@stamhoofd/backend 2.137.4 → 2.138.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.137.4",
+    "version": "2.138.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -19,6 +19,12 @@
             "import": "./dist/src/boot.js",
             "require": "./dist/src/boot.js"
         },
+        "./services/*": {
+            "types": "./dist/src/services/*.d.ts",
+            "import": "./dist/src/services/*.js",
+            "require": "./dist/src/services/*.js",
+            "@stamhoofd/source": "./src/services/*.ts"
+        },
         "./tests/helpers": {
             "types": "./dist/tests/helpers/index.d.ts",
             "import": "./dist/tests/helpers/index.js",
@@ -58,21 +64,23 @@
         "@simonbackx/simple-endpoints": "1.22.0",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.137.4",
-        "@stamhoofd/backend-i18n": "2.137.4",
-        "@stamhoofd/backend-middleware": "2.137.4",
-        "@stamhoofd/crons": "2.137.4",
-        "@stamhoofd/email": "2.137.4",
-        "@stamhoofd/excel-writer": "2.137.4",
-        "@stamhoofd/logging": "2.137.4",
-        "@stamhoofd/models": "2.137.4",
-        "@stamhoofd/object-differ": "2.137.4",
-        "@stamhoofd/queues": "2.137.4",
-        "@stamhoofd/sql": "2.137.4",
-        "@stamhoofd/structures": "2.137.4",
-        "@stamhoofd/types": "2.137.4",
-        "@stamhoofd/utility": "2.137.4",
+        "@simplewebauthn/server": "13.3.2",
+        "@stamhoofd/backend-env": "2.138.0",
+        "@stamhoofd/backend-i18n": "2.138.0",
+        "@stamhoofd/backend-middleware": "2.138.0",
+        "@stamhoofd/crons": "2.138.0",
+        "@stamhoofd/email": "2.138.0",
+        "@stamhoofd/excel-writer": "2.138.0",
+        "@stamhoofd/logging": "2.138.0",
+        "@stamhoofd/models": "2.138.0",
+        "@stamhoofd/object-differ": "2.138.0",
+        "@stamhoofd/queues": "2.138.0",
+        "@stamhoofd/sql": "2.138.0",
+        "@stamhoofd/structures": "2.138.0",
+        "@stamhoofd/types": "2.138.0",
+        "@stamhoofd/utility": "2.138.0",
         "archiver": "7.0.1",
+        "argon2": "0.44.0",
         "axios": "1.18.1",
         "base-x": "3.0.11",
         "chalk": "5.6.2",
@@ -89,11 +97,12 @@
         "mysql2": "3.23.1",
         "node-rsa": "2.0.0",
         "openid-client": "5.7.1",
+        "otplib": "12.0.1",
         "stripe": "16.12.0",
         "uuid": "14.0.1"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.137.4",
+        "@stamhoofd/test-utils": "2.138.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.2",
         "@types/mailparser": "3.4.6",
@@ -108,5 +117,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "22cb2b32de8f785d8e0d94f324940d6419fbe7ea"
+    "gitHead": "781877acb024516e384b4119af7e86f847a9d237"
 }

package/src/boot.ts

@@ -18,6 +18,7 @@ import { resumeEmails } from './helpers/EmailResumer.js';
 import { GlobalHelper } from './helpers/GlobalHelper.js';
 import { SetupStepUpdater } from './helpers/SetupStepUpdater.js';
 import { ContextMiddleware } from './middleware/ContextMiddleware.js';
+import { TenantScopeMiddleware } from './middleware/TenantScopeMiddleware.js';
 import { AuditLogService } from './services/AuditLogService.js';
 import { BalanceItemService } from './services/BalanceItemService.js';
 import { BootChecksService } from './services/BootChecksService.js';
@@ -137,6 +138,10 @@ export const boot = async (options: { killProcess: boolean }) => {
     // Contexts
     routerServer.addRequestMiddleware(ContextMiddleware);
 
+    // After ContextMiddleware on purpose: the last registered wrapRun is the outermost, and the
+    // tenant has to be in scope before the context that reads it.
+    routerServer.addRequestMiddleware(TenantScopeMiddleware);
+
     // Add version headers and minimum version
     const versionMiddleware = new VersionMiddleware({
         latestVersions: {

package/src/crons/balance-emails.ts

@@ -6,6 +6,7 @@ import type { OrganizationEmail, StamhoofdFilter } from '@stamhoofd/structures';
 import { EmailRecipientFilter, EmailRecipientSubfilter, EmailTemplateType, ReceivableBalanceType } from '@stamhoofd/structures';
 import { ContextInstance } from '../helpers/Context.js';
 import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
+import { EmailSendService } from '../services/EmailSendService.js';
 
 registerCron('balanceEmails', balanceEmails);
 
@@ -201,7 +202,7 @@ async function sendTemplate({
 
     try {
         const upToDate = await ContextInstance.startForUser(systemUser, organization, async () => {
-            return await model.queueForSending(true);
+            return await EmailSendService.queueForSending(model, true);
         });
 
         if (!upToDate) {

package/src/crons/delete-expired-mfa-tokens.ts

@@ -0,0 +1,35 @@
+import { registerCron } from '@stamhoofd/crons';
+import { MFAToken, WebauthnChallenge } from '@stamhoofd/models';
+
+let lastRunDate: number | null = null;
+
+registerCron('deleteExpiredMFATokens', deleteExpiredMFATokens);
+
+/**
+ * Sweep the short-lived tokens of the two-factor flows.
+ *
+ * Both are also cleaned up while they are used (a new challenge supersedes the previous
+ * one, and an expired token is dropped when it is looked up), but a token of a login that
+ * was simply abandoned has nothing left to trigger that. Run every night at 5 AM.
+ */
+export async function deleteExpiredMFATokens() {
+    const now = new Date();
+
+    if (now.getDate() === lastRunDate) {
+        return;
+    }
+
+    const hour = now.getHours();
+
+    // between 5 and 6 AM
+    if (hour !== 5 && STAMHOOFD.environment !== 'development') {
+        return;
+    }
+
+    const tokens = await MFAToken.deleteExpired();
+    const challenges = await WebauthnChallenge.deleteExpired();
+
+    console.log(`Deleted ${tokens} expired MFA tokens and ${challenges} expired WebAuthn challenges.`);
+
+    lastRunDate = now.getDate();
+}

package/src/crons/drip-emails.ts

@@ -1,5 +1,6 @@
 import { registerCron } from '@stamhoofd/crons';
 import { Organization } from '@stamhoofd/models';
+import { OrganizationEmailService } from '../services/OrganizationEmailService.js';
 import { isOutside } from './helpers/isOutside.js';
 import { useSavedIterator } from './helpers/useSavedIterator.js';
 
@@ -30,7 +31,7 @@ async function checkDrips() {
     // Get the next x organization to send e-mails for
     for await (const organization of iterate()) {
         try {
-            await organization.checkDrips();
+            await OrganizationEmailService.checkDrips(organization);
         } catch (e) {
             console.error(e);
         }

package/src/crons/index.ts

@@ -5,6 +5,7 @@ import './update-cached-balances.js';
 import './cleanup-orphaned-cached-balances.js';
 import './balance-emails.js';
 import './delete-old-email-drafts.js';
+import './delete-expired-mfa-tokens.js';
 import './delete-archived-data.js';
 import './mollie-chargebacks.js';
 import './mollie-refunds.js';

package/src/crons/invoices.ts

@@ -1,13 +1,15 @@
 import { isSimpleError, isSimpleErrors } from '@simonbackx/simple-errors';
 import { registerCron } from '@stamhoofd/crons';
 import type { Invoice } from '@stamhoofd/models';
-import { Organization, Payment, sendEmailTemplate } from '@stamhoofd/models';
+import { Organization, Payment } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 import { EmailTemplateType, InvoiceStruct, PaymentStatus, Replacement } from '@stamhoofd/structures';
 import { Formatter, Sorter } from '@stamhoofd/utility';
 import { AuthenticatedStructures } from '../helpers/AuthenticatedStructures.js';
 import { InvoiceService } from '../services/InvoiceService.js';
 import { useSavedIterator } from './helpers/useSavedIterator.js';
 import { isOutside } from './helpers/isOutside.js';
+import { OrganizationAdminService } from '../services/OrganizationAdminService.js';
 
 registerCron('invoices', invoices);
 
@@ -50,7 +52,7 @@ async function createInvoicesFor(organization: Organization) {
 
     // Belgian rules: allowed to invoice up to the 15th day of the next month. We extend it with one month to fix mistakes.
     const today = Formatter.luxon();
-    const startDate = today.day <= 15 ? today.minus({ month: 2 }).startOf('month') : today.minus({ month: 1 }).startOf('month');
+    const startDate = today.day <= 15 ? today.minus({ month: 3 }).startOf('month') : today.minus({ month: 2 }).startOf('month');
 
     // Don't invoice below 4 euro - unless we reached the timeout date for invoices (end of month + 15 days - 5 days margin) OR + 15 day offset
     const invoiceLimit = STAMHOOFD.environment === 'development' ? 0 : 4_0000;
@@ -147,7 +149,7 @@ async function createInvoicesFor(organization: Organization) {
             template: {
                 type: EmailTemplateType.InvoiceGenerationErrors,
             },
-            recipients: await organization.getAdminRecipients(),
+            recipients: await OrganizationAdminService.getAdminRecipients(organization),
             type: 'transactional',
             fromStamhoofd: true,
             defaultReplacements: [

package/src/crons.ts

@@ -4,8 +4,10 @@ import { Group, Organization, Payment, Registration, STPackage, Webshop } from '
 import { SQL } from '@stamhoofd/sql';
 import { PaymentMethod, PaymentProvider, PaymentStatus } from '@stamhoofd/structures';
 import { checkSettlements } from './helpers/CheckSettlements.js';
+import { OrganizationDNSService } from './services/OrganizationDNSService.js';
 import { PaymentService } from './services/PaymentService.js';
 import { RegistrationService } from './services/RegistrationService.js';
+import { STPackageService } from './services/STPackageService.js';
 
 let lastDNSCheck: Date | null = null;
 let lastDNSId = '';
@@ -39,7 +41,7 @@ async function checkDNS() {
             console.log('[DNS] ' + organization.name);
         }
         try {
-            await organization.updateDNSRecords();
+            await OrganizationDNSService.updateDNSRecords(organization);
         } catch (e) {
             console.error(e);
         }
@@ -76,7 +78,7 @@ async function checkExpirationEmails() {
     console.log('[EXPIRATION EMAILS] Sending expiration emails...');
 
     for (const pack of packages) {
-        await pack.sendExpiryEmail();
+        await STPackageService.sendExpiryEmail(pack);
     }
     lastExpirationCheck = new Date();
 }

package/src/email-recipient-loaders/orders.ts

@@ -1,4 +1,5 @@
-import { Email, runWithRecipientLocale, Webshop } from '@stamhoofd/models';
+import { Email, Webshop } from '@stamhoofd/models';
+import { runWithRecipientLocale } from '../helpers/EmailBuilder.js';
 import type { EmailRecipient, LimitedFilteredRequest, WebshopPreview } from '@stamhoofd/structures';
 import { mergeFilters, PaginatedResponse } from '@stamhoofd/structures';
 import { GetWebshopOrdersEndpoint } from '../endpoints/organization/dashboard/webshops/GetWebshopOrdersEndpoint.js';

package/src/email-recipient-loaders/organizations.ts

@@ -6,6 +6,7 @@ import { baseInMemoryFilterCompilers, compileToInMemoryFilter, createInMemoryFil
 import { PaginatedResponse } from '@stamhoofd/structures';
 import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
 import { GetOrganizationsEndpoint } from '../endpoints/admin/organizations/GetOrganizationsEndpoint.js';
+import { OrganizationAdminService } from '../services/OrganizationAdminService.js';
 
 function userToFilterableAdmin(user: User, platform: PlatformStruct, organization: Organization) {
     return {
@@ -49,14 +50,14 @@ async function fetchRecipients(query: LimitedFilteredRequest, subfilter: Stamhoo
     const recipients: EmailRecipient[] = [];
     for (const organization of result.results) {
         // todo: filter admins
-        const users = await organization.getAdmins();
+        const users = await OrganizationAdminService.getAdmins(organization);
         const filteredUsers = users.filter((user) => {
             const filterable = userToFilterableAdmin(user, platform, organization);
             return compiledFilter(filterable);
         });
 
         recipients.push(
-            ...organization.adminsToRecipients(filteredUsers).map((r) => {
+            ...OrganizationAdminService.adminsToRecipients(filteredUsers).map((r) => {
                 return EmailRecipient.create({
                     ...r,
                     replacements: [

package/src/email-recipient-loaders/payments.ts

@@ -1,5 +1,5 @@
 import type { RecipientLoader } from '@stamhoofd/models';
-import { BalanceItem, BalanceItemPayment, Email, Member, MemberResponsibilityRecord, Organization, Payment, User } from '@stamhoofd/models';
+import { BalanceItem, BalanceItemPayment, Email, Member, MemberResponsibilityRecord, Organization, Payment, Platform, User } from '@stamhoofd/models';
 import { compileToSQLFilter, SQL } from '@stamhoofd/sql';
 import type { LimitedFilteredRequest, PaymentGeneral, StamhoofdFilter } from '@stamhoofd/structures';
 import { CountFilteredRequest, EmailRecipient, PaginatedResponse, PaymentMethod } from '@stamhoofd/structures';
@@ -301,12 +301,13 @@ async function getOrganizationRecipients(ids: { organizationId: string; payment:
     if (subFilter === null) {
         // Use full admins instead
         const admins = await User.getAdmins(allOrganizationIds, { verified: true });
+        const platform = await Platform.getSharedStruct();
         for (const { organizationId, payment } of ids) {
             const organization = organizationMap.get(organizationId);
             if (!organization) {
                 continue;
             }
-            const users = admins.filter(a => a.permissions?.forOrganization(organization)?.hasFullAccess());
+            const users = admins.filter(a => a.permissions?.forOrganization(organization, platform, { inheritFromPlatform: false })?.hasFullAccess());
 
             if (users.length === 0) {
                 console.warn('No admins found for organization with id ', organizationId, ' while fetching email recipients for payment with id ', payment.id);

package/src/endpoints/auth/ConfirmTOTPEndpoint.ts

@@ -0,0 +1,84 @@
+import type { Decoder } from '@simonbackx/simple-encoding';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { MFATOTP } from '@stamhoofd/models';
+import type { MFAEnrollmentResult } from '@stamhoofd/structures';
+import { MFAMethodType, TOTPConfirmRequest } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { TOTPHelper } from '../../helpers/TOTPHelper.js';
+import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
+import { TwoFactorAuditLogService } from '../../services/TwoFactorAuditLogService.js';
+
+type Params = { id: string };
+type Query = undefined;
+type Body = TOTPConfirmRequest;
+type ResponseBody = MFAEnrollmentResult;
+
+/**
+ * Confirm a pending TOTP authenticator by verifying the first code. On the user's first
+ * factor this also returns recovery codes, and during forced enrollment it issues a
+ * full session token.
+ */
+export class ConfirmTOTPEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    bodyDecoder = TOTPConfirmRequest as Decoder<TOTPConfirmRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa/totp/@id/confirm', { id: String });
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope();
+        const { user, setupToken, token } = await Context.authenticateMFAEnrollment();
+
+        const totp = await MFATOTP.getByID(request.params.id);
+        if (!totp || totp.userId !== user.id) {
+            throw new SimpleError({
+                code: 'not_found',
+                message: 'TOTP authenticator not found',
+                human: $t('%ZgJ'),
+                statusCode: 404,
+            });
+        }
+
+        if (totp.confirmedAt) {
+            throw new SimpleError({
+                code: 'already_confirmed',
+                message: 'This authenticator is already confirmed',
+                human: $t('%ZgM'),
+                statusCode: 400,
+            });
+        }
+
+        const counter = TOTPHelper.verify(request.body.code, totp.secret);
+        if (counter === null) {
+            throw new SimpleError({
+                code: 'invalid_mfa_code',
+                message: 'Invalid code',
+                human: $t('%Zgp'),
+                field: 'code',
+                statusCode: 400,
+            });
+        }
+
+        const wasFirstFactor = !(await TwoFactorHelper.userHasFactors(user.id));
+
+        totp.confirmedAt = new Date();
+        totp.name = request.body.name.trim() || $t('%ZiG');
+        // Record the counter so the confirmation code can't be replayed as a login code.
+        totp.lastUsedCounter = counter;
+        await totp.save();
+
+        await TwoFactorAuditLogService.logMethodAdded(user, MFAMethodType.TOTP, totp.name);
+
+        return new Response(await TwoFactorHelper.completeEnrollment(user, setupToken, wasFirstFactor, token));
+    }
+}

package/src/endpoints/auth/CreateAdminEndpoint.ts

@@ -2,13 +2,15 @@ import type { Decoder } from '@simonbackx/simple-encoding';
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { PasswordToken, Platform, sendEmailTemplate, User } from '@stamhoofd/models';
+import { Platform, User } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../../helpers/EmailBuilder.js';
 import type { UserWithMembers } from '@stamhoofd/structures';
 import { EmailTemplateType, Recipient, Replacement, UserPermissions, User as UserStruct } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 
 import { AuthenticatedStructures } from '../../helpers/AuthenticatedStructures.js';
 import { Context } from '../../helpers/Context.js';
+import { PasswordForgotService } from '../../services/PasswordForgotService.js';
 type Params = Record<string, never>;
 type Query = undefined;
 type Body = UserStruct;
@@ -117,7 +119,7 @@ export class CreateAdminEndpoint extends Endpoint<Params, Query, Body, ResponseB
         validUntil.setTime(validUntil.getTime() + 7 * 24 * 3600 * 1000);
 
         const dateTime = Formatter.dateTime(validUntil);
-        const recoveryUrl = await PasswordToken.getPasswordRecoveryUrl(admin, organization, request.i18n, validUntil);
+        const recoveryUrl = await PasswordForgotService.getPasswordRecoveryUrl(admin, organization, request.i18n, validUntil);
         const platformName = ((await Platform.getSharedStruct()).config.name);
 
         const name = organization?.name ?? platformName;

package/src/endpoints/auth/CreateTokenEndpoint.test.ts

@@ -1,5 +1,5 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { OrganizationFactory, Token, User, UserFactory } from '@stamhoofd/models';
 import { Token as TokenStruct } from '@stamhoofd/structures';
 
 import { testServer } from '../../../tests/helpers/TestServer.js';
@@ -65,4 +65,64 @@ describe('Endpoint.CreateToken', () => {
         const byRefresh = await Token.getByRefreshToken(response.body.refreshToken);
         expect(byRefresh).toBeDefined();
     });
+
+    describe('last activity', () => {
+        const password = 'test-password-1234';
+
+        async function getLastActiveAt(user: User): Promise<Date | null> {
+            const updated = await User.getByID(user.id);
+            return updated!.lastActiveAt;
+        }
+
+        test('a password login marks the user as active', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ organization, password }).create();
+            expect(user.lastActiveAt).toBeNull();
+
+            const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'password',
+                username: user.email,
+                password,
+            });
+            await testServer.test(endpoint, r);
+
+            const lastActiveAt = await getLastActiveAt(user);
+            expect(lastActiveAt).not.toBeNull();
+            expect(lastActiveAt!.getTime()).toBeGreaterThan(Date.now() - 60 * 1000);
+        });
+
+        test('refreshing a token marks the user as active again', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ organization, password }).create();
+            const token = await Token.createToken(user);
+
+            const monthsAgo = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000);
+            monthsAgo.setMilliseconds(0);
+            user.lastActiveAt = monthsAgo;
+            await user.save();
+
+            const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'refresh_token',
+                refresh_token: token.refreshToken,
+            });
+            await testServer.test(endpoint, r);
+
+            const lastActiveAt = await getLastActiveAt(user);
+            expect(lastActiveAt!.getTime()).toBeGreaterThan(Date.now() - 60 * 1000);
+        });
+
+        test('a failed login does not mark the user as active', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ organization, password }).create();
+
+            const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'password',
+                username: user.email,
+                password: 'wrong-password',
+            });
+            await expect(testServer.test(endpoint, r)).rejects.toThrow();
+
+            expect(await getLastActiveAt(user)).toBeNull();
+        });
+    });
 });