een gezinslid (\", \"type\": \"text\"}, {\"type\": \"smartVariable\", \"attrs\": {\"id\": \"requesterEmail\"}}, {\"text\": \") vroeg de beveiligingscode op van \", \"type\": \"text\"}, {\"type\": \"smartVariable\", \"attrs\": {\"id\": \"firstNameMember\"}}, {\"text\": \" bij \", \"type\": \"text\"}, {\"type\": \"smartVariable\", \"attrs\": {\"id\": \"organizationName\"}}, {\"text\": \". Met deze code kan je toegang krijgen tot dit lid:\", \"type\": \"text\"}]}, {\"type\": \"paragraph\"}, {\"type\": \"smartVariableBlock\", \"attrs\": {\"id\": \"securityCode\"}}, {\"type\": \"descriptiveText\", \"content\": [{\"text\": \"Heb je dit niet aangevraagd? Dan kan je deze e-mail veilig negeren.\", \"type\": \"text\"}]}, {\"type\": \"paragraph\"}, {\"type\": \"paragraph\", \"content\": [{\"text\": \"Met vriendelijke groeten,\", \"type\": \"text\"}]}, {\"type\": \"paragraph\", \"content\": [{\"type\": \"smartVariable\", \"attrs\": {\"id\": \"organizationName\"}}]}, {\"type\": \"paragraph\"}, {\"type\": \"horizontalRule\"}, {\"type\": \"paragraph\", \"content\": [{\"type\": \"smartButtonInline\", \"attrs\": {\"id\": \"unsubscribeUrl\"}, \"content\": [{\"text\": \"Ik wil deze mails niet meer ontvangen\", \"type\": \"text\"}]}]}, {\"type\": \"paragraph\"}]}, \"version\": 401}', '2026-07-03 15:41:24', '2026-07-03 15:41:24')
+ON DUPLICATE KEY UPDATE id=id;

package/src/{migrations/1761665607-sync-member-users.ts → seeds/1783100286-sync-member-users-security-codes.ts}

@@ -6,20 +6,15 @@ import { MemberUserSyncer } from '../helpers/MemberUserSyncer.js';
 import { allSettledButThrowFirst, SeedTools } from '../helpers/SeedTools.js';
 
 export default new Migration(async () => {
-    if (STAMHOOFD.environment == 'test') {
+    if (STAMHOOFD.environment === 'test') {
         console.log('skipped in tests');
         return;
     }
 
-    if (STAMHOOFD.platformName.toLowerCase() !== 'stamhoofd') {
-        console.log('skipped for platform (only runs for Stamhoofd): ' + STAMHOOFD.platformName);
-        return;
-    }
-
     const result = await logger.setContext({ tags: ['silent-seed', 'seed'] }, async () => {
         return await SeedTools.loopBatched({
             query: Member.select('id'),
-            batchSize: 500,
+            batchSize: 50,
             batchAction: async (rawMembers) => {
                 const membersWithRegistrations = await Member.getBlobByIds(...rawMembers.map(m => m.id));
 

package/src/services/SMSService.test.ts

@@ -0,0 +1,48 @@
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
+import { initSMSApi } from '../../tests/init/index.js';
+import { SMSService } from './SMSService.js';
+
+describe('SMSService', () => {
+    describe('configuration', () => {
+        test('is configured when GATEWAYAPI_TOKEN is set', () => {
+            // The test environment configures GATEWAYAPI_TOKEN by default
+            expect(SMSService.isConfigured).toBe(true);
+        });
+
+        test('is not configured when GATEWAYAPI_TOKEN is missing', () => {
+            TestUtils.setEnvironment('GATEWAYAPI_TOKEN', undefined);
+            expect(SMSService.isConfigured).toBe(false);
+        });
+    });
+
+    describe('phone number formatting', () => {
+        test('converts to E.164 and msisdn', () => {
+            expect(SMSService.toE164('+32 470 12 34 56')).toBe('+32470123456');
+            expect(SMSService.toMsisdn('+32 470 12 34 56')).toBe(32470123456);
+        });
+
+        test('throws for invalid phone numbers', () => {
+            expect(() => SMSService.toE164('not-a-number')).toThrow(STExpect.errorWithCode('invalid_phone'));
+        });
+    });
+
+    describe('sending', () => {
+        test('sends via GatewayAPI', async () => {
+            const mocker = initSMSApi();
+
+            await SMSService.send({ to: '+32 470 12 34 56', message: 'Your code is 1234' });
+
+            expect(mocker.sentMessages.length).toBe(1);
+            expect(mocker.lastMessage!.recipient).toBe(32470123456);
+            expect(mocker.lastMessage!.message).toBe('Your code is 1234');
+        });
+
+        test('throws sms_not_configured when GATEWAYAPI_TOKEN is missing', async () => {
+            TestUtils.setEnvironment('GATEWAYAPI_TOKEN', undefined);
+
+            await expect(SMSService.send({ to: '+32470123456', message: 'hi' }))
+                .rejects
+                .toThrow(STExpect.errorWithCode('sms_not_configured'));
+        });
+    });
+});