@stamhoofd/backend 2.127.1 → 2.129.1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.127.1",
+    "version": "2.129.1",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -57,20 +57,20 @@
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.127.1",
-        "@stamhoofd/backend-i18n": "2.127.1",
-        "@stamhoofd/backend-middleware": "2.127.1",
-        "@stamhoofd/crons": "2.127.1",
-        "@stamhoofd/email": "2.127.1",
-        "@stamhoofd/excel-writer": "2.127.1",
-        "@stamhoofd/logging": "2.127.1",
-        "@stamhoofd/models": "2.127.1",
-        "@stamhoofd/object-differ": "2.127.1",
-        "@stamhoofd/queues": "2.127.1",
-        "@stamhoofd/sql": "2.127.1",
-        "@stamhoofd/structures": "2.127.1",
-        "@stamhoofd/types": "2.127.1",
-        "@stamhoofd/utility": "2.127.1",
+        "@stamhoofd/backend-env": "2.129.1",
+        "@stamhoofd/backend-i18n": "2.129.1",
+        "@stamhoofd/backend-middleware": "2.129.1",
+        "@stamhoofd/crons": "2.129.1",
+        "@stamhoofd/email": "2.129.1",
+        "@stamhoofd/excel-writer": "2.129.1",
+        "@stamhoofd/logging": "2.129.1",
+        "@stamhoofd/models": "2.129.1",
+        "@stamhoofd/object-differ": "2.129.1",
+        "@stamhoofd/queues": "2.129.1",
+        "@stamhoofd/sql": "2.129.1",
+        "@stamhoofd/structures": "2.129.1",
+        "@stamhoofd/types": "2.129.1",
+        "@stamhoofd/utility": "2.129.1",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.127.1",
+        "@stamhoofd/test-utils": "2.129.1",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "0e8db3ce693701ff334894c2e9e60d9a51c7286e"
+    "gitHead": "fed4dfbbbb768c9d57c476b93a3a42dfac6dd69b"
 }

package/src/crons/mollie-refunds.ts

@@ -16,7 +16,7 @@ export const MOLLIE_REFUNDS_MINIMUM_DATE = new Date('2026-06-22T00:00:00.000Z');
 let lastRun: Date | null = null;
 export async function checkMollieRefunds() {
     if (STAMHOOFD.environment !== 'development') {
-        if (lastRun && new Date().getTime() - lastRun.getTime() < 1000 * 60 * 60 * 24) {
+        if (lastRun && new Date().getTime() - lastRun.getTime() < 1000 * 60 * 60 * 12) {
             return;
         }
         lastRun = new Date();

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.test.ts

@@ -47,6 +47,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 lastName,
                 birthDay,
                 generateData: true,
+                generateSensitiveData: true,
             }).create();
 
             const token = await Token.createToken(user);
@@ -94,6 +95,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 lastName,
                 birthDay,
                 generateData: true,
+                generateSensitiveData: true,
                 // should be member of the same organization
                 organization,
             }).create();
@@ -148,6 +150,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 lastName,
                 birthDay,
                 generateData: true,
+                generateSensitiveData: true,
                 // should be member of the same organization
                 organization,
             }).create();
@@ -157,6 +160,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 lastName,
                 birthDay,
                 generateData: true,
+                generateSensitiveData: true,
                 // should be member of the same organization
                 organization,
             }).create();
@@ -185,7 +189,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             request.headers.authorization = 'Bearer ' + token.accessToken;
             await expect(testServer.test(endpoint, request))
                 .rejects
-                .toThrow(STExpect.errorWithCode('not_found'));
+                .toThrow(STExpect.errorWithCode('known_member_missing_rights'));
         });
 
         test('Should be able to create duplicate from another organization in userMode organization', async () => {
@@ -215,6 +219,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 lastName,
                 birthDay,
                 generateData: true,
+                generateSensitiveData: true,
                 // member of other organization
                 organization: otherOrganization,
                 details: MemberDetails.create({

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.ts

@@ -33,13 +33,38 @@ type ResponseBody = MembersBlob;
 export const securityCodeLimiter = new RateLimiter({
     limits: [
         {
-            // Max 10 a day
-            limit: 10,
+            // Max 5 per 15 minutes (this makes sure accidental enters block maximum 15 minutes and not the whole day)
+            limit: 5,
+            duration: 15 * 60 * 1000 * 60,
+        },
+        {
+            // Max 12 a day
+            limit: 12,
             duration: 24 * 60 * 1000 * 60,
         },
     ],
 });
 
+export const duplicateCheckLimiter = new RateLimiter({
+    limits: [
+        {
+            // Max 5 requests per 5 minutes
+            limit: 5,
+            duration: 15 * 60 * 1000,
+        },
+        {
+            // Max 6 requests per 10 minutes
+            limit: 6,
+            duration: 15 * 60 * 1000,
+        },
+        {
+            // Max 7 requests per day
+            limit: 7,
+            duration: 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
 /**
  * One endpoint to create, patch and delete members and their registrations and payments
  */
@@ -168,7 +193,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
                 throw Context.auth.memberNotFoundOrNoAccess();
             }
 
-            await PatchOrganizationMembersEndpoint.checkCanAccessMember(member, securityCode, 'patch');
+            await PatchOrganizationMembersEndpoint.checkCanAccessMember(member, securityCode, 'direct');
 
             patch = await Context.auth.filterMemberPatch(member, patch);
             const originalDetails = member.details.clone();
@@ -1011,41 +1036,27 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
         await log.save();
     }
 
-    static async checkCanAccessMember(member: MemberWithUsersRegistrationsAndGroups, securityCode: string | null | undefined, type: 'put' | 'patch') {
-        // do not check security code for user mode organization (throw error if not allowed)
-        if (STAMHOOFD.userMode === 'organization') {
-            if ((type === 'put' && await member.isSafeToMergeDuplicateWithoutSecurityCode()) || await Context.auth.canAccessMember(member, PermissionLevel.Write)) {
-                console.log('checkSecurityCode: allowed for ' + member.id);
-                return;
-            }
-
-            if (type === 'patch') {
-                throw Context.auth.memberNotFoundOrNoAccess();
-            }
-
-            throw new SimpleError({
-                code: 'known_member_missing_rights',
-                message: 'Creating known member without sufficient access rights',
-                // different message for userMode organization because security codes are not available in that mode
-                human: $t(`%1Oz`, { member: member.details.firstName }),
-                statusCode: 400,
-            });
-        }
-
-        if ((type === 'put' && await member.isSafeToMergeDuplicateWithoutSecurityCode()) || await Context.auth.canAccessMember(member, PermissionLevel.Write)) {
+    static async checkCanAccessMember(member: MemberWithUsersRegistrationsAndGroups, securityCode: string | null | undefined, type: 'put' | 'patch' | 'direct') {
+        if ((type !== 'direct' && await member.isSafeToMergeDuplicateWithoutSecurityCode(Context.auth.user.email)) || await Context.auth.canAccessMember(member, PermissionLevel.Write)) {
             console.log('checkSecurityCode: without security code: allowed for ' + member.id);
         } else if (securityCode) {
             await this.checkSecurityCode(member, securityCode);
         } else {
-            if (type === 'patch') {
+            if (type === 'direct') {
                 throw Context.auth.memberNotFoundOrNoAccess();
             }
 
             throw new SimpleError({
                 code: 'known_member_missing_rights',
                 message: 'Creating known member without sufficient access rights',
-                human: $t(`%1BA`, { member: member.details.firstName }),
+                human: $t(`%ZbD`, {
+                    member: member.details.firstName,
+                    email: Context.auth.user.email,
+                }),
                 statusCode: 400,
+                meta: {
+                    id: member.id,
+                },
             });
         }
     }
@@ -1069,6 +1080,24 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
             return;
         }
 
+        if ((!member.organizationId && !Context.auth.hasSomePlatformAccess()) || (member.organizationId && !await Context.auth.hasSomeAccess(member.organizationId))) {
+            try {
+                duplicateCheckLimiter.track(member.organizationId + '-' + Formatter.slug(member.details.name), 1);
+            } catch (e) {
+                Email.sendWebmaster({
+                    subject: '[Limiet] Limiet bereikt voor aantal duplicate checks per member name',
+                    text: $t(`%EA`) + ' ' + member.details.name + ' ' + '(Org: ' + ' ' + member.organizationId + ')' + ' by ' + Context.user?.id + '\n\n' + e.message + '\n\nStamhoofd',
+                });
+
+                throw new SimpleError({
+                    code: 'too_many_tries',
+                    message: 'Too many names',
+                    human: $t(`%ZbQ`),
+                    field: 'details.name',
+                });
+            }
+        }
+
         // Check for duplicates and prevent creating a duplicate member by a user
         const duplicate = await this.findExistingMember(member);
         if (duplicate) {

package/src/endpoints/global/members/SendMemberSecurityCodeEndpoint.test.ts

@@ -0,0 +1,388 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { EmailMocker } from '@stamhoofd/email';
+import type { RateLimiter } from '@stamhoofd/models';
+import { AuditLog, EmailTemplateFactory, Member, MemberFactory, OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { AuditLogReplacementType, AuditLogType, EmailTemplateType, MemberDetails, Parent, ParentType, SecurityCodeSendMethod, SendMemberSecurityCodeRequest } from '@stamhoofd/structures';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
+import { Formatter } from '@stamhoofd/utility';
+import type { SMSMocker } from '../../../../tests/helpers/SMSMocker.js';
+import { testServer } from '../../../../tests/helpers/TestServer.js';
+import { initSMSApi } from '../../../../tests/init/index.js';
+import { memberPhoneLookupLimiter, memberSecurityCodeSendLimiter, SendMemberSecurityCodeEndpoint, smsOrganizationLimiter, userSecurityCodeSendLimiter } from './SendMemberSecurityCodeEndpoint.js';
+
+const baseUrl = `/members/security-code`;
+const endpoint = new SendMemberSecurityCodeEndpoint();
+
+const securityCode = 'ABCD1234WXYZ5678';
+const formattedCode = 'ABCD-1234-WXYZ-5678';
+const memberPhone = '+32 470 12 34 56'; // -> 32470123456
+const parentPhone = '+32 471 98 76 54'; // -> 32471987654
+
+function resetLimiter(limiter: RateLimiter) {
+    for (const window of limiter.windows) {
+        window.windows.clear();
+        window.start = new Date();
+    }
+}
+
+describe('Endpoint.SendMemberSecurityCode', () => {
+    beforeEach(() => {
+        TestUtils.setEnvironment('userMode', 'organization');
+
+        // Rate limiters are in-memory singletons, reset them between tests
+        resetLimiter(memberSecurityCodeSendLimiter);
+        resetLimiter(userSecurityCodeSendLimiter);
+        resetLimiter(smsOrganizationLimiter);
+        resetLimiter(memberPhoneLookupLimiter);
+    });
+
+    async function setup(overrides: { phone?: string | null; parents?: Parent[] } = {}) {
+        const organization = await new OrganizationFactory({}).create();
+        await new EmailTemplateFactory({ type: EmailTemplateType.MemberSecurityCode }).create();
+
+        const user = await new UserFactory({ organization }).create();
+        const token = await Token.createToken(user);
+
+        const details = MemberDetails.create({
+            firstName: 'Jef',
+            lastName: 'Testman',
+            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            email: 'kid@example.com',
+            phone: overrides.phone !== undefined ? overrides.phone : memberPhone,
+            securityCode,
+            parents: overrides.parents !== undefined
+                ? overrides.parents
+                : [
+                        Parent.create({
+                            type: ParentType.Mother,
+                            firstName: 'Anna',
+                            lastName: 'Testman',
+                            email: 'parent@example.com',
+                            phone: parentPhone,
+                        }),
+                    ],
+        });
+
+        const member = await new MemberFactory({ organization, details }).create();
+        return { organization, user, token, member };
+    }
+
+    function buildRequest(host: string, token: Token, body: SendMemberSecurityCodeRequest) {
+        const request = Request.buildJson('POST', baseUrl, host, body);
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+        return request;
+    }
+
+    test('sends the code via email to all known email addresses', async () => {
+        const { organization, token, member } = await setup();
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.Email,
+        }));
+
+        const response = await testServer.test(endpoint, request);
+        expect(response.body.method).toBe(SecurityCodeSendMethod.Email);
+
+        const emails = await EmailMocker.transactional.getSucceededEmails();
+        expect(emails.length).toBe(2);
+        const recipients = emails.map(e => e.to).join(', ');
+        expect(recipients).toContain('kid@example.com');
+        expect(recipients).toContain('parent@example.com');
+        for (const email of emails) {
+            expect(email.text).toContain(formattedCode);
+        }
+    });
+
+    test('sends the code via SMS to the member phone number', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        const { organization, token, member } = await setup();
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.SMS,
+        }));
+
+        const response = await testServer.test(endpoint, request);
+
+        expect(response.body.method).toBe(SecurityCodeSendMethod.SMS);
+        expect(response.body.maskedRecipient).toBe('•• •• 56');
+
+        expect(mocker.sentMessages.length).toBe(1);
+        expect(mocker.lastMessage!.recipient).toEqual(32470123456);
+        expect(mocker.lastMessage!.message).toContain(formattedCode);
+
+        // No emails should have been sent
+        expect(await EmailMocker.transactional.getSucceededCount()).toBe(0);
+    });
+
+    test('cycles to the next phone number on retries', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        const { organization, token, member } = await setup();
+
+        const body = SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.SMS,
+            tryCount: 0,
+        });
+
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body));
+        expect(mocker.lastMessage!.recipient).toEqual(32470123456);
+
+        // Allow a new send for the same member (5 minute limit)
+        resetLimiter(memberSecurityCodeSendLimiter);
+
+        const retry = SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.SMS,
+            tryCount: 1,
+        });
+        const response = await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, retry));
+
+        expect(mocker.sentMessages.length).toBe(2);
+        expect(mocker.lastMessage!.recipient).toEqual(32471987654);
+        expect(response.body.maskedRecipient).toBe('•• •• 54');
+    });
+
+    test('only sends to the provided phone number when it matches a known number', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        const { organization, token, member } = await setup();
+
+        // Provide the parent number in national format. Even though tryCount 0 would normally select the
+        // member number, an exact (normalized) match must win.
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.SMS,
+            tryCount: 0,
+            phone: '0471 98 76 54',
+        }));
+
+        const response = await testServer.test(endpoint, request);
+
+        expect(mocker.sentMessages.length).toBe(1);
+        expect(mocker.lastMessage!.recipient).toEqual(32471987654);
+        expect(response.body.maskedRecipient).toBe('•• •• 54');
+    });
+
+    test('throws when the provided phone number is not known for the member', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        const { organization, token, member } = await setup();
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.SMS,
+            phone: '+32 490 00 00 00',
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('phone_not_found'));
+
+        // No SMS may be sent to an unknown number
+        expect(mocker.sentMessages.length).toBe(0);
+    });
+
+    test('rate limits phone number lookups per member to prevent enumeration', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        const { organization, token, member } = await setup();
+
+        // Simulate that the hourly phone lookup limit for this member is already reached
+        for (let i = 0; i < 10; i++) {
+            memberPhoneLookupLimiter.track(member.id, 1);
+        }
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.SMS,
+            phone: '+32 490 00 00 00',
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('too_many_requests'));
+        expect(mocker.sentMessages.length).toBe(0);
+    });
+
+    test('creates an audit log when a security code is requested via email', async () => {
+        const { organization, user, token, member } = await setup();
+
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.Email,
+        })));
+
+        const log = await AuditLog.select()
+            .where('type', AuditLogType.MemberSecurityCodeRequested)
+            .where('objectId', member.id)
+            .first(true);
+
+        expect(log.userId).toBe(user.id);
+        expect(log.organizationId).toBe(member.organizationId);
+        expect(log.replacements.get('m')).toMatchObject({
+            id: member.id,
+            value: member.details.name,
+            type: AuditLogReplacementType.Member,
+        });
+        expect(log.replacements.get('method')?.value).toBe('e-mail');
+        expect(log.replacements.get('recipient')?.value).toContain('kid@example.com');
+        expect(log.replacements.get('recipient')?.value).toContain('parent@example.com');
+    });
+
+    test('creates an audit log with the masked recipient when a security code is requested via SMS', async () => {
+        initSMSApi();
+        const { user, organization, token, member } = await setup();
+
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.SMS,
+        })));
+
+        const log = await AuditLog.select()
+            .where('type', AuditLogType.MemberSecurityCodeRequested)
+            .where('objectId', member.id)
+            .first(true);
+
+        expect(log.userId).toBe(user.id);
+        expect(log.replacements.get('method')?.value).toBe('SMS');
+        expect(log.replacements.get('recipient')?.value).toBe('•• •• 56');
+    });
+
+    test('generates a security code if the member has none', async () => {
+        const { organization, token, member } = await setup();
+
+        // Simulate an organization-mode member without a security code
+        member.details.securityCode = null;
+        await member.save();
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.Email,
+        }));
+
+        await testServer.test(endpoint, request);
+
+        const updated = await Member.getByID(member.id);
+        expect(updated!.details.securityCode).toBeTruthy();
+        expect(updated!.details.securityCode!.length).toBe(16);
+
+        const formatted = Formatter.spaceString(updated!.details.securityCode!, 4, '-');
+        const emails = await EmailMocker.transactional.getSucceededEmails();
+        expect(emails.length).toBe(2);
+        expect(emails[0].text).toContain(formatted);
+    });
+
+    test('throws when no member is found', async () => {
+        const { organization, token } = await setup();
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: 'not-found',
+            method: SecurityCodeSendMethod.Email,
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('member_not_found'));
+    });
+
+    test('throws when the member has no phone number for SMS', async () => {
+        initSMSApi();
+        const { organization, token, member } = await setup({ phone: null, parents: [] });
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.SMS,
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('no_phone'));
+    });
+
+    test('rate limits sending email per member', async () => {
+        const { organization, token, member } = await setup();
+
+        const body = () => SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.Email,
+        });
+
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body()));
+
+        await expect(testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body())))
+            .rejects
+            .toThrow(STExpect.errorWithCode('too_many_requests'));
+    });
+
+    test('rate limits sending SMS per member', async () => {
+        const mocker: SMSMocker = initSMSApi();
+
+        const { organization, token, member } = await setup();
+
+        const body = () => SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.SMS,
+        });
+
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body()));
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body()));
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body()));
+
+        await expect(testServer.test(endpoint, buildRequest(organization.getApiHost(), token, body())))
+            .rejects
+            .toThrow(STExpect.errorWithCode('too_many_requests'));
+        expect(mocker.sentMessages.length).toBe(3);
+    });
+
+    test('rate limits SMS per organization to 25 per day', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        const { organization, token, member } = await setup();
+
+        // Simulate that the organization already sent 25 SMS today
+        for (let i = 0; i < 25; i++) {
+            smsOrganizationLimiter.track(member.organizationId ?? organization.id, 1);
+        }
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.SMS,
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('too_many_sms'));
+        expect(mocker.sentMessages.length).toBe(0);
+    });
+
+    test('rate limits per user to prevent enumeration', async () => {
+        const { organization, user, token, member } = await setup();
+
+        // Simulate that the user already reached the hourly limit
+        for (let i = 0; i < 20; i++) {
+            userSecurityCodeSendLimiter.track(user.id, 1);
+        }
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.Email,
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('too_many_requests'));
+    });
+
+    test('reports an error when the SMS gateway fails', async () => {
+        const mocker: SMSMocker = initSMSApi();
+        mocker.forceFailure();
+        const { organization, token, member } = await setup();
+
+        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.SMS,
+        }));
+
+        await expect(testServer.test(endpoint, request))
+            .rejects
+            .toThrow(STExpect.errorWithCode('sms_failed'));
+    });
+});