@stamhoofd/backend 2.128.0 → 2.129.1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.128.0",
+    "version": "2.129.1",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -57,20 +57,20 @@
         "@simonbackx/simple-endpoints": "1.21.1",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.128.0",
-        "@stamhoofd/backend-i18n": "2.128.0",
-        "@stamhoofd/backend-middleware": "2.128.0",
-        "@stamhoofd/crons": "2.128.0",
-        "@stamhoofd/email": "2.128.0",
-        "@stamhoofd/excel-writer": "2.128.0",
-        "@stamhoofd/logging": "2.128.0",
-        "@stamhoofd/models": "2.128.0",
-        "@stamhoofd/object-differ": "2.128.0",
-        "@stamhoofd/queues": "2.128.0",
-        "@stamhoofd/sql": "2.128.0",
-        "@stamhoofd/structures": "2.128.0",
-        "@stamhoofd/types": "2.128.0",
-        "@stamhoofd/utility": "2.128.0",
+        "@stamhoofd/backend-env": "2.129.1",
+        "@stamhoofd/backend-i18n": "2.129.1",
+        "@stamhoofd/backend-middleware": "2.129.1",
+        "@stamhoofd/crons": "2.129.1",
+        "@stamhoofd/email": "2.129.1",
+        "@stamhoofd/excel-writer": "2.129.1",
+        "@stamhoofd/logging": "2.129.1",
+        "@stamhoofd/models": "2.129.1",
+        "@stamhoofd/object-differ": "2.129.1",
+        "@stamhoofd/queues": "2.129.1",
+        "@stamhoofd/sql": "2.129.1",
+        "@stamhoofd/structures": "2.129.1",
+        "@stamhoofd/types": "2.129.1",
+        "@stamhoofd/utility": "2.129.1",
         "archiver": "7.0.1",
         "axios": "1.16.0",
         "base-x": "3.0.11",
@@ -91,7 +91,7 @@
         "stripe": "16.12.0"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.128.0",
+        "@stamhoofd/test-utils": "2.129.1",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.1",
         "@types/mailparser": "3.4.6",
@@ -107,5 +107,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "77c7e13c592a4d51542716d204c3b39dd9d28ec7"
+    "gitHead": "fed4dfbbbb768c9d57c476b93a3a42dfac6dd69b"
 }

package/src/crons/mollie-refunds.ts

@@ -16,7 +16,7 @@ export const MOLLIE_REFUNDS_MINIMUM_DATE = new Date('2026-06-22T00:00:00.000Z');
 let lastRun: Date | null = null;
 export async function checkMollieRefunds() {
     if (STAMHOOFD.environment !== 'development') {
-        if (lastRun && new Date().getTime() - lastRun.getTime() < 1000 * 60 * 60 * 24) {
+        if (lastRun && new Date().getTime() - lastRun.getTime() < 1000 * 60 * 60 * 12) {
             return;
         }
         lastRun = new Date();

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.test.ts

@@ -47,6 +47,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 lastName,
                 birthDay,
                 generateData: true,
+                generateSensitiveData: true,
             }).create();
 
             const token = await Token.createToken(user);
@@ -94,6 +95,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 lastName,
                 birthDay,
                 generateData: true,
+                generateSensitiveData: true,
                 // should be member of the same organization
                 organization,
             }).create();
@@ -148,6 +150,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 lastName,
                 birthDay,
                 generateData: true,
+                generateSensitiveData: true,
                 // should be member of the same organization
                 organization,
             }).create();
@@ -157,6 +160,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 lastName,
                 birthDay,
                 generateData: true,
+                generateSensitiveData: true,
                 // should be member of the same organization
                 organization,
             }).create();
@@ -185,7 +189,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
             request.headers.authorization = 'Bearer ' + token.accessToken;
             await expect(testServer.test(endpoint, request))
                 .rejects
-                .toThrow(STExpect.errorWithCode('not_found'));
+                .toThrow(STExpect.errorWithCode('known_member_missing_rights'));
         });
 
         test('Should be able to create duplicate from another organization in userMode organization', async () => {
@@ -215,6 +219,7 @@ describe('Endpoint.PatchOrganizationMembersEndpoint', () => {
                 lastName,
                 birthDay,
                 generateData: true,
+                generateSensitiveData: true,
                 // member of other organization
                 organization: otherOrganization,
                 details: MemberDetails.create({

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.ts

@@ -33,13 +33,38 @@ type ResponseBody = MembersBlob;
 export const securityCodeLimiter = new RateLimiter({
     limits: [
         {
-            // Max 10 a day
-            limit: 10,
+            // Max 5 per 15 minutes (this makes sure accidental enters block maximum 15 minutes and not the whole day)
+            limit: 5,
+            duration: 15 * 60 * 1000 * 60,
+        },
+        {
+            // Max 12 a day
+            limit: 12,
             duration: 24 * 60 * 1000 * 60,
         },
     ],
 });
 
+export const duplicateCheckLimiter = new RateLimiter({
+    limits: [
+        {
+            // Max 5 requests per 5 minutes
+            limit: 5,
+            duration: 15 * 60 * 1000,
+        },
+        {
+            // Max 6 requests per 10 minutes
+            limit: 6,
+            duration: 15 * 60 * 1000,
+        },
+        {
+            // Max 7 requests per day
+            limit: 7,
+            duration: 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
 /**
  * One endpoint to create, patch and delete members and their registrations and payments
  */
@@ -168,7 +193,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
                 throw Context.auth.memberNotFoundOrNoAccess();
             }
 
-            await PatchOrganizationMembersEndpoint.checkCanAccessMember(member, securityCode, 'patch');
+            await PatchOrganizationMembersEndpoint.checkCanAccessMember(member, securityCode, 'direct');
 
             patch = await Context.auth.filterMemberPatch(member, patch);
             const originalDetails = member.details.clone();
@@ -1011,13 +1036,13 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
         await log.save();
     }
 
-    static async checkCanAccessMember(member: MemberWithUsersRegistrationsAndGroups, securityCode: string | null | undefined, type: 'put' | 'patch') {
-        if ((type === 'put' && await member.isSafeToMergeDuplicateWithoutSecurityCode(Context.auth.user.email)) || await Context.auth.canAccessMember(member, PermissionLevel.Write)) {
+    static async checkCanAccessMember(member: MemberWithUsersRegistrationsAndGroups, securityCode: string | null | undefined, type: 'put' | 'patch' | 'direct') {
+        if ((type !== 'direct' && await member.isSafeToMergeDuplicateWithoutSecurityCode(Context.auth.user.email)) || await Context.auth.canAccessMember(member, PermissionLevel.Write)) {
             console.log('checkSecurityCode: without security code: allowed for ' + member.id);
         } else if (securityCode) {
             await this.checkSecurityCode(member, securityCode);
         } else {
-            if (type === 'patch') {
+            if (type === 'direct') {
                 throw Context.auth.memberNotFoundOrNoAccess();
             }
 
@@ -1029,6 +1054,9 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
                     email: Context.auth.user.email,
                 }),
                 statusCode: 400,
+                meta: {
+                    id: member.id,
+                },
             });
         }
     }
@@ -1052,6 +1080,24 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
             return;
         }
 
+        if ((!member.organizationId && !Context.auth.hasSomePlatformAccess()) || (member.organizationId && !await Context.auth.hasSomeAccess(member.organizationId))) {
+            try {
+                duplicateCheckLimiter.track(member.organizationId + '-' + Formatter.slug(member.details.name), 1);
+            } catch (e) {
+                Email.sendWebmaster({
+                    subject: '[Limiet] Limiet bereikt voor aantal duplicate checks per member name',
+                    text: $t(`%EA`) + ' ' + member.details.name + ' ' + '(Org: ' + ' ' + member.organizationId + ')' + ' by ' + Context.user?.id + '\n\n' + e.message + '\n\nStamhoofd',
+                });
+
+                throw new SimpleError({
+                    code: 'too_many_tries',
+                    message: 'Too many names',
+                    human: $t(`%ZbQ`),
+                    field: 'details.name',
+                });
+            }
+        }
+
         // Check for duplicates and prevent creating a duplicate member by a user
         const duplicate = await this.findExistingMember(member);
         if (duplicate) {

package/src/endpoints/global/members/SendMemberSecurityCodeEndpoint.test.ts

@@ -1,14 +1,14 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { EmailMocker } from '@stamhoofd/email';
 import type { RateLimiter } from '@stamhoofd/models';
-import { EmailTemplateFactory, Member, MemberFactory, OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
-import { EmailTemplateType, MemberDetails, Parent, ParentType, SecurityCodeSendMethod, SendMemberSecurityCodeRequest } from '@stamhoofd/structures';
+import { AuditLog, EmailTemplateFactory, Member, MemberFactory, OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { AuditLogReplacementType, AuditLogType, EmailTemplateType, MemberDetails, Parent, ParentType, SecurityCodeSendMethod, SendMemberSecurityCodeRequest } from '@stamhoofd/structures';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { Formatter } from '@stamhoofd/utility';
 import type { SMSMocker } from '../../../../tests/helpers/SMSMocker.js';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { initSMSApi } from '../../../../tests/init/index.js';
-import { memberPhoneLookupLimiter, memberSecurityCodeSendLimiter, nameSecurityCodeSendLimiter, SendMemberSecurityCodeEndpoint, smsOrganizationLimiter, userSecurityCodeSendLimiter } from './SendMemberSecurityCodeEndpoint.js';
+import { memberPhoneLookupLimiter, memberSecurityCodeSendLimiter, SendMemberSecurityCodeEndpoint, smsOrganizationLimiter, userSecurityCodeSendLimiter } from './SendMemberSecurityCodeEndpoint.js';
 
 const baseUrl = `/members/security-code`;
 const endpoint = new SendMemberSecurityCodeEndpoint();
@@ -31,7 +31,6 @@ describe('Endpoint.SendMemberSecurityCode', () => {
 
         // Rate limiters are in-memory singletons, reset them between tests
         resetLimiter(memberSecurityCodeSendLimiter);
-        resetLimiter(nameSecurityCodeSendLimiter);
         resetLimiter(userSecurityCodeSendLimiter);
         resetLimiter(smsOrganizationLimiter);
         resetLimiter(memberPhoneLookupLimiter);
@@ -75,12 +74,10 @@ describe('Endpoint.SendMemberSecurityCode', () => {
     }
 
     test('sends the code via email to all known email addresses', async () => {
-        const { organization, token } = await setup();
+        const { organization, token, member } = await setup();
 
         const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.Email,
         }));
 
@@ -99,19 +96,17 @@ describe('Endpoint.SendMemberSecurityCode', () => {
 
     test('sends the code via SMS to the member phone number', async () => {
         const mocker: SMSMocker = initSMSApi();
-        const { organization, token } = await setup();
+        const { organization, token, member } = await setup();
 
         const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.SMS,
         }));
 
         const response = await testServer.test(endpoint, request);
 
         expect(response.body.method).toBe(SecurityCodeSendMethod.SMS);
-        expect(response.body.maskedRecipient).toBe('•••• 56');
+        expect(response.body.maskedRecipient).toBe('•• •• 56');
 
         expect(mocker.sentMessages.length).toBe(1);
         expect(mocker.lastMessage!.recipient).toEqual(32470123456);
@@ -123,12 +118,10 @@ describe('Endpoint.SendMemberSecurityCode', () => {
 
     test('cycles to the next phone number on retries', async () => {
         const mocker: SMSMocker = initSMSApi();
-        const { organization, token } = await setup();
+        const { organization, token, member } = await setup();
 
         const body = SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.SMS,
             tryCount: 0,
         });
@@ -140,9 +133,7 @@ describe('Endpoint.SendMemberSecurityCode', () => {
         resetLimiter(memberSecurityCodeSendLimiter);
 
         const retry = SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.SMS,
             tryCount: 1,
         });
@@ -150,19 +141,17 @@ describe('Endpoint.SendMemberSecurityCode', () => {
 
         expect(mocker.sentMessages.length).toBe(2);
         expect(mocker.lastMessage!.recipient).toEqual(32471987654);
-        expect(response.body.maskedRecipient).toBe('•••• 54');
+        expect(response.body.maskedRecipient).toBe('•• •• 54');
     });
 
     test('only sends to the provided phone number when it matches a known number', async () => {
         const mocker: SMSMocker = initSMSApi();
-        const { organization, token } = await setup();
+        const { organization, token, member } = await setup();
 
         // Provide the parent number in national format. Even though tryCount 0 would normally select the
         // member number, an exact (normalized) match must win.
         const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.SMS,
             tryCount: 0,
             phone: '0471 98 76 54',
@@ -172,17 +161,15 @@ describe('Endpoint.SendMemberSecurityCode', () => {
 
         expect(mocker.sentMessages.length).toBe(1);
         expect(mocker.lastMessage!.recipient).toEqual(32471987654);
-        expect(response.body.maskedRecipient).toBe('•••• 54');
+        expect(response.body.maskedRecipient).toBe('•• •• 54');
     });
 
     test('throws when the provided phone number is not known for the member', async () => {
         const mocker: SMSMocker = initSMSApi();
-        const { organization, token } = await setup();
+        const { organization, token, member } = await setup();
 
         const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.SMS,
             phone: '+32 490 00 00 00',
         }));
@@ -205,9 +192,7 @@ describe('Endpoint.SendMemberSecurityCode', () => {
         }
 
         const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.SMS,
             phone: '+32 490 00 00 00',
         }));
@@ -218,17 +203,48 @@ describe('Endpoint.SendMemberSecurityCode', () => {
         expect(mocker.sentMessages.length).toBe(0);
     });
 
-    test('can look up the member by id', async () => {
-        const { organization, token, member } = await setup();
+    test('creates an audit log when a security code is requested via email', async () => {
+        const { organization, user, token, member } = await setup();
 
-        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
             memberId: member.id,
             method: SecurityCodeSendMethod.Email,
-        }));
+        })));
+
+        const log = await AuditLog.select()
+            .where('type', AuditLogType.MemberSecurityCodeRequested)
+            .where('objectId', member.id)
+            .first(true);
+
+        expect(log.userId).toBe(user.id);
+        expect(log.organizationId).toBe(member.organizationId);
+        expect(log.replacements.get('m')).toMatchObject({
+            id: member.id,
+            value: member.details.name,
+            type: AuditLogReplacementType.Member,
+        });
+        expect(log.replacements.get('method')?.value).toBe('e-mail');
+        expect(log.replacements.get('recipient')?.value).toContain('kid@example.com');
+        expect(log.replacements.get('recipient')?.value).toContain('parent@example.com');
+    });
 
-        const response = await testServer.test(endpoint, request);
-        expect(response.body.method).toBe(SecurityCodeSendMethod.Email);
-        expect(await EmailMocker.transactional.getSucceededCount()).toBe(2);
+    test('creates an audit log with the masked recipient when a security code is requested via SMS', async () => {
+        initSMSApi();
+        const { user, organization, token, member } = await setup();
+
+        await testServer.test(endpoint, buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
+            memberId: member.id,
+            method: SecurityCodeSendMethod.SMS,
+        })));
+
+        const log = await AuditLog.select()
+            .where('type', AuditLogType.MemberSecurityCodeRequested)
+            .where('objectId', member.id)
+            .first(true);
+
+        expect(log.userId).toBe(user.id);
+        expect(log.replacements.get('method')?.value).toBe('SMS');
+        expect(log.replacements.get('recipient')?.value).toBe('•• •• 56');
     });
 
     test('generates a security code if the member has none', async () => {
@@ -239,9 +255,7 @@ describe('Endpoint.SendMemberSecurityCode', () => {
         await member.save();
 
         const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.Email,
         }));
 
@@ -261,9 +275,7 @@ describe('Endpoint.SendMemberSecurityCode', () => {
         const { organization, token } = await setup();
 
         const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
-            firstName: 'Unknown',
-            lastName: 'Person',
-            birthDay: new Date(Date.UTC(2000, 0, 1)),
+            memberId: 'not-found',
             method: SecurityCodeSendMethod.Email,
         }));
 
@@ -274,12 +286,10 @@ describe('Endpoint.SendMemberSecurityCode', () => {
 
     test('throws when the member has no phone number for SMS', async () => {
         initSMSApi();
-        const { organization, token } = await setup({ phone: null, parents: [] });
+        const { organization, token, member } = await setup({ phone: null, parents: [] });
 
         const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.SMS,
         }));
 
@@ -288,13 +298,11 @@ describe('Endpoint.SendMemberSecurityCode', () => {
             .toThrow(STExpect.errorWithCode('no_phone'));
     });
 
-    test('rate limits sending per member', async () => {
-        const { organization, token } = await setup();
+    test('rate limits sending email per member', async () => {
+        const { organization, token, member } = await setup();
 
         const body = () => SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.Email,
         });
 
@@ -308,12 +316,10 @@ describe('Endpoint.SendMemberSecurityCode', () => {
     test('rate limits sending SMS per member', async () => {
         const mocker: SMSMocker = initSMSApi();
 
-        const { organization, token } = await setup();
+        const { organization, token, member } = await setup();
 
         const body = () => SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.SMS,
         });
 
@@ -327,28 +333,6 @@ describe('Endpoint.SendMemberSecurityCode', () => {
         expect(mocker.sentMessages.length).toBe(3);
     });
 
-    test('rate limits by member name and organization to prevent birthday guessing', async () => {
-        const { organization, token } = await setup();
-
-        // Simulate that the hourly limit for this member name in this organization is already reached
-        const nameKey = organization.id + ':jef testman';
-        for (let i = 0; i < 10; i++) {
-            nameSecurityCodeSendLimiter.track(nameKey, 1);
-        }
-
-        // Even with a wrong birth day, the request is blocked before the member lookup happens
-        const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(1990, 0, 1)),
-            method: SecurityCodeSendMethod.Email,
-        }));
-
-        await expect(testServer.test(endpoint, request))
-            .rejects
-            .toThrow(STExpect.errorWithCode('too_many_requests'));
-    });
-
     test('rate limits SMS per organization to 25 per day', async () => {
         const mocker: SMSMocker = initSMSApi();
         const { organization, token, member } = await setup();
@@ -359,9 +343,7 @@ describe('Endpoint.SendMemberSecurityCode', () => {
         }
 
         const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.SMS,
         }));
 
@@ -372,7 +354,7 @@ describe('Endpoint.SendMemberSecurityCode', () => {
     });
 
     test('rate limits per user to prevent enumeration', async () => {
-        const { organization, user, token } = await setup();
+        const { organization, user, token, member } = await setup();
 
         // Simulate that the user already reached the hourly limit
         for (let i = 0; i < 20; i++) {
@@ -380,9 +362,7 @@ describe('Endpoint.SendMemberSecurityCode', () => {
         }
 
         const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.Email,
         }));
 
@@ -394,12 +374,10 @@ describe('Endpoint.SendMemberSecurityCode', () => {
     test('reports an error when the SMS gateway fails', async () => {
         const mocker: SMSMocker = initSMSApi();
         mocker.forceFailure();
-        const { organization, token } = await setup();
+        const { organization, token, member } = await setup();
 
         const request = buildRequest(organization.getApiHost(), token, SendMemberSecurityCodeRequest.create({
-            firstName: 'Jef',
-            lastName: 'Testman',
-            birthDay: new Date(Date.UTC(2010, 4, 5)),
+            memberId: member.id,
             method: SecurityCodeSendMethod.SMS,
         }));
 

package/src/endpoints/global/members/SendMemberSecurityCodeEndpoint.ts

@@ -3,8 +3,8 @@ import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import type { Organization } from '@stamhoofd/models';
-import { Member, Platform, RateLimiter, sendEmailTemplate } from '@stamhoofd/models';
-import { EmailTemplateType, Recipient, Replacement, SecurityCodeSendMethod, SendMemberSecurityCodeRequest, SendMemberSecurityCodeResponse } from '@stamhoofd/structures';
+import { AuditLog, Member, Platform, RateLimiter, sendEmailTemplate } from '@stamhoofd/models';
+import { AuditLogReplacement, AuditLogReplacementType, AuditLogSource, AuditLogType, EmailTemplateType, Recipient, Replacement, SecurityCodeSendMethod, SendMemberSecurityCodeRequest, SendMemberSecurityCodeResponse } from '@stamhoofd/structures';
 import type { Country } from '@stamhoofd/types/Country';
 import { Formatter } from '@stamhoofd/utility';
 
@@ -56,25 +56,6 @@ export const memberEmailSecurityCodeSendLimiter = new RateLimiter({
     ],
 });
 
-/**
- * Limit per member name + organization, so a birth day cannot be guessed or detected by
- * trying different birth days for a known member name.
- */
-export const nameSecurityCodeSendLimiter = new RateLimiter({
-    limits: [
-        {
-            // Max 10 requests per hour
-            limit: 10,
-            duration: 60 * 60 * 1000,
-        },
-        {
-            // Max 20 requests per day
-            limit: 20,
-            duration: 24 * 60 * 60 * 1000,
-        },
-    ],
-});
-
 /**
  * Limit per user to avoid member enumeration attacks.
  */
@@ -190,51 +171,7 @@ export class SendMemberSecurityCodeEndpoint extends Endpoint<Params, Query, Body
      * String matching relies on the case- and accent-insensitive collation of the database.
      */
     private async findMember(body: SendMemberSecurityCodeRequest, organization: Organization | null): Promise<Member | undefined> {
-        if (body.memberId) {
-            return (await Member.getByID(body.memberId)) ?? undefined;
-        }
-
-        if (!body.firstName || !body.lastName || !body.birthDay) {
-            throw new SimpleError({
-                code: 'invalid_field',
-                message: 'Either memberId or firstName, lastName and birthDay are required',
-                human: $t(`%Zb9`),
-                statusCode: 400,
-            });
-        }
-
-        // Rate limit by member name + organization (checked before the lookup, so a birth day cannot be
-        // guessed or detected by trying different birth days for a known member name).
-        const nameKey = (organization?.id ?? 'platform') + ':' + body.firstName.toLowerCase().trim() + ' ' + body.lastName.toLowerCase().trim();
-        try {
-            nameSecurityCodeSendLimiter.track(nameKey, 1);
-        } catch (e) {
-            throw new SimpleError({
-                code: 'too_many_requests',
-                message: 'Too many security code requests for this member name',
-                human: $t(`%ZbM`),
-                statusCode: 429,
-            });
-        }
-
-        const query: { firstName: string; lastName: string; birthDay: string; organizationId?: string } = {
-            firstName: body.firstName,
-            lastName: body.lastName,
-            birthDay: Formatter.dateIso(body.birthDay),
-        };
-
-        // In organization mode members are scoped to a single organization
-        if (organization && STAMHOOFD.userMode !== 'platform') {
-            query.organizationId = organization.id;
-        }
-
-        const members = await Member.where(query);
-        if (members.length === 0) {
-            return undefined;
-        }
-
-        // Prefer a member that already has a security code set
-        return members.find(m => m.details.securityCode) ?? members[0];
+        return (await Member.getByID(body.memberId)) ?? undefined;
     }
 
     /**
@@ -292,6 +229,8 @@ export class SendMemberSecurityCodeEndpoint extends Endpoint<Params, Query, Body
             type: 'transactional',
         });
 
+        await this.logSecurityCodeRequested(member, SecurityCodeSendMethod.Email, emails.join(', '));
+
         return SendMemberSecurityCodeResponse.create({
             method: SecurityCodeSendMethod.Email,
             maskedRecipient: '',
@@ -417,12 +356,43 @@ export class SendMemberSecurityCodeEndpoint extends Endpoint<Params, Query, Body
             defaultCountry: member.details.address?.country ?? organization?.address?.country,
         });
 
+        const maskedRecipient = this.maskPhone(phone);
+        await this.logSecurityCodeRequested(member, SecurityCodeSendMethod.SMS, maskedRecipient);
+
         return SendMemberSecurityCodeResponse.create({
             method: SecurityCodeSendMethod.SMS,
-            maskedRecipient: this.maskPhone(phone),
+            maskedRecipient,
         });
     }
 
+    /**
+     * Record an audit log entry so it is traceable who requested a member's security code, how and to where.
+     */
+    private async logSecurityCodeRequested(member: Member, method: SecurityCodeSendMethod, maskedRecipient: string) {
+        const log = new AuditLog();
+
+        // A member can belong to multiple organizations, so this is best-effort (mainly visible in the admin panel).
+        log.organizationId = member.organizationId;
+        log.type = AuditLogType.MemberSecurityCodeRequested;
+        log.source = AuditLogSource.User;
+        log.userId = Context.user?.id ?? null;
+        log.objectId = member.id;
+        log.replacements = new Map([
+            ['m', AuditLogReplacement.create({
+                value: member.details.name,
+                type: AuditLogReplacementType.Member,
+                id: member.id,
+            })],
+            ['method', AuditLogReplacement.create({
+                value: method === SecurityCodeSendMethod.SMS ? 'SMS' : 'e-mail',
+            })],
+            ['recipient', AuditLogReplacement.create({
+                value: maskedRecipient,
+            })],
+        ]);
+        await log.save();
+    }
+
     private trackMemberLimit(member: Member, method: SecurityCodeSendMethod) {
         try {
             if (method === SecurityCodeSendMethod.Email) {
@@ -457,6 +427,6 @@ export class SendMemberSecurityCodeEndpoint extends Endpoint<Params, Query, Body
     private maskPhone(phone: string): string {
         const digits = phone.replace(/\D/g, '');
         const last = digits.substring(Math.max(0, digits.length - 2));
-        return '•••• ' + last;
+        return '•• •• ' + last;
     }
 }

package/src/endpoints/global/members/shouldCheckIfMemberIsDuplicate.ts

@@ -1,6 +1,5 @@
 import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
 import type { MemberDetails } from '@stamhoofd/structures';
-import { MemberWithRegistrationsBlob } from '@stamhoofd/structures';
 
 /**
  * Returns true when either the firstname, lastname or birthday has changed

package/src/endpoints/global/registration/PatchUserMembersEndpoint.test.ts

@@ -9,6 +9,7 @@ import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { initUitpasApi } from '../../../../tests/init/index.js';
 import { PatchUserMembersEndpoint } from './PatchUserMembersEndpoint.js';
+import { MemberUserSyncer } from '../../../helpers/MemberUserSyncer.js';
 
 const baseUrl = `/members`;
 const endpoint = new PatchUserMembersEndpoint();
@@ -101,6 +102,9 @@ describe('Endpoint.PatchUserMembersEndpoint', () => {
             expect(member.details.birthDay).toEqual(newBirthDay);
             expect(member.details.email).toBe('anewemail@example.com'); // this has been merged
             expect(member.details.alternativeEmails).toHaveLength(0);
+
+            // Check access
+            expect(member.users.filter(u => u.id === user.id)).toHaveLength(1);
         });
 
         test('A duplicate member with existing registrations returns those registrations after a merge', async () => {
@@ -171,6 +175,99 @@ describe('Endpoint.PatchUserMembersEndpoint', () => {
             // Check parent is still there
             expect(member.details.parents.length).toBe(1);
             expect(member.details.parents[0]).toEqual(existingMember.details.parents[0]);
+
+            // Check access
+            expect(member.users.filter(u => u.id === user.id)).toHaveLength(1);
+        });
+
+        test('Putting a new member without email address gives you access and links your user', async () => {
+            const organization = await new OrganizationFactory({ }).create();
+            const user = await new UserFactory({ organization }).create();
+
+            const token = await Token.createToken(user);
+
+            const arr: Body = new PatchableArray();
+            const put = MemberWithRegistrationsBlob.create({
+                details: MemberDetails.create({
+                    firstName: 'Invented ' + Math.floor(Math.random() * 100000),
+                    lastName: 'Last ' + Math.floor(Math.random() * 100000),
+                    birthDay: new Date(),
+                    // Security code is not required: you have access
+                }),
+            });
+            arr.addPut(put);
+
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+            const response = await testServer.test(endpoint, request);
+            expect(response.status).toBe(200);
+
+            // Check id of the returned memebr matches the existing member
+            expect(response.body.members.length).toBe(1);
+
+            // Check data matches the original data + changes from the put
+            const member = response.body.members[0];
+
+            // Check access
+            expect(member.users.map(u => u.id)).toEqual([user.id]);
+        });
+
+        test('[Regression] Putting a new member with same name of existing member you have access to does not create a duplicate link', async () => {
+            const organization = await new OrganizationFactory({ }).create();
+            const user = await new UserFactory({ organization }).create();
+            const details = MemberDetails.create({
+                firstName,
+                lastName,
+                securityCode: 'ABC-123',
+                parents: [
+                    Parent.create({
+                        firstName: 'Jane',
+                        lastName: 'Doe',
+                    }),
+                ],
+            });
+
+            const existingMember = await new MemberFactory({
+                birthDay,
+                details,
+            }).create();
+
+            await MemberUserSyncer.linkUser(user.email, existingMember, true);
+
+            // Check access
+            expect(existingMember.users).toHaveLength(1);
+
+            const token = await Token.createToken(user);
+
+            const arr: Body = new PatchableArray();
+            const newBirthDay = new Date(existingMember.details.birthDay!.getTime() + 1000);
+            const put = MemberWithRegistrationsBlob.create({
+                details: MemberDetails.create({
+                    firstName,
+                    lastName,
+                    birthDay: newBirthDay,
+                    // Security code is not required: you have access
+                }),
+            });
+            arr.addPut(put);
+
+            const request = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), arr);
+            request.headers.authorization = 'Bearer ' + token.accessToken;
+            const response = await testServer.test(endpoint, request);
+            expect(response.status).toBe(200);
+
+            // Check id of the returned memebr matches the existing member
+            expect(response.body.members.length).toBe(1);
+            expect(response.body.members[0].id).toBe(existingMember.id);
+
+            // Check data matches the original data + changes from the put
+            const member = response.body.members[0];
+            expect(member.details.firstName).toBe(firstName);
+            expect(member.details.lastName).toBe(lastName);
+            expect(member.details.birthDay).toEqual(newBirthDay);
+
+            // Check access
+            expect(member.users.map(u => u.id)).toEqual([user.id]);
         });
     });
 

package/src/endpoints/global/registration/PatchUserMembersEndpoint.ts

@@ -171,30 +171,25 @@ export class PatchUserMembersEndpoint extends Endpoint<Params, Query, Body, Resp
             await Document.updateForMember(member);
         }
 
-        // Modify members
-        if (addedMembers.length > 0) {
-            // Give access to created members
-            await Member.users.reverse('members').link(user, addedMembers);
-        }
-
         await PatchOrganizationMembersEndpoint.deleteMembers(request.body.getDeletes());
 
-        members = await Member.getMembersWithRegistrationForUser(user);
-
-        for (const member of addedMembers) {
-            const updatedMember = members.find(m => m.id === member.id);
-            if (updatedMember) {
-                // Make sure we also give access to other parents
-                await MemberUserSyncer.onChangeMember(updatedMember);
+        for (const updatedMember of addedMembers) {
+            await Member.users.load(updatedMember);
+            if (!Member.users.isLoaded(updatedMember)) {
+                throw new Error('Failed to load users for member ' + updatedMember.id);
+            }
 
-                if (!updatedMember.users.find(u => u.id === user.id)) {
-                    // Also link the user to the member if the email address is missing in the details
-                    await MemberUserSyncer.linkUser(user.email, updatedMember, true);
-                }
+            // Make sure we also give access to other parents
+            await MemberUserSyncer.onChangeMember(updatedMember);
 
-                await Document.updateForMember(updatedMember);
+            if (!updatedMember.users.find(u => u.id === user.id)) {
+                // Also link the user to the member if the email address is missing in the details
+                await MemberUserSyncer.linkUser(user.email, updatedMember, true);
             }
+
+            await Document.updateForMember(updatedMember);
         }
+        members = await Member.getMembersWithRegistrationForUser(user);
 
         return new Response(
             await AuthenticatedStructures.membersBlob(members),

package/src/helpers/MemberMerger.ts

@@ -4,6 +4,7 @@ import {
     Member,
     MemberPlatformMembership,
     MemberResponsibilityRecord,
+    MemberUser,
     MergedMember,
     Registration,
     User,
@@ -70,6 +71,7 @@ export async function mergeTwoMembers(base: Member, other: Member, options?: { u
     if (other.existsInDatabase) {
         await mergeRegistrations(base, other);
         await mergeUsers(base, other);
+        // await mergeUserMembers(base, other);
         await mergeResponsibilities(base, other);
         await mergeBalanceItems(base, other);
         await mergeDocuments(base, other);
@@ -114,6 +116,20 @@ async function mergeUsers(base: Member, other: Member) {
     await mergeModels(base, other, User);
 }
 
+async function mergeUserMembers(base: Member, other: Member) {
+    const baseId = base.id;
+    const otherModels = await MemberUser.select().where('membersId', other.id).fetch();
+
+    for (const otherModel of otherModels) {
+        otherModel.membersId = baseId;
+
+        await otherModel.save({
+            skipMarkSaved: true,
+            skipSendEvents: true,
+        });
+    }
+}
+
 async function mergeResponsibilities(base: Member, other: Member) {
     async function getResponsibilities(memberId: string) {
         const rows = await SQL.select()

package/src/helpers/MemberUserSyncer.test.ts

@@ -1,5 +1,6 @@
 import { Database } from '@simonbackx/simple-database';
-import { Member, MemberFactory, MemberResponsibilityRecordFactory, User, UserFactory } from '@stamhoofd/models';
+import { Member, MemberFactory, MemberResponsibilityRecordFactory, MemberUser, User, UserFactory } from '@stamhoofd/models';
+import { SQL } from '@stamhoofd/sql';
 import { BooleanStatus, MemberDetails, Parent, UserPermissions } from '@stamhoofd/structures';
 import { TestUtils } from '@stamhoofd/test-utils';
 import { MemberUserSyncer } from './MemberUserSyncer.js';
@@ -1027,6 +1028,68 @@ describe('Helpers.MemberUserSyncer', () => {
         });
     });
 
+    describe('removeDuplicates', () => {
+        const link = async (memberId: string, userId: string) => {
+            await SQL.insert(MemberUser.table)
+                .columns('membersId', 'usersId')
+                .values([memberId, userId])
+                .insert();
+        };
+
+        const countLinks = async (memberId: string, userId: string) => {
+            const rows = await SQL.select()
+                .from(SQL.table(MemberUser.table))
+                .where(SQL.column('membersId'), memberId)
+                .where(SQL.column('usersId'), userId)
+                .fetch();
+            return rows.length;
+        };
+
+        test('Duplicate links for a single member are collapsed to one', async () => {
+            const member = await new MemberFactory({}).create();
+            const otherMember = await new MemberFactory({}).create();
+            const userA = await new UserFactory({ email: 'a@example.com' }).create();
+            const userB = await new UserFactory({ email: 'b@example.com' }).create();
+
+            // 3 duplicate links for (member, userA)
+            await link(member.id, userA.id);
+            await link(member.id, userA.id);
+            await link(member.id, userA.id);
+
+            // A single link for (member, userB) should be kept untouched
+            await link(member.id, userB.id);
+
+            // Duplicates for another member should not be affected when scoping to member
+            await link(otherMember.id, userA.id);
+            await link(otherMember.id, userA.id);
+
+            await MemberUserSyncer.removeDuplicates(member.id);
+
+            expect(await countLinks(member.id, userA.id)).toBe(1);
+            expect(await countLinks(member.id, userB.id)).toBe(1);
+
+            // Untouched: scoped to member only
+            expect(await countLinks(otherMember.id, userA.id)).toBe(2);
+        });
+
+        test('Duplicate links across all members are collapsed when memberId is null', async () => {
+            const member1 = await new MemberFactory({}).create();
+            const member2 = await new MemberFactory({}).create();
+            const userA = await new UserFactory({ email: 'a@example.com' }).create();
+
+            await link(member1.id, userA.id);
+            await link(member1.id, userA.id);
+            await link(member2.id, userA.id);
+            await link(member2.id, userA.id);
+            await link(member2.id, userA.id);
+
+            await MemberUserSyncer.removeDuplicates(null);
+
+            expect(await countLinks(member1.id, userA.id)).toBe(1);
+            expect(await countLinks(member2.id, userA.id)).toBe(1);
+        });
+    });
+
     describe('Members with the same email addresses', () => {
         test('The most recent member is linked to a user if both do not have responsibilities', async () => {
             const member1 = await new MemberFactory({

package/src/helpers/MemberUserSyncer.ts

@@ -1,13 +1,55 @@
 import type { MemberWithUsers } from '@stamhoofd/models';
-import { CachedBalance, Member, MemberResponsibilityRecord, Organization, Platform, User } from '@stamhoofd/models';
+import { CachedBalance, Member, MemberResponsibilityRecord, MemberUser, Organization, Platform, User } from '@stamhoofd/models';
 import { QueueHandler } from '@stamhoofd/queues';
-import { SQL } from '@stamhoofd/sql';
+import { SQL, SQLAlias, SQLCount, SQLSelectAs } from '@stamhoofd/sql';
 import type { MemberDetails, PermissionRole } from '@stamhoofd/structures';
 import { AuditLogSource, Permissions, ReceivableBalanceType, UserPermissions } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { AuditLogService } from '../services/AuditLogService.js';
 
 export class MemberUserSyncerStatic {
+    /**
+     * Delete duplicate member <-> user links (the same user linked to the same member more than once),
+     * keeping the row with the lowest id for each (membersId, usersId) pair.
+     *
+     * Runs as a single atomic statement, either scoped to one member or across all members (memberId = null).
+     */
+    async removeDuplicates(memberId: string | null) {
+        // Find only the (membersId, usersId) pairs that actually have duplicates, together with the
+        // lowest id we want to keep. HAVING COUNT(*) > 1 keeps this derived table tiny (duplicates are
+        // rare), so we only materialize + join the handful of affected groups instead of the whole table.
+        // It has to be a derived table so MySQL materializes it up front: a plain self-join against the
+        // delete target does not reliably delete rows (and is forbidden as a subquery on the same table).
+        const duplicateGroups = SQL.select(
+            SQL.column('membersId'),
+            SQL.column('usersId'),
+            new SQLSelectAs(SQL.min(SQL.column('id')), new SQLAlias('keepId')),
+        )
+            .from(SQL.table(MemberUser.table))
+            .groupBy(SQL.column('membersId'), SQL.column('usersId'))
+            .having(SQL.where(new SQLCount(), '>', 1));
+
+        if (memberId !== null) {
+            duplicateGroups.where(SQL.column('membersId'), memberId);
+        }
+
+        // Delete the duplicate rows: every row in an affected group whose id is higher than the one we keep.
+        const query = SQL.delete()
+            .from(SQL.table(MemberUser.table, 'duplicate'))
+            .join(
+                SQL.join(duplicateGroups.as('duplicate_group'))
+                    .where(SQL.column('duplicate_group', 'membersId'), SQL.column('duplicate', 'membersId'))
+                    .where(SQL.column('duplicate_group', 'usersId'), SQL.column('duplicate', 'usersId'))
+                    .where(SQL.column('duplicate', 'id'), '>', SQL.column('duplicate_group', 'keepId')),
+            );
+
+        if (memberId !== null) {
+            query.where(SQL.column('duplicate', 'membersId'), memberId);
+        }
+
+        await query.delete();
+    }
+
     /**
      * Call when:
      * - responsibilities have changed
@@ -23,6 +65,22 @@ export class MemberUserSyncerStatic {
                     throw new Error('Failed to load users for member ' + member.id);
                 }
 
+                // Check duplicate users
+                // Cleanup legacy bugs, but also cleans up merges
+                let removeDuplicates = false;
+                for (const user of member.users) {
+                    const o = member.users.filter(u => u.id === user.id);
+                    if (o.length > 1) {
+                        removeDuplicates = true;
+                        break;
+                    }
+                }
+
+                if (removeDuplicates) {
+                    await this.removeDuplicates(member.id);
+                    await Member.users.load(member);
+                }
+
                 const { userEmails, parentEmails, unverifiedEmails, allEmails } = this.getMemberAccessEmails(member.details);
 
                 // Make sure all these users have access to the member

package/src/helpers/StripeInvoicer.ts

@@ -347,7 +347,7 @@ export class StripeInvoicer {
                 break;
             }
             const nextMonth = new Date(currentMonth.getFullYear(), currentMonth.getMonth() + 1, 1);
-            const { end: endNext } = StripeInvoicer.getMonthUnixStartEnd(currentMonth);
+            const { end: endNext } = StripeInvoicer.getMonthUnixStartEnd(nextMonth);
             const isLastMonth = endNext >= stopAt.getTime() / 1000;
             await this.generateInvoices(sellingOrganization, currentMonth, { ...options, force: (isLastMonth && !!options?.forceLast) || !!options?.force });
             currentMonth = nextMonth;