@stamhoofd/backend 2.137.4 → 2.138.0

package/src/services/SSOService.ts

@@ -10,6 +10,7 @@ import { Context } from '../helpers/Context.js';
 
 import type { ObjectWithHeaders } from '../helpers/CookieHelper.js';
 import { CookieHelper } from '../helpers/CookieHelper.js';
+import { TwoFactorHelper } from '../helpers/TwoFactorHelper.js';
 
 async function randomBytes(size: number): Promise<Buffer> {
     return new Promise((resolve, reject) => {
@@ -37,12 +38,24 @@ type SSOSessionContext = {
      * Link this method to this existing user and don't create a new token
      */
     userId?: string | null;
+
+    /**
+     * The session (access token) that has to count as freshly authenticated again once the
+     * provider confirms the identity of `userId`. Only set for a reauthentication flow.
+     */
+    reauthenticateAccessToken?: string | null;
 };
 
 export class SSOAuthToken {
     validUntil: Date;
     token: string;
     userId: string;
+
+    /**
+     * The session this token was requested with, so a reauthentication can mark it fresh
+     * again. Null for API users and other sessionless callers.
+     */
+    accessToken: string | null = null;
 }
 
 export class SSOService {
@@ -76,7 +89,7 @@ export class SSOService {
         }
     }
 
-    static async createToken() {
+    static async createToken(sessionToken: Token | null = null) {
         if (!Context.user) {
             throw new SimpleError({
                 code: 'invalid_user',
@@ -89,6 +102,7 @@ export class SSOService {
         token.validUntil = new Date(Date.now() + 1000 * 60 * 5);
         token.token = (await randomBytes(192)).toString('base64').toUpperCase();
         token.userId = Context.user.id;
+        token.accessToken = sessionToken?.accessToken ?? null;
 
         await this.clearExpiredTokensOrFromUser(token.userId);
         this.authTokens.set(token.token, token);
@@ -369,6 +383,7 @@ export class SSOService {
         }
 
         let user: User | undefined = undefined;
+        let reauthenticateAccessToken: string | null = null;
 
         if (data.authToken) {
             const token = await SSOService.validateToken(data.authToken);
@@ -384,10 +399,27 @@ export class SSOService {
                 }
 
                 this.validateEmail(user.email);
+
+                // Force reentry of login credentials (no automatic login)
+                // Sadly select_account is not reliable and sometimes works automatically
+                // since this would automatically link a possibly wrong user, we don't allow that
+                // we check this with the auth_time, so a user cannot really get around this
+                data.prompt = 'login';
+
+                if (data.reauthenticate) {
+                    if (!token.accessToken) {
+                        throw new SimpleError({
+                            code: 'invalid_token',
+                            message: 'Cannot reauthenticate without a session',
+                            statusCode: 400,
+                        });
+                    }
+                    reauthenticateAccessToken = token.accessToken;
+                }
             }
         }
 
-        return await this.startAuthCodeFlow(redirectUri, data.spaState, data.prompt, user);
+        return await this.startAuthCodeFlow(redirectUri, data.spaState, data.prompt, user, reauthenticateAccessToken);
     }
 
     validateRedirectUri(uri: string) {
@@ -422,7 +454,7 @@ export class SSOService {
         }
     }
 
-    async startAuthCodeFlow(redirectUri: string, spaState: string, prompt: string | null = null, user?: User): Promise<Response<undefined>> {
+    async startAuthCodeFlow(redirectUri: string, spaState: string, prompt: string | null = null, user?: User, reauthenticateAccessToken: string | null = null): Promise<Response<undefined>> {
         const code_verifier = generators.codeVerifier();
         const state = generators.state(); // this is the internal state backend <-> SSO provider
         const nonce = generators.nonce();
@@ -439,6 +471,7 @@ export class SSOService {
             providerType: this.provider,
             organizationId: this.organization?.id ?? null,
             userId: user?.id ?? null,
+            reauthenticateAccessToken,
         };
 
         try {
@@ -465,7 +498,8 @@ export class SSOService {
                 prompt: prompt ?? undefined,
                 login_hint: user?.email ?? undefined,
                 redirect_uri: this.externalRedirectUri,
-
+                max_age: prompt === 'login' ? 0 : undefined, // required to get auth_time in the response
+                claims: prompt === 'login' ? { id_token: { auth_time: { essential: true } } } : undefined,
                 // Google has this instead of the offline_access scope
                 access_type: this.provider === LoginProviderType.Google ? 'offline' : undefined,
             });
@@ -585,6 +619,21 @@ export class SSOServiceWithSession {
 
             this.service.validateEmail(claims.email);
 
+            if (this.session.userId) {
+                if (!claims.auth_time || claims.auth_time * 1000 < Date.now() - 1000 * 60 * 5) {
+                    if (STAMHOOFD.environment === 'development' || STAMHOOFD.environment === 'test') {
+                        // Dex does not support this (yet)
+                    } else {
+                        throw new SimpleError({
+                            code: 'invalid_user',
+                            message: 'No recent authentication',
+                            human: $t('%ZhH'),
+                            statusCode: 400,
+                        });
+                    }
+                }
+            }
+
             // Get user from database
             let user = await User.getForRegister(this.service.organization?.id ?? null, claims.email);
             if (!user) {
@@ -639,23 +688,66 @@ export class SSOServiceWithSession {
             const redirectUri = new URL(session.redirectUri);
 
             if (!this.session.userId) {
-                const token = await Token.createExpiredToken(user);
-
-                if (!token) {
+                // The identity provider authenticated the user, but that is only the first
+                // factor. A user who enrolled a second factor still has to pass it, and an
+                // account that also has a password must still enroll one when it is
+                // required — the password would otherwise stay a way in that skips
+                // whatever the provider enforces.
+                //
+                // This is a redirect, not a request/response pair, so the client gets the
+                // token of the pending step in the URL and picks the flow up from there.
+                const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, this.service.organization, { loginMethod: 'sso' });
+
+                if (requirement.type === 'challenge') {
+                    redirectUri.searchParams.set('oid_mfa', requirement.challenge.token);
+                    redirectUri.searchParams.set('s', session.spaState);
+                } else if (requirement.type === 'setup') {
+                    redirectUri.searchParams.set('oid_mfa_setup', requirement.setupToken.token);
+                    // Which methods to offer. Only a hint for the enrollment screen: the
+                    // enrollment endpoints check this themselves.
+                    redirectUri.searchParams.set('oid_mfa_passkeys', user.canUsePasskeys() ? '1' : '0');
+                    redirectUri.searchParams.set('s', session.spaState);
+                } else {
+                    const token = await Token.createExpiredToken(user);
+
+                    if (!token) {
+                        throw new SimpleError({
+                            code: 'error',
+                            message: 'Could not generate token',
+                            human: $t(`%D6`),
+                            statusCode: 500,
+                        });
+                    }
+
+                    const st = new TokenStruct(token);
+                    redirectUri.searchParams.set('oid_rt', st.refreshToken);
+                    redirectUri.searchParams.set('s', session.spaState);
+                }
+            } else if (this.session.reauthenticateAccessToken) {
+                // The provider confirmed the identity of the user that is already signed in,
+                // so their session counts as freshly authenticated again and the sensitive
+                // actions behind Context.authenticateFresh() unlock. This is the only way an
+                // SSO-only account can reach them: it has no password to confirm with.
+                const token = await Token.getByAccessToken(this.session.reauthenticateAccessToken);
+
+                if (!token || token.userId !== user.id) {
                     throw new SimpleError({
-                        code: 'error',
-                        message: 'Could not generate token',
-                        human: $t(`%D6`),
-                        statusCode: 500,
+                        code: 'invalid_token',
+                        message: 'The session to reauthenticate no longer exists',
+                        human: $t('%ZhJ'),
+                        statusCode: 401,
                     });
                 }
 
-                const st = new TokenStruct(token);
-                redirectUri.searchParams.set('oid_rt', st.refreshToken);
+                token.authenticatedAt = new Date();
+                await token.save();
+                await user.markActive();
+
                 redirectUri.searchParams.set('s', session.spaState);
+                redirectUri.searchParams.set('msg', $t('%Zhh'));
             } else {
                 redirectUri.searchParams.set('s', session.spaState);
-                redirectUri.searchParams.set('msg', 'Je account is succesvol gekoppeld');
+                redirectUri.searchParams.set('msg', $t('%Zh3'));
             }
 
             response.headers['location'] = redirectUri.toString();

package/src/services/STPackageService.test.ts

@@ -0,0 +1,191 @@
+import { EmailMocker } from '@stamhoofd/email';
+import { EmailTemplateFactory, OrganizationFactory, STPackage, UserFactory } from '@stamhoofd/models';
+import { EmailTemplateType, PermissionLevel, Permissions, STPackageMeta, STPackageType } from '@stamhoofd/structures';
+import { TestUtils } from '@stamhoofd/test-utils';
+import { Formatter } from '@stamhoofd/utility';
+import { v4 as uuidv4 } from 'uuid';
+import { vi } from 'vitest';
+import { STPackageService } from './STPackageService.js';
+
+const DAY = 1000 * 60 * 60 * 24;
+
+/**
+ * A global (not organization scoped) template that only contains the replacements the service fills
+ * in, so the rendered email can be asserted without depending on the real template contents.
+ */
+async function createExpirationTemplate(type: EmailTemplateType) {
+    await new EmailTemplateFactory({
+        type,
+        html: '<p>organizationName: {{organizationName}}</p>'
+            + '<p>packageName: {{packageName}}</p>'
+            + '<p>validUntil: {{validUntil}}</p>'
+            + '<p>validUntilDate: {{validUntilDate}}</p>'
+            + '<p>renewUrl: {{renewUrl}}</p>',
+    }).create();
+}
+
+async function createPackage(options: {
+    organizationId: string;
+    type: STPackageType;
+    /**
+     * Defaults to 10 days from now: inside the reminder window of every package type.
+     */
+    validUntil?: Date | null;
+    removeAt?: Date | null;
+    validAt?: Date | null;
+}) {
+    const pack = new STPackage();
+    pack.organizationId = options.organizationId;
+    pack.meta = STPackageMeta.create({
+        type: options.type,
+        startDate: new Date(Date.now() - 365 * DAY),
+    });
+    pack.validAt = options.validAt !== undefined ? options.validAt : new Date(Date.now() - 365 * DAY);
+    pack.validUntil = options.validUntil !== undefined ? options.validUntil : new Date(Date.now() + 10 * DAY);
+    pack.removeAt = options.removeAt ?? null;
+    await pack.save();
+    return pack;
+}
+
+async function createOrganizationWithAdmin() {
+    const organization = await new OrganizationFactory({}).create();
+    const admin = await new UserFactory({
+        organization,
+        firstName: 'Full',
+        lastName: 'Admin',
+        permissions: Permissions.create({ level: PermissionLevel.Full }),
+    }).create();
+    return { organization, admin };
+}
+
+describe('STPackageService', () => {
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+    describe('sendExpiryEmail', () => {
+        test('Sends the reminder to the full admins of the organization and records it on the package', async () => {
+            TestUtils.setEnvironment('environment', 'production');
+            await createExpirationTemplate(EmailTemplateType.MembersExpirationReminder);
+
+            const { organization, admin } = await createOrganizationWithAdmin();
+
+            // A user without permissions should not receive the reminder
+            const member = await new UserFactory({ organization }).create();
+
+            const validUntil = new Date(Date.now() + 10 * DAY);
+            const pack = await createPackage({ organizationId: organization.id, type: STPackageType.Members, validUntil });
+
+            await STPackageService.sendExpiryEmail(pack);
+
+            const emails = await EmailMocker.getSucceededEmails();
+            expect(emails.length).toBe(1);
+            expect(emails[0].to).toContain(admin.email);
+            expect(emails[0].to).not.toContain(member.email);
+
+            expect(emails[0].html).toContain('organizationName: ' + organization.name);
+            expect(emails[0].html).toContain('packageName: ' + pack.meta.name);
+            expect(emails[0].html).toContain('validUntil: ' + Formatter.dateTime(validUntil));
+            expect(emails[0].html).toContain('validUntilDate: ' + Formatter.date(validUntil));
+            expect(emails[0].html).toContain(`renewUrl: https://${STAMHOOFD.domains.dashboard ?? 'stamhoofd.app'}/${organization.i18n.locale}/beheerders/${organization.uri}/instellingen/functionaliteiten`);
+
+            expect(pack.lastEmailAt).not.toBeNull();
+            expect(pack.emailCount).toBe(1);
+
+            const fromDatabase = await STPackage.getByID(pack.id);
+            expect(fromDatabase!.lastEmailAt).not.toBeNull();
+            expect(fromDatabase!.emailCount).toBe(1);
+        });
+
+        test('Counts the email, but does not set lastEmailAt, for a package type without a reminder', async () => {
+            TestUtils.setEnvironment('environment', 'production');
+            const { organization } = await createOrganizationWithAdmin();
+
+            // LegacyMembers has no expiration reminder template type
+            const pack = await createPackage({ organizationId: organization.id, type: STPackageType.LegacyMembers });
+
+            await STPackageService.sendExpiryEmail(pack);
+
+            expect(await EmailMocker.getSucceededCount()).toBe(0);
+            expect(pack.lastEmailAt).toBeNull();
+            expect(pack.emailCount).toBe(1);
+
+            const fromDatabase = await STPackage.getByID(pack.id);
+            expect(fromDatabase!.lastEmailAt).toBeNull();
+            expect(fromDatabase!.emailCount).toBe(1);
+        });
+
+        test('Does not send outside production, but still records the email on the package', async () => {
+            // The production guard only covers the send itself: the bookkeeping runs in every environment
+            expect(STAMHOOFD.environment).not.toBe('production');
+            await createExpirationTemplate(EmailTemplateType.MembersExpirationReminder);
+
+            const { organization } = await createOrganizationWithAdmin();
+            const pack = await createPackage({ organizationId: organization.id, type: STPackageType.Members });
+
+            await STPackageService.sendExpiryEmail(pack);
+
+            expect(await EmailMocker.getSucceededCount()).toBe(0);
+            expect(pack.lastEmailAt).not.toBeNull();
+            expect(pack.emailCount).toBe(1);
+
+            const fromDatabase = await STPackage.getByID(pack.id);
+            expect(fromDatabase!.lastEmailAt).not.toBeNull();
+            expect(fromDatabase!.emailCount).toBe(1);
+        });
+
+        test('Logs and skips the email when the organization of the package no longer exists', async () => {
+            TestUtils.setEnvironment('environment', 'production');
+            await createExpirationTemplate(EmailTemplateType.MembersExpirationReminder);
+            const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
+
+            const pack = await createPackage({ organizationId: uuidv4(), type: STPackageType.Members });
+
+            await STPackageService.sendExpiryEmail(pack);
+
+            expect(consoleError).toHaveBeenCalledWith('Could not find package organization ' + pack.id);
+            expect(await EmailMocker.getSucceededCount()).toBe(0);
+
+            // A missing organization does not stop the bookkeeping
+            expect(pack.emailCount).toBe(1);
+        });
+
+        test('Does not send or count a package that is not due', async () => {
+            TestUtils.setEnvironment('environment', 'production');
+            await createExpirationTemplate(EmailTemplateType.MembersExpirationReminder);
+
+            const { organization } = await createOrganizationWithAdmin();
+
+            const neverActivated = await createPackage({ organizationId: organization.id, type: STPackageType.Members, validAt: null });
+
+            // Expires in 100 days, which is outside the 32 day window of a members package
+            const notExpiringSoon = await createPackage({ organizationId: organization.id, type: STPackageType.Members, validUntil: new Date(Date.now() + 100 * DAY) });
+
+            await STPackageService.sendExpiryEmail(neverActivated);
+            await STPackageService.sendExpiryEmail(notExpiringSoon);
+
+            expect(await EmailMocker.getSucceededCount()).toBe(0);
+            expect(neverActivated.emailCount).toBe(0);
+            expect(neverActivated.lastEmailAt).toBeNull();
+            expect(notExpiringSoon.emailCount).toBe(0);
+            expect(notExpiringSoon.lastEmailAt).toBeNull();
+        });
+
+        test('Counts, but does not send, a package that is already removed', async () => {
+            TestUtils.setEnvironment('environment', 'production');
+            await createExpirationTemplate(EmailTemplateType.MembersExpirationReminder);
+
+            const { organization } = await createOrganizationWithAdmin();
+            const pack = await createPackage({ organizationId: organization.id, type: STPackageType.Members, removeAt: new Date(Date.now() - DAY) });
+
+            await STPackageService.sendExpiryEmail(pack);
+
+            expect(await EmailMocker.getSucceededCount()).toBe(0);
+            expect(pack.lastEmailAt).toBeNull();
+            expect(pack.emailCount).toBe(1);
+
+            const fromDatabase = await STPackage.getByID(pack.id);
+            expect(fromDatabase!.emailCount).toBe(1);
+        });
+    });
+});

package/src/services/STPackageService.ts

@@ -1,9 +1,11 @@
 import { BalanceItem, Organization, Platform, STPackage } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 import { SQL } from '@stamhoofd/sql';
 import type { Company } from '@stamhoofd/structures';
-import { BalanceItemRelation, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, getPricingTypeName, STPackageStatus, STPackageType, STPackageTypeHelper, STPricingType, TranslatedString } from '@stamhoofd/structures';
+import { BalanceItemRelation, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, EmailTemplateType, getPricingTypeName, Recipient, Replacement, STPackageStatus, STPackageType, STPackageTypeHelper, STPricingType, TranslatedString } from '@stamhoofd/structures';
 import { Formatter, STMath } from '@stamhoofd/utility';
 import { VATService } from './VATService.js';
+import { OrganizationAdminService } from './OrganizationAdminService.js';
 
 export class STPackageService {
     static async getActivePackages(organizationId: string) {
@@ -263,6 +265,118 @@ export class STPackageService {
         await this.updateOrganizationPackages(organizationId);
     }
 
+    /**
+     * Send the expiration reminder of a package if one is due, and record on the package that it was
+     * sent (also when nothing was sent, so a package is only ever considered once).
+     */
+    static async sendExpiryEmail(pack: STPackage) {
+        if (pack.validAt === null) {
+            // never activated
+            return;
+        }
+
+        if (pack.removeAt && pack.removeAt <= new Date()) {
+            pack.emailCount += 1;
+            await pack.save();
+            return;
+        }
+
+        let allowDays = 0;
+        let type: EmailTemplateType | null = null;
+
+        if (pack.meta.type === STPackageType.Members) {
+            type = EmailTemplateType.MembersExpirationReminder;
+            allowDays = 32;
+        } else if (pack.meta.type === STPackageType.Webshops) {
+            type = EmailTemplateType.WebshopsExpirationReminder;
+            allowDays = 32;
+        } else if (pack.meta.type === STPackageType.SingleWebshop) {
+            type = EmailTemplateType.SingleWebshopExpirationReminder;
+            allowDays = 7;
+        } else if (pack.meta.type === STPackageType.TrialMembers) {
+            type = EmailTemplateType.TrialMembersExpirationReminder;
+            allowDays = 3;
+        } else if (pack.meta.type === STPackageType.TrialWebshops) {
+            type = EmailTemplateType.TrialWebshopsExpirationReminder;
+            allowDays = 3;
+        }
+
+        const allowFrom = new Date(Date.now() + 1000 * 60 * 60 * 24 * allowDays);
+        if (type && (pack.validUntil === null || pack.validUntil < new Date() || pack.validUntil > allowFrom)) {
+            console.log('Skip sending expiration email for ' + pack.id);
+            return;
+        }
+
+        if (type) {
+            console.log('Sending expiration email for ' + pack.id, type);
+            if (STAMHOOFD.environment === 'production') {
+                await this.sendEmailTemplate(pack, {
+                    type,
+                });
+            }
+            pack.lastEmailAt = new Date();
+        } else {
+            console.log('Skip sending expiration email for ' + pack.id + ' (no type)');
+        }
+
+        pack.emailCount += 1;
+        await pack.save();
+    }
+
+    /**
+     * Send an email template about a package to the full administrators of its organization.
+     */
+    static async sendEmailTemplate(pack: STPackage, data: {
+        type: EmailTemplateType;
+    }) {
+        const organization = await Organization.getByID(pack.organizationId);
+
+        if (!organization) {
+            console.error('Could not find package organization ' + pack.id);
+            return;
+        }
+
+        const admins = await OrganizationAdminService.getFullAdmins(organization);
+
+        const recipients = admins.map(admin =>
+            Recipient.create({
+                firstName: admin.firstName,
+                lastName: admin.lastName,
+                email: admin.email,
+                replacements: [
+                    Replacement.create({
+                        token: 'organizationName',
+                        value: organization.name,
+                    }),
+                    Replacement.create({
+                        token: 'packageName',
+                        value: pack.meta.name ?? '',
+                    }),
+                    Replacement.create({
+                        token: 'validUntil',
+                        value: pack.validUntil ? Formatter.dateTime(pack.validUntil) : 'nooit',
+                    }),
+                    Replacement.create({
+                        token: 'validUntilDate',
+                        value: pack.validUntil ? Formatter.date(pack.validUntil) : 'nooit',
+                    }),
+                    Replacement.create({
+                        token: 'renewUrl',
+                        value: `https://${(STAMHOOFD.domains.dashboard ?? 'stamhoofd.app')}/${organization.i18n.locale}/beheerders/${organization.uri}/instellingen/functionaliteiten`,
+                    }),
+                ],
+            }),
+        );
+
+        // Create e-mail builder
+        await sendEmailTemplate(null, {
+            template: {
+                type: data.type,
+            },
+            recipients,
+        });
+    }
+
     static async markBalanceRestored(organizationId: string) {
         console.log('Marking packages as restored for ' + organizationId);
 

package/src/services/TwoFactorAuditLogService.ts

@@ -0,0 +1,64 @@
+import type { User } from '@stamhoofd/models';
+import { AuditLog } from '@stamhoofd/models';
+import type { MFAMethodType } from '@stamhoofd/structures';
+import { AuditLogReplacement, AuditLogReplacementType, AuditLogSource, AuditLogType } from '@stamhoofd/structures';
+
+/**
+ * Records the changes a user makes to their own two-factor authentication.
+ *
+ * These are security-relevant events that are not visible anywhere else: the credentials
+ * themselves are not audit-logged models, and an attacker who took over a session would
+ * use exactly these endpoints to lock the owner out. So they are logged explicitly, at the
+ * moment the change is effective.
+ */
+export class TwoFactorAuditLogService {
+    static async logMethodAdded(user: User, method: MFAMethodType, name: string) {
+        await this.save(AuditLogType.UserTwoFactorMethodAdded, user, method, name);
+    }
+
+    static async logMethodDeleted(user: User, method: MFAMethodType, name: string) {
+        await this.save(AuditLogType.UserTwoFactorMethodDeleted, user, method, name);
+    }
+
+    /**
+     * Only for an explicit regeneration by the user. The batch that is generated together
+     * with a first factor is already covered by the method-added log.
+     */
+    static async logRecoveryCodesRegenerated(user: User) {
+        await this.save(AuditLogType.UserRecoveryCodesRegenerated, user, null, '');
+    }
+
+    private static async save(type: AuditLogType, user: User, method: MFAMethodType | null, name: string) {
+        const log = new AuditLog();
+        log.type = type;
+        log.source = AuditLogSource.User;
+
+        // A user changes their own factors, so the account is both the actor and the subject.
+        log.userId = user.id;
+        log.objectId = user.id;
+
+        // Deliberately the organization of the account itself, not the one the request was
+        // scoped to: a platform administrator enrolling a factor while working in an
+        // organization is not that organization's business.
+        log.organizationId = user.organizationId;
+
+        log.replacements = new Map([
+            ['u', AuditLogReplacement.create({
+                id: user.id,
+                value: user.email,
+                type: AuditLogReplacementType.User,
+            })],
+        ]);
+
+        const methodReplacement = AuditLogReplacement.enum('MFAMethodType', method);
+        if (methodReplacement) {
+            log.replacements.set('method', methodReplacement);
+        }
+
+        if (name) {
+            log.replacements.set('name', AuditLogReplacement.string(name));
+        }
+
+        await log.save();
+    }
+}

package/src/services/VerificationCodeService.test.ts

@@ -0,0 +1,71 @@
+import { I18n } from '@stamhoofd/backend-i18n';
+import { EmailMocker } from '@stamhoofd/email';
+import { EmailTemplateFactory, EmailVerificationCode, OrganizationFactory, Platform, UserFactory } from '@stamhoofd/models';
+import { EmailTemplateType } from '@stamhoofd/structures';
+import { TestUtils } from '@stamhoofd/test-utils';
+import { VerificationCodeService } from './VerificationCodeService.js';
+
+const i18n = new I18n(I18n.defaultLanguage, I18n.defaultCountry);
+
+const PLATFORM_NAME = 'The test platform';
+
+/**
+ * A template that only contains the organizationName replacement, so the name that ends up in the
+ * email can be asserted without depending on the real (translated) template contents.
+ */
+async function createVerifyEmailTemplate() {
+    await new EmailTemplateFactory({
+        type: EmailTemplateType.VerifyEmail,
+        html: '<p>{{organizationName}}</p>',
+        text: '{{organizationName}}',
+    }).create();
+}
+
+describe('VerificationCodeService', () => {
+    let originalPlatformName: string;
+
+    beforeAll(async () => {
+        const platform = await Platform.getForEditing();
+        originalPlatformName = platform.config.name;
+        platform.config.name = PLATFORM_NAME;
+        await platform.save();
+    });
+
+    afterAll(async () => {
+        const platform = await Platform.getForEditing();
+        platform.config.name = originalPlatformName;
+        await platform.save();
+    });
+
+    describe('send', () => {
+        test('Uses the name of the organization when the code is scoped to an organization', async () => {
+            TestUtils.setEnvironment('userMode', 'organization');
+            await createVerifyEmailTemplate();
+
+            const organization = await new OrganizationFactory({ name: 'Organization with a name' }).create();
+            const user = await new UserFactory({ organization }).create();
+            const code = await EmailVerificationCode.createFor(user, user.email);
+
+            await VerificationCodeService.send(code, user, organization, i18n);
+
+            const emails = await EmailMocker.transactional.getSucceededEmails();
+            expect(emails.length).toBe(1);
+            expect(emails[0].text).toContain('Organization with a name');
+            expect(emails[0].text).not.toContain(PLATFORM_NAME);
+        });
+
+        test('Falls back to the name of the platform when there is no organization', async () => {
+            TestUtils.setEnvironment('userMode', 'platform');
+            await createVerifyEmailTemplate();
+
+            const user = await new UserFactory({}).create();
+            const code = await EmailVerificationCode.createFor(user, user.email);
+
+            await VerificationCodeService.send(code, user, null, i18n);
+
+            const emails = await EmailMocker.transactional.getSucceededEmails();
+            expect(emails.length).toBe(1);
+            expect(emails[0].text).toContain(PLATFORM_NAME);
+        });
+    });
+});