@stamhoofd/backend 2.127.1 → 2.129.1

package/src/endpoints/global/members/SendMemberSecurityCodeEndpoint.ts

@@ -0,0 +1,432 @@
+import type { Decoder } from '@simonbackx/simple-encoding';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import type { Organization } from '@stamhoofd/models';
+import { AuditLog, Member, Platform, RateLimiter, sendEmailTemplate } from '@stamhoofd/models';
+import { AuditLogReplacement, AuditLogReplacementType, AuditLogSource, AuditLogType, EmailTemplateType, Recipient, Replacement, SecurityCodeSendMethod, SendMemberSecurityCodeRequest, SendMemberSecurityCodeResponse } from '@stamhoofd/structures';
+import type { Country } from '@stamhoofd/types/Country';
+import { Formatter } from '@stamhoofd/utility';
+
+import { Context } from '../../../helpers/Context.js';
+import { SMSService } from '../../../services/SMSService.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = SendMemberSecurityCodeRequest;
+type ResponseBody = SendMemberSecurityCodeResponse;
+
+/**
+ * Only allow to send a code a limited number of times for the same member.
+ */
+export const memberSecurityCodeSendLimiter = new RateLimiter({
+    limits: [
+        {
+            limit: 3,
+            duration: 5 * 60 * 1000,
+        },
+        {
+            limit: 6,
+            duration: 12 * 60 * 60 * 1000,
+        },
+        {
+            limit: 9,
+            duration: 3 * 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
+/**
+ * Email limit is lower because no reason to send multiple times
+ */
+export const memberEmailSecurityCodeSendLimiter = new RateLimiter({
+    limits: [
+        {
+            limit: 1,
+            duration: 5 * 60 * 1000,
+        },
+        {
+            limit: 2,
+            duration: 12 * 60 * 60 * 1000,
+        },
+        {
+            limit: 3,
+            duration: 3 * 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
+/**
+ * Limit per user to avoid member enumeration attacks.
+ */
+export const userSecurityCodeSendLimiter = new RateLimiter({
+    limits: [
+        {
+            // Max 20 requests per hour
+            limit: 20,
+            duration: 60 * 60 * 1000,
+        },
+        {
+            // Max 30 requests per day
+            limit: 30,
+            duration: 24 * 60 * 60 * 1000,
+        },
+        {
+            // Max 100 requests per week
+            limit: 100,
+            duration: 7 * 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
+/**
+ * Limit the number of SMS messages per organization (SMS costs money).
+ */
+export const smsOrganizationLimiter = new RateLimiter({
+    limits: [
+        {
+            // Max 25 SMS per day
+            limit: 25,
+            duration: 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
+/**
+ * Limit how often the provided phone number can be checked against a member's known numbers. Because a
+ * wrong number returns an error, this would otherwise be an oracle to enumerate a member's phone numbers.
+ */
+export const memberPhoneLookupLimiter = new RateLimiter({
+    limits: [
+        {
+            // Max 10 attempts per hour
+            limit: 10,
+            duration: 60 * 60 * 1000,
+        },
+        {
+            // Max 30 attempts per day
+            limit: 30,
+            duration: 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
+/**
+ * Send the security code of a member to the member (or its parents), so an authenticated user can gain
+ * access to a member that is already known in the system but not yet linked to their account.
+ */
+export class SendMemberSecurityCodeEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    bodyDecoder = SendMemberSecurityCodeRequest as Decoder<SendMemberSecurityCodeRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/members/security-code', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        const organization = await Context.setOptionalOrganizationScope();
+        const { user } = await Context.authenticate();
+
+        const body = request.body;
+
+        // Enumeration defense: always consume the per-user rate limit first, before revealing anything.
+        try {
+            userSecurityCodeSendLimiter.track(user.id, 1);
+        } catch (e) {
+            throw new SimpleError({
+                code: 'too_many_requests',
+                message: 'Too many security code requests for this user',
+                human: $t(`%ZbM`),
+                statusCode: 429,
+            });
+        }
+
+        const member = await this.findMember(body, organization);
+        if (!member) {
+            throw new SimpleError({
+                code: 'member_not_found',
+                message: 'No member found for the given details',
+                human: $t(`%ZbF`),
+                statusCode: 404,
+            });
+        }
+
+        if (body.method === SecurityCodeSendMethod.SMS) {
+            return new Response(await this.sendViaSMS(member, organization, body.tryCount, body.phone));
+        }
+
+        return new Response(await this.sendViaEmail(member, organization));
+    }
+
+    /**
+     * Look up the member by id, or by the combination of first name, last name and birth day.
+     * String matching relies on the case- and accent-insensitive collation of the database.
+     */
+    private async findMember(body: SendMemberSecurityCodeRequest, organization: Organization | null): Promise<Member | undefined> {
+        return (await Member.getByID(body.memberId)) ?? undefined;
+    }
+
+    /**
+     * Make sure the member has a security code, generating one if needed.
+     */
+    private async ensureSecurityCode(member: Member): Promise<string> {
+        if (member.details.securityCode === null) {
+            member.details.securityCode = await Member.generateSecurityCode();
+            await member.save();
+        }
+        return member.details.securityCode;
+    }
+
+    private async sendViaEmail(member: Member, organization: Organization | null): Promise<SendMemberSecurityCodeResponse> {
+        const emails = Formatter.uniqueArray([
+            ...member.details.getMemberEmails(),
+            ...member.details.getParentEmails(),
+            ...member.details.unverifiedEmails,
+        ].map(e => e.toLowerCase().trim()));
+
+        if (emails.length === 0) {
+            throw new SimpleError({
+                code: 'no_email',
+                message: 'No email address is known for this member',
+                human: $t(`%Zb1`),
+                statusCode: 400,
+            });
+        }
+
+        // Once every 5 minutes per member
+        this.trackMemberLimit(member, SecurityCodeSendMethod.Email);
+
+        const code = await this.ensureSecurityCode(member);
+        const formattedCode = Formatter.spaceString(code, 4, '-');
+
+        await sendEmailTemplate(organization, {
+            recipients: emails.map(email => Recipient.create({
+                firstName: member.details.firstName,
+                lastName: member.details.lastName,
+                email,
+                replacements: [
+                    Replacement.create({ token: 'requesterEmail', value: Context.auth.user.email }),
+                    Replacement.create({ token: 'firstNameMember', value: member.details.firstName }),
+                    Replacement.create({ token: 'lastNameMember', value: member.details.lastName }),
+                    Replacement.create({
+                        token: 'securityCode',
+                        value: formattedCode,
+                        html: `<p class="style-code-large">${Formatter.escapeHtml(formattedCode)}</p>`,
+                    }),
+                ],
+            })),
+            template: {
+                type: EmailTemplateType.MemberSecurityCode,
+            },
+            type: 'transactional',
+        });
+
+        await this.logSecurityCodeRequested(member, SecurityCodeSendMethod.Email, emails.join(', '));
+
+        return SendMemberSecurityCodeResponse.create({
+            method: SecurityCodeSendMethod.Email,
+            maskedRecipient: '',
+        });
+    }
+
+    private async sendViaSMS(member: Member, organization: Organization | null, tryCount: number, requestedPhone: string | null): Promise<SendMemberSecurityCodeResponse> {
+        // Collect candidate phone numbers, member first, then parents.
+        const uniquePhones = member.details.getPhoneNumbersForVerification();
+
+        if (uniquePhones.length === 0) {
+            throw new SimpleError({
+                code: 'no_phone',
+                message: 'No phone number is known for this member',
+                human: $t(`%Zal`),
+                statusCode: 400,
+            });
+        }
+
+        const defaultCountry = member.details.address?.country ?? organization?.address?.country;
+
+        let phone: string;
+        if (requestedPhone !== null && requestedPhone.trim().length > 0) {
+            // The user filled in a phone number: only send to it if we already know it for this member.
+            // We never send to an arbitrary number (that would leak the code), and this lookup is rate
+            // limited per member so it cannot be used to enumerate a member's phone numbers.
+            try {
+                memberPhoneLookupLimiter.track(member.id, 1);
+            } catch (e) {
+                throw new SimpleError({
+                    code: 'too_many_requests',
+                    message: 'Too many phone number lookups for this member',
+                    human: $t(`%ZbL`),
+                    statusCode: 429,
+                });
+            }
+
+            const requestedE164 = this.normalizePhone(requestedPhone, defaultCountry);
+            const match = requestedE164 === null
+                ? undefined
+                : uniquePhones.find(p => this.normalizePhone(p, defaultCountry) === requestedE164);
+
+            if (!match) {
+                throw new SimpleError({
+                    code: 'phone_not_found',
+                    message: 'The provided phone number is not linked to this member',
+                    human: $t(`%Zar`),
+                    statusCode: 404,
+                });
+            }
+
+            phone = match;
+        } else {
+            // No phone number provided: cycle through the known phone numbers based on the number of previous tries.
+            phone = uniquePhones[Math.abs(tryCount) % uniquePhones.length];
+        }
+
+        // Once every 5 minutes per member
+        this.trackMemberLimit(member, SecurityCodeSendMethod.SMS);
+
+        // Max 25 SMS per organization per day
+        const organizationKey = member.organizationId ?? organization?.id ?? 'platform';
+        try {
+            smsOrganizationLimiter.track(organizationKey, 1);
+        } catch (e) {
+            throw new SimpleError({
+                code: 'too_many_sms',
+                message: 'The daily SMS limit for this organization has been reached',
+                human: $t(`%Zat`),
+                statusCode: 429,
+            });
+        }
+
+        const code = await this.ensureSecurityCode(member);
+        const formattedCode = Formatter.spaceString(code, 4, '-');
+
+        let message = Context.user?.name && !Context.auth.hasSomePlatformAccess()
+            ? $t(`%Zav`, {
+                    organization: organization?.name ?? (await Platform.getShared()).config.name,
+                    firstName: member.details.firstName,
+                    securityCode: formattedCode,
+                    user: Context.user.name,
+                })
+            : $t(`%Zao`, {
+                    organization: organization?.name ?? (await Platform.getShared()).config.name,
+                    firstName: member.details.firstName,
+                    securityCode: formattedCode,
+                });
+
+        if (message.length > 160) {
+            message = Context.user?.firstName && !Context.auth.hasSomePlatformAccess()
+                ? $t(`%Zaz`, {
+                        organization: organization?.name ?? (await Platform.getShared()).config.name,
+                        firstName: member.details.firstName,
+                        securityCode: formattedCode,
+                        user: Context.user.firstName,
+                    })
+                : $t(`%Zaq`, {
+                        organization: organization?.name ?? (await Platform.getShared()).config.name,
+                        firstName: member.details.firstName,
+                        securityCode: formattedCode,
+                    });
+        }
+
+        if (message.length > 160) {
+            message = Context.user?.firstName && !Context.auth.hasSomePlatformAccess()
+                ? $t(`%Zb2`, {
+                        organization: organization?.name ?? (await Platform.getShared()).config.name,
+                        firstName: member.details.firstName,
+                        securityCode: formattedCode,
+                        user: Context.user.firstName,
+                    })
+                : $t(`%Zas`, {
+                        organization: organization?.name ?? (await Platform.getShared()).config.name,
+                        firstName: member.details.firstName,
+                        securityCode: formattedCode,
+                    });
+        }
+
+        await SMSService.send({
+            to: phone,
+            message,
+            defaultCountry: member.details.address?.country ?? organization?.address?.country,
+        });
+
+        const maskedRecipient = this.maskPhone(phone);
+        await this.logSecurityCodeRequested(member, SecurityCodeSendMethod.SMS, maskedRecipient);
+
+        return SendMemberSecurityCodeResponse.create({
+            method: SecurityCodeSendMethod.SMS,
+            maskedRecipient,
+        });
+    }
+
+    /**
+     * Record an audit log entry so it is traceable who requested a member's security code, how and to where.
+     */
+    private async logSecurityCodeRequested(member: Member, method: SecurityCodeSendMethod, maskedRecipient: string) {
+        const log = new AuditLog();
+
+        // A member can belong to multiple organizations, so this is best-effort (mainly visible in the admin panel).
+        log.organizationId = member.organizationId;
+        log.type = AuditLogType.MemberSecurityCodeRequested;
+        log.source = AuditLogSource.User;
+        log.userId = Context.user?.id ?? null;
+        log.objectId = member.id;
+        log.replacements = new Map([
+            ['m', AuditLogReplacement.create({
+                value: member.details.name,
+                type: AuditLogReplacementType.Member,
+                id: member.id,
+            })],
+            ['method', AuditLogReplacement.create({
+                value: method === SecurityCodeSendMethod.SMS ? 'SMS' : 'e-mail',
+            })],
+            ['recipient', AuditLogReplacement.create({
+                value: maskedRecipient,
+            })],
+        ]);
+        await log.save();
+    }
+
+    private trackMemberLimit(member: Member, method: SecurityCodeSendMethod) {
+        try {
+            if (method === SecurityCodeSendMethod.Email) {
+                memberEmailSecurityCodeSendLimiter.track(member.id, 1);
+            } else {
+                memberSecurityCodeSendLimiter.track(member.id, 1);
+            }
+        } catch (e) {
+            throw new SimpleError({
+                code: 'too_many_requests',
+                message: 'A security code was already sent for this member recently',
+                human: $t(`%Zaw`),
+                statusCode: 429,
+            });
+        }
+    }
+
+    /**
+     * Normalize a phone number to E.164 for comparison, returning null when it cannot be parsed.
+     */
+    private normalizePhone(phone: string, defaultCountry: Country | undefined): string | null {
+        try {
+            return SMSService.toE164(phone, defaultCountry);
+        } catch (e) {
+            return null;
+        }
+    }
+
+    /**
+     * Return a masked version of a phone number that is safe to show to the user, e.g. "•••• 89".
+     */
+    private maskPhone(phone: string): string {
+        const digits = phone.replace(/\D/g, '');
+        const last = digits.substring(Math.max(0, digits.length - 2));
+        return '•• •• ' + last;
+    }
+}

package/src/endpoints/global/members/shouldCheckIfMemberIsDuplicate.ts

@@ -1,6 +1,5 @@
 import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
 import type { MemberDetails } from '@stamhoofd/structures';
-import { MemberWithRegistrationsBlob } from '@stamhoofd/structures';
 
 /**
  * Returns true when either the firstname, lastname or birthday has changed

package/src/endpoints/global/registration/PatchUserMembersEndpoint.test.ts

@@ -9,6 +9,7 @@ import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { initUitpasApi } from '../../../../tests/init/index.js';
 import { PatchUserMembersEndpoint } from './PatchUserMembersEndpoint.js';
+import { MemberUserSyncer } from '../../../helpers/MemberUserSyncer.js';
 
 const baseUrl = `/members`;
 const endpoint = new PatchUserMembersEndpoint();
@@ -39,6 +40,8 @@ describe('Endpoint.PatchUserMembersEndpoint', () => {
                 birthDay,
                 generateData: true,
             }).create();
+            existingMember.details.nationalRegisterNumber = '123454123';
+            await existingMember.save();
 
             const token = await Token.createToken(user);
 
@@ -99,6 +102,9 @@ describe('Endpoint.PatchUserMembersEndpoint', () => {
             expect(member.details.birthDay).toEqual(newBirthDay);
             expect(member.details.email).toBe('anewemail@example.com'); // this has been merged
             expect(member.details.alternativeEmails).toHaveLength(0);
+
+            // Check access
+            expect(member.users.filter(u => u.id === user.id)).toHaveLength(1);
         });
 
         test('A duplicate member with existing registrations returns those registrations after a merge', async () => {
@@ -169,6 +175,99 @@ describe('Endpoint.PatchUserMembersEndpoint', () => {
             // Check parent is still there
             expect(member.details.parents.length).toBe(1);
             expect(member.details.parents[0]).toEqual(existingMember.details.parents[0]);
+
+            // Check access
+            expect(member.users.filter(u => u.id === user.id)).toHaveLength(1);
+        });
+
+        test('Putting a new member without email address gives you access and links your user', async () => {
+            const organization = await new OrganizationFactory({ }).create();
+            const user = await new UserFactory({ organization }).create();
+
+            const token = await Token.createToken(user);
+
+            const arr: Body = new PatchableArray();
+            const put = MemberWithRegistrationsBlob.create({
+                details: MemberDetails.create({
+                    firstName: 'Invented ' + Math.floor(Math.random() * 100000),
+                    lastName: 'Last ' + Math.floor(Math.random() * 100000),
+                    birthDay: new Date(),
+                    // Security code is not required: you have access
+                }),
+            });
+            arr.addPut(put);
+
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+            const response = await testServer.test(endpoint, request);
+            expect(response.status).toBe(200);
+
+            // Check id of the returned memebr matches the existing member
+            expect(response.body.members.length).toBe(1);
+
+            // Check data matches the original data + changes from the put
+            const member = response.body.members[0];
+
+            // Check access
+            expect(member.users.map(u => u.id)).toEqual([user.id]);
+        });
+
+        test('[Regression] Putting a new member with same name of existing member you have access to does not create a duplicate link', async () => {
+            const organization = await new OrganizationFactory({ }).create();
+            const user = await new UserFactory({ organization }).create();
+            const details = MemberDetails.create({
+                firstName,
+                lastName,
+                securityCode: 'ABC-123',
+                parents: [
+                    Parent.create({
+                        firstName: 'Jane',
+                        lastName: 'Doe',
+                    }),
+                ],
+            });
+
+            const existingMember = await new MemberFactory({
+                birthDay,
+                details,
+            }).create();
+
+            await MemberUserSyncer.linkUser(user.email, existingMember, true);
+
+            // Check access
+            expect(existingMember.users).toHaveLength(1);
+
+            const token = await Token.createToken(user);
+
+            const arr: Body = new PatchableArray();
+            const newBirthDay = new Date(existingMember.details.birthDay!.getTime() + 1000);
+            const put = MemberWithRegistrationsBlob.create({
+                details: MemberDetails.create({
+                    firstName,
+                    lastName,
+                    birthDay: newBirthDay,
+                    // Security code is not required: you have access
+                }),
+            });
+            arr.addPut(put);
+
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+            const response = await testServer.test(endpoint, request);
+            expect(response.status).toBe(200);
+
+            // Check id of the returned memebr matches the existing member
+            expect(response.body.members.length).toBe(1);
+            expect(response.body.members[0].id).toBe(existingMember.id);
+
+            // Check data matches the original data + changes from the put
+            const member = response.body.members[0];
+            expect(member.details.firstName).toBe(firstName);
+            expect(member.details.lastName).toBe(lastName);
+            expect(member.details.birthDay).toEqual(newBirthDay);
+
+            // Check access
+            expect(member.users.map(u => u.id)).toEqual([user.id]);
         });
     });
 

package/src/endpoints/global/registration/PatchUserMembersEndpoint.ts

@@ -6,7 +6,7 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import type { Group, Registration } from '@stamhoofd/models';
 import { Document, Member, RateLimiter } from '@stamhoofd/models';
 import type { MemberDetails, MembersBlob } from '@stamhoofd/structures';
-import { MemberWithRegistrationsBlob } from '@stamhoofd/structures';
+import { BooleanStatus, MemberWithRegistrationsBlob } from '@stamhoofd/structures';
 
 import type { OneToManyRelation } from '@simonbackx/simple-database';
 import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures.js';
@@ -112,6 +112,7 @@ export class PatchUserMembersEndpoint extends Endpoint<Params, Query, Body, Resp
                 const previousUitpasNumber = member.details.uitpasNumberDetails?.uitpasNumber ?? null;
 
                 const originalReviewTimes = member.details.reviewTimes;
+
                 member.details.patchOrPut(struct.details);
 
                 if (struct.details.uitpasNumberDetails || didUitpasReviewChange(struct.details.reviewTimes, originalReviewTimes)) {
@@ -120,6 +121,20 @@ export class PatchUserMembersEndpoint extends Endpoint<Params, Query, Body, Resp
 
                 member.details.cleanData();
                 this.throwIfInvalidDetails(member.details);
+
+                // give the parents access to the member they are patching if they would loose access
+                if (
+                    // if the parents have no access after the patch
+                    !member.details.calculatedParentsHaveAccess
+                    // and the parent access is not yet configured
+                    && member.details.parentsHaveAccess === null
+                    // and the user is one of the parents
+                    && member.details.parents.find(p => p.email === user.email)) {
+                    // grant parents access
+                    member.details.parentsHaveAccess = BooleanStatus.create({
+                        value: true,
+                    });
+                }
             }
 
             if (!member.details) {
@@ -156,30 +171,25 @@ export class PatchUserMembersEndpoint extends Endpoint<Params, Query, Body, Resp
             await Document.updateForMember(member);
         }
 
-        // Modify members
-        if (addedMembers.length > 0) {
-            // Give access to created members
-            await Member.users.reverse('members').link(user, addedMembers);
-        }
-
         await PatchOrganizationMembersEndpoint.deleteMembers(request.body.getDeletes());
 
-        members = await Member.getMembersWithRegistrationForUser(user);
-
-        for (const member of addedMembers) {
-            const updatedMember = members.find(m => m.id === member.id);
-            if (updatedMember) {
-                // Make sure we also give access to other parents
-                await MemberUserSyncer.onChangeMember(updatedMember);
+        for (const updatedMember of addedMembers) {
+            await Member.users.load(updatedMember);
+            if (!Member.users.isLoaded(updatedMember)) {
+                throw new Error('Failed to load users for member ' + updatedMember.id);
+            }
 
-                if (!updatedMember.users.find(u => u.id === user.id)) {
-                    // Also link the user to the member if the email address is missing in the details
-                    await MemberUserSyncer.linkUser(user.email, updatedMember, true);
-                }
+            // Make sure we also give access to other parents
+            await MemberUserSyncer.onChangeMember(updatedMember);
 
-                await Document.updateForMember(updatedMember);
+            if (!updatedMember.users.find(u => u.id === user.id)) {
+                // Also link the user to the member if the email address is missing in the details
+                await MemberUserSyncer.linkUser(user.email, updatedMember, true);
             }
+
+            await Document.updateForMember(updatedMember);
         }
+        members = await Member.getMembersWithRegistrationForUser(user);
 
         return new Response(
             await AuthenticatedStructures.membersBlob(members),

package/src/endpoints/organization/dashboard/webshops/PatchWebshopOrdersEndpoint.ts

@@ -155,12 +155,9 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                         payment.method = struct.data.paymentMethod;
 
                         // quick throw to prevent payment from being saved
-                        if (payment.method === PaymentMethod.Transfer && !webshop.meta.paymentConfiguration.transferSettings.iban) {
-                            throw new SimpleError({
-                                code: 'missing_iban',
-                                message: 'Missing IBAN',
-                                human: $t(`%w2`),
-                            });
+                        if (payment.method === PaymentMethod.Transfer) {
+                            // will throw if iban is missing
+                            order.getTransferSettings({ shouldThrowIfNoIban: true });
                         }
 
                         payment.status = PaymentStatus.Created;