@stamhoofd/backend 2.137.4 → 2.137.5

package/src/services/VerificationCodeService.test.ts

@@ -0,0 +1,71 @@
+import { I18n } from '@stamhoofd/backend-i18n';
+import { EmailMocker } from '@stamhoofd/email';
+import { EmailTemplateFactory, EmailVerificationCode, OrganizationFactory, Platform, UserFactory } from '@stamhoofd/models';
+import { EmailTemplateType } from '@stamhoofd/structures';
+import { TestUtils } from '@stamhoofd/test-utils';
+import { VerificationCodeService } from './VerificationCodeService.js';
+
+const i18n = new I18n(I18n.defaultLanguage, I18n.defaultCountry);
+
+const PLATFORM_NAME = 'The test platform';
+
+/**
+ * A template that only contains the organizationName replacement, so the name that ends up in the
+ * email can be asserted without depending on the real (translated) template contents.
+ */
+async function createVerifyEmailTemplate() {
+    await new EmailTemplateFactory({
+        type: EmailTemplateType.VerifyEmail,
+        html: '<p>{{organizationName}}</p>',
+        text: '{{organizationName}}',
+    }).create();
+}
+
+describe('VerificationCodeService', () => {
+    let originalPlatformName: string;
+
+    beforeAll(async () => {
+        const platform = await Platform.getForEditing();
+        originalPlatformName = platform.config.name;
+        platform.config.name = PLATFORM_NAME;
+        await platform.save();
+    });
+
+    afterAll(async () => {
+        const platform = await Platform.getForEditing();
+        platform.config.name = originalPlatformName;
+        await platform.save();
+    });
+
+    describe('send', () => {
+        test('Uses the name of the organization when the code is scoped to an organization', async () => {
+            TestUtils.setEnvironment('userMode', 'organization');
+            await createVerifyEmailTemplate();
+
+            const organization = await new OrganizationFactory({ name: 'Organization with a name' }).create();
+            const user = await new UserFactory({ organization }).create();
+            const code = await EmailVerificationCode.createFor(user, user.email);
+
+            await VerificationCodeService.send(code, user, organization, i18n);
+
+            const emails = await EmailMocker.transactional.getSucceededEmails();
+            expect(emails.length).toBe(1);
+            expect(emails[0].text).toContain('Organization with a name');
+            expect(emails[0].text).not.toContain(PLATFORM_NAME);
+        });
+
+        test('Falls back to the name of the platform when there is no organization', async () => {
+            TestUtils.setEnvironment('userMode', 'platform');
+            await createVerifyEmailTemplate();
+
+            const user = await new UserFactory({}).create();
+            const code = await EmailVerificationCode.createFor(user, user.email);
+
+            await VerificationCodeService.send(code, user, null, i18n);
+
+            const emails = await EmailMocker.transactional.getSucceededEmails();
+            expect(emails.length).toBe(1);
+            expect(emails[0].text).toContain(PLATFORM_NAME);
+        });
+    });
+});

package/src/services/VerificationCodeService.ts

@@ -0,0 +1,100 @@
+import type { I18n } from '@stamhoofd/backend-i18n';
+import type { Organization } from '@stamhoofd/models';
+import { EmailVerificationCode, Platform, sendEmailTemplate, User } from '@stamhoofd/models';
+import { EmailTemplateType, getAppHost, Recipient, Replacement } from '@stamhoofd/structures';
+
+/**
+ * Sends the verification emails for an EmailVerificationCode. The code itself is generated, stored
+ * and verified on the model.
+ */
+export class VerificationCodeService {
+    static getEmailVerificationUrl(code: EmailVerificationCode, user: User, organization: Organization | null, i18n: I18n) {
+        const host = getAppHost('verify-email', organization, !!user.permissions, i18n);
+        return 'https://' + host + '?code=' + encodeURIComponent(code.code) + '&token=' + encodeURIComponent(code.token) + '&email=' + encodeURIComponent(code.email);
+    }
+
+    static async send(code: EmailVerificationCode, user: User, organization: Organization | null, i18n: I18n, withCode = true) {
+        const url = this.getEmailVerificationUrl(code, user, organization, i18n);
+
+        const name = organization?.name ?? (await Platform.getSharedPrivateStruct()).config.name;
+
+        const replacements: Replacement[] = [
+            Replacement.create({
+                token: 'organizationName',
+                value: name,
+            }),
+            Replacement.create({
+                token: 'confirmEmailUrl',
+                value: url,
+            }),
+        ];
+
+        if (withCode) {
+            const formattedCode = code.code.substr(0, 3) + ' ' + code.code.substr(3);
+
+            await sendEmailTemplate(organization, {
+                recipients: [
+                    Recipient.create({
+                        email: code.email,
+                        replacements: [
+                            ...replacements,
+                            Replacement.create({
+                                token: 'confirmEmailCode',
+                                value: formattedCode,
+                            }),
+                        ],
+                    }),
+                ],
+                template: {
+                    type: EmailTemplateType.VerifyEmail,
+                },
+                type: 'transactional',
+            });
+        } else {
+            await sendEmailTemplate(organization, {
+                recipients: [
+                    Recipient.create({
+                        email: code.email,
+                        replacements,
+                    }),
+                ],
+                template: {
+                    type: EmailTemplateType.VerifyEmailWithoutCode,
+                },
+                type: 'transactional',
+            });
+        }
+    }
+
+    static async resend(organization: Organization | null, token: string, i18n: I18n) {
+        const verificationCodes = await EmailVerificationCode.where({
+            token,
+            organizationId: organization
+                ? {
+                        sign: 'IN',
+                        value: [organization.id, null],
+                    }
+                : null,
+        }, { limit: 1 });
+
+        if (verificationCodes.length == 0) {
+            console.log("Can't resend code, no coded found for token", token);
+            // TODO: maybe send a note via email
+            return;
+        }
+
+        const verificationCode = verificationCodes[0];
+
+        if (verificationCode.expiresAt < new Date()) {
+            // Don't report error, could be brute forced
+            console.log("Can't resend code, token is expired", token);
+            return;
+        }
+
+        const user = await User.getByID(verificationCode.userId);
+        if (!user) {
+            return;
+        }
+        await this.send(verificationCode, user, organization, i18n);
+    }
+}

package/tests/e2e/documents.test.ts

@@ -12,6 +12,7 @@ import { testServer } from '../helpers/TestServer.js';
 import { initAdmin } from '../init/initAdmin.js';
 import { initStripe } from '../init/initStripe.js';
 import { registrationUpdateQueue } from '../../src/services/BalanceItemService.js';
+import { DocumentRenderService } from '../../src/services/DocumentRenderService.js';
 import { initMembershipOrganization } from '../init/initMembershipOrganization.js';
 
 const baseUrl = `/members/register`;
@@ -119,7 +120,7 @@ describe('E2E.Documents', () => {
         const document = await Document.select().where('registrationId', registration.id).first(false);
         expect(document).not.toBeNull();
 
-        const html = await document!.getRenderedHtml(organization);
+        const html = await DocumentRenderService.getRenderedHtml(document!, organization);
 
         const registrationModel = (await Registration.getByID(registration.id))!;
 

package/tests/e2e/private-files.test.ts

@@ -1,7 +1,7 @@
 import { File, MemberDetails, MemberWithRegistrationsBlob, RecordCategory, RecordFileAnswer, RecordSettings, RecordType, TranslatedString, Version } from '@stamhoofd/structures';
 
 import type { PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
-import { PatchableArray } from '@simonbackx/simple-encoding';
+import { encodeObject, EncodeMedium, PatchableArray } from '@simonbackx/simple-encoding';
 import { Request } from '@simonbackx/simple-endpoints';
 import { Member, OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
 import { PermissionLevel, Permissions } from '@stamhoofd/structures';
@@ -62,7 +62,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const privateFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: true,
@@ -105,7 +105,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const privateFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: true,
@@ -149,7 +149,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const privateFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: true,
@@ -188,6 +188,69 @@ describe('E2E.PrivateFiles', () => {
         expect(answer.file!.signedUrl).toBeTruthy();
     });
 
+    test('Cannot set a public file with a url a browser would run as code', async () => {
+        const organization = await createOrganization();
+
+        const user = await new UserFactory({
+            organization,
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+        }).create();
+        const token = await Token.createToken(user);
+
+        // Public files are not signed, so a malicious user can put anything in them. The url of a file ends up
+        // in a link (and in the source of an image), so a javascript: url would run on our own domain.
+        const buildBody = (server: string) => {
+            const member = MemberWithRegistrationsBlob.create({
+                details: MemberDetails.create({
+                    firstName: 'John',
+                    lastName: 'Doe',
+                }),
+            });
+
+            member.details.recordAnswers.set(recordSettings.id, RecordFileAnswer.create({
+                file: new File({
+                    id: 'test',
+                    server: 'https://replace-me.example.com',
+                    path: 'test.pdf',
+                    size: 100,
+                    isPrivate: false,
+                }),
+                settings: recordSettings,
+            }));
+
+            const arr = new PatchableArray() as PatchableArrayAutoEncoder<MemberWithRegistrationsBlob>;
+            arr.addPut(member);
+
+            // An attacker doesn't use our client, so build the request body they would send instead
+            const encoded = encodeObject(arr, { version: Version, medium: EncodeMedium.Network });
+            return JSON.parse(JSON.stringify(encoded).replaceAll('https://replace-me.example.com', server));
+        };
+
+        const attacks = [
+            { server: 'javascript:alert(document.domain)', error: /can only be http or https/i },
+            { server: 'data:text/html,<script>alert(1)</script>', error: /can only be http or https/i },
+            { server: 'not-a-url', error: /invalid url for a file/i },
+            { server: '', error: /invalid url for a file/i },
+        ];
+
+        for (const attack of attacks) {
+            const r = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), buildBody(attack.server));
+            r.headers.authorization = 'Bearer ' + token.accessToken;
+
+            await expect(testServer.test(endpoint, r), attack.server).rejects.toThrow(attack.error);
+        }
+
+        // ... and our own code can never store one either
+        expect(() => Request.buildJson('PATCH', baseUrl, organization.getApiHost(), new File({
+            id: 'test',
+            server: 'javascript:alert(document.domain)',
+            path: 'test.pdf',
+            size: 100,
+        }))).toThrow(/can only be http or https/i);
+    });
+
     test('Can set public files', async () => {
         const organization = await createOrganization();
 
@@ -211,7 +274,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const publicFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: false,
@@ -275,7 +338,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const maliciousFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: true,
@@ -355,7 +418,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const maliciousFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: true,
@@ -418,7 +481,7 @@ describe('E2E.PrivateFiles', () => {
             // access to the signed URL. This should not be possible without a valid signature
             const privateFile = new File({
                 id: 'test',
-                server: 'test.com',
+                server: 'https://test.com',
                 path: 'test.txt',
                 size: 100,
                 isPrivate: true,
@@ -447,7 +510,7 @@ describe('E2E.PrivateFiles', () => {
             // access to the signed URL. This should not be possible without a valid signature
             const privateFile = new File({
                 id: 'test',
-                server: 'test.com',
+                server: 'https://test.com',
                 path: 'test.txt',
                 size: 100,
                 isPrivate: true,
@@ -481,7 +544,7 @@ describe('E2E.PrivateFiles', () => {
             // access to the signed URL. This should not be possible without a valid signature
             const privateFile = new File({
                 id: 'test',
-                server: 'test.com',
+                server: 'https://test.com',
                 path: 'test.txt',
                 size: 100,
                 isPrivate: true,
@@ -509,7 +572,7 @@ describe('E2E.PrivateFiles', () => {
             // access to the signed URL. This should not be possible without a valid signature
             const privateFile = new File({
                 id: 'test',
-                server: 'test.com',
+                server: 'https://test.com',
                 path: 'test.txt',
                 size: 100,
                 isPrivate: true,
@@ -537,7 +600,7 @@ describe('E2E.PrivateFiles', () => {
             // access to the signed URL. This should not be possible without a valid signature
             const privateFile = new File({
                 id: 'test',
-                server: 'test.com',
+                server: 'https://test.com',
                 path: 'test.txt',
                 size: 100,
                 isPrivate: true,
@@ -564,7 +627,7 @@ describe('E2E.PrivateFiles', () => {
             // access to the signed URL. This should not be possible without a valid signature
             const privateFile = new File({
                 id: 'test',
-                server: 'test.com',
+                server: 'https://test.com',
                 path: 'test.txt',
                 size: 100,
                 isPrivate: true,
@@ -613,7 +676,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const maliciousFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: true,