@stamhoofd/backend 2.137.5 → 2.138.1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.137.5",
+    "version": "2.138.1",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -64,21 +64,23 @@
         "@simonbackx/simple-endpoints": "1.22.0",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
-        "@stamhoofd/backend-env": "2.137.5",
-        "@stamhoofd/backend-i18n": "2.137.5",
-        "@stamhoofd/backend-middleware": "2.137.5",
-        "@stamhoofd/crons": "2.137.5",
-        "@stamhoofd/email": "2.137.5",
-        "@stamhoofd/excel-writer": "2.137.5",
-        "@stamhoofd/logging": "2.137.5",
-        "@stamhoofd/models": "2.137.5",
-        "@stamhoofd/object-differ": "2.137.5",
-        "@stamhoofd/queues": "2.137.5",
-        "@stamhoofd/sql": "2.137.5",
-        "@stamhoofd/structures": "2.137.5",
-        "@stamhoofd/types": "2.137.5",
-        "@stamhoofd/utility": "2.137.5",
+        "@simplewebauthn/server": "13.3.2",
+        "@stamhoofd/backend-env": "2.138.1",
+        "@stamhoofd/backend-i18n": "2.138.1",
+        "@stamhoofd/backend-middleware": "2.138.1",
+        "@stamhoofd/crons": "2.138.1",
+        "@stamhoofd/email": "2.138.1",
+        "@stamhoofd/excel-writer": "2.138.1",
+        "@stamhoofd/logging": "2.138.1",
+        "@stamhoofd/models": "2.138.1",
+        "@stamhoofd/object-differ": "2.138.1",
+        "@stamhoofd/queues": "2.138.1",
+        "@stamhoofd/sql": "2.138.1",
+        "@stamhoofd/structures": "2.138.1",
+        "@stamhoofd/types": "2.138.1",
+        "@stamhoofd/utility": "2.138.1",
         "archiver": "7.0.1",
+        "argon2": "0.44.0",
         "axios": "1.18.1",
         "base-x": "3.0.11",
         "chalk": "5.6.2",
@@ -95,11 +97,12 @@
         "mysql2": "3.23.1",
         "node-rsa": "2.0.0",
         "openid-client": "5.7.1",
+        "otplib": "12.0.1",
         "stripe": "16.12.0",
         "uuid": "14.0.1"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.137.5",
+        "@stamhoofd/test-utils": "2.138.1",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.2",
         "@types/mailparser": "3.4.6",
@@ -114,5 +117,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "52c8072d0294d8005c9d36a79219708ea148a357"
+    "gitHead": "ea8e0dcbc22e86969883fa09e920931896110781"
 }

package/src/boot.ts

@@ -18,6 +18,7 @@ import { resumeEmails } from './helpers/EmailResumer.js';
 import { GlobalHelper } from './helpers/GlobalHelper.js';
 import { SetupStepUpdater } from './helpers/SetupStepUpdater.js';
 import { ContextMiddleware } from './middleware/ContextMiddleware.js';
+import { TenantScopeMiddleware } from './middleware/TenantScopeMiddleware.js';
 import { AuditLogService } from './services/AuditLogService.js';
 import { BalanceItemService } from './services/BalanceItemService.js';
 import { BootChecksService } from './services/BootChecksService.js';
@@ -137,6 +138,10 @@ export const boot = async (options: { killProcess: boolean }) => {
     // Contexts
     routerServer.addRequestMiddleware(ContextMiddleware);
 
+    // After ContextMiddleware on purpose: the last registered wrapRun is the outermost, and the
+    // tenant has to be in scope before the context that reads it.
+    routerServer.addRequestMiddleware(TenantScopeMiddleware);
+
     // Add version headers and minimum version
     const versionMiddleware = new VersionMiddleware({
         latestVersions: {

package/src/crons/balance-emails.ts

@@ -6,6 +6,7 @@ import type { OrganizationEmail, StamhoofdFilter } from '@stamhoofd/structures';
 import { EmailRecipientFilter, EmailRecipientSubfilter, EmailTemplateType, ReceivableBalanceType } from '@stamhoofd/structures';
 import { ContextInstance } from '../helpers/Context.js';
 import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
+import { EmailSendService } from '../services/EmailSendService.js';
 
 registerCron('balanceEmails', balanceEmails);
 
@@ -201,7 +202,7 @@ async function sendTemplate({
 
     try {
         const upToDate = await ContextInstance.startForUser(systemUser, organization, async () => {
-            return await model.queueForSending(true);
+            return await EmailSendService.queueForSending(model, true);
         });
 
         if (!upToDate) {

package/src/crons/delete-expired-mfa-tokens.ts

@@ -0,0 +1,35 @@
+import { registerCron } from '@stamhoofd/crons';
+import { MFAToken, WebauthnChallenge } from '@stamhoofd/models';
+
+let lastRunDate: number | null = null;
+
+registerCron('deleteExpiredMFATokens', deleteExpiredMFATokens);
+
+/**
+ * Sweep the short-lived tokens of the two-factor flows.
+ *
+ * Both are also cleaned up while they are used (a new challenge supersedes the previous
+ * one, and an expired token is dropped when it is looked up), but a token of a login that
+ * was simply abandoned has nothing left to trigger that. Run every night at 5 AM.
+ */
+export async function deleteExpiredMFATokens() {
+    const now = new Date();
+
+    if (now.getDate() === lastRunDate) {
+        return;
+    }
+
+    const hour = now.getHours();
+
+    // between 5 and 6 AM
+    if (hour !== 5 && STAMHOOFD.environment !== 'development') {
+        return;
+    }
+
+    const tokens = await MFAToken.deleteExpired();
+    const challenges = await WebauthnChallenge.deleteExpired();
+
+    console.log(`Deleted ${tokens} expired MFA tokens and ${challenges} expired WebAuthn challenges.`);
+
+    lastRunDate = now.getDate();
+}

package/src/crons/index.ts

@@ -5,6 +5,7 @@ import './update-cached-balances.js';
 import './cleanup-orphaned-cached-balances.js';
 import './balance-emails.js';
 import './delete-old-email-drafts.js';
+import './delete-expired-mfa-tokens.js';
 import './delete-archived-data.js';
 import './mollie-chargebacks.js';
 import './mollie-refunds.js';

package/src/crons/invoices.ts

@@ -1,13 +1,15 @@
 import { isSimpleError, isSimpleErrors } from '@simonbackx/simple-errors';
 import { registerCron } from '@stamhoofd/crons';
 import type { Invoice } from '@stamhoofd/models';
-import { Organization, Payment, sendEmailTemplate } from '@stamhoofd/models';
+import { Organization, Payment } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 import { EmailTemplateType, InvoiceStruct, PaymentStatus, Replacement } from '@stamhoofd/structures';
 import { Formatter, Sorter } from '@stamhoofd/utility';
 import { AuthenticatedStructures } from '../helpers/AuthenticatedStructures.js';
 import { InvoiceService } from '../services/InvoiceService.js';
 import { useSavedIterator } from './helpers/useSavedIterator.js';
 import { isOutside } from './helpers/isOutside.js';
+import { OrganizationAdminService } from '../services/OrganizationAdminService.js';
 
 registerCron('invoices', invoices);
 
@@ -50,7 +52,7 @@ async function createInvoicesFor(organization: Organization) {
 
     // Belgian rules: allowed to invoice up to the 15th day of the next month. We extend it with one month to fix mistakes.
     const today = Formatter.luxon();
-    const startDate = today.day <= 15 ? today.minus({ month: 2 }).startOf('month') : today.minus({ month: 1 }).startOf('month');
+    const startDate = today.day <= 15 ? today.minus({ month: 3 }).startOf('month') : today.minus({ month: 2 }).startOf('month');
 
     // Don't invoice below 4 euro - unless we reached the timeout date for invoices (end of month + 15 days - 5 days margin) OR + 15 day offset
     const invoiceLimit = STAMHOOFD.environment === 'development' ? 0 : 4_0000;
@@ -147,7 +149,7 @@ async function createInvoicesFor(organization: Organization) {
             template: {
                 type: EmailTemplateType.InvoiceGenerationErrors,
             },
-            recipients: await organization.getAdminRecipients(),
+            recipients: await OrganizationAdminService.getAdminRecipients(organization),
             type: 'transactional',
             fromStamhoofd: true,
             defaultReplacements: [

package/src/email-recipient-loaders/orders.ts

@@ -1,4 +1,5 @@
-import { Email, runWithRecipientLocale, Webshop } from '@stamhoofd/models';
+import { Email, Webshop } from '@stamhoofd/models';
+import { runWithRecipientLocale } from '../helpers/EmailBuilder.js';
 import type { EmailRecipient, LimitedFilteredRequest, WebshopPreview } from '@stamhoofd/structures';
 import { mergeFilters, PaginatedResponse } from '@stamhoofd/structures';
 import { GetWebshopOrdersEndpoint } from '../endpoints/organization/dashboard/webshops/GetWebshopOrdersEndpoint.js';

package/src/email-recipient-loaders/organizations.ts

@@ -6,6 +6,7 @@ import { baseInMemoryFilterCompilers, compileToInMemoryFilter, createInMemoryFil
 import { PaginatedResponse } from '@stamhoofd/structures';
 import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
 import { GetOrganizationsEndpoint } from '../endpoints/admin/organizations/GetOrganizationsEndpoint.js';
+import { OrganizationAdminService } from '../services/OrganizationAdminService.js';
 
 function userToFilterableAdmin(user: User, platform: PlatformStruct, organization: Organization) {
     return {
@@ -49,14 +50,14 @@ async function fetchRecipients(query: LimitedFilteredRequest, subfilter: Stamhoo
     const recipients: EmailRecipient[] = [];
     for (const organization of result.results) {
         // todo: filter admins
-        const users = await organization.getAdmins();
+        const users = await OrganizationAdminService.getAdmins(organization);
         const filteredUsers = users.filter((user) => {
             const filterable = userToFilterableAdmin(user, platform, organization);
             return compiledFilter(filterable);
         });
 
         recipients.push(
-            ...organization.adminsToRecipients(filteredUsers).map((r) => {
+            ...OrganizationAdminService.adminsToRecipients(filteredUsers).map((r) => {
                 return EmailRecipient.create({
                     ...r,
                     replacements: [

package/src/endpoints/auth/ConfirmTOTPEndpoint.ts

@@ -0,0 +1,84 @@
+import type { Decoder } from '@simonbackx/simple-encoding';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { MFATOTP } from '@stamhoofd/models';
+import type { MFAEnrollmentResult } from '@stamhoofd/structures';
+import { MFAMethodType, TOTPConfirmRequest } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { TOTPHelper } from '../../helpers/TOTPHelper.js';
+import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
+import { TwoFactorAuditLogService } from '../../services/TwoFactorAuditLogService.js';
+
+type Params = { id: string };
+type Query = undefined;
+type Body = TOTPConfirmRequest;
+type ResponseBody = MFAEnrollmentResult;
+
+/**
+ * Confirm a pending TOTP authenticator by verifying the first code. On the user's first
+ * factor this also returns recovery codes, and during forced enrollment it issues a
+ * full session token.
+ */
+export class ConfirmTOTPEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    bodyDecoder = TOTPConfirmRequest as Decoder<TOTPConfirmRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa/totp/@id/confirm', { id: String });
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope();
+        const { user, setupToken, token } = await Context.authenticateMFAEnrollment();
+
+        const totp = await MFATOTP.getByID(request.params.id);
+        if (!totp || totp.userId !== user.id) {
+            throw new SimpleError({
+                code: 'not_found',
+                message: 'TOTP authenticator not found',
+                human: $t('%ZgJ'),
+                statusCode: 404,
+            });
+        }
+
+        if (totp.confirmedAt) {
+            throw new SimpleError({
+                code: 'already_confirmed',
+                message: 'This authenticator is already confirmed',
+                human: $t('%ZgM'),
+                statusCode: 400,
+            });
+        }
+
+        const counter = TOTPHelper.verify(request.body.code, totp.secret);
+        if (counter === null) {
+            throw new SimpleError({
+                code: 'invalid_mfa_code',
+                message: 'Invalid code',
+                human: $t('%Zgp'),
+                field: 'code',
+                statusCode: 400,
+            });
+        }
+
+        const wasFirstFactor = !(await TwoFactorHelper.userHasFactors(user.id));
+
+        totp.confirmedAt = new Date();
+        totp.name = request.body.name.trim() || $t('%ZiG');
+        // Record the counter so the confirmation code can't be replayed as a login code.
+        totp.lastUsedCounter = counter;
+        await totp.save();
+
+        await TwoFactorAuditLogService.logMethodAdded(user, MFAMethodType.TOTP, totp.name);
+
+        return new Response(await TwoFactorHelper.completeEnrollment(user, setupToken, wasFirstFactor, token));
+    }
+}

package/src/endpoints/auth/CreateAdminEndpoint.ts

@@ -2,7 +2,8 @@ import type { Decoder } from '@simonbackx/simple-encoding';
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { Platform, sendEmailTemplate, User } from '@stamhoofd/models';
+import { Platform, User } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../../helpers/EmailBuilder.js';
 import type { UserWithMembers } from '@stamhoofd/structures';
 import { EmailTemplateType, Recipient, Replacement, UserPermissions, User as UserStruct } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';

package/src/endpoints/auth/CreateTokenEndpoint.test.ts

@@ -1,5 +1,5 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { OrganizationFactory, Token, User, UserFactory } from '@stamhoofd/models';
 import { Token as TokenStruct } from '@stamhoofd/structures';
 
 import { testServer } from '../../../tests/helpers/TestServer.js';
@@ -65,4 +65,64 @@ describe('Endpoint.CreateToken', () => {
         const byRefresh = await Token.getByRefreshToken(response.body.refreshToken);
         expect(byRefresh).toBeDefined();
     });
+
+    describe('last activity', () => {
+        const password = 'test-password-1234';
+
+        async function getLastActiveAt(user: User): Promise<Date | null> {
+            const updated = await User.getByID(user.id);
+            return updated!.lastActiveAt;
+        }
+
+        test('a password login marks the user as active', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ organization, password }).create();
+            expect(user.lastActiveAt).toBeNull();
+
+            const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'password',
+                username: user.email,
+                password,
+            });
+            await testServer.test(endpoint, r);
+
+            const lastActiveAt = await getLastActiveAt(user);
+            expect(lastActiveAt).not.toBeNull();
+            expect(lastActiveAt!.getTime()).toBeGreaterThan(Date.now() - 60 * 1000);
+        });
+
+        test('refreshing a token marks the user as active again', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ organization, password }).create();
+            const token = await Token.createToken(user);
+
+            const monthsAgo = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000);
+            monthsAgo.setMilliseconds(0);
+            user.lastActiveAt = monthsAgo;
+            await user.save();
+
+            const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'refresh_token',
+                refresh_token: token.refreshToken,
+            });
+            await testServer.test(endpoint, r);
+
+            const lastActiveAt = await getLastActiveAt(user);
+            expect(lastActiveAt!.getTime()).toBeGreaterThan(Date.now() - 60 * 1000);
+        });
+
+        test('a failed login does not mark the user as active', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ organization, password }).create();
+
+            const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'password',
+                username: user.email,
+                password: 'wrong-password',
+            });
+            await expect(testServer.test(endpoint, r)).rejects.toThrow();
+
+            expect(await getLastActiveAt(user)).toBeNull();
+        });
+    });
 });

package/src/endpoints/auth/CreateTokenEndpoint.ts

@@ -1,16 +1,20 @@
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { EmailVerificationCode, PasswordToken, Platform, Token, User } from '@stamhoofd/models';
-import type { ChallengeGrantStruct, PasswordGrantStruct, PasswordTokenGrantStruct, RefreshTokenGrantStruct, RequestChallengeGrantStruct } from '@stamhoofd/structures';
-import { CreateTokenStruct, LoginMethod, SignupResponse, Token as TokenStruct } from '@stamhoofd/structures';
+import { EmailVerificationCode, MFATOTP, MFAToken, PasswordToken, Platform, Token, User, WebauthnCredential } from '@stamhoofd/models';
+import type { ChallengeGrantStruct, MFAGrantStruct, PasswordGrantStruct, PasswordTokenGrantStruct, RefreshTokenGrantStruct, RequestChallengeGrantStruct } from '@stamhoofd/structures';
+import { CreateTokenStruct, LoginMethod, MFAMethodType, SignupResponse, Token as TokenStruct } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context.js';
+import { RecoveryCodeHelper } from '../../helpers/RecoveryCodeHelper.js';
+import { TOTPHelper } from '../../helpers/TOTPHelper.js';
+import { mfaVerificationRateLimiter, TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
+import { WebauthnHelper } from '../../helpers/WebauthnHelper.js';
 import { VerificationCodeService } from '../../services/VerificationCodeService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
-type Body = RequestChallengeGrantStruct | ChallengeGrantStruct | RefreshTokenGrantStruct | PasswordTokenGrantStruct | PasswordGrantStruct;
+type Body = RequestChallengeGrantStruct | ChallengeGrantStruct | RefreshTokenGrantStruct | PasswordTokenGrantStruct | PasswordGrantStruct | MFAGrantStruct;
 type ResponseBody = TokenStruct;
 
 export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
@@ -82,6 +86,8 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     });
                 }
 
+                await oldToken.user.markActive();
+
                 const st = new TokenStruct(token);
                 return new Response(st);
             }
@@ -141,7 +147,12 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     });
                 }
 
-                const token = await Token.createToken(user);
+                // Second factor / forced enrollment: block the session until the user
+                // completes (or first sets up) a second factor. Shared with every other
+                // grant that mints a session from a single primary credential.
+                await TwoFactorHelper.assertSecondFactorOrThrow(user, organization, request.request.getVersion());
+
+                const token = await Token.createToken(user, new Date());
 
                 if (!token) {
                     throw new SimpleError({
@@ -152,6 +163,110 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     });
                 }
 
+                await user.markActive();
+
+                const st = new TokenStruct(token);
+                return new Response(st);
+            }
+
+            case 'mfa': {
+                const mfaToken = await MFAToken.getValid(request.body.mfaToken, 'login');
+                if (!mfaToken) {
+                    throw new SimpleError({
+                        code: 'invalid_mfa_token',
+                        message: 'The MFA session is invalid or expired',
+                        human: $t('%ZhJ'),
+                        statusCode: 400,
+                    });
+                }
+
+                const user = await User.getByID(mfaToken.userId);
+                if (!user) {
+                    await mfaToken.consume();
+                    throw new SimpleError({
+                        code: 'invalid_mfa_token',
+                        message: 'The MFA session is invalid or expired',
+                        human: $t('%ZhJ'),
+                        statusCode: 400,
+                    });
+                }
+
+                // Scope check (same rules as refresh/password_token)
+                if ((organization && user.organizationId && user.organizationId !== organization.id) || (!organization && user.organizationId)) {
+                    throw new SimpleError({
+                        code: 'invalid_mfa_token',
+                        message: 'The MFA session is invalid or expired',
+                        human: $t('%ZhJ'),
+                        statusCode: 400,
+                    });
+                }
+
+                // Aggregate brute-force protection across ALL of this user's MFA tokens
+                // (the per-token counter alone can be bypassed by minting new tokens).
+                // This MUST run before verification so that, once the limit is hit, even a
+                // correct code is rejected — otherwise a lucky/leaked code would still let
+                // an attacker through after unlimited guesses.
+                mfaVerificationRateLimiter.track(user.id);
+
+                let verified = false;
+                if (request.body.method === MFAMethodType.TOTP) {
+                    const code = request.body.code ?? '';
+                    for (const totp of await MFATOTP.getConfirmedForUser(user.id)) {
+                        const counter = TOTPHelper.verify(code, totp.secret);
+                        if (counter === null) {
+                            continue;
+                        }
+                        // Claiming the step counter both rejects a still-valid code that was
+                        // accepted before (replay) and settles two requests that submit the
+                        // same code at the same time: only one of them gets the claim.
+                        if (await totp.claimCounter(counter)) {
+                            verified = true;
+                            break;
+                        }
+                    }
+                } else if (request.body.method === MFAMethodType.RecoveryCode) {
+                    verified = await RecoveryCodeHelper.consume(user.id, request.body.code ?? '');
+                } else if (request.body.method === MFAMethodType.Passkey) {
+                    const assertion = request.body.assertion;
+                    const credentialId = assertion?.id;
+                    if (mfaToken.webauthnChallenge && assertion && credentialId) {
+                        const credential = await WebauthnCredential.getByCredentialId(credentialId);
+                        if (credential && credential.userId === user.id) {
+                            const newCounter = await WebauthnHelper.verifyAuthentication(assertion, mfaToken.webauthnChallenge, credential);
+                            if (newCounter !== null) {
+                                credential.counter = newCounter;
+                                credential.lastUsedAt = new Date();
+                                await credential.save();
+                                verified = true;
+                            }
+                        }
+                    }
+                }
+
+                if (!verified) {
+                    const locked = await mfaToken.registerFailedAttempt();
+                    throw new SimpleError({
+                        code: locked ? 'too_many_attempts' : 'invalid_mfa_code',
+                        message: locked ? 'Too many attempts' : 'Invalid code',
+                        human: locked ? $t('%ZhT') : $t('%Zgp'),
+                        statusCode: locked ? 429 : 400,
+                        field: 'code',
+                    });
+                }
+
+                if (!await mfaToken.consume()) {
+                    // Another request already completed this challenge.
+                    throw new SimpleError({
+                        code: 'invalid_mfa_token',
+                        message: 'The MFA session is invalid or expired',
+                        human: $t('%ZhJ'),
+                        statusCode: 400,
+                    });
+                }
+
+                const token = await Token.createToken(user, new Date());
+                await user.markActive();
+
                 const st = new TokenStruct(token);
                 return new Response(st);
             }
@@ -188,8 +303,18 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     });
                 }
 
+                // A valid password-reset/magic-link token is a single primary credential:
+                // enforce the same second-factor gate as the password grant, otherwise
+                // anyone with a reset link (i.e. email access) could bypass the user's 2FA
+                // and even wipe their factors with the resulting fresh session.
+                //
+                // Forced enrollment (the user has no factor yet) additionally returns a
+                // temporary session token: this flow is also used to choose a first
+                // password (invites), which the client can only do with a session.
+                await TwoFactorHelper.assertSecondFactorOrThrow(passwordToken.user, organization, request.request.getVersion(), { allowTemporarySession: true });
+
                 // Important to create a new token before adjusting the old token
-                const token = await Token.createToken(passwordToken.user);
+                const token = await Token.createToken(passwordToken.user, new Date());
 
                 // TODO: make token short lived until renewal
 
@@ -211,6 +336,8 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     await token.user.save();
                 }
 
+                await token.user.markActive();
+
                 const st = new TokenStruct(token);
                 return new Response(st);
             }

package/src/endpoints/auth/DeletePasskeyEndpoint.ts

@@ -0,0 +1,61 @@
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { MFATOTP, WebauthnCredential } from '@stamhoofd/models';
+import type { MFAStatus } from '@stamhoofd/structures';
+import { MFAMethodType } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
+import { TwoFactorAuditLogService } from '../../services/TwoFactorAuditLogService.js';
+
+type Params = { id: string };
+type Query = undefined;
+type Body = undefined;
+type ResponseBody = MFAStatus;
+
+export class DeletePasskeyEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'DELETE') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa/passkeys/@id', { id: String });
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        const organization = await Context.setOptionalOrganizationScope();
+        const { user, token } = await Context.authenticateFresh({ allowWithoutAccount: true, allowUnscoped: true });
+
+        const credential = await WebauthnCredential.getByID(request.params.id);
+        if (!credential || credential.userId !== user.id) {
+            throw new SimpleError({
+                code: 'not_found',
+                message: 'Passkey not found',
+                human: $t('%Zho'),
+                statusCode: 404,
+            });
+        }
+
+        const confirmedTotp = await MFATOTP.getConfirmedForUser(user.id);
+        const passkeys = await WebauthnCredential.getForUser(user.id);
+        const remaining = confirmedTotp.length + passkeys.filter(p => p.id !== credential.id).length;
+        if (remaining === 0 && await TwoFactorHelper.isTwoFactorRequired(user, organization ?? Context.organization ?? null)) {
+            throw new SimpleError({
+                code: 'cannot_remove_last_factor',
+                message: 'Cannot remove the last two-factor method',
+                human: $t('%Zh4'),
+                statusCode: 400,
+            });
+        }
+
+        await credential.delete();
+
+        await TwoFactorAuditLogService.logMethodDeleted(user, MFAMethodType.Passkey, credential.name || credential.providerName || '');
+
+        return new Response(await TwoFactorHelper.completeRemoval(user, token));
+    }
+}