@stamhoofd/backend 2.137.4 → 2.138.0

package/src/endpoints/global/members/PatchOrganizationMembersEndpoint.ts

@@ -585,7 +585,7 @@ export class PatchOrganizationMembersEndpoint extends Endpoint<Params, Query, Bo
                 membership.locked = false;
 
                 // Correct price and dates
-                await membership.calculatePrice(member);
+                await PlatformMembershipService.calculatePrice(membership, member);
 
                 const incompatible = await MemberPlatformMembership.select()
                     .where('memberId', member.id)

package/src/endpoints/global/members/SendMemberSecurityCodeEndpoint.ts

@@ -3,7 +3,8 @@ import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import type { Organization } from '@stamhoofd/models';
-import { AuditLog, Member, Platform, RateLimiter, sendEmailTemplate } from '@stamhoofd/models';
+import { AuditLog, Member, Platform, RateLimiter } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../../../helpers/EmailBuilder.js';
 import { AuditLogReplacement, AuditLogReplacementType, AuditLogSource, AuditLogType, EmailTemplateType, Recipient, Replacement, SecurityCodeSendMethod, SendMemberSecurityCodeRequest, SendMemberSecurityCodeResponse } from '@stamhoofd/structures';
 import type { Country } from '@stamhoofd/types/Country';
 import { Formatter } from '@stamhoofd/utility';

package/src/endpoints/global/organizations/CreateOrganizationEndpoint.ts

@@ -12,6 +12,7 @@ import { Formatter } from '@stamhoofd/utility';
 import { v4 as uuidv4 } from 'uuid';
 import { AuditLogService } from '../../../services/AuditLogService.js';
 import { ReferralService } from '../../../services/ReferralService.js';
+import { VerificationCodeService } from '../../../services/VerificationCodeService.js';
 import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures.js';
 import { Context } from '../../../helpers/Context.js';
 
@@ -160,7 +161,7 @@ export class CreateOrganizationEndpoint extends Endpoint<Params, Query, Body, Re
         await AuditLog.update().where('type', AuditLogType.OrganizationAdded).where('objectId', organization.id).set('userId', user.id).set('source', AuditLogSource.User).update();
 
         const code = await EmailVerificationCode.createFor(user, user.email);
-        code.send(user, organization, request.i18n).catch(console.error);
+        VerificationCodeService.send(code, user, organization, request.i18n).catch(console.error);
 
         for (const email of delayEmails) {
             Email.send({

package/src/endpoints/global/platform/GetPlatformAdminsEndpoint.ts

@@ -4,6 +4,7 @@ import { User } from '@stamhoofd/models';
 import { OrganizationAdmins } from '@stamhoofd/structures';
 
 import { Context } from '../../../helpers/Context.js';
+import { TwoFactorHelper } from '../../../helpers/TwoFactorHelper.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -34,10 +35,12 @@ export class GetPlatformAdminsEndpoint extends Endpoint<Params, Query, Body, Res
 
         // Get all admins
         const admins = await User.getPlatformAdmins();
+        const users = admins.map(user => user.getStructure());
+        await TwoFactorHelper.fillTwoFactorStatus(users);
 
         return new Response(
             OrganizationAdmins.create({
-                users: admins.map(user => user.getStructure()),
+                users,
             }),
         );
     }

package/src/endpoints/global/platform/PatchPlatformEnpoint.test.ts

@@ -1,7 +1,7 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import type { Organization } from '@stamhoofd/models';
 import { OrganizationFactory, Platform, RegistrationPeriod, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
-import { PermissionLevel, Permissions, PlatformConfig, Platform as PlatformStruct, Version } from '@stamhoofd/structures';
+import { PermissionLevel, Permissions, PlatformConfig, PlatformPrivateConfig, Platform as PlatformStruct, Version } from '@stamhoofd/structures';
 
 import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
 import { TestUtils } from '@stamhoofd/test-utils';
@@ -22,6 +22,40 @@ describe('Endpoint.PatchPlatform', () => {
         return await testServer.test(endpoint, request);
     };
 
+    const setPlatformRequiresTwoFactor = async (requireTwoFactor: boolean) => {
+        const platform = await Platform.getForEditing();
+        platform.privateConfig.requireTwoFactor = requireTwoFactor;
+        await platform.save();
+    };
+
+    test('Should save whether two-factor authentication is required for platform admins', async () => {
+        const organization = await new OrganizationFactory({ }).create();
+
+        const admin = await new UserFactory({
+            globalPermissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+        const token = await Token.createToken(admin);
+
+        try {
+            const response = await patchPlatform({
+                patch: PlatformStruct.patch({
+                    privateConfig: PlatformPrivateConfig.patch({
+                        requireTwoFactor: true,
+                    }),
+                }),
+                organization,
+                token,
+            });
+
+            expect(response.body.privateConfig?.requireTwoFactor).toBe(true);
+            expect((await Platform.getForEditing()).privateConfig.requireTwoFactor).toBe(true);
+        }
+        finally {
+            // The platform row is shared by every test file
+            await setPlatformRequiresTwoFactor(false);
+        }
+    });
+
     describe('userMode organization', () => {
         beforeEach(async () => {
             TestUtils.setEnvironment('userMode', 'organization');

package/src/endpoints/global/platform/PatchPlatformEnpoint.ts

@@ -82,6 +82,14 @@ export class PatchPlatformEndpoint extends Endpoint<
                     request.body.privateConfig.emails,
                 );
             }
+
+            if (request.body.privateConfig.requireTwoFactor !== undefined) {
+                if (!Context.auth.hasPlatformFullAccess()) {
+                    throw Context.auth.error();
+                }
+
+                platform.privateConfig.requireTwoFactor = request.body.privateConfig.requireTwoFactor;
+            }
         }
 
         let shouldUpdateSetupSteps = false;

package/src/endpoints/global/platform/SignOutPlatformAdminsEndpoint.test.ts

@@ -0,0 +1,92 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import type { Organization } from '@stamhoofd/models';
+import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { PermissionLevel, Permissions } from '@stamhoofd/structures';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
+
+import { testServer } from '../../../../tests/helpers/TestServer.js';
+import { SignOutPlatformAdminsEndpoint } from './SignOutPlatformAdminsEndpoint.js';
+
+describe('Endpoint.SignOutPlatformAdmins', () => {
+    const endpoint = new SignOutPlatformAdminsEndpoint();
+
+    beforeEach(() => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
+    const signOut = async (organization: Organization, token: Token) => {
+        const request = Request.buildJson('POST', '/platform/admins/sign-out', organization.getApiHost());
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+        return await testServer.test(endpoint, request);
+    };
+
+    const createPlatformAdmin = async (level = PermissionLevel.Full) => {
+        return await new UserFactory({
+            globalPermissions: Permissions.create({ level }),
+        }).create();
+    };
+
+    const tokenExists = async (token: Token) => {
+        return !!(await Token.getByAccessToken(token.accessToken, true));
+    };
+
+    test('all sessions of all platform admins are signed out, except the one making the request', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const admin = await createPlatformAdmin();
+        const otherAdmin = await createPlatformAdmin();
+
+        // An admin of an organization is not a platform admin
+        const organizationAdmin = await new UserFactory({
+            organization,
+            permissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+        organizationAdmin.organizationId = null;
+        await organizationAdmin.save();
+
+        const currentToken = await Token.createToken(admin, new Date());
+        const secondDeviceOfAdmin = await Token.createToken(admin, new Date());
+        const otherAdminToken = await Token.createToken(otherAdmin, new Date());
+        const organizationAdminToken = await Token.createToken(organizationAdmin, new Date());
+
+        const response = await signOut(organization, currentToken);
+
+        expect(response.body.count).toBe(2);
+        expect(await tokenExists(currentToken)).toBe(true);
+        expect(await tokenExists(secondDeviceOfAdmin)).toBe(false);
+        expect(await tokenExists(otherAdminToken)).toBe(false);
+        expect(await tokenExists(organizationAdminToken)).toBe(true);
+    });
+
+    test('a platform admin without full access cannot sign out the other admins', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const admin = await createPlatformAdmin(PermissionLevel.Write);
+        const otherAdmin = await createPlatformAdmin();
+        const otherAdminToken = await Token.createToken(otherAdmin, new Date());
+
+        await expect(signOut(organization, await Token.createToken(admin, new Date()))).rejects.toThrow(STExpect.simpleError({
+            code: 'permission_denied',
+        }));
+        expect(await tokenExists(otherAdminToken)).toBe(true);
+    });
+
+    test('an admin of an organization cannot sign out the platform admins', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const organizationAdmin = await new UserFactory({
+            organization,
+            permissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+        organizationAdmin.organizationId = null;
+        await organizationAdmin.save();
+
+        const platformAdmin = await createPlatformAdmin();
+        const platformAdminToken = await Token.createToken(platformAdmin, new Date());
+
+        await expect(signOut(organization, await Token.createToken(organizationAdmin, new Date()))).rejects.toThrow(STExpect.simpleError({
+            code: 'permission_denied',
+        }));
+        expect(await tokenExists(platformAdminToken)).toBe(true);
+    });
+});

package/src/endpoints/global/platform/SignOutPlatformAdminsEndpoint.ts

@@ -0,0 +1,43 @@
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { CountResponse } from '@stamhoofd/structures';
+
+import { Context } from '../../../helpers/Context.js';
+import { AdminSessionService } from '../../../services/AdminSessionService.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = undefined;
+type ResponseBody = CountResponse;
+
+/**
+ * End the sessions of all administrators of the platform, so they have to sign in again.
+ * Used after making two-factor authentication required, which is only enforced on new
+ * logins.
+ */
+export class SignOutPlatformAdminsEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/platform/admins/sign-out', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(_: DecodedRequest<Params, Query, Body>) {
+        const { token } = await Context.authenticate();
+
+        if (!Context.auth.canManagePlatformAdmins()) {
+            throw Context.auth.error();
+        }
+
+        const count = await AdminSessionService.signOutPlatformAdmins(token.accessToken);
+
+        return new Response(CountResponse.create({ count }));
+    }
+}

package/src/endpoints/organization/dashboard/documents/GetDocumentTemplateXML.ts

@@ -4,6 +4,7 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import { DocumentTemplate } from '@stamhoofd/models';
 
 import { Context } from '../../../../helpers/Context.js';
+import { DocumentRenderService } from '../../../../services/DocumentRenderService.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -42,7 +43,7 @@ export class GetDocumentTemplateXMLEndpoint extends Endpoint<Params, Query, Body
         }
 
         // Update documents
-        const xml = await template.getRenderedXml(organization);
+        const xml = await DocumentRenderService.getRenderedXml(template, organization);
         if (!xml) {
             throw new SimpleError({
                 code: 'failed_generating',

package/src/endpoints/organization/dashboard/organization/PatchOrganizationEndpoint.ts

@@ -166,6 +166,7 @@ export class PatchOrganizationEndpoint extends Endpoint<Params, Query, Body, Res
                 organization.privateMeta.balanceNotificationSettings = patchObject(organization.privateMeta.balanceNotificationSettings, request.body.privateMeta.balanceNotificationSettings);
                 organization.privateMeta.invoiceSettings = patchObject(organization.privateMeta.invoiceSettings, request.body.privateMeta.invoiceSettings);
                 organization.privateMeta.recordAnswers = request.body.privateMeta.recordAnswers.applyTo(organization.privateMeta.recordAnswers);
+                organization.privateMeta.requireTwoFactor = patchObject(organization.privateMeta.requireTwoFactor, request.body.privateMeta.requireTwoFactor);
 
                 if (request.body.privateMeta.responsibilities || request.body.privateMeta.roles) {
                     shouldUpdateUserPermissions = true;

package/src/endpoints/organization/dashboard/organization/SetOrganizationDomainEndpoint.ts

@@ -9,6 +9,7 @@ import NodeRSA from 'node-rsa';
 import { Formatter } from '@stamhoofd/utility';
 import { AuthenticatedStructures } from '../../../../helpers/AuthenticatedStructures.js';
 import { Context } from '../../../../helpers/Context.js';
+import { OrganizationDNSService } from '../../../../services/OrganizationDNSService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -169,7 +170,7 @@ export class SetOrganizationDomainEndpoint extends Endpoint<Params, Query, Body,
                 }));
             } else {
                 if (oldMailDomain) {
-                    organization.deleteAWSMailIdenitity(oldMailDomain).catch(console.error);
+                    OrganizationDNSService.deleteAWSMailIdenitity(organization, oldMailDomain).catch(console.error);
                 }
 
                 if (organization.serverMeta.privateDKIMKey && organization.serverMeta.publicDKIMKey) {
@@ -188,7 +189,7 @@ export class SetOrganizationDomainEndpoint extends Endpoint<Params, Query, Body,
         } else {
             // Validate DNS-records if not empty
             console.log('Validating domains');
-            await organization.updateDNSRecords();
+            await OrganizationDNSService.updateDNSRecords(organization);
         }
 
         console.log('Done.');

package/src/endpoints/organization/dashboard/receivable-balances/ChargeReceivableBalancesEndpoint.ts

@@ -13,6 +13,7 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import { PaymentMandateService } from '../../../../services/PaymentMandateService.js';
 import { BalanceItemService } from '../../../../services/BalanceItemService.js';
 import { QueueHandler } from '@stamhoofd/queues';
+import { OrganizationAdminService } from '../../../../services/OrganizationAdminService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -121,11 +122,11 @@ export class ChargeReceivableBalancesEndpoint extends Endpoint<Params, Query, Bo
                     continue;
                 }
 
-                customerUser = customerUser ?? (payingOrganization ? (await payingOrganization.getFullAdmins())[0] : null);
+                customerUser = customerUser ?? (payingOrganization ? (await OrganizationAdminService.getFullAdmins(payingOrganization))[0] : null);
                 const customer = PaymentCustomer.create({
                     firstName: customerUser?.firstName,
                     lastName: customerUser?.lastName,
-                    email: customerUser?.email ?? (payingOrganization ? (await payingOrganization.getReplyEmails())[0].email : null),
+                    email: customerUser?.email ?? (payingOrganization ? (await OrganizationAdminService.getReplyEmails(payingOrganization))[0].email : null),
                     company: payingOrganization?.defaultCompanies[0],
                 });
 

package/src/endpoints/organization/dashboard/users/CreateApiUserEndpoint.test.ts

@@ -15,6 +15,35 @@ describe('Endpoint.CreateApiUserEndpoint', () => {
         TestUtils.setEnvironment('userMode', 'platform');
     });
 
+    test('A session that did not recently authenticate cannot create a key', async () => {
+        // An API key is not covered by two-factor authentication and does not expire, so a
+        // stolen session must not be enough to mint one: the user has to prove who they
+        // are again first.
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+
+        // A token as produced by a refresh_token rotation (never authenticatedAt).
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+
+        await expect(testServer.test(endpoint, createRequest)).rejects.toThrow(STExpect.simpleError({
+            code: 'require_fresh_auth',
+        }));
+    });
+
     test('Only a platform admin can set the rate limits of a key', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({
@@ -22,7 +51,7 @@ describe('Endpoint.CreateApiUserEndpoint', () => {
                 level: PermissionLevel.Full,
             }),
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -49,7 +78,7 @@ describe('Endpoint.CreateApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -76,7 +105,7 @@ describe('Endpoint.CreateApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({

package/src/endpoints/organization/dashboard/users/CreateApiUserEndpoint.ts

@@ -29,7 +29,10 @@ export class CreateApiUserEndpoint extends Endpoint<Params, Query, Body, Respons
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOrganizationScope();
-        await Context.authenticate();
+        // An API key is a long-lived credential that is not covered by two-factor
+        // authentication, so creating one requires a recent authentication: a stolen
+        // session should not be enough to mint a permanent way back in.
+        await Context.authenticateFresh();
 
         // Fast throw first (more in depth checking for patches later)
         if (!await Context.auth.canManageAdmins(organization.id)) {

package/src/endpoints/organization/dashboard/users/GetOrganizationAdminsEndpoint.test.ts

@@ -0,0 +1,100 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import type { Organization, User } from '@stamhoofd/models';
+import { MFATOTP, OrganizationFactory, Token, UserFactory, WebauthnCredential } from '@stamhoofd/models';
+import { OrganizationAdmins, PermissionLevel, Permissions } from '@stamhoofd/structures';
+import crypto from 'crypto';
+
+import { MFATestHelper } from '../../../../../tests/helpers/MFATestHelper.js';
+import { testServer } from '../../../../../tests/helpers/TestServer.js';
+import { GetOrganizationAdminsEndpoint } from './GetOrganizationAdminsEndpoint.js';
+
+describe('Endpoint.GetOrganizationAdmins', () => {
+    const endpoint = new GetOrganizationAdminsEndpoint();
+
+    async function createAdmin(organization: Organization): Promise<User> {
+        return await new UserFactory({
+            organization,
+            permissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+    }
+
+    async function getAdmins(organization: Organization, user: User) {
+        const token = await Token.createToken(user, new Date());
+        const request = Request.buildJson('GET', '/organization/admins', organization.getApiHost());
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, request);
+        expect(response.body).toBeInstanceOf(OrganizationAdmins);
+        return (response.body as OrganizationAdmins).users;
+    }
+
+    test('The last activity of every admin is returned', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            organization,
+            permissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+
+        const lastActiveAt = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000);
+        lastActiveAt.setMilliseconds(0);
+
+        const inactiveAdmin = await new UserFactory({
+            organization,
+            permissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+        inactiveAdmin.lastActiveAt = lastActiveAt;
+        await inactiveAdmin.save();
+
+        const token = await Token.createToken(user, new Date());
+        const request = Request.buildJson('GET', '/organization/admins', organization.getApiHost());
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, request);
+        expect(response.body).toBeInstanceOf(OrganizationAdmins);
+
+        const users = (response.body as OrganizationAdmins).users;
+        expect(users.find(u => u.id === inactiveAdmin.id)?.lastActiveAt?.getTime()).toEqual(lastActiveAt.getTime());
+
+        // The user never signed in: the token was created directly.
+        expect(users.find(u => u.id === user.id)?.lastActiveAt).toBeNull();
+    });
+
+    test('Whether an admin has two-factor authentication is returned', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const me = await createAdmin(organization);
+
+        const withTotp = await createAdmin(organization);
+        await MFATestHelper.addConfirmedTOTP(withTotp);
+
+        const withPasskey = await createAdmin(organization);
+        const credential = new WebauthnCredential();
+        credential.userId = withPasskey.id;
+        credential.credentialId = 'cred-' + crypto.randomBytes(16).toString('base64url');
+        credential.publicKey = crypto.randomBytes(32).toString('base64url');
+        credential.name = 'Test passkey';
+        await credential.save();
+
+        const withoutFactors = await createAdmin(organization);
+
+        const users = await getAdmins(organization, me);
+
+        expect(users.find(u => u.id === withTotp.id)?.hasTwoFactor).toBe(true);
+        expect(users.find(u => u.id === withPasskey.id)?.hasTwoFactor).toBe(true);
+        expect(users.find(u => u.id === withoutFactors.id)?.hasTwoFactor).toBe(false);
+        expect(users.find(u => u.id === me.id)?.hasTwoFactor).toBe(false);
+    });
+
+    test('An authenticator that was never confirmed does not count as two-factor authentication', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const me = await createAdmin(organization);
+
+        const totp = new MFATOTP();
+        totp.userId = me.id;
+        totp.name = 'Pending authenticator';
+        totp.secret = 'encrypted-secret';
+        await totp.save();
+
+        const users = await getAdmins(organization, me);
+        expect(users.find(u => u.id === me.id)?.hasTwoFactor).toBe(false);
+    });
+});

package/src/endpoints/organization/dashboard/users/GetOrganizationAdminsEndpoint.ts

@@ -4,6 +4,7 @@ import { User } from '@stamhoofd/models';
 import { OrganizationAdmins } from '@stamhoofd/structures';
 
 import { Context } from '../../../../helpers/Context.js';
+import { TwoFactorHelper } from '../../../../helpers/TwoFactorHelper.js';
 type Params = Record<string, never>;
 type Query = undefined;
 type Body = undefined;
@@ -34,10 +35,12 @@ export class GetOrganizationAdminsEndpoint extends Endpoint<Params, Query, Body,
 
         // Get all admins
         const admins = await User.getAdmins(organization.id);
+        const users = admins.map(user => user.getStructure());
+        await TwoFactorHelper.fillTwoFactorStatus(users);
 
         return new Response(
             OrganizationAdmins.create({
-                users: admins.map(user => user.getStructure()),
+                users,
             }),
         );
     }

package/src/endpoints/organization/dashboard/users/PatchApiUserEndpoint.test.ts

@@ -24,7 +24,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
                 level: PermissionLevel.Full,
             }),
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -60,7 +60,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -95,7 +95,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -143,7 +143,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -190,7 +190,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({

package/src/endpoints/organization/dashboard/users/PatchApiUserEndpoint.ts

@@ -3,7 +3,7 @@ import { isPatch } from '@simonbackx/simple-encoding';
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { Token, User } from '@stamhoofd/models';
+import { Platform, Token, User } from '@stamhoofd/models';
 import { ApiUser, PermissionLevel, UserMeta, UserPermissions } from '@stamhoofd/structures';
 import { Context } from '../../../../helpers/Context.js';
 
@@ -58,10 +58,12 @@ export class PatchApiUserEndpoint extends Endpoint<Params, Query, Body, Response
             }
 
             if (request.body.permissions) {
+                const platform = await Platform.getSharedStruct();
+
                 if (organization) {
                     editUser.permissions = UserPermissions.limitedPatch(editUser.permissions, request.body.permissions, organization.id);
 
-                    if (editUser.id === user.id && (!editUser.permissions || !editUser.permissions.forOrganization(organization)?.hasFullAccess())) {
+                    if (editUser.id === user.id && (!editUser.permissions || !editUser.permissions.forOrganization(organization, platform, { inheritFromPlatform: false })?.hasFullAccess())) {
                         throw new SimpleError({
                             code: 'permission_denied',
                             message: 'Je kan jezelf niet verwijderen als hoofdbeheerder',
@@ -74,7 +76,7 @@ export class PatchApiUserEndpoint extends Endpoint<Params, Query, Body, Response
                         editUser.permissions = request.body.permissions.isPut() ? request.body.permissions : null;
                     }
 
-                    if (editUser.id === user.id && !editUser.permissions?.platform?.hasFullAccess()) {
+                    if (editUser.id === user.id && !editUser.permissions?.forPlatform(platform)?.hasFullAccess()) {
                         throw new SimpleError({
                             code: 'permission_denied',
                             message: 'Je kan jezelf niet verwijderen als hoofdbeheerder',