@stamhoofd/backend 2.137.5 → 2.138.0

package/src/endpoints/global/platform/SignOutPlatformAdminsEndpoint.ts

@@ -0,0 +1,43 @@
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { CountResponse } from '@stamhoofd/structures';
+
+import { Context } from '../../../helpers/Context.js';
+import { AdminSessionService } from '../../../services/AdminSessionService.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = undefined;
+type ResponseBody = CountResponse;
+
+/**
+ * End the sessions of all administrators of the platform, so they have to sign in again.
+ * Used after making two-factor authentication required, which is only enforced on new
+ * logins.
+ */
+export class SignOutPlatformAdminsEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/platform/admins/sign-out', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(_: DecodedRequest<Params, Query, Body>) {
+        const { token } = await Context.authenticate();
+
+        if (!Context.auth.canManagePlatformAdmins()) {
+            throw Context.auth.error();
+        }
+
+        const count = await AdminSessionService.signOutPlatformAdmins(token.accessToken);
+
+        return new Response(CountResponse.create({ count }));
+    }
+}

package/src/endpoints/organization/dashboard/organization/PatchOrganizationEndpoint.ts

@@ -166,6 +166,7 @@ export class PatchOrganizationEndpoint extends Endpoint<Params, Query, Body, Res
                 organization.privateMeta.balanceNotificationSettings = patchObject(organization.privateMeta.balanceNotificationSettings, request.body.privateMeta.balanceNotificationSettings);
                 organization.privateMeta.invoiceSettings = patchObject(organization.privateMeta.invoiceSettings, request.body.privateMeta.invoiceSettings);
                 organization.privateMeta.recordAnswers = request.body.privateMeta.recordAnswers.applyTo(organization.privateMeta.recordAnswers);
+                organization.privateMeta.requireTwoFactor = patchObject(organization.privateMeta.requireTwoFactor, request.body.privateMeta.requireTwoFactor);
 
                 if (request.body.privateMeta.responsibilities || request.body.privateMeta.roles) {
                     shouldUpdateUserPermissions = true;

package/src/endpoints/organization/dashboard/receivable-balances/ChargeReceivableBalancesEndpoint.ts

@@ -13,6 +13,7 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import { PaymentMandateService } from '../../../../services/PaymentMandateService.js';
 import { BalanceItemService } from '../../../../services/BalanceItemService.js';
 import { QueueHandler } from '@stamhoofd/queues';
+import { OrganizationAdminService } from '../../../../services/OrganizationAdminService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -121,11 +122,11 @@ export class ChargeReceivableBalancesEndpoint extends Endpoint<Params, Query, Bo
                     continue;
                 }
 
-                customerUser = customerUser ?? (payingOrganization ? (await payingOrganization.getFullAdmins())[0] : null);
+                customerUser = customerUser ?? (payingOrganization ? (await OrganizationAdminService.getFullAdmins(payingOrganization))[0] : null);
                 const customer = PaymentCustomer.create({
                     firstName: customerUser?.firstName,
                     lastName: customerUser?.lastName,
-                    email: customerUser?.email ?? (payingOrganization ? (await payingOrganization.getReplyEmails())[0].email : null),
+                    email: customerUser?.email ?? (payingOrganization ? (await OrganizationAdminService.getReplyEmails(payingOrganization))[0].email : null),
                     company: payingOrganization?.defaultCompanies[0],
                 });
 

package/src/endpoints/organization/dashboard/users/CreateApiUserEndpoint.test.ts

@@ -15,6 +15,35 @@ describe('Endpoint.CreateApiUserEndpoint', () => {
         TestUtils.setEnvironment('userMode', 'platform');
     });
 
+    test('A session that did not recently authenticate cannot create a key', async () => {
+        // An API key is not covered by two-factor authentication and does not expire, so a
+        // stolen session must not be enough to mint one: the user has to prove who they
+        // are again first.
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+            organization,
+        }).create();
+
+        // A token as produced by a refresh_token rotation (never authenticatedAt).
+        const token = await Token.createToken(user);
+
+        const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
+            permissions: UserPermissions.create({
+                organizationPermissions: new Map([
+                    [organization.id, Permissions.create({ level: PermissionLevel.Read })],
+                ]),
+            }),
+        }));
+        createRequest.headers.authorization = 'Bearer ' + token.accessToken;
+
+        await expect(testServer.test(endpoint, createRequest)).rejects.toThrow(STExpect.simpleError({
+            code: 'require_fresh_auth',
+        }));
+    });
+
     test('Only a platform admin can set the rate limits of a key', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({
@@ -22,7 +51,7 @@ describe('Endpoint.CreateApiUserEndpoint', () => {
                 level: PermissionLevel.Full,
             }),
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -49,7 +78,7 @@ describe('Endpoint.CreateApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -76,7 +105,7 @@ describe('Endpoint.CreateApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({

package/src/endpoints/organization/dashboard/users/CreateApiUserEndpoint.ts

@@ -29,7 +29,10 @@ export class CreateApiUserEndpoint extends Endpoint<Params, Query, Body, Respons
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOrganizationScope();
-        await Context.authenticate();
+        // An API key is a long-lived credential that is not covered by two-factor
+        // authentication, so creating one requires a recent authentication: a stolen
+        // session should not be enough to mint a permanent way back in.
+        await Context.authenticateFresh();
 
         // Fast throw first (more in depth checking for patches later)
         if (!await Context.auth.canManageAdmins(organization.id)) {

package/src/endpoints/organization/dashboard/users/GetOrganizationAdminsEndpoint.test.ts

@@ -0,0 +1,100 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import type { Organization, User } from '@stamhoofd/models';
+import { MFATOTP, OrganizationFactory, Token, UserFactory, WebauthnCredential } from '@stamhoofd/models';
+import { OrganizationAdmins, PermissionLevel, Permissions } from '@stamhoofd/structures';
+import crypto from 'crypto';
+
+import { MFATestHelper } from '../../../../../tests/helpers/MFATestHelper.js';
+import { testServer } from '../../../../../tests/helpers/TestServer.js';
+import { GetOrganizationAdminsEndpoint } from './GetOrganizationAdminsEndpoint.js';
+
+describe('Endpoint.GetOrganizationAdmins', () => {
+    const endpoint = new GetOrganizationAdminsEndpoint();
+
+    async function createAdmin(organization: Organization): Promise<User> {
+        return await new UserFactory({
+            organization,
+            permissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+    }
+
+    async function getAdmins(organization: Organization, user: User) {
+        const token = await Token.createToken(user, new Date());
+        const request = Request.buildJson('GET', '/organization/admins', organization.getApiHost());
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, request);
+        expect(response.body).toBeInstanceOf(OrganizationAdmins);
+        return (response.body as OrganizationAdmins).users;
+    }
+
+    test('The last activity of every admin is returned', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({
+            organization,
+            permissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+
+        const lastActiveAt = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000);
+        lastActiveAt.setMilliseconds(0);
+
+        const inactiveAdmin = await new UserFactory({
+            organization,
+            permissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+        inactiveAdmin.lastActiveAt = lastActiveAt;
+        await inactiveAdmin.save();
+
+        const token = await Token.createToken(user, new Date());
+        const request = Request.buildJson('GET', '/organization/admins', organization.getApiHost());
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, request);
+        expect(response.body).toBeInstanceOf(OrganizationAdmins);
+
+        const users = (response.body as OrganizationAdmins).users;
+        expect(users.find(u => u.id === inactiveAdmin.id)?.lastActiveAt?.getTime()).toEqual(lastActiveAt.getTime());
+
+        // The user never signed in: the token was created directly.
+        expect(users.find(u => u.id === user.id)?.lastActiveAt).toBeNull();
+    });
+
+    test('Whether an admin has two-factor authentication is returned', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const me = await createAdmin(organization);
+
+        const withTotp = await createAdmin(organization);
+        await MFATestHelper.addConfirmedTOTP(withTotp);
+
+        const withPasskey = await createAdmin(organization);
+        const credential = new WebauthnCredential();
+        credential.userId = withPasskey.id;
+        credential.credentialId = 'cred-' + crypto.randomBytes(16).toString('base64url');
+        credential.publicKey = crypto.randomBytes(32).toString('base64url');
+        credential.name = 'Test passkey';
+        await credential.save();
+
+        const withoutFactors = await createAdmin(organization);
+
+        const users = await getAdmins(organization, me);
+
+        expect(users.find(u => u.id === withTotp.id)?.hasTwoFactor).toBe(true);
+        expect(users.find(u => u.id === withPasskey.id)?.hasTwoFactor).toBe(true);
+        expect(users.find(u => u.id === withoutFactors.id)?.hasTwoFactor).toBe(false);
+        expect(users.find(u => u.id === me.id)?.hasTwoFactor).toBe(false);
+    });
+
+    test('An authenticator that was never confirmed does not count as two-factor authentication', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const me = await createAdmin(organization);
+
+        const totp = new MFATOTP();
+        totp.userId = me.id;
+        totp.name = 'Pending authenticator';
+        totp.secret = 'encrypted-secret';
+        await totp.save();
+
+        const users = await getAdmins(organization, me);
+        expect(users.find(u => u.id === me.id)?.hasTwoFactor).toBe(false);
+    });
+});

package/src/endpoints/organization/dashboard/users/GetOrganizationAdminsEndpoint.ts

@@ -4,6 +4,7 @@ import { User } from '@stamhoofd/models';
 import { OrganizationAdmins } from '@stamhoofd/structures';
 
 import { Context } from '../../../../helpers/Context.js';
+import { TwoFactorHelper } from '../../../../helpers/TwoFactorHelper.js';
 type Params = Record<string, never>;
 type Query = undefined;
 type Body = undefined;
@@ -34,10 +35,12 @@ export class GetOrganizationAdminsEndpoint extends Endpoint<Params, Query, Body,
 
         // Get all admins
         const admins = await User.getAdmins(organization.id);
+        const users = admins.map(user => user.getStructure());
+        await TwoFactorHelper.fillTwoFactorStatus(users);
 
         return new Response(
             OrganizationAdmins.create({
-                users: admins.map(user => user.getStructure()),
+                users,
             }),
         );
     }

package/src/endpoints/organization/dashboard/users/PatchApiUserEndpoint.test.ts

@@ -24,7 +24,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
                 level: PermissionLevel.Full,
             }),
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -60,7 +60,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -95,7 +95,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -143,7 +143,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -190,7 +190,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({

package/src/endpoints/organization/dashboard/users/SignOutOrganizationAdminsEndpoint.test.ts

@@ -0,0 +1,160 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import type { Organization, User } from '@stamhoofd/models';
+import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { PermissionLevel, Permissions, UserPermissions } from '@stamhoofd/structures';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
+
+import { testServer } from '../../../../../tests/helpers/TestServer.js';
+import { AdminSessionService } from '../../../../services/AdminSessionService.js';
+import { SignOutOrganizationAdminsEndpoint } from './SignOutOrganizationAdminsEndpoint.js';
+
+describe('Endpoint.SignOutOrganizationAdmins', () => {
+    const endpoint = new SignOutOrganizationAdminsEndpoint();
+
+    beforeEach(() => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
+    const signOut = async (organization: Organization, token: Token) => {
+        const request = Request.buildJson('POST', '/organization/admins/sign-out', organization.getApiHost());
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+        return await testServer.test(endpoint, request);
+    };
+
+    /**
+     * In platform mode users are not owned by an organization: they have permissions for it.
+     */
+    const createAdmin = async (organization: Organization, level = PermissionLevel.Full) => {
+        const user = await new UserFactory({
+            organization,
+            permissions: Permissions.create({ level }),
+        }).create();
+        user.organizationId = null;
+        await user.save();
+        return user;
+    };
+
+    const tokenExists = async (token: Token) => {
+        return !!(await Token.getByAccessToken(token.accessToken, true));
+    };
+
+    test('all sessions of all admins are signed out, except the one making the request', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const otherOrganization = await new OrganizationFactory({}).create();
+
+        const admin = await createAdmin(organization);
+        const otherAdmin = await createAdmin(organization);
+        const otherOrganizationAdmin = await createAdmin(otherOrganization);
+        const member = await new UserFactory({ organization }).create();
+
+        const currentToken = await Token.createToken(admin, new Date());
+        const secondDeviceOfAdmin = await Token.createToken(admin, new Date());
+        const otherAdminToken = await Token.createToken(otherAdmin, new Date());
+        const otherOrganizationAdminToken = await Token.createToken(otherOrganizationAdmin, new Date());
+        const memberToken = await Token.createToken(member, new Date());
+
+        const response = await signOut(organization, currentToken);
+
+        // The other device of the admin is signed out too: only this session is spared
+        expect(response.body.count).toBe(2);
+        expect(await tokenExists(currentToken)).toBe(true);
+        expect(await tokenExists(secondDeviceOfAdmin)).toBe(false);
+        expect(await tokenExists(otherAdminToken)).toBe(false);
+
+        // Users without permissions in this organization are not affected
+        expect(await tokenExists(otherOrganizationAdminToken)).toBe(true);
+        expect(await tokenExists(memberToken)).toBe(true);
+    });
+
+    test('an admin without full access cannot sign out the other admins', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const admin = await createAdmin(organization, PermissionLevel.Write);
+        const otherAdmin = await createAdmin(organization);
+        const otherAdminToken = await Token.createToken(otherAdmin, new Date());
+
+        await expect(signOut(organization, await Token.createToken(admin, new Date()))).rejects.toThrow(STExpect.simpleError({
+            code: 'permission_denied',
+        }));
+        expect(await tokenExists(otherAdminToken)).toBe(true);
+    });
+
+    test('an api user cannot sign out the admins', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const apiUser = await new UserFactory({ organization, apiUser: true }).create();
+        apiUser.permissions = UserPermissions.create({
+            organizationPermissions: new Map([[organization.id, Permissions.create({ level: PermissionLevel.Full })]]),
+        });
+        await apiUser.save();
+
+        const otherAdmin = await createAdmin(organization);
+        const otherAdminToken = await Token.createToken(otherAdmin, new Date());
+
+        await expect(signOut(organization, await Token.createApiToken(apiUser))).rejects.toThrow(STExpect.simpleError({
+            code: 'permission_denied',
+        }));
+        expect(await tokenExists(otherAdminToken)).toBe(true);
+    });
+
+    test('an organization without admins is a no-op', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const member = await new UserFactory({ organization }).create();
+        const memberToken = await Token.createToken(member, new Date());
+
+        // Not reachable through the endpoint (the caller is an admin themselves), but the
+        // empty list of users may not turn into a query that deletes everything.
+        expect(await AdminSessionService.signOutOrganizationAdmins(organization.id, null)).toBe(0);
+        expect(await tokenExists(memberToken)).toBe(true);
+    });
+
+    describe('userMode organization', () => {
+        beforeEach(() => {
+            TestUtils.setEnvironment('userMode', 'organization');
+        });
+
+        test('all sessions of all admins are signed out, except the one making the request', async () => {
+            const organization = await new OrganizationFactory({}).create();
+
+            const admin: User = await new UserFactory({
+                organization,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+            const otherAdmin: User = await new UserFactory({
+                organization,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+            const member = await new UserFactory({ organization }).create();
+
+            const otherAdminToken = await Token.createToken(otherAdmin, new Date());
+            const memberToken = await Token.createToken(member, new Date());
+
+            const response = await signOut(organization, await Token.createToken(admin, new Date()));
+
+            expect(response.body.count).toBe(1);
+            expect(await tokenExists(otherAdminToken)).toBe(false);
+            expect(await tokenExists(memberToken)).toBe(true);
+        });
+
+        test('api users keep their token, because they cannot complete a login', async () => {
+            const organization = await new OrganizationFactory({}).create();
+
+            const admin: User = await new UserFactory({
+                organization,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const apiUser = await new UserFactory({ organization, apiUser: true }).create();
+            apiUser.permissions = UserPermissions.create({
+                organizationPermissions: new Map([[organization.id, Permissions.create({ level: PermissionLevel.Full })]]),
+            });
+            await apiUser.save();
+            const apiToken = await Token.createApiToken(apiUser);
+
+            const response = await signOut(organization, await Token.createToken(admin, new Date()));
+
+            expect(response.body.count).toBe(0);
+            expect(await tokenExists(apiToken)).toBe(true);
+        });
+    });
+});

package/src/endpoints/organization/dashboard/users/SignOutOrganizationAdminsEndpoint.ts

@@ -0,0 +1,44 @@
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { CountResponse } from '@stamhoofd/structures';
+
+import { Context } from '../../../../helpers/Context.js';
+import { AdminSessionService } from '../../../../services/AdminSessionService.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = undefined;
+type ResponseBody = CountResponse;
+
+/**
+ * End the sessions of all administrators of this organization, so they have to sign in
+ * again. Used after making two-factor authentication required, which is only enforced on
+ * new logins.
+ */
+export class SignOutOrganizationAdminsEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/organization/admins/sign-out', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(_: DecodedRequest<Params, Query, Body>) {
+        const organization = await Context.setOrganizationScope();
+        const { token } = await Context.authenticate();
+
+        if (!await Context.auth.canManageAdmins(organization.id)) {
+            throw Context.auth.error();
+        }
+
+        const count = await AdminSessionService.signOutOrganizationAdmins(organization.id, token.accessToken);
+
+        return new Response(CountResponse.create({ count }));
+    }
+}

package/src/helpers/AuthenticatedStructures.ts

@@ -9,6 +9,7 @@ import { Sorter } from '@stamhoofd/utility';
 import { SQL } from '@stamhoofd/sql';
 import { Formatter } from '@stamhoofd/utility';
 import { Context } from './Context.js';
+import { TwoFactorHelper } from './TwoFactorHelper.js';
 
 /**
  * Builds authenticated structures for the current user
@@ -425,7 +426,7 @@ export class AuthenticatedStructures {
             }
         }
 
-        return UserWithMembers.create({
+        const struct = UserWithMembers.create({
             ...user,
             hasAccount: user.hasAccount(),
             hasPassword: user.hasPasswordBasedAccount(),
@@ -433,6 +434,8 @@ export class AuthenticatedStructures {
             // Always include the current context organization - because it is possible we switch organization and we don't want to refetch every time
             members: await this.membersBlob(filtered, true, user),
         });
+        await TwoFactorHelper.fillTwoFactorStatus([struct]);
+        return struct;
     }
 
     /**
@@ -453,6 +456,8 @@ export class AuthenticatedStructures {
             }));
         }
 
+        await TwoFactorHelper.fillTwoFactorStatus(structs);
+
         return structs;
     }
 
@@ -697,6 +702,9 @@ export class AuthenticatedStructures {
             );
         }
 
+        // After filterMemberData, so we only query for the users we actually return.
+        await TwoFactorHelper.fillTwoFactorStatus(memberBlobs.flatMap(b => b.users));
+
         for (const blob of memberBlobs) {
             blob.responsibilities = responsibilities.filter(r => r.memberId == blob.id).map((r) => {
                 const group = allGroups.get(r.groupId ?? '') ?? null;