@stamhoofd/backend 2.137.5 → 2.138.0

package/src/services/TwoFactorAuditLogService.ts

@@ -0,0 +1,64 @@
+import type { User } from '@stamhoofd/models';
+import { AuditLog } from '@stamhoofd/models';
+import type { MFAMethodType } from '@stamhoofd/structures';
+import { AuditLogReplacement, AuditLogReplacementType, AuditLogSource, AuditLogType } from '@stamhoofd/structures';
+
+/**
+ * Records the changes a user makes to their own two-factor authentication.
+ *
+ * These are security-relevant events that are not visible anywhere else: the credentials
+ * themselves are not audit-logged models, and an attacker who took over a session would
+ * use exactly these endpoints to lock the owner out. So they are logged explicitly, at the
+ * moment the change is effective.
+ */
+export class TwoFactorAuditLogService {
+    static async logMethodAdded(user: User, method: MFAMethodType, name: string) {
+        await this.save(AuditLogType.UserTwoFactorMethodAdded, user, method, name);
+    }
+
+    static async logMethodDeleted(user: User, method: MFAMethodType, name: string) {
+        await this.save(AuditLogType.UserTwoFactorMethodDeleted, user, method, name);
+    }
+
+    /**
+     * Only for an explicit regeneration by the user. The batch that is generated together
+     * with a first factor is already covered by the method-added log.
+     */
+    static async logRecoveryCodesRegenerated(user: User) {
+        await this.save(AuditLogType.UserRecoveryCodesRegenerated, user, null, '');
+    }
+
+    private static async save(type: AuditLogType, user: User, method: MFAMethodType | null, name: string) {
+        const log = new AuditLog();
+        log.type = type;
+        log.source = AuditLogSource.User;
+
+        // A user changes their own factors, so the account is both the actor and the subject.
+        log.userId = user.id;
+        log.objectId = user.id;
+
+        // Deliberately the organization of the account itself, not the one the request was
+        // scoped to: a platform administrator enrolling a factor while working in an
+        // organization is not that organization's business.
+        log.organizationId = user.organizationId;
+
+        log.replacements = new Map([
+            ['u', AuditLogReplacement.create({
+                id: user.id,
+                value: user.email,
+                type: AuditLogReplacementType.User,
+            })],
+        ]);
+
+        const methodReplacement = AuditLogReplacement.enum('MFAMethodType', method);
+        if (methodReplacement) {
+            log.replacements.set('method', methodReplacement);
+        }
+
+        if (name) {
+            log.replacements.set('name', AuditLogReplacement.string(name));
+        }
+
+        await log.save();
+    }
+}

package/src/services/VerificationCodeService.ts

@@ -1,6 +1,7 @@
 import type { I18n } from '@stamhoofd/backend-i18n';
 import type { Organization } from '@stamhoofd/models';
-import { EmailVerificationCode, Platform, sendEmailTemplate, User } from '@stamhoofd/models';
+import { EmailVerificationCode, Platform, User } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 import { EmailTemplateType, getAppHost, Recipient, Replacement } from '@stamhoofd/structures';
 
 /**

package/tests/e2e/api-rate-limits.test.ts

@@ -29,7 +29,7 @@ describe('E2E.APIRateLimits', () => {
                 level: PermissionLevel.Full,
             }),
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({

package/tests/helpers/MFATestHelper.ts

@@ -0,0 +1,42 @@
+import type { User } from '@stamhoofd/models';
+import { MFATOTP } from '@stamhoofd/models';
+import { authenticator } from 'otplib';
+
+import { RecoveryCodeHelper } from '../../src/helpers/RecoveryCodeHelper.js';
+import { TOTPHelper } from '../../src/helpers/TOTPHelper.js';
+
+/**
+ * Set up two-factor authentication in tests, without going through the enrollment flow.
+ * Also used by the Playwright tests, which drive the real UI but need to know the secret
+ * of an authenticator app to generate its codes.
+ */
+export const MFATestHelper = {
+    /**
+     * Enroll a confirmed authenticator app and return its plaintext secret.
+     */
+    async addConfirmedTOTP(user: User, name = 'Test authenticator'): Promise<{ id: string; secret: string }> {
+        const totp = new MFATOTP();
+        const secret = authenticator.generateSecret();
+        totp.userId = user.id;
+        totp.name = name;
+        totp.secret = TOTPHelper.encrypt(secret);
+        totp.confirmedAt = new Date();
+        await totp.save();
+        return { id: totp.id, secret };
+    },
+
+    /**
+     * The code an authenticator app would show right now for this secret.
+     */
+    generateTOTPCode(secret: string): string {
+        return authenticator.generate(secret);
+    },
+
+    /**
+     * Whether this recovery code is one of the user's valid codes. Consumes it, just like
+     * using it to log in would.
+     */
+    async useRecoveryCode(userId: string, code: string): Promise<boolean> {
+        return await RecoveryCodeHelper.consume(userId, code);
+    },
+};

package/tests/helpers/TestServer.ts

@@ -3,12 +3,16 @@ import { VersionMiddleware } from '@stamhoofd/backend-middleware';
 import { Version } from '@stamhoofd/structures';
 
 import { ContextMiddleware } from '../../src/middleware/ContextMiddleware.js';
+import { TenantScopeMiddleware } from '../../src/middleware/TenantScopeMiddleware.js';
 import { FileSignService } from '../../src/services/FileSignService.js';
 
 export const testServer = new TestServer();
 
 // Contexts
 testServer.addRequestMiddleware(ContextMiddleware);
+
+// Registration order mirrors boot.ts
+testServer.addRequestMiddleware(TenantScopeMiddleware);
 testServer.addResponseMiddleware(FileSignService);
 testServer.addRequestMiddleware(FileSignService);
 

package/tests/helpers/index.ts

@@ -1,3 +1,4 @@
+export * from './MFATestHelper.js';
 export * from './MollieMocker.js';
 export * from './PayconiqMocker.js';
 export * from './StripeMocker.js';

package/tsconfig.build.json

@@ -8,7 +8,8 @@
         "./index.ts",
         "./migrations.ts",
         "./src",
-        "../../stamhoofd.d.ts"
+        "../../stamhoofd.d.ts",
+        "./src/**/*.json",
     ],
     "exclude": [
         "./src/**/*.spec.ts",