@stamhoofd/backend 2.137.4 → 2.138.0

package/src/services/OrganizationDNSService.ts

@@ -0,0 +1,282 @@
+import type { GetEmailIdentityCommandOutput } from '@aws-sdk/client-sesv2';
+import { CreateEmailIdentityCommand, DeleteEmailIdentityCommand, GetEmailIdentityCommand, PutEmailIdentityFeedbackAttributesCommand, PutEmailIdentityMailFromAttributesCommand, SESv2Client } from '@aws-sdk/client-sesv2';
+import type { Organization } from '@stamhoofd/models';
+import { validateDNSRecords } from '@stamhoofd/models/helpers/DNSValidator.js';
+import { DNSRecordStatus, EmailTemplateType } from '@stamhoofd/structures';
+import { Formatter } from '@stamhoofd/utility';
+import { OrganizationEmailService } from './OrganizationEmailService.js';
+
+export class OrganizationDNSService {
+    static async updateDNSRecords(organization: Organization) {
+        // Check initial status
+        let isValidRecords = true;
+        for (const record of organization.privateMeta.dnsRecords) {
+            if (record.status !== DNSRecordStatus.Valid) {
+                isValidRecords = false;
+            }
+        }
+
+        const { allValid } = await validateDNSRecords(organization.privateMeta.dnsRecords);
+
+        if (organization.registerDomain ?? organization.privateMeta.pendingRegisterDomain) {
+            const registerDomainRecord = (organization.privateMeta.pendingRegisterDomain ?? organization.registerDomain) + '.';
+            const records = organization.privateMeta.dnsRecords.filter(r => r.name === registerDomainRecord);
+            const areRegisterDomainRecordsValid = records.length === 0 || records.every(r => r.status === DNSRecordStatus.Valid);
+
+            if (areRegisterDomainRecordsValid) {
+                // We can setup the register domain if needed
+                if (organization.privateMeta.pendingRegisterDomain !== null) {
+                    organization.registerDomain = organization.privateMeta.pendingRegisterDomain;
+                    organization.privateMeta.pendingRegisterDomain = null;
+
+                    console.log('Did set register domain for ' + organization.id + ' to ' + organization.registerDomain);
+                }
+            } else {
+                // Clear register domain
+                if (organization.registerDomain) {
+                    // We need to clear it, to prevent sending e-mails with invalid links
+                    organization.privateMeta.pendingRegisterDomain = organization.privateMeta.pendingRegisterDomain ?? organization.registerDomain;
+                    organization.registerDomain = null;
+
+                    console.log('Cleared register domain for ' + organization.id + ' because of invalid non txt records');
+                }
+            }
+        }
+
+        if (allValid) {
+            if (organization.privateMeta.pendingMailDomain !== null) {
+                organization.privateMeta.mailDomain = organization.privateMeta.pendingMailDomain;
+                organization.privateMeta.pendingMailDomain = null;
+            }
+
+            const wasUnstable = organization.serverMeta.isDNSUnstable;
+            organization.serverMeta.markDNSValid();
+
+            const didSendDomainSetupMail = organization.serverMeta.didSendDomainSetupMail;
+            const didSendWarning = organization.serverMeta.DNSRecordWarningCount > 0;
+            organization.serverMeta.DNSRecordWarningCount = 0;
+
+            const wasActive = organization.privateMeta.mailDomainActive;
+            await this.updateAWSMailIdenitity(organization);
+
+            // yay! Do not Save until after doing AWS changes
+            await organization.save();
+
+            if (wasUnstable && !organization.serverMeta.isDNSUnstable) {
+                console.warn('DNS settings became stable for ' + organization.name + ' ' + organization.id);
+
+                await OrganizationEmailService.sendEmailTemplate(organization, {
+                    type: EmailTemplateType.OrganizationStableDNS,
+                    bcc: true,
+                });
+            } else if (!wasActive && organization.privateMeta.mailDomainActive && (!didSendDomainSetupMail || didSendWarning) && !organization.serverMeta.isDNSUnstable) {
+                organization.serverMeta.didSendDomainSetupMail = true;
+                await organization.save();
+
+                if (!didSendDomainSetupMail) {
+                    await OrganizationEmailService.sendEmailTemplate(organization, {
+                        type: EmailTemplateType.OrganizationDNSSetupComplete,
+                    });
+                } else {
+                    await OrganizationEmailService.sendEmailTemplate(organization, {
+                        type: EmailTemplateType.OrganizationValidDNS,
+                    });
+                }
+            }
+        } else {
+            // DNS settings gone broken
+            if (organization.privateMeta.mailDomain) {
+                organization.privateMeta.pendingMailDomain = organization.privateMeta.pendingMailDomain ?? organization.privateMeta.mailDomain;
+                organization.privateMeta.mailDomain = null;
+            }
+
+            const wasDNSUnstable = organization.serverMeta.isDNSUnstable;
+
+            organization.serverMeta.markDNSFailure();
+
+            // disable AWS emails
+            organization.privateMeta.mailDomainActive = false;
+
+            // save
+            await organization.save();
+
+            if (!wasDNSUnstable && organization.serverMeta.isDNSUnstable) {
+                // DNS became instable
+                console.warn('DNS settings became instable for ' + organization.name + ' ' + organization.id);
+
+                await OrganizationEmailService.sendEmailTemplate(organization, {
+                    type: EmailTemplateType.OrganizationUnstableDNS,
+                    bcc: true,
+                });
+            } else if (!organization.serverMeta.isDNSUnstable && organization.serverMeta.didSendDomainSetupMail && organization.serverMeta.DNSRecordWarningCount == 0) {
+                organization.serverMeta.DNSRecordWarningCount += 1;
+                await organization.save();
+
+                await OrganizationEmailService.sendEmailTemplate(organization, {
+                    type: EmailTemplateType.OrganizationInvalidDNS,
+                });
+            }
+        }
+    }
+
+    static get forbiddenEmailDomains() {
+        return [
+            STAMHOOFD.domains.dashboard,
+            ...Object.values(STAMHOOFD.domains.defaultBroadcastEmail ?? {}),
+            ...Object.values(STAMHOOFD.domains.defaultTransactionalEmail ?? {}),
+        ];
+    }
+
+    static async deleteAWSMailIdenitity(organization: Organization, mailDomain: string) {
+        // Protect specific domain names
+        if (this.forbiddenEmailDomains.includes(mailDomain.toLowerCase())) {
+            return;
+        }
+
+        if (STAMHOOFD.environment !== 'production') {
+            // Temporary ignore this
+            return;
+        }
+
+        const client = new SESv2Client({});
+
+        // Check if mail identitiy already exists..
+        try {
+            const cmd = new GetEmailIdentityCommand({
+                EmailIdentity: mailDomain,
+            });
+            const result = await client.send(cmd);
+
+            if (result.VerifiedForSendingStatus === true) {
+                console.log('Cant delete AWS mail idenitiy @' + organization.id + ' for ' + mailDomain + ': already validated and might be in use by other organizations');
+                return;
+            }
+
+            console.log('Deleting AWS mail identity @' + organization.id + ' for ' + mailDomain);
+
+            const deleteCmd = new DeleteEmailIdentityCommand({
+                EmailIdentity: mailDomain,
+            });
+
+            await client.send(deleteCmd);
+            console.log('Deleted AWS mail idenitiy @' + organization.id + ' for ' + organization.privateMeta.mailDomain);
+        } catch (e) {
+            console.error('Could not delete AWS email identitiy @' + organization.id + ' for ' + organization.privateMeta.mailDomain);
+            console.error(e);
+        }
+    }
+
+    /**
+     * Create or update the AWS mail idenitiy and also update the active state of the mailDomain
+     */
+    static async updateAWSMailIdenitity(organization: Organization) {
+        if (organization.privateMeta.mailDomain === null) {
+            return;
+        }
+
+        // Protect specific domain names
+        if (['stamhoofd.be', 'stamhoofd.nl', 'stamhoofd.shop', 'stamhoofd.app', 'stamhoofd.email'].includes(organization.privateMeta.mailDomain)) {
+            console.error('Tried to validate AWS mail identity with protected domains @' + organization.id);
+            organization.privateMeta.mailDomainActive = false;
+            return;
+        }
+
+        if (STAMHOOFD.environment !== 'production') {
+            // Temporary ignore this
+            organization.privateMeta.mailDomainActive = true;
+            return;
+        }
+
+        const client = new SESv2Client({});
+        const expectedConfigurationSetName = Formatter.slug(STAMHOOFD.platformName + '-domains');
+
+        // Check if mail identitiy already exists..
+        let exists = false;
+        let existing: GetEmailIdentityCommandOutput | undefined = undefined;
+        try {
+            const cmd = new GetEmailIdentityCommand({
+                EmailIdentity: organization.privateMeta.mailDomain,
+            });
+
+            existing = await client.send(cmd);
+            exists = true;
+
+            console.log('AWS mail idenitiy exists already: just checking the verification status in AWS @' + organization.id);
+
+            if (existing.ConfigurationSetName !== expectedConfigurationSetName) {
+                // Not allowed to use this identity
+                organization.privateMeta.mailDomainActive = false;
+                console.error('Organization is not allowed to use email identity ' + organization.privateMeta.mailDomain + ' @' + organization.id + ', got ' + existing.ConfigurationSetName);
+                return;
+            }
+
+            organization.privateMeta.mailDomainActive = existing.VerifiedForSendingStatus ?? false;
+
+            if (existing.VerifiedForSendingStatus !== true) {
+                console.error('Not validated @' + organization.id);
+            }
+
+            if (existing.VerifiedForSendingStatus !== true && existing.DkimAttributes?.Status === 'FAILED') {
+                console.error('AWS failed to verify DKIM records. Triggering a forced recheck @' + organization.id);
+
+                const deleteCmd = new DeleteEmailIdentityCommand({
+                    EmailIdentity: organization.privateMeta.mailDomain,
+                });
+                await client.send(deleteCmd);
+
+                // Recreate it immediately
+                exists = false;
+            }
+        } catch (e) {
+            console.error(e);
+        }
+
+        if (!exists) {
+            console.log('Creating email identity in AWS SES...');
+
+            const cmd = new CreateEmailIdentityCommand({
+                EmailIdentity: organization.privateMeta.mailDomain,
+                ConfigurationSetName: expectedConfigurationSetName,
+                DkimSigningAttributes: {
+                    DomainSigningPrivateKey: organization.serverMeta.privateDKIMKey!,
+                    DomainSigningSelector: Formatter.slug(STAMHOOFD.platformName),
+                },
+                Tags: [
+                    {
+                        Key: 'OrganizationId',
+                        Value: organization.id,
+                    },
+                    {
+                        Key: 'Environment',
+                        Value: STAMHOOFD.environment ?? 'Unknown',
+                    },
+                ],
+            });
+
+            const result = await client.send(cmd);
+            organization.privateMeta.mailDomainActive = result.VerifiedForSendingStatus ?? false;
+
+            // Disable email forwarding of bounces and complaints
+            // We handle this now with the configuration set
+            const putFeedbackCmd = new PutEmailIdentityFeedbackAttributesCommand({
+                EmailIdentity: organization.privateMeta.mailDomain,
+                EmailForwardingEnabled: false,
+            });
+
+            await client.send(putFeedbackCmd);
+        }
+
+        if (organization.privateMeta.mailFromDomain && (!exists || (existing && (!existing.MailFromAttributes || existing.MailFromAttributes.MailFromDomain !== organization.privateMeta.mailFromDomain)))) {
+            // Also set a from domain, to fix SPF
+            console.log('Setting mail from domain: ' + organization.privateMeta.mailFromDomain + ' for ' + organization.id);
+
+            const cmd = new PutEmailIdentityMailFromAttributesCommand({
+                EmailIdentity: organization.privateMeta.mailDomain,
+                BehaviorOnMxFailure: 'USE_DEFAULT_VALUE',
+                MailFromDomain: organization.privateMeta.mailFromDomain,
+            });
+
+            await client.send(cmd);
+        }
+    }
+}

package/src/services/OrganizationEmailService.test.ts

@@ -0,0 +1,57 @@
+import { EmailMocker } from '@stamhoofd/email';
+import type { Organization } from '@stamhoofd/models';
+import { EmailTemplateFactory, OrganizationFactory, UserFactory } from '@stamhoofd/models';
+import { EmailTemplateType, PermissionLevel, Permissions } from '@stamhoofd/structures';
+import { TestUtils } from '@stamhoofd/test-utils';
+import { OrganizationEmailService } from './OrganizationEmailService.js';
+
+async function createOrganizationWithAdmin(): Promise<Organization> {
+    const organization = await new OrganizationFactory({}).create();
+    await new UserFactory({
+        organization,
+        email: 'admin@example.com',
+        firstName: 'Ad',
+        lastName: 'Min',
+        permissions: Permissions.create({ level: PermissionLevel.Full }),
+    }).create();
+    return organization;
+}
+
+function setupEnvironment() {
+    TestUtils.setEnvironment('userMode', 'organization');
+
+    // The notification emails localize the marketing domain, which the shared test environment does not set
+    TestUtils.setEnvironment('domains', {
+        ...STAMHOOFD.domains,
+        marketing: { '': 'stamhoofd.dev', BE: 'be.stamhoofd.dev', NL: 'nl.stamhoofd.dev' },
+    });
+}
+
+describe('OrganizationEmailService.checkDrips', () => {
+    beforeAll(async () => {
+        await new EmailTemplateFactory({
+            type: EmailTemplateType.OrganizationDripWelcome,
+            subject: EmailTemplateType.OrganizationDripWelcome,
+            html: '<p>{{organizationName}} - {{mailDomain}}</p>',
+            text: '{{organizationName}} - {{mailDomain}}',
+        }).create();
+    });
+
+    beforeEach(() => {
+        setupEnvironment();
+    });
+
+    test('Sends the welcome drip email only once', async () => {
+        const organization = await createOrganizationWithAdmin();
+
+        await OrganizationEmailService.checkDrips(organization);
+
+        const emails = await EmailMocker.transactional.getSucceededEmails();
+        expect(emails).toHaveLength(1);
+        expect(emails[0].subject).toBe(EmailTemplateType.OrganizationDripWelcome);
+        expect(organization.serverMeta.hasEmail(EmailTemplateType.OrganizationDripWelcome)).toBe(true);
+
+        await OrganizationEmailService.checkDrips(organization);
+        expect(await EmailMocker.transactional.getSucceededEmails()).toHaveLength(1);
+    });
+});

package/src/services/OrganizationEmailService.ts

@@ -0,0 +1,212 @@
+import { I18n } from '@stamhoofd/backend-i18n';
+import type { Organization } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
+import { EmailTemplateType, Replacement, STPackageType } from '@stamhoofd/structures';
+import { Country } from '@stamhoofd/types/Country';
+import { Language } from '@stamhoofd/types/Language';
+import { OrganizationAdminService } from './OrganizationAdminService.js';
+
+export class OrganizationEmailService {
+    static async sendEmailTemplate(organization: Organization, data: {
+        type: EmailTemplateType;
+        personal?: boolean;
+        bcc?: boolean;
+    }) {
+        const recipients = await OrganizationAdminService.getAdminRecipients(organization);
+        const defaultI18n = new I18n(Language.Dutch, Country.Belgium);
+        const i18n = organization.i18n;
+
+        const replaceAll = [
+            {
+                from: defaultI18n.localizedDomains.marketing(),
+                to: i18n.localizedDomains.marketing(),
+            },
+            {
+                from: defaultI18n.$t('%2a'),
+                to: i18n.$t('%2a'),
+            },
+            {
+                from: defaultI18n.$t('%19'),
+                to: i18n.$t('%19'),
+            },
+        ];
+
+        await sendEmailTemplate(null, {
+            replaceAll,
+            recipients,
+            template: {
+                type: data.type,
+            },
+            singleBcc: data.bcc ? { email: 'simon@stamhoofd.be' } : undefined,
+            type: 'transactional',
+            defaultReplacements: [
+                Replacement.create({
+                    token: 'mailDomain',
+                    value: organization.privateMeta.mailDomain ?? organization.privateMeta.pendingMailDomain ?? '',
+                }),
+                Replacement.create({
+                    token: 'organizationName',
+                    value: organization.name,
+                }),
+            ],
+            unsubscribeType: 'marketing',
+            fromStamhoofd: true,
+        });
+    }
+
+    static async checkDrips(organization: Organization) {
+        const days7 = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
+
+        // Welcome drip
+        // Created maximum 7 days ago
+        if (organization.createdAt > days7 && !organization.serverMeta.hasEmail(EmailTemplateType.OrganizationDripWelcome)) {
+            await this.sendEmailTemplate(organization, {
+                type: EmailTemplateType.OrganizationDripWelcome,
+                personal: true,
+            });
+
+            organization.serverMeta.addEmail(EmailTemplateType.OrganizationDripWelcome);
+            await organization.save();
+
+            return; // Never send more than 1 drip email on the same day
+        }
+
+        // Webshop trial checkin
+        if (!organization.serverMeta.hasEmail(EmailTemplateType.OrganizationDripWebshopTrialCheckin)) {
+            if (organization.meta.packages.isWebshopsTrial) {
+                const activeTime = organization.meta.packages.getActiveTime(STPackageType.TrialWebshops);
+                if (activeTime !== null && activeTime > 4 * 24 * 60 * 60 * 1000) {
+                    // 7 days checkin
+                    await this.sendEmailTemplate(organization, {
+                        type: EmailTemplateType.OrganizationDripWebshopTrialCheckin,
+                        personal: true,
+                    });
+
+                    organization.serverMeta.addEmail(EmailTemplateType.OrganizationDripWebshopTrialCheckin);
+                    organization.serverMeta.addEmail(EmailTemplateType.OrganizationDripMembersTrialCheckin); // also mark members checkin
+                    await organization.save();
+
+                    return; // Never send more than 1 drip email on the same day
+                }
+            }
+        }
+
+        // Members trial checkin
+        if (!organization.serverMeta.hasEmail(EmailTemplateType.OrganizationDripMembersTrialCheckin)) {
+            if (organization.meta.packages.isMembersTrial) {
+                const activeTime = organization.meta.packages.getActiveTime(STPackageType.TrialMembers);
+                if (activeTime !== null && activeTime > 4 * 24 * 60 * 60 * 1000) {
+                    // 7 days checkin
+                    await this.sendEmailTemplate(organization, {
+                        type: EmailTemplateType.OrganizationDripMembersTrialCheckin,
+                        personal: true,
+                    });
+
+                    organization.serverMeta.addEmail(EmailTemplateType.OrganizationDripMembersTrialCheckin);
+                    organization.serverMeta.addEmail(EmailTemplateType.OrganizationDripWebshopTrialCheckin); // Also mark webshop trial checkin
+                    await organization.save();
+
+                    return; // Never send more than 1 drip email on the same day
+                }
+            }
+        }
+
+        // Webshop trial expired after 1 week
+        if (!organization.serverMeta.hasEmail(EmailTemplateType.OrganizationDripWebshopTrialExpired)) {
+            if (!organization.meta.packages.useWebshops) {
+                const deactivatedTime = organization.meta.packages.getDeactivatedTime(STPackageType.TrialWebshops);
+                if (deactivatedTime !== null && deactivatedTime < 14 * 24 * 60 * 60 * 1000 && deactivatedTime > 7 * 24 * 60 * 60 * 1000) {
+                    await this.sendEmailTemplate(organization, {
+                        type: EmailTemplateType.OrganizationDripWebshopTrialExpired,
+                        personal: true,
+                    });
+
+                    organization.serverMeta.addEmail(EmailTemplateType.OrganizationDripWebshopTrialExpired);
+                    organization.serverMeta.addEmail(EmailTemplateType.OrganizationDripMembersTrialExpired); // also mark members
+                    await organization.save();
+
+                    return; // Never send more than 1 drip email on the same day
+                }
+            }
+        }
+
+        if (!organization.serverMeta.hasEmail(EmailTemplateType.OrganizationDripMembersTrialExpired)) {
+            if (!organization.meta.packages.useMembers) {
+                const deactivatedTime = organization.meta.packages.getDeactivatedTime(STPackageType.TrialMembers);
+                if (deactivatedTime !== null && deactivatedTime < 14 * 24 * 60 * 60 * 1000 && deactivatedTime > 7 * 24 * 60 * 60 * 1000) {
+                    await this.sendEmailTemplate(organization, {
+                        type: EmailTemplateType.OrganizationDripMembersTrialExpired,
+                        personal: true,
+                    });
+
+                    organization.serverMeta.addEmail(EmailTemplateType.OrganizationDripMembersTrialExpired);
+                    organization.serverMeta.addEmail(EmailTemplateType.OrganizationDripWebshopTrialExpired); // also mark webshops
+                    await organization.save();
+
+                    return; // Never send more than 1 drip email on the same day
+                }
+            }
+        }
+
+        // trial expired reminder (after 10 months)
+        if (!organization.serverMeta.hasEmail(EmailTemplateType.OrganizationDripTrialExpiredReminder)) {
+            if (!organization.meta.packages.isPaid && !organization.meta.packages.wasPaid) {
+                const deactivatedTime1 = organization.meta.packages.getDeactivatedTime(STPackageType.TrialWebshops);
+                const deactivatedTime2 = organization.meta.packages.getDeactivatedTime(STPackageType.TrialMembers);
+
+                const deactivatedTime = deactivatedTime1 && deactivatedTime2 ? Math.max(deactivatedTime1, deactivatedTime2) : (deactivatedTime1 ? deactivatedTime1 : deactivatedTime2);
+
+                if (deactivatedTime !== null && deactivatedTime > 10 * 30 * 24 * 60 * 60 * 1000 && deactivatedTime < 13 * 31 * 24 * 60 * 60 * 1000) {
+                    await this.sendEmailTemplate(organization, {
+                        type: EmailTemplateType.OrganizationDripTrialExpiredReminder,
+                        personal: true,
+                        bcc: true,
+                    });
+
+                    organization.serverMeta.addEmail(EmailTemplateType.OrganizationDripTrialExpiredReminder);
+                    await organization.save();
+
+                    return; // Never send more than 1 drip email on the same day
+                }
+            }
+        }
+
+        if (!organization.serverMeta.hasEmail(EmailTemplateType.OrganizationDripWebshopNotRenewed)) {
+            if (!organization.meta.packages.useWebshops) {
+                const deactivatedTime = organization.meta.packages.getDeactivatedTime(STPackageType.Webshops);
+
+                if (deactivatedTime !== null && deactivatedTime > 30 * 24 * 60 * 60 * 1000 && deactivatedTime < 30 * 3 * 24 * 60 * 60 * 1000) {
+                    await this.sendEmailTemplate(organization, {
+                        type: EmailTemplateType.OrganizationDripWebshopNotRenewed,
+                        personal: true,
+                        bcc: true,
+                    });
+
+                    organization.serverMeta.addEmail(EmailTemplateType.OrganizationDripWebshopNotRenewed);
+                    await organization.save();
+
+                    return; // Never send more than 1 drip email on the same day
+                }
+            }
+        }
+
+        if (!organization.serverMeta.hasEmail(EmailTemplateType.OrganizationDripMembersNotRenewed)) {
+            if (!organization.meta.packages.useMembers) {
+                const deactivatedTime = organization.meta.packages.getDeactivatedTime(STPackageType.Members);
+
+                if (deactivatedTime !== null && deactivatedTime > 30 * 24 * 60 * 60 * 1000 && deactivatedTime < 30 * 3 * 24 * 60 * 60 * 1000) {
+                    await this.sendEmailTemplate(organization, {
+                        type: EmailTemplateType.OrganizationDripMembersNotRenewed,
+                        personal: true,
+                        bcc: true,
+                    });
+
+                    organization.serverMeta.addEmail(EmailTemplateType.OrganizationDripMembersNotRenewed);
+                    await organization.save();
+
+                    return; // Never send more than 1 drip email on the same day
+                }
+            }
+        }
+    }
+}

package/src/services/PasswordForgotService.test.ts

@@ -0,0 +1,99 @@
+import { I18n } from '@stamhoofd/backend-i18n';
+import { Organization, OrganizationFactory, PasswordToken, User, UserFactory } from '@stamhoofd/models';
+import { Address, OrganizationMetaData, PermissionLevel, Permissions } from '@stamhoofd/structures';
+import { TestUtils } from '@stamhoofd/test-utils';
+import { Country } from '@stamhoofd/types/Country';
+import { PasswordForgotService } from './PasswordForgotService.js';
+
+const i18n = new I18n(I18n.defaultLanguage, I18n.defaultCountry);
+
+/**
+ * An organization that is not saved in the database: enough to build an url with.
+ */
+function buildOrganization(id = 'organization-1') {
+    const organization = new Organization();
+    organization.id = id;
+    organization.name = 'Test organization';
+    organization.uri = 'test-organization';
+    organization.meta = OrganizationMetaData.create({});
+    organization.address = Address.create({
+        street: 'Demostraat',
+        number: '12',
+        city: 'Gent',
+        postalCode: '9000',
+        country: Country.Belgium,
+    });
+    return organization;
+}
+
+function buildUser(organizationId: string | null) {
+    const user = new User();
+    user.id = 'user-1';
+    user.organizationId = organizationId;
+    user.email = 'user@example.com';
+    return user;
+}
+
+function buildToken(user: User, token: string) {
+    const passwordToken = new PasswordToken();
+    passwordToken.token = token;
+    passwordToken.userId = user.id;
+    return passwordToken;
+}
+
+describe('PasswordForgotService', () => {
+    beforeEach(() => {
+        TestUtils.setEnvironment('userMode', 'organization');
+    });
+
+    describe('getPasswordRecoveryUrl', () => {
+        test('An administrator of the organization gets a dashboard url', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const admin = await new UserFactory({
+                organization,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const url = new URL(await PasswordForgotService.getPasswordRecoveryUrl(admin, organization, i18n));
+
+            expect(url.host).toBe(STAMHOOFD.domains.dashboard);
+            expect(url.pathname).toMatch(/\/reset-password$/);
+        });
+
+        test('A user without permissions for the organization gets a registration url', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const member = await new UserFactory({ organization }).create();
+
+            const url = new URL(await PasswordForgotService.getPasswordRecoveryUrl(member, organization, i18n));
+
+            expect(url.host).not.toBe(STAMHOOFD.domains.dashboard);
+            expect(url.host.split('.')[0]).toBe(organization.uri);
+            expect(url.pathname).toMatch(/\/reset-password$/);
+        });
+
+        test('The url points to the reset-password page with a url encoded token', async () => {
+            const organization = buildOrganization();
+            const user = buildUser(organization.id);
+
+            const url = await PasswordForgotService.getPasswordRecoveryUrlForToken(buildToken(user, 'a+b/c=d&e'), organization, i18n, user);
+
+            expect(url).toMatch(/\/reset-password\?token=a%2Bb%2Fc%3Dd%26e$/);
+            expect(new URL(url).searchParams.get('token')).toBe('a+b/c=d&e');
+        });
+
+        test('Throws when the user belongs to a different organization', async () => {
+            const user = buildUser('a-different-organization');
+
+            await expect(PasswordForgotService.getPasswordRecoveryUrlForToken(buildToken(user, 'my-token'), buildOrganization(), i18n, user))
+                .rejects
+                .toThrow('Unexpected mismatch in organization id for PasswordToken');
+        });
+
+        test('Allows a user without an organization in every scope', async () => {
+            const user = buildUser(null);
+
+            await expect(PasswordForgotService.getPasswordRecoveryUrlForToken(buildToken(user, 'my-token'), buildOrganization(), i18n, user))
+                .toResolve();
+        });
+    });
+});