@stamhoofd/backend 2.137.4 → 2.138.0

package/src/helpers/EmailResumer.ts

@@ -2,6 +2,7 @@ import { Email, Organization, User } from '@stamhoofd/models';
 import { SQL } from '@stamhoofd/sql';
 import { EmailStatus } from '@stamhoofd/structures';
 import { ContextInstance } from './Context.js';
+import { EmailSendService } from '../services/EmailSendService.js';
 
 export async function resumeEmails() {
     const query = SQL.select()
@@ -28,7 +29,7 @@ export async function resumeEmails() {
 
         try {
             await ContextInstance.startForUser(user, organization, async () => {
-                await email.resumeSending();
+                await EmailSendService.resumeSending(email);
             });
         } catch (e) {
             console.error('Error resuming email', email.id, e);

package/src/helpers/ForwardHandler.ts

@@ -5,6 +5,7 @@ import { Email, EmailAddress } from '@stamhoofd/email';
 import { Organization, Platform } from '@stamhoofd/models';
 import { Formatter } from '@stamhoofd/utility';
 import { simpleParser } from 'mailparser';
+import { OrganizationAdminService } from '../services/OrganizationAdminService.js';
 
 export class ForwardHandler {
     static async handle(content: any, receipt: {
@@ -93,7 +94,7 @@ export class ForwardHandler {
         }
 
         if (organization) {
-            organizationEmails = await organization.getReplyEmails();
+            organizationEmails = await OrganizationAdminService.getReplyEmails(organization);
             if (!organizationEmails) {
                 if (STAMHOOFD.environment === 'test') {
                     // ignore

package/src/helpers/MFAEncryption.ts

@@ -0,0 +1,34 @@
+import crypto from 'crypto';
+
+/**
+ * Symmetric encryption for TOTP secrets at rest. The key is derived from
+ * STAMHOOFD.INTERNAL_SECRET_KEY so we don't need a separate provisioned secret.
+ */
+const ALGORITHM = 'aes-256-gcm';
+
+function getKey(): Buffer {
+    const base = STAMHOOFD.INTERNAL_SECRET_KEY;
+    if (!base) {
+        throw new Error('INTERNAL_SECRET_KEY is required to encrypt MFA secrets');
+    }
+    return crypto.createHash('sha256').update(base + ':mfa-totp-secret').digest();
+}
+
+export function encryptMFASecret(plaintext: string): string {
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv(ALGORITHM, getKey(), iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return [iv.toString('base64'), tag.toString('base64'), encrypted.toString('base64')].join(':');
+}
+
+export function decryptMFASecret(payload: string): string {
+    const parts = payload.split(':');
+    if (parts.length !== 3) {
+        throw new Error('Invalid encrypted MFA secret');
+    }
+    const [ivB64, tagB64, dataB64] = parts;
+    const decipher = crypto.createDecipheriv(ALGORITHM, getKey(), Buffer.from(ivB64, 'base64'));
+    decipher.setAuthTag(Buffer.from(tagB64, 'base64'));
+    return Buffer.concat([decipher.update(Buffer.from(dataB64, 'base64')), decipher.final()]).toString('utf8');
+}

package/src/helpers/MembershipCharger.ts

@@ -3,6 +3,7 @@ import { BalanceItem, Member, MemberPlatformMembership, Platform, RegistrationPe
 import { SQL, SQLOrderBy, SQLWhereSign } from '@stamhoofd/sql';
 import { BalanceItemRelation, BalanceItemRelationType, BalanceItemType, TranslatedString } from '@stamhoofd/structures';
 import { Formatter, sleep } from '@stamhoofd/utility';
+import { PlatformMembershipService } from '../services/PlatformMembershipService.js';
 
 export const MembershipCharger = {
     async charge() {
@@ -86,7 +87,7 @@ export const MembershipCharger = {
 
                 // Force price update (required because could have changed - especially for free memberships in combination with deletes)
                 try {
-                    await membership.calculatePrice(member);
+                    await PlatformMembershipService.calculatePrice(membership, member);
                 } catch (e) {
                     console.error('Failed to update price for membership. Not charged.', membership.id, e);
                     continue;
@@ -194,7 +195,7 @@ export const MembershipCharger = {
 
                 // Force price update (required because could have changed - especially for free memberships in combination with deletes)
                 try {
-                    await membership.calculatePrice(member);
+                    await PlatformMembershipService.calculatePrice(membership, member);
                     await membership.save();
                 } catch (e) {
                     console.error('Failed to update price for membership', membership.id, e);

package/src/helpers/RecoveryCodeHelper.ts

@@ -0,0 +1,81 @@
+import * as argon2 from 'argon2';
+import basex from 'base-x';
+import crypto from 'crypto';
+
+import { MFARecoveryCode } from '@stamhoofd/models';
+
+const RECOVERY_CODE_COUNT = 10;
+const CODE_LENGTH = 16;
+
+// No 0, O, I or L, to make the codes easier for humans to read. Mirrors
+// Member.generateSecurityCode.
+export const RECOVERY_CODE_ALPHABET = '123456789ABCDEFGHJKMNPQRSTUVWXYZ';
+const recoveryCodeBase = basex(RECOVERY_CODE_ALPHABET);
+
+/**
+ * A single recovery code: 16 symbols (~80 bits) from the base-x encoding of random
+ * bytes, formatted as XXXX-XXXX-XXXX-XXXX. Uses base-x (like Member.generateSecurityCode)
+ * rather than hand-rolled modulo indexing.
+ */
+function randomCode(): string {
+    const raw = recoveryCodeBase.encode(crypto.randomBytes(100)).toUpperCase().substring(0, CODE_LENGTH);
+    return raw.replace(/(.{4})(.{4})(.{4})(.{4})/, '$1-$2-$3-$4');
+}
+
+function normalize(code: string): string {
+    return (code ?? '').toUpperCase().replace(/[^A-Z0-9]/g, '');
+}
+
+export const RecoveryCodeHelper = {
+    /**
+     * Generate a new batch of recovery codes for a user, replacing any existing batch.
+     * Returns the plaintext codes (only shown once). Only Argon2 hashes are stored.
+     */
+    async regenerateForUser(userId: string): Promise<string[]> {
+        await MFARecoveryCode.deleteForUser(userId);
+
+        const codes: string[] = [];
+        for (let i = 0; i < RECOVERY_CODE_COUNT; i++) {
+            const code = randomCode();
+            codes.push(code);
+
+            const model = new MFARecoveryCode();
+            model.userId = userId;
+            model.codeHash = await argon2.hash(normalize(code));
+            await model.save();
+        }
+        return codes;
+    },
+
+    /**
+     * Verify and consume a recovery code. Returns true if a matching unused code was
+     * found. The row is claimed with a conditional `UPDATE ... WHERE usedAt IS NULL`, so
+     * two concurrent requests can never both consume the same code.
+     */
+    async consume(userId: string, code: string): Promise<boolean> {
+        const normalized = normalize(code);
+        if (normalized.length === 0) {
+            return false;
+        }
+
+        const unused = await MFARecoveryCode.getUnusedForUser(userId);
+        for (const candidate of unused) {
+            try {
+                if (await argon2.verify(candidate.codeHash, normalized)) {
+                    // Atomically claim the code: only the first request whose UPDATE
+                    // matches (usedAt still NULL) wins the race.
+                    const result = await MFARecoveryCode.update()
+                        .set('usedAt', new Date())
+                        .where('id', candidate.id)
+                        .where('usedAt', null)
+                        .update();
+                    return result.changedRows === 1;
+                }
+            }
+            catch (e) {
+                // Ignore malformed hash, keep checking
+            }
+        }
+        return false;
+    },
+};

package/src/helpers/TOTPHelper.ts

@@ -0,0 +1,79 @@
+import { authenticator } from 'otplib';
+
+import { decryptMFASecret, encryptMFASecret } from './MFAEncryption.js';
+import { Formatter } from '@stamhoofd/utility';
+
+// Allow a ±1 step (±30s) tolerance to account for clock drift.
+const WINDOW = 1;
+
+/**
+ * Reset the shared otplib singleton to our defaults, optionally pinning the epoch (ms) so
+ * that a verification's returned delta and the counter we derive from it are computed from
+ * the exact same instant. Pass no argument to restore the live-clock behaviour.
+ */
+function configureAuthenticator(epoch?: number) {
+    authenticator.resetOptions();
+    authenticator.options = epoch === undefined ? { window: WINDOW } : { window: WINDOW, epoch };
+}
+
+configureAuthenticator();
+
+export const TOTPHelper = {
+    /**
+     * Generate a fresh base32 secret (plaintext, to show once to the user).
+     */
+    generateSecret(): string {
+        return authenticator.generateSecret();
+    },
+
+    /**
+     * Build the otpauth:// URI used to render the QR code.
+     */
+    keyuri(accountName: string, secret: string): string {
+        const service = STAMHOOFD.domains?.dashboard ?? Formatter.capitalizeFirstLetter(STAMHOOFD.platformName);
+        return authenticator.keyuri(accountName, service, secret);
+    },
+
+    encrypt(secret: string): string {
+        return encryptMFASecret(secret);
+    },
+
+    /**
+     * Verify a 6-digit code against an encrypted secret. Returns the absolute TOTP step
+     * counter that matched (which increases monotonically over time), or null when the
+     * code is invalid.
+     *
+     * Callers MUST reject a counter that is not strictly greater than the last counter
+     * they accepted for the same authenticator, otherwise a still-valid code can be
+     * replayed within its window (RFC 6238 §5.2).
+     */
+    verify(code: string, encryptedSecret: string): number | null {
+        const trimmed = (code ?? '').trim();
+        if (!/^\d{6}$/.test(trimmed)) {
+            return null;
+        }
+        try {
+            const secret = decryptMFASecret(encryptedSecret);
+            const now = Date.now();
+            const step = authenticator.allOptions().step ?? 30;
+
+            // Pin the epoch so checkDelta() and our counter are derived from the same
+            // instant (otherwise a step boundary crossing between the two reads could
+            // produce an off-by-one counter).
+            configureAuthenticator(now);
+            let delta: number | null;
+            try {
+                delta = authenticator.checkDelta(trimmed, secret);
+            } finally {
+                configureAuthenticator();
+            }
+
+            if (delta === null) {
+                return null;
+            }
+            return Math.floor(now / 1000 / step) + delta;
+        } catch (e) {
+            return null;
+        }
+    },
+};

package/src/helpers/TenantContext.test.ts

@@ -0,0 +1,96 @@
+import { Database } from '@simonbackx/simple-database';
+import { Platform, ROOT_TENANT_ID } from '@stamhoofd/models';
+import { PlatformConfig, PlatformMembershipType } from '@stamhoofd/structures';
+import { STExpect } from '@stamhoofd/test-utils';
+import { TenantContext } from './TenantContext.js';
+
+describe('TenantContext', () => {
+    test('there is no tenant outside a scope', () => {
+        expect(TenantContext.optional).toBeNull();
+        expect(() => TenantContext.current).toThrow(
+            STExpect.simpleError({ code: 'no_tenant_context' }),
+        );
+    });
+
+    test('currentOrRoot falls back to the root tenant', () => {
+        expect(TenantContext.currentOrRoot.tenantId).toBe(ROOT_TENANT_ID);
+    });
+
+    test('run enters a scope and leaves it again', async () => {
+        await TenantContext.run('tenant-a', async () => {
+            expect(TenantContext.current.tenantId).toBe('tenant-a');
+            expect(TenantContext.currentOrRoot.tenantId).toBe('tenant-a');
+        });
+
+        expect(TenantContext.optional).toBeNull();
+    });
+
+    test('a nested scope wins and the outer one is restored', async () => {
+        await TenantContext.run('tenant-a', async () => {
+            await TenantContext.run('tenant-b', async () => {
+                expect(TenantContext.current.tenantId).toBe('tenant-b');
+            });
+
+            expect(TenantContext.current.tenantId).toBe('tenant-a');
+        });
+    });
+
+    test('concurrent scopes do not leak into each other', async () => {
+        const seen: string[] = [];
+
+        const observe = async (tenantId: string, delay: number) => {
+            return await TenantContext.run(tenantId, async () => {
+                await new Promise(resolve => setTimeout(resolve, delay));
+                seen.push(`${tenantId}:${TenantContext.current.tenantId}`);
+                return TenantContext.current.tenantId;
+            });
+        };
+
+        // a enters first but resumes first too, so a save/restore of one mutable "current" would
+        // hand a whichever tenant entered after it
+        const [a, b] = await Promise.all([observe('tenant-a', 5), observe('tenant-b', 30)]);
+
+        expect(a).toBe('tenant-a');
+        expect(b).toBe('tenant-b');
+        expect(seen).toEqual(['tenant-a:tenant-a', 'tenant-b:tenant-b']);
+    });
+
+    describe('resolving the tenant', () => {
+        afterEach(async () => {
+            await Platform.clearCacheForTenantWithoutRefresh('context-tenant');
+            await Database.delete('DELETE FROM platform WHERE id != ?', [ROOT_TENANT_ID]);
+            await Platform.clearCache();
+        });
+
+        test('the scope resolves its own struct', async () => {
+            const root = await Platform.getForEditing();
+
+            const other = new Platform();
+            other.id = 'context-tenant';
+            other.periodId = root.periodId;
+            other.config = PlatformConfig.create({
+                membershipTypes: [PlatformMembershipType.create({ id: 'ct', name: 'Context tenant type' })],
+            });
+            await other.save();
+
+            await TenantContext.run('context-tenant', async () => {
+                const struct = await TenantContext.current.getStruct();
+                expect(struct.config.membershipTypes.map(m => m.name)).toEqual(['Context tenant type']);
+                expect(struct.privateConfig).toBeNull();
+
+                const privateStruct = await TenantContext.current.getPrivateStruct();
+                expect(privateStruct.privateConfig).not.toBeNull();
+
+                expect((await TenantContext.current.getTenant()).id).toBe('context-tenant');
+            });
+        });
+
+        test('an unknown tenant does not resolve', async () => {
+            await TenantContext.run('no-such-tenant', async () => {
+                await expect(TenantContext.current.getStruct()).rejects.toThrow(
+                    STExpect.simpleError({ code: 'tenant_not_found' }),
+                );
+            });
+        });
+    });
+});

package/src/helpers/TenantContext.ts

@@ -0,0 +1,67 @@
+import { SimpleError } from '@simonbackx/simple-errors';
+import { Platform, ROOT_TENANT_ID } from '@stamhoofd/models';
+import type { PlatformPrivateConfig, Platform as PlatformStruct } from '@stamhoofd/structures';
+import { AsyncLocalStorage } from 'async_hooks';
+
+export class TenantContextInstance {
+    readonly tenantId: string;
+
+    constructor(tenantId: string) {
+        this.tenantId = tenantId;
+    }
+
+    async getTenant(): Promise<Readonly<Platform>> {
+        return await Platform.getForTenant(this.tenantId);
+    }
+
+    async getStruct(): Promise<PlatformStruct> {
+        return await Platform.getStructForTenant(this.tenantId);
+    }
+
+    async getPrivateStruct(): Promise<PlatformStruct & { privateConfig: PlatformPrivateConfig }> {
+        return await Platform.getPrivateStructForTenant(this.tenantId);
+    }
+}
+
+/**
+ * The tenant the current work belongs to.
+ *
+ * Separate from Context on purpose: crons, migrations and queued jobs run for a fixed tenant with no
+ * request, no authentication and no user, so a request-scoped context cannot carry them.
+ */
+export class TenantContext {
+    private static asyncLocalStorage = new AsyncLocalStorage<TenantContextInstance>();
+
+    static get optional(): TenantContextInstance | null {
+        return this.asyncLocalStorage.getStore() ?? null;
+    }
+
+    static get current(): TenantContextInstance {
+        const c = this.optional;
+
+        if (!c) {
+            throw new SimpleError({
+                code: 'no_tenant_context',
+                message: 'No tenant context found',
+                statusCode: 500,
+            });
+        }
+
+        return c;
+    }
+
+    /**
+     * The current tenant, or the root tenant when nothing has entered a scope yet.
+     *
+     * Only for call sites that have not been given a tenant yet. Anything that already runs for a
+     * known tenant should use current, so a missing scope fails loudly instead of quietly reading
+     * the root tenant.
+     */
+    static get currentOrRoot(): TenantContextInstance {
+        return this.optional ?? new TenantContextInstance(ROOT_TENANT_ID);
+    }
+
+    static async run<T>(tenantId: string, handler: () => Promise<T>): Promise<T> {
+        return await this.asyncLocalStorage.run(new TenantContextInstance(tenantId), handler);
+    }
+}