@stamhoofd/backend 2.137.4 → 2.138.0

package/src/endpoints/auth/OpenIDConnectAuthTokenEndpoint.ts

@@ -32,10 +32,10 @@ export class OpenIDConnectAuthTokenEndpoint extends Endpoint<Params, Query, Body
     async handle(request: DecodedRequest<Params, Query, Body>) {
         // Check webshop and/or organization
         await Context.setUserOrganizationScope();
-        await Context.authenticate({ allowWithoutAccount: false });
+        const { token: sessionToken } = await Context.authenticate({ allowWithoutAccount: false });
 
         // Create a SSO auth token that can only be used once
-        const token = await SSOService.createToken();
+        const token = await SSOService.createToken(sessionToken);
 
         return new Response(OpenIDAuthTokenResponse.create({
             ssoAuthToken: token,

package/src/endpoints/auth/PatchUserEndpoint.ts

@@ -10,6 +10,7 @@ import { LoginMethod, NewUser, PermissionLevel, SignupResponse, UserPermissions
 import { Context } from '../../helpers/Context.js';
 import { MemberUserSyncer } from '../../helpers/MemberUserSyncer.js';
 import { AuthenticatedStructures } from '../../helpers/AuthenticatedStructures.js';
+import { VerificationCodeService } from '../../services/VerificationCodeService.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -79,10 +80,12 @@ export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBod
             }
 
             if (request.body.permissions) {
+                const platform = await Platform.getSharedStruct();
+
                 if (organization) {
                     editUser.permissions = UserPermissions.limitedPatch(editUser.permissions, request.body.permissions, organization.id);
 
-                    if (editUser.id === user.id && (!editUser.permissions || !editUser.permissions.forOrganization(organization)?.hasFullAccess()) && STAMHOOFD.environment !== 'development') {
+                    if (editUser.id === user.id && (!editUser.permissions || !editUser.permissions.forOrganization(organization, platform, { inheritFromPlatform: false })?.hasFullAccess()) && STAMHOOFD.environment !== 'development') {
                         throw new SimpleError({
                             code: 'permission_denied',
                             message: $t(`%DG`),
@@ -99,7 +102,7 @@ export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBod
                         editUser.permissions = null;
                     }
 
-                    if (editUser.id === user.id && !editUser.permissions?.platform?.hasFullAccess() && STAMHOOFD.environment !== 'development') {
+                    if (editUser.id === user.id && !editUser.permissions?.forPlatform(platform)?.hasFullAccess() && STAMHOOFD.environment !== 'development') {
                         throw new SimpleError({
                             code: 'permission_denied',
                             message: $t(`%DG`),
@@ -187,7 +190,7 @@ export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBod
                 // Create an validation code
                 // We always need the code, to return it. Also on password recovery -> may not be visible to the client whether the user exists or not
                 const code = await EmailVerificationCode.createFor(editUser, request.body.email);
-                code.send(editUser, organization, request.i18n, editUser.id === user.id).catch(console.error);
+                VerificationCodeService.send(code, editUser, organization, request.i18n, editUser.id === user.id).catch(console.error);
 
                 throw new SimpleError({
                     code: 'verify_email',

package/src/endpoints/auth/RegenerateRecoveryCodesEndpoint.ts

@@ -0,0 +1,51 @@
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { RecoveryCodes } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { RecoveryCodeHelper } from '../../helpers/RecoveryCodeHelper.js';
+import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
+import { TwoFactorAuditLogService } from '../../services/TwoFactorAuditLogService.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = undefined;
+type ResponseBody = RecoveryCodes;
+
+/**
+ * Regenerate the user's recovery codes (replacing the previous batch). Returns the new
+ * plaintext codes once. Requires the user to already have a factor enrolled.
+ */
+export class RegenerateRecoveryCodesEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa/recovery-codes', {});
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope();
+        const { user } = await Context.authenticateFresh({ allowWithoutAccount: true, allowUnscoped: true });
+
+        if (!(await TwoFactorHelper.userHasFactors(user.id))) {
+            throw new SimpleError({
+                code: 'no_factors',
+                message: 'You need at least one two-factor method before generating recovery codes',
+                human: $t('%Zgz'),
+                statusCode: 400,
+            });
+        }
+
+        const codes = await RecoveryCodeHelper.regenerateForUser(user.id);
+
+        await TwoFactorAuditLogService.logRecoveryCodesRegenerated(user);
+
+        return new Response(RecoveryCodes.create({ codes }));
+    }
+}

package/src/endpoints/auth/RegisterPasskeyEndpoint.ts

@@ -0,0 +1,99 @@
+import type { Decoder } from '@simonbackx/simple-encoding';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { WebauthnChallenge, WebauthnCredential } from '@stamhoofd/models';
+import type { MFAEnrollmentResult } from '@stamhoofd/structures';
+import { MFAMethodType, WebauthnRegistrationRequest } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
+import { WebauthnHelper } from '../../helpers/WebauthnHelper.js';
+import { TwoFactorAuditLogService } from '../../services/TwoFactorAuditLogService.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = WebauthnRegistrationRequest;
+type ResponseBody = MFAEnrollmentResult;
+
+/**
+ * Verify and store a newly registered passkey. On the user's first factor this also
+ * returns recovery codes, and during forced enrollment it issues a full session token.
+ */
+export class RegisterPasskeyEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    bodyDecoder = WebauthnRegistrationRequest as Decoder<WebauthnRegistrationRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa/passkeys', {});
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope();
+        const { user, setupToken, token } = await Context.authenticateMFAEnrollment();
+
+        if (!user.canUsePasskeys()) {
+            throw new SimpleError({
+                code: 'passkeys_not_available',
+                message: 'Passkeys are not available for this account',
+                human: $t('%ZhE'),
+                statusCode: 400,
+            });
+        }
+
+        const challenge = await WebauthnChallenge.consumeForUser(user.id);
+        if (!challenge) {
+            throw new SimpleError({
+                code: 'invalid_challenge',
+                message: 'No valid registration challenge found',
+                human: $t('%Zi9'),
+                statusCode: 400,
+            });
+        }
+
+        const result = await WebauthnHelper.verifyRegistration(request.body.response, challenge);
+        if (!result) {
+            throw new SimpleError({
+                code: 'invalid_passkey',
+                message: 'Could not verify the passkey',
+                human: $t('%Zhr'),
+                statusCode: 400,
+            });
+        }
+
+        if (await WebauthnCredential.getByCredentialId(result.credentialId)) {
+            throw new SimpleError({
+                code: 'passkey_already_registered',
+                message: 'This passkey is already registered',
+                human: $t('%Zhf'),
+                statusCode: 400,
+            });
+        }
+
+        const wasFirstFactor = !(await TwoFactorHelper.userHasFactors(user.id));
+
+        const credential = new WebauthnCredential();
+        credential.userId = user.id;
+        credential.credentialId = result.credentialId;
+        credential.rpId = result.rpId;
+        credential.publicKey = result.publicKey;
+        credential.counter = result.counter;
+        credential.transports = result.transports ? JSON.stringify(result.transports) : null;
+        credential.backedUp = result.backedUp;
+        credential.backupEligible = result.backupEligible;
+        credential.name = request.body.name?.trim() || '';
+        credential.providerId = result.providerId;
+        credential.providerName = result.providerName;
+        await credential.save();
+
+        await TwoFactorAuditLogService.logMethodAdded(user, MFAMethodType.Passkey, credential.name || credential.providerName || '');
+
+        return new Response(await TwoFactorHelper.completeEnrollment(user, setupToken, wasFirstFactor, token));
+    }
+}

package/src/endpoints/auth/RegisterPasskeyOptionsEndpoint.ts

@@ -0,0 +1,49 @@
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { WebauthnChallenge, WebauthnCredential } from '@stamhoofd/models';
+import { WebauthnRegistrationOptions } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { WebauthnHelper } from '../../helpers/WebauthnHelper.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = undefined;
+type ResponseBody = WebauthnRegistrationOptions;
+
+/**
+ * Generate WebAuthn registration options (a challenge) for enrolling a new passkey.
+ */
+export class RegisterPasskeyOptionsEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa/passkeys/options', {});
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope();
+        const { user } = await Context.authenticateMFAEnrollment();
+
+        if (!user.canUsePasskeys()) {
+            throw new SimpleError({
+                code: 'passkeys_not_available',
+                message: 'Passkeys are not available for this account',
+                human: $t('%ZhE'),
+                statusCode: 400,
+            });
+        }
+
+        const existing = await WebauthnCredential.getForUser(user.id);
+        const options = await WebauthnHelper.generateRegistration(user, existing);
+        await WebauthnChallenge.createFor(user.id, options.challenge);
+
+        return new Response(WebauthnRegistrationOptions.create({ options }));
+    }
+}

package/src/endpoints/auth/RetryEmailVerificationEndpoint.ts

@@ -5,6 +5,7 @@ import { EmailVerificationCode } from '@stamhoofd/models';
 import { PollEmailVerificationRequest, PollEmailVerificationResponse } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context.js';
+import { VerificationCodeService } from '../../services/VerificationCodeService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -32,7 +33,7 @@ export class PollEmailVerificationEndpoint extends Endpoint<Params, Query, Body,
         const valid = await EmailVerificationCode.poll(organization?.id ?? null, request.body.token);
 
         if (valid) {
-            EmailVerificationCode.resend(organization, request.body.token, request.i18n).catch(console.error);
+            VerificationCodeService.resend(organization, request.body.token, request.i18n).catch(console.error);
         }
 
         return new Response(PollEmailVerificationResponse.create({

package/src/endpoints/auth/SetupTOTPEndpoint.ts

@@ -0,0 +1,54 @@
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { MFATOTP } from '@stamhoofd/models';
+import { TOTPSetupResponse } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { TOTPHelper } from '../../helpers/TOTPHelper.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = undefined;
+type ResponseBody = TOTPSetupResponse;
+
+/**
+ * Start enrolling a new TOTP authenticator. Creates an unconfirmed row and returns the
+ * secret (shown once). Confirm it with ConfirmTOTPEndpoint.
+ */
+export class SetupTOTPEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa/totp', {});
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope();
+        const { user } = await Context.authenticateMFAEnrollment();
+
+        // Drop any unconfirmed authenticators from earlier, abandoned setup attempts so
+        // they don't pile up as orphaned rows holding an (encrypted) unused secret.
+        await MFATOTP.deleteUnconfirmedForUser(user.id);
+
+        const secret = TOTPHelper.generateSecret();
+        const totp = new MFATOTP();
+        totp.userId = user.id;
+        totp.name = '';
+        totp.secret = TOTPHelper.encrypt(secret);
+        totp.confirmedAt = null;
+        await totp.save();
+
+        const otpauthUri = TOTPHelper.keyuri(user.email, secret);
+
+        return new Response(TOTPSetupResponse.create({
+            totpId: totp.id,
+            secret,
+            otpauthUri,
+        }));
+    }
+}

package/src/endpoints/auth/SignupEndpoint.ts

@@ -2,10 +2,13 @@ import type { Decoder } from '@simonbackx/simple-encoding';
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { EmailVerificationCode, PasswordToken, Platform, sendEmailTemplate, User } from '@stamhoofd/models';
+import { EmailVerificationCode, PasswordToken, Platform, User } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../../helpers/EmailBuilder.js';
 import { EmailTemplateType, LoginMethod, NewUser, Recipient, Replacement, SignupResponse } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context.js';
+import { PasswordForgotService } from '../../services/PasswordForgotService.js';
+import { VerificationCodeService } from '../../services/VerificationCodeService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -31,7 +34,17 @@ export class SignupEndpoint extends Endpoint<Params, Query, Body, ResponseBody>
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setUserOrganizationScope({ willAuthenticate: false });
 
-        if (STAMHOOFD.userMode === 'platform') {
+        if (!organization) {
+            if (STAMHOOFD.userMode === 'organization') {
+                // Not supported for now
+                throw new SimpleError({
+                    code: 'not_supported',
+                    message: 'This platform does not support password login',
+                    human: $t(`%D7`),
+                    statusCode: 400,
+                });
+            }
+
             const platform = await Platform.getShared();
             if (!platform.config.loginMethods.has(LoginMethod.Password)) {
                 throw new SimpleError({
@@ -77,7 +90,7 @@ export class SignupEndpoint extends Endpoint<Params, Query, Body, ResponseBody>
                 // We don't await this block to avoid user enumeration attack using request response time
                 (async () => {
                     // Send an e-mail to say you already have an account + follow password forgot flow
-                    const recoveryUrl = await PasswordToken.getPasswordRecoveryUrl(user, organization, request.i18n);
+                    const recoveryUrl = await PasswordForgotService.getPasswordRecoveryUrl(user, organization, request.i18n);
 
                     // Create e-mail builder
                     await sendEmailTemplate(organization, {
@@ -118,7 +131,7 @@ export class SignupEndpoint extends Endpoint<Params, Query, Body, ResponseBody>
         const code = await EmailVerificationCode.createFor(user, user.email);
 
         if (sendCode) {
-            code.send(user, organization, request.i18n).catch(console.error);
+            VerificationCodeService.send(code, user, organization, request.i18n).catch(console.error);
         }
 
         return new Response(SignupResponse.create({

package/src/endpoints/auth/VerifyEmailEndpoint.ts

@@ -6,6 +6,7 @@ import { EmailVerificationCode, Token, User } from '@stamhoofd/models';
 import { Token as TokenStruct, VerifyEmailRequest } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context.js';
+import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
 import { BalanceItemService } from '../../services/BalanceItemService.js';
 
 type Params = Record<string, never>;
@@ -50,6 +51,11 @@ export class VerifyEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
             });
         }
 
+        // Read the (optional) session of the caller before consuming the code: a user that
+        // is already signed in is verifying a new email address from their account
+        // settings, and already passed their second factor for that session.
+        const authenticatedUser = await Context.optionalAuthenticatedUser();
+
         const code = await EmailVerificationCode.verify(organization?.id ?? null, request.body.token, request.body.code);
 
         if (!code) {
@@ -105,7 +111,17 @@ export class VerifyEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
             throw e;
         }
 
+        // Verifying an email is a single primary credential: if this user already has a
+        // second factor (or must enroll one), don't hand out a session without it. Unless
+        // the request already comes from a session of that same user (changing your email
+        // address while signed in): the second factor was checked when it was created.
+        if (authenticatedUser?.id !== user.id) {
+            await TwoFactorHelper.assertSecondFactorOrThrow(user, organization, request.request.getVersion());
+        }
+
         const token = await Token.createToken(user);
+        await user.markActive();
+
         const st = new TokenStruct(token);
         return new Response(st);
     }

package/src/endpoints/global/email/CreateEmailEndpoint.ts

@@ -7,6 +7,8 @@ import { EmailStatus, Email as EmailStruct, EmailTemplate as EmailTemplateStruct
 
 import { Context } from '../../../helpers/Context.js';
 import { SimpleError } from '@simonbackx/simple-errors';
+import { EmailPreviewService } from '../../../services/EmailPreviewService.js';
+import { EmailSendService } from '../../../services/EmailSendService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -131,7 +133,7 @@ export class CreateEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
         }
 
         await model.save();
-        await model.buildExampleRecipient(true);
+        await EmailSendService.buildExampleRecipient(model, true);
         await model.updateCount();
 
         if (request.body.status === EmailStatus.Sending || request.body.status === EmailStatus.Sent || request.body.status === EmailStatus.Queued) {
@@ -141,7 +143,7 @@ export class CreateEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     human: $t('%1Cw'),
                 });
             }
-            await model.queueForSending();
+            await EmailSendService.queueForSending(model);
         }
 
         // Delete open drafts with the same content, from the same user
@@ -162,6 +164,6 @@ export class CreateEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
             await duplicate.save();
         }
 
-        return new Response(await model.getPreviewStructure({ allLanguages: true }));
+        return new Response(await EmailPreviewService.getPreviewStructure(model, { allLanguages: true }));
     }
 }

package/src/endpoints/global/email/GetAdminEmailsEndpoint.test.ts

@@ -157,7 +157,7 @@ describe('Endpoint.getAdminEmails', () => {
         expect(unsubscribeUrlReplacement!.value).toMatch(/^https:\/\//); // Should still be a valid URL
         expect(unsubscribeUrlReplacement!.value).not.toContain('secret-token-12345'); // Original sensitive token should be gone
 
-        // This tests that Email.getStructureForUser properly handles sensitive data by:
+        // This tests that EmailPreviewService.getStructureForUser properly handles sensitive data by:
         // 1. Removing original sensitive replacements from other users' data
         // 2. Creating fresh, appropriate replacements for the current viewer
         // 3. Ensuring web safety of all replacement values

package/src/endpoints/global/email/GetAdminEmailsEndpoint.ts

@@ -9,6 +9,7 @@ import { Email, Platform } from '@stamhoofd/models';
 import type { SQLFilterDefinitions, SQLSortDefinitions } from '@stamhoofd/sql';
 import { applySQLSorter, compileToSQLFilter } from '@stamhoofd/sql';
 import { Context } from '../../../helpers/Context.js';
+import { EmailPreviewService } from '../../../services/EmailPreviewService.js';
 import { emailFilterCompilers } from '../../../sql-filters/emails.js';
 import { emailSorters } from '../../../sql-sorters/emails.js';
 
@@ -158,7 +159,7 @@ export class GetAdminEmailsEndpoint extends Endpoint<Params, Query, Body, Respon
         }
 
         return new PaginatedResponse<EmailPreview[], LimitedFilteredRequest>({
-            results: await Promise.all(emails.map(email => email.getPreviewStructure({ allLanguages: true }))),
+            results: await Promise.all(emails.map(email => EmailPreviewService.getPreviewStructure(email, { allLanguages: true }))),
             next,
         });
     }

package/src/endpoints/global/email/GetEmailEndpoint.ts

@@ -5,6 +5,7 @@ import type { EmailPreview } from '@stamhoofd/structures';
 
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Context } from '../../../helpers/Context.js';
+import { EmailPreviewService } from '../../../services/EmailPreviewService.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -51,6 +52,6 @@ export class GetEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBody
             throw Context.auth.error();
         }
 
-        return new Response(await model.getPreviewStructure({ allLanguages: true }));
+        return new Response(await EmailPreviewService.getPreviewStructure(model, { allLanguages: true }));
     }
 }

package/src/endpoints/global/email/GetUserEmailsEndpoint.test.ts

@@ -537,7 +537,7 @@ describe('Endpoint.GetUserEmails', () => {
         expect(unsubscribeUrlReplacement!.value).toMatch(/^https:\/\//); // Should still be a valid URL
         expect(unsubscribeUrlReplacement!.value).not.toContain('secret-token-12345'); // Original sensitive token should be gone
 
-        // This tests that Email.getStructureForUser properly handles sensitive data by:
+        // This tests that EmailPreviewService.getStructureForUser properly handles sensitive data by:
         // 1. Removing original sensitive replacements from other users' data
         // 2. Creating fresh, appropriate replacements for the current viewer
         // 3. Ensuring web safety of all replacement values

package/src/endpoints/global/email/GetUserEmailsEndpoint.ts

@@ -11,6 +11,7 @@ import type { Language } from '@stamhoofd/types/Language';
 import type { SQLFilterDefinitions, SQLSortDefinitions } from '@stamhoofd/sql';
 import { applySQLSorter, compileToSQLFilter } from '@stamhoofd/sql';
 import { Context } from '../../../helpers/Context.js';
+import { EmailPreviewService } from '../../../services/EmailPreviewService.js';
 import { emailFilterCompilers, userEmailFilterCompilers } from '../../../sql-filters/emails.js';
 import { emailSorters } from '../../../sql-sorters/emails.js';
 
@@ -135,7 +136,7 @@ export class GetUserEmailsEndpoint extends Endpoint<Params, Query, Body, Respons
         }
 
         return new PaginatedResponse<EmailWithRecipients[], LimitedFilteredRequest>({
-            results: await Promise.all(emails.map(email => email.getStructureForUser(user, memberIds, options))),
+            results: await Promise.all(emails.map(email => EmailPreviewService.getStructureForUser(email, user, memberIds, options))),
             next,
         });
     }

package/src/endpoints/global/email/PatchEmailEndpoint.ts

@@ -8,6 +8,8 @@ import type { AutoEncoderPatchType, Decoder } from '@simonbackx/simple-encoding'
 import { patchObject } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Context } from '../../../helpers/Context.js';
+import { EmailPreviewService } from '../../../services/EmailPreviewService.js';
+import { EmailSendService } from '../../../services/EmailSendService.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -195,7 +197,7 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
         await model.save();
 
         if (rebuild) {
-            await model.buildExampleRecipient();
+            await EmailSendService.buildExampleRecipient(model);
             await model.updateCount();
         }
 
@@ -208,9 +210,9 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             }
 
             // Preview the sending status
-            await model.queueForSending();
+            await EmailSendService.queueForSending(model);
         }
 
-        return new Response(await model.getPreviewStructure({ allLanguages: true }));
+        return new Response(await EmailPreviewService.getPreviewStructure(model, { allLanguages: true }));
     }
 }

package/src/endpoints/global/email-recipients/GetEmailRecipientsEndpoint.ts

@@ -5,7 +5,8 @@ import { assertSort, getSortFilter, LimitedFilteredRequest, PaginatedResponse, P
 
 import type { Decoder } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { EmailRecipient, fillRecipientReplacements } from '@stamhoofd/models';
+import { EmailRecipient } from '@stamhoofd/models';
+import { fillRecipientReplacements } from '../../../helpers/EmailBuilder.js';
 import type { SQLFilterDefinitions, SQLSortDefinitions } from '@stamhoofd/sql';
 import { applySQLSorter, compileToSQLFilter } from '@stamhoofd/sql';
 import { Context } from '../../../helpers/Context.js';

package/src/endpoints/global/email-recipients/RetryEmailRecipientEndpoint.ts

@@ -6,6 +6,7 @@ import { EmailStatus, PermissionLevel } from '@stamhoofd/structures';
 
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Context } from '../../../helpers/Context.js';
+import { EmailSendService } from '../../../services/EmailSendService.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -76,7 +77,7 @@ export class RetryEmailRecipientEndpoint extends Endpoint<Params, Query, Body, R
         }
 
         // Retry
-        await model.resumeSending(emailRecipient.id);
+        await EmailSendService.resumeSending(model, emailRecipient.id);
 
         await emailRecipient.refresh();
 

package/src/endpoints/global/files/ExportToExcelEndpoint.ts

@@ -4,9 +4,10 @@ import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import type { XlsxTransformerSheet } from '@stamhoofd/excel-writer';
 import { ArchiverWriterAdapter, exportToExcel, XlsxWriter } from '@stamhoofd/excel-writer';
-import { Platform, RateLimiter, sendEmailTemplate } from '@stamhoofd/models';
+import { Platform, RateLimiter } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../../../helpers/EmailBuilder.js';
 import { QueueHandler } from '@stamhoofd/queues';
-import type { ExcelExportType, IPaginatedResponse, LimitedFilteredRequest } from '@stamhoofd/structures';
+import type { ExcelExportType, IPaginatedResponse, LimitedFilteredRequest, Platform as PlatformStruct } from '@stamhoofd/structures';
 import { EmailTemplateType, ExcelExportRequest, ExcelExportResponse, Replacement, Version } from '@stamhoofd/structures';
 import { sleep } from '@stamhoofd/utility';
 import { Context } from '../../../helpers/Context.js';
@@ -20,7 +21,12 @@ type ResponseBody = ExcelExportResponse;
 
 type ExcelExporter<T> = {
     fetch(request: LimitedFilteredRequest): Promise<IPaginatedResponse<T[], LimitedFilteredRequest>>;
-    sheets: XlsxTransformerSheet<T, unknown>[];
+
+    /**
+     * The sheet definitions depend on the platform: they are built per export request instead of
+     * once at module load, so the callbacks never have to read a process wide platform singleton.
+     */
+    getSheets(platform: PlatformStruct): XlsxTransformerSheet<T, unknown>[];
 };
 
 export const limiter = new RateLimiter({
@@ -86,8 +92,6 @@ export class ExportToExcelEndpoint extends Endpoint<Params, Query, Body, Respons
         limiter.track(user.id, 1);
         let sendEmail = false;
 
-        await Platform.getSharedStruct();
-
         const result = await Promise.race([
             this.job(loader, request.body, request.params.type, user.id).then(async (url: string) => {
                 if (sendEmail) {
@@ -146,6 +150,7 @@ export class ExportToExcelEndpoint extends Endpoint<Params, Query, Body, Respons
                 // Estimate how long it will take.
                 // If too long, we'll schedule it and write it to Digitalocean Spaces
                 // Otherwise we'll just return the file directly
+                const platform = await Platform.getSharedStruct();
                 const { file, stream } = await FileCache.getWriteStream('.xlsx');
 
                 const zipWriterAdapter = new ArchiverWriterAdapter(stream);
@@ -155,7 +160,7 @@ export class ExportToExcelEndpoint extends Endpoint<Params, Query, Body, Respons
                 request.filter.limit = STAMHOOFD.environment === 'development' ? 1000 : 100; // in development, we need to check if total count matches and pagination is working correctly
 
                 await exportToExcel({
-                    definitions: loader.sheets,
+                    definitions: loader.getSheets(platform),
                     writer,
                     dataGenerator: fetchToAsyncIterator(request.filter, loader, { signFiles: true }),
                     filter: request.workbookFilter,