@stamhoofd/backend 2.137.4 → 2.138.0

package/src/excel-loaders/platform-sheets.test.ts

@@ -0,0 +1,113 @@
+import type { XlsxTransformerColumn, XlsxTransformerConcreteColumn } from '@stamhoofd/excel-writer';
+import { isXlsxTransformerConcreteColumn } from '@stamhoofd/excel-writer';
+import { EventNotificationType, ExcelExportType, Organization, OrganizationMetaData, OrganizationTag, Platform, PlatformConfig, PlatformMembership, PlatformMembershipMemberDetails, PlatformMembershipOrganizationDetails, PlatformMembershipType, RecordCategory, RecordSettings, RecordType, TranslatedString } from '@stamhoofd/structures';
+import { ExportToExcelEndpoint } from '../endpoints/global/files/ExportToExcelEndpoint.js';
+import './index.js';
+
+/**
+ * The sheets are built per export request, so every callback should read the platform it was built
+ * with instead of a process wide singleton.
+ */
+describe('Excel loaders platform argument', () => {
+    function getColumns(type: ExcelExportType, platform: Platform, sheetId: string): XlsxTransformerColumn<unknown>[] {
+        const loader = ExportToExcelEndpoint.loaders.get(type);
+
+        if (!loader) {
+            throw new Error('Loader ' + type + ' not registered');
+        }
+
+        const sheet = loader.getSheets(platform).find(s => s.id === sheetId);
+
+        if (!sheet) {
+            throw new Error('Sheet ' + sheetId + ' not found');
+        }
+
+        return sheet.columns;
+    }
+
+    function getColumn(type: ExcelExportType, platform: Platform, sheetId: string, columnId: string): XlsxTransformerConcreteColumn<unknown> {
+        const column = getColumns(type, platform, sheetId).find(c => isXlsxTransformerConcreteColumn(c) && c.id === columnId);
+
+        if (!column || !isXlsxTransformerConcreteColumn(column)) {
+            throw new Error('Column ' + columnId + ' not found');
+        }
+
+        return column;
+    }
+
+    function createPlatformWithTag(tagName: string) {
+        return Platform.create({
+            config: PlatformConfig.create({
+                tags: [
+                    OrganizationTag.create({ id: 'tag-1', name: tagName }),
+                ],
+            }),
+        });
+    }
+
+    it('reads the organization tags from the platform the sheets were built with', () => {
+        const organization = Organization.create({
+            meta: OrganizationMetaData.create({ tags: ['tag-1'] }),
+        });
+
+        const first = getColumn(ExcelExportType.Organizations, createPlatformWithTag('Gewest Noord'), 'organizations', 'tags');
+        expect(first.getValue(organization).value).toBe('Gewest Noord');
+
+        // Building the sheets again with another platform should not reuse the first platform
+        const second = getColumn(ExcelExportType.Organizations, createPlatformWithTag('Gewest Zuid'), 'organizations', 'tags');
+        expect(second.getValue(organization).value).toBe('Gewest Zuid');
+    });
+
+    it('reads the membership type from the platform the sheets were built with', () => {
+        const platform = Platform.create({
+            config: PlatformConfig.create({
+                membershipTypes: [
+                    PlatformMembershipType.create({ id: 'type-1', name: 'Aansluiting' }),
+                ],
+            }),
+        });
+
+        const membership = PlatformMembership.create({
+            memberId: 'member-1',
+            membershipTypeId: 'type-1',
+            organizationId: 'organization-1',
+            periodId: 'period-1',
+            member: PlatformMembershipMemberDetails.create({ firstName: 'John', lastName: 'Doe', memberNumber: null }),
+            organization: PlatformMembershipOrganizationDetails.create({}),
+            balanceItem: null,
+        });
+
+        const column = getColumn(ExcelExportType.PlatformMemberships, platform, 'platform-memberships', 'type');
+        expect(column.getValue(membership).value).toBe('Aansluiting');
+    });
+
+    it('reads the record categories of an event notification from the platform the sheets were built with', () => {
+        const platform = Platform.create({
+            config: PlatformConfig.create({
+                eventNotificationTypes: [
+                    EventNotificationType.create({
+                        recordCategories: [
+                            RecordCategory.create({
+                                name: new TranslatedString('Kamp'),
+                                records: [
+                                    RecordSettings.create({
+                                        id: 'record-1',
+                                        name: new TranslatedString('Aantal deelnemers'),
+                                        type: RecordType.Text,
+                                    }),
+                                ],
+                            }),
+                        ],
+                    }),
+                ],
+            }),
+        });
+
+        const columns = getColumns(ExcelExportType.EventNotifications, platform, 'event-notifications');
+        const matched = columns.flatMap(c => isXlsxTransformerConcreteColumn(c) ? [] : (c.match('recordAnswers.record-1') ?? []));
+
+        expect(matched).toHaveLength(1);
+        expect(matched[0].name).toBe('Aantal deelnemers');
+        expect(matched[0].category).toBe('Kamp');
+    });
+});

package/src/excel-loaders/receivable-balances.ts

@@ -19,7 +19,7 @@ ExportToExcelEndpoint.loaders.set(ExcelExportType.ReceivableBalances, {
             ...data,
         });
     },
-    sheets: [
+    getSheets: () => [
         {
             id: 'receivableBalances',
             name: $t(`%99`),

package/src/excel-loaders/registrations.ts

@@ -1,17 +1,17 @@
 import type { XlsxTransformerSheet } from '@stamhoofd/excel-writer';
 import { XlsxBuiltInNumberFormat } from '@stamhoofd/excel-writer';
 import { Platform } from '@stamhoofd/models';
-import type { LimitedFilteredRequest, PlatformMember } from '@stamhoofd/structures';
-import { ExcelExportType, getGroupTypeName, PlatformRegistration, Platform as PlatformStruct, UnencodeablePaginatedResponse } from '@stamhoofd/structures';
+import type { LimitedFilteredRequest, PlatformMember, Platform as PlatformStruct } from '@stamhoofd/structures';
+import { ExcelExportType, getGroupTypeName, PlatformRegistration, UnencodeablePaginatedResponse } from '@stamhoofd/structures';
 import { ExportToExcelEndpoint } from '../endpoints/global/files/ExportToExcelEndpoint.js';
 import { GetRegistrationsEndpoint } from '../endpoints/global/registration/GetRegistrationsEndpoint.js';
 import { AuthenticatedStructures } from '../helpers/AuthenticatedStructures.js';
 import { Context } from '../helpers/Context.js';
 import { XlsxTransformerColumnHelper } from '../helpers/XlsxTransformerColumnHelper.js';
-import { baseMemberColumns } from './members.js';
+import { getBaseMemberColumns } from './members.js';
 
 // Assign to a typed variable to assure we have correct type checking in place
-const sheet: XlsxTransformerSheet<PlatformMember, PlatformRegistration> = {
+const getSheet = (platform: PlatformStruct): XlsxTransformerSheet<PlatformMember, PlatformRegistration> => ({
     id: 'registrations',
     name: $t('%1EI'),
     columns: [
@@ -294,7 +294,7 @@ const sheet: XlsxTransformerSheet<PlatformMember, PlatformRegistration> = {
                 ];
             },
         },
-        ...baseMemberColumns.map(column => XlsxTransformerColumnHelper.transformColumnForProperty({
+        ...getBaseMemberColumns(platform).map(column => XlsxTransformerColumnHelper.transformColumnForProperty({
             column,
             key: 'member',
             getPropertyValue: (registration: PlatformRegistration) => registration.member,
@@ -341,7 +341,7 @@ const sheet: XlsxTransformerSheet<PlatformMember, PlatformRegistration> = {
                     };
                 }
                 return {
-                    value: PlatformStruct.shared.config.defaultAgeGroups.find(g => g.id === defaultAgeGroupId)?.name ?? $t(`%wJ`),
+                    value: platform.config.defaultAgeGroups.find(g => g.id === defaultAgeGroupId)?.name ?? $t(`%wJ`),
                 };
             },
         },
@@ -356,7 +356,7 @@ const sheet: XlsxTransformerSheet<PlatformMember, PlatformRegistration> = {
             },
         },
     ],
-};
+});
 
 ExportToExcelEndpoint.loaders.set(ExcelExportType.Registrations, {
     fetch: async (query: LimitedFilteredRequest) => {
@@ -370,7 +370,7 @@ ExportToExcelEndpoint.loaders.set(ExcelExportType.Registrations, {
             next: result.next,
         });
     },
-    sheets: [
-        sheet,
+    getSheets: platform => [
+        getSheet(platform),
     ],
 });

package/src/helpers/AdminPermissionChecker.ts

@@ -794,7 +794,7 @@ export class AdminPermissionChecker {
 
             // Check if this user has permissions for the current scoped organization
             if (this.organization && await this.hasFullAccess(this.organization.id)) {
-                if (user.permissions?.forOrganization(this.organization)) {
+                if (user.permissions?.forOrganization(this.organization, this.platform, { inheritFromPlatform: false })) {
                     return true;
                 }
             }

package/src/helpers/AuthenticatedStructures.ts

@@ -1,14 +1,15 @@
 import { SimpleError } from '@simonbackx/simple-errors';
 import type { AuditLog, Document, EventNotification, MemberWithUsersRegistrationsAndGroups, Order, Ticket } from '@stamhoofd/models';
-import { BalanceItem, CachedBalance, Event, Group, Invoice, Member, MemberPlatformMembership, MemberResponsibilityRecord, Organization, OrganizationRegistrationPeriod, Payment, Registration, RegistrationInvitation, RegistrationPeriod, User, Webshop } from '@stamhoofd/models';
+import { BalanceItem, CachedBalance, Event, Group, Invoice, Member, MemberPlatformMembership, MemberResponsibilityRecord, Organization, OrganizationRegistrationPeriod, Payment, Platform as PlatformModel, Registration, RegistrationInvitation, RegistrationPeriod, User, Webshop } from '@stamhoofd/models';
 import type { PaymentGeneral } from '@stamhoofd/structures';
 import { BaseOrganization, getAppHost, OrganizationPrivateMetaData } from '@stamhoofd/structures';
-import { Payment as PaymentStruct, AuditLogReplacement, AuditLogReplacementType, AuditLog as AuditLogStruct, BalanceItem as BalanceItemStruct, DetailedReceivableBalance, Document as DocumentStruct, EventNotification as EventNotificationStruct, Event as EventStruct, GenericBalance, Group as GroupStruct, GroupType, InvitationGroupData, InvitationMemberData, InvoicedBalanceItem, InvoiceStruct, MemberPlatformMembership as MemberPlatformMembershipStruct, MemberRegistrationInvitation, MembersBlob, MemberWithRegistrationsBlob, NamedObject, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, Organization as OrganizationStruct, PaymentCustomer, PermissionLevel, Platform, PrivateOrder, PrivateWebshop, ReceivableBalanceObject, ReceivableBalanceObjectContact, ReceivableBalance as ReceivableBalanceStruct, ReceivableBalanceType, RegistrationInvitation as RegistrationInvitationStruct, RegistrationsBlob, RegistrationWithMemberBlob, TicketPrivate, UserWithMembers, WebshopPreview, Webshop as WebshopStruct } from '@stamhoofd/structures';
+import { Payment as PaymentStruct, AuditLogReplacement, AuditLogReplacementType, AuditLog as AuditLogStruct, BalanceItem as BalanceItemStruct, DetailedReceivableBalance, Document as DocumentStruct, EventNotification as EventNotificationStruct, Event as EventStruct, GenericBalance, Group as GroupStruct, GroupType, InvitationGroupData, InvitationMemberData, InvoicedBalanceItem, InvoiceStruct, MemberPlatformMembership as MemberPlatformMembershipStruct, MemberRegistrationInvitation, MembersBlob, MemberWithRegistrationsBlob, NamedObject, OrganizationRegistrationPeriod as OrganizationRegistrationPeriodStruct, Organization as OrganizationStruct, PaymentCustomer, PermissionLevel, PrivateOrder, PrivateWebshop, ReceivableBalanceObject, ReceivableBalanceObjectContact, ReceivableBalance as ReceivableBalanceStruct, ReceivableBalanceType, RegistrationInvitation as RegistrationInvitationStruct, RegistrationsBlob, RegistrationWithMemberBlob, TicketPrivate, UserWithMembers, WebshopPreview, Webshop as WebshopStruct } from '@stamhoofd/structures';
 import { Sorter } from '@stamhoofd/utility';
 
 import { SQL } from '@stamhoofd/sql';
 import { Formatter } from '@stamhoofd/utility';
 import { Context } from './Context.js';
+import { TwoFactorHelper } from './TwoFactorHelper.js';
 
 /**
  * Builds authenticated structures for the current user
@@ -425,7 +426,7 @@ export class AuthenticatedStructures {
             }
         }
 
-        return UserWithMembers.create({
+        const struct = UserWithMembers.create({
             ...user,
             hasAccount: user.hasAccount(),
             hasPassword: user.hasPasswordBasedAccount(),
@@ -433,6 +434,8 @@ export class AuthenticatedStructures {
             // Always include the current context organization - because it is possible we switch organization and we don't want to refetch every time
             members: await this.membersBlob(filtered, true, user),
         });
+        await TwoFactorHelper.fillTwoFactorStatus([struct]);
+        return struct;
     }
 
     /**
@@ -453,6 +456,8 @@ export class AuthenticatedStructures {
             }));
         }
 
+        await TwoFactorHelper.fillTwoFactorStatus(structs);
+
         return structs;
     }
 
@@ -465,11 +470,12 @@ export class AuthenticatedStructures {
             return MembersBlob.create({ members: [], organizations: [] });
         }
 
+        const platform = await PlatformModel.getSharedStruct();
         const organizations = new Map<string, Organization>();
         const relevantPeriodIds = Formatter.uniqueArray([
-            Platform.shared.period.previousPeriodId,
-            Platform.shared.period.id,
-            Platform.shared.period.nextPeriodId,
+            platform.period.previousPeriodId,
+            platform.period.id,
+            platform.period.nextPeriodId,
             Context.organization?.periodId ?? null,
         ].filter(id => id !== null)) as string[];
 
@@ -520,7 +526,7 @@ export class AuthenticatedStructures {
             organizationIds.push(STAMHOOFD.singleOrganization);
         }
 
-        const membershipOrganizationId = Platform.shared.membershipOrganizationId;
+        const membershipOrganizationId = platform.membershipOrganizationId;
         if (membershipOrganizationId && Context.auth.hasSomePlatformAccess()) {
             if (await Context.auth.hasSomeAccess(membershipOrganizationId)) {
                 organizationIds.push(membershipOrganizationId);
@@ -696,6 +702,9 @@ export class AuthenticatedStructures {
             );
         }
 
+        // After filterMemberData, so we only query for the users we actually return.
+        await TwoFactorHelper.fillTwoFactorStatus(memberBlobs.flatMap(b => b.users));
+
         for (const blob of memberBlobs) {
             blob.responsibilities = responsibilities.filter(r => r.memberId == blob.id).map((r) => {
                 const group = allGroups.get(r.groupId ?? '') ?? null;
@@ -1007,6 +1016,7 @@ export class AuthenticatedStructures {
             ...balances.filter(b => b.objectType === ReceivableBalanceType.user || b.objectType === ReceivableBalanceType.userWithoutMembers).map(b => b.objectId),
         ]);
         const users = userIds.length > 0 ? await User.getByIDs(...userIds) : [];
+        const platform = await PlatformModel.getSharedStruct();
 
         const result: { balance: CachedBalance; object: ReceivableBalanceObject }[] = [];
 
@@ -1131,7 +1141,7 @@ export class AuthenticatedStructures {
             } else if (balance.objectType === ReceivableBalanceType.user || balance.objectType === ReceivableBalanceType.userWithoutMembers) {
                 const user = users.find(m => m.id === balance.objectId) ?? null;
                 if (user) {
-                    const url = Context.organization && Context.organization.id === balance.organizationId ? 'https://' + getAppHost('registration', Context.organization, user.permissions?.forOrganization(Context.organization)?.isEmpty === false) : '';
+                    const url = Context.organization && Context.organization.id === balance.organizationId ? 'https://' + getAppHost('registration', Context.organization, user.permissions?.forOrganization(Context.organization, platform, { inheritFromPlatform: false })?.isEmpty === false) : '';
                     object = ReceivableBalanceObject.create({
                         id: balance.objectId,
                         name: user.name || user.email,
@@ -1193,6 +1203,7 @@ export class AuthenticatedStructures {
         const users = await User.getByIDs(...userIds);
         const organizationsIds = Formatter.uniqueArray(logs.map(l => l.organizationId).filter(id => id !== null));
         const organizations = await Organization.getByIDs(...organizationsIds);
+        const platform = await PlatformModel.getSharedStruct();
 
         for (const log of logs) {
             const user = log.userId ? (users.find(u => u.id === log.userId) ?? null) : null;
@@ -1200,10 +1211,10 @@ export class AuthenticatedStructures {
 
             if (user) {
                 if (!await Context.auth.canAccessUser(user)) {
-                    if (user.permissions?.platform !== null) {
+                    if (user.permissions?.forPlatform(platform) !== null) {
                         userStruct = NamedObject.create({
                             id: '',
-                            name: $t(`%wi`) + ' ' + Platform.shared.config.name,
+                            name: $t(`%wi`) + ' ' + platform.config.name,
                         });
                     } else {
                         userStruct = NamedObject.create({

package/src/helpers/Context.ts

@@ -1,14 +1,14 @@
 import { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { isSimpleError, SimpleError } from '@simonbackx/simple-errors';
 import { I18n } from '@stamhoofd/backend-i18n';
-import type { User } from '@stamhoofd/models';
-import { Organization, Platform, RateLimiter, Token } from '@stamhoofd/models';
+import { MFAToken, Organization, Platform, RateLimiter, Token, User } from '@stamhoofd/models';
 import { AsyncLocalStorage } from 'async_hooks';
 
 import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, field, StringDecoder } from '@simonbackx/simple-encoding';
 import { ApiUserRateLimits } from '@stamhoofd/structures';
 import { AdminPermissionChecker } from './AdminPermissionChecker.js';
+import { TwoFactorHelper } from './TwoFactorHelper.js';
 
 export const apiUserRateLimiter = new RateLimiter({
     limits: [
@@ -180,7 +180,7 @@ export class ContextInstance {
         if (STAMHOOFD.userMode === 'platform') {
             return null;
         }
-        return await this.setOrganizationScope(options);
+        return await this.setOptionalOrganizationScope(options);
     }
 
     async setOrganizationScope(options?: { willAuthenticate?: boolean }) {
@@ -223,7 +223,24 @@ export class ContextInstance {
         }
     }
 
-    async authenticate({ allowWithoutAccount = false, allowUnscoped = false }: { allowWithoutAccount?: boolean; allowUnscoped?: boolean } = {}): Promise<{ user: User; token: Token }> {
+    /**
+     * Identify the caller from the Authorization header without ever throwing: returns
+     * null when the request is unauthenticated or carries an invalid/expired token.
+     * Use this to give an already signed in user a smoother experience, never to grant
+     * access (there is no error to react to).
+     */
+    async optionalAuthenticatedUser(): Promise<User | null> {
+        try {
+            const { user } = await this.authenticate({ allowWithoutAccount: true });
+            return user;
+        } catch (e) {
+            return null;
+        }
+    }
+
+    async authenticate(options: { allowMFASetupToken: true; allowWithoutAccount?: boolean; allowUnscoped?: boolean }): Promise<{ user: User; token: Token } | { user: User; setupToken: MFAToken }>;
+    async authenticate(options?: { allowMFASetupToken?: false | undefined; allowWithoutAccount?: boolean; allowUnscoped?: boolean }): Promise<{ user: User; token: Token }>;
+    async authenticate({ allowWithoutAccount = false, allowUnscoped = false, allowMFASetupToken = false }: { allowMFASetupToken?: boolean; allowWithoutAccount?: boolean; allowUnscoped?: boolean } = {}): Promise<{ user: User; token: Token } | { user: User; setupToken: MFAToken }> {
         let header = this.request.headers.authorization;
 
         if (!header && this.request.method === 'POST') {
@@ -244,6 +261,12 @@ export class ContextInstance {
         }
 
         if (!header.startsWith('Bearer ')) {
+            if (allowMFASetupToken) {
+                const result = await this.authenticateMFASetup();
+                if (result) {
+                    return result;
+                }
+            }
             throw new SimpleError({
                 code: 'not_supported_authentication',
                 message: 'Authentication method not supported. Please authenticate with OAuth2',
@@ -320,6 +343,93 @@ export class ContextInstance {
         return { user, token };
     }
 
+    /**
+     * Like authenticate(), but additionally requires the access token to be "fresh"
+     * (minted by a real authentication within the FRESH_WINDOW, not via a refresh).
+     * Used to gate sensitive actions such as managing 2FA methods.
+     */
+    async authenticateFresh(options: { allowWithoutAccount?: boolean; allowUnscoped?: boolean } = {}): Promise<{ user: User; token: Token }> {
+        const result = await this.authenticate(options);
+        if (!result.token.isFresh()) {
+            throw new SimpleError({
+                code: 'require_fresh_auth',
+                message: 'A recent authentication is required for this action',
+                human: $t('%Zgs'),
+                statusCode: 403,
+            });
+        }
+        return result;
+    }
+
+    /**
+     * Authorize a 2FA enrollment/management action. Accepts either a fresh full session
+     * (Bearer access token) or a setup token (Authorization: MFASetup <token>) issued
+     * during forced enrollment, before a session exists.
+     */
+    async authenticateMFASetup(): Promise<{ user: User; setupToken: MFAToken } | null> {
+        const header = this.request.headers.authorization;
+        if (header && header.startsWith('MFASetup ')) {
+            const raw = header.substring('MFASetup '.length);
+            const setupToken = await MFAToken.getValid(raw, 'setup');
+            if (!setupToken) {
+                throw new SimpleError({
+                    code: 'mfa_setup_expired',
+                    message: 'The MFA setup session is invalid or expired',
+                    human: $t('%ZhJ'),
+                    statusCode: 401,
+                });
+            }
+            const user = await User.getByID(setupToken.userId);
+            if (!user) {
+                throw new SimpleError({
+                    code: 'mfa_setup_expired',
+                    message: 'The MFA setup session is invalid or expired',
+                    human: $t('%ZhJ'),
+                    statusCode: 401,
+                });
+            }
+
+            // A setup token is issued on the strength of a password alone, to bootstrap a
+            // *first* factor. If the user enrolled one in the meantime (e.g. from another
+            // device), it must stop being worth a session: otherwise someone who only
+            // knows the password keeps a 15 minute window in which they can enroll a
+            // factor of their own and sign in, even though the account is now protected.
+            if (await TwoFactorHelper.userHasFactors(user.id)) {
+                await setupToken.consume();
+                throw new SimpleError({
+                    code: 'mfa_setup_expired',
+                    message: 'The MFA setup session is no longer valid: the user already has a second factor',
+                    human: $t('%ZhJ'),
+                    statusCode: 401,
+                });
+            }
+
+            this.user = user;
+            await this.insecurelyAuthenticateAs(user);
+            return { user, setupToken };
+        }
+
+        return null;
+    }
+
+    /**
+     * Authorize a 2FA enrollment/management action. Accepts either a fresh full session
+     * (Bearer access token) or a setup token (Authorization: MFASetup <token>) issued
+     * during forced enrollment, before a session exists.
+     *
+     * Exactly one of `setupToken` / `token` is set: `token` is the session the request was
+     * made with, which enrollment keeps alive while signing out the user's other sessions.
+     */
+    async authenticateMFAEnrollment(): Promise<{ user: User; setupToken: MFAToken | null; token: Token | null }> {
+        const mfa = await this.authenticateMFASetup();
+        if (mfa) {
+            return { ...mfa, token: null };
+        }
+
+        const { user, token } = await this.authenticateFresh();
+        return { user, setupToken: null, token };
+    }
+
     async insecurelyAuthenticateAs(user: User) {
         this.#auth = new AdminPermissionChecker(user, await Platform.getSharedPrivateStruct(), this.organization);