@stamhoofd/backend 2.137.5 → 2.138.1

package/src/middleware/TenantScopeMiddleware.test.ts

@@ -0,0 +1,41 @@
+import type { DecodedRequest } from '@simonbackx/simple-endpoints';
+import { Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
+import { ROOT_TENANT_ID } from '@stamhoofd/models';
+import { testServer } from '../../tests/helpers/TestServer.js';
+import { TenantContext } from '../helpers/TenantContext.js';
+
+type Params = Record<string, never>;
+
+/**
+ * Reports the tenant scope it was reached in, so a request can assert what the middleware set up.
+ */
+class TenantProbeEndpoint extends Endpoint<Params, undefined, undefined, string> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'GET' || request.url !== '/tenant-probe') {
+            return [false];
+        }
+        return [true, {}];
+    }
+
+    async handle(_request: DecodedRequest<Params, undefined, undefined>) {
+        return new Response(TenantContext.optional?.tenantId ?? 'no-tenant');
+    }
+}
+
+describe('TenantScopeMiddleware', () => {
+    test('a request runs in a tenant scope', async () => {
+        const endpoint = new TenantProbeEndpoint();
+
+        const response = await testServer.test(endpoint, Request.buildJson('GET', '/tenant-probe', 'localhost'));
+
+        expect(response.body).toBe(ROOT_TENANT_ID);
+    });
+
+    test('the scope does not outlive the request', async () => {
+        const endpoint = new TenantProbeEndpoint();
+
+        await testServer.test(endpoint, Request.buildJson('GET', '/tenant-probe', 'localhost'));
+
+        expect(TenantContext.optional).toBeNull();
+    });
+});

package/src/middleware/TenantScopeMiddleware.ts

@@ -0,0 +1,24 @@
+import type { Request, RequestMiddleware } from '@simonbackx/simple-endpoints';
+import { ROOT_TENANT_ID } from '@stamhoofd/models';
+
+import { TenantContext } from '../helpers/TenantContext.js';
+
+/**
+ * Puts every request in a tenant scope.
+ *
+ * Every request resolves to the deployment's root tenant for now. Resolving it from the host is a
+ * later step; this exists so the scope is already there when it starts to matter.
+ *
+ * Register this *after* ContextMiddleware: wrapRun wrappers are applied in registration order, so
+ * the last one registered is the outermost. The tenant has to be in scope before the context that
+ * reads it.
+ */
+export const TenantScopeMiddleware: RequestMiddleware = {
+    wrapRun<T>(run: () => Promise<T>, _request: Request) {
+        return TenantContext.run(ROOT_TENANT_ID, run);
+    },
+
+    handleRequest() {
+        // Noop
+    },
+};

package/src/seeds/1785417302-fill-user-last-active-at.sql

@@ -0,0 +1,6 @@
+UPDATE `users` u
+SET u.lastActiveAt = (
+    SELECT MAX(t.updatedAt)
+    FROM tokens t
+    WHERE t.userId = u.id
+);

package/src/services/AdminSessionService.ts

@@ -0,0 +1,41 @@
+import { Token, User } from '@stamhoofd/models';
+
+/**
+ * Signs out administrators in bulk.
+ *
+ * Making two-factor authentication required only affects new logins: it is evaluated when a
+ * session is created, so admins that are already signed in keep their session and never get
+ * asked to enroll. An administrator can therefore ask us to end those sessions, which forces
+ * every other admin through the login flow again — and with that through the forced
+ * enrollment.
+ *
+ * API users are never signed out: their tokens are machine credentials with a long lifetime
+ * that cannot complete an interactive login. User.getAdmins()/getPlatformAdmins() already
+ * leave them out.
+ */
+export class AdminSessionService {
+    /**
+     * Sign out every administrator of an organization.
+     *
+     * `keepAccessToken` is the session of the administrator making the request: signing
+     * themselves out would interrupt what they are doing, and they are forced to enroll on
+     * their next login anyway.
+     *
+     * Returns the number of ended sessions.
+     */
+    static async signOutOrganizationAdmins(organizationId: string, keepAccessToken: string | null): Promise<number> {
+        const admins = await User.getAdmins(organizationId);
+        return await Token.deleteForUsers(admins.map(a => a.id), keepAccessToken);
+    }
+
+    /**
+     * Sign out every administrator of the platform. Administrators that only have
+     * permissions within an organization are not affected.
+     *
+     * Returns the number of ended sessions.
+     */
+    static async signOutPlatformAdmins(keepAccessToken: string | null): Promise<number> {
+        const admins = await User.getPlatformAdmins();
+        return await Token.deleteForUsers(admins.map(a => a.id), keepAccessToken);
+    }
+}

package/src/services/EmailPreviewService.ts

@@ -1,7 +1,7 @@
 import { I18n } from '@stamhoofd/backend-i18n/I18n';
 import type { Email } from '@stamhoofd/models';
 import { EmailRecipient, Organization, User } from '@stamhoofd/models';
-import { fillRecipientReplacements, mergeReplacementsIfEqual, removeUnusedReplacements, runWithRecipientLocale, stripRecipientReplacementsForWebDisplay, stripSensitiveRecipientReplacements } from '@stamhoofd/models/helpers/EmailBuilder.js';
+import { fillRecipientReplacements, mergeReplacementsIfEqual, removeUnusedReplacements, runWithRecipientLocale, stripRecipientReplacementsForWebDisplay, stripSensitiveRecipientReplacements } from '../helpers/EmailBuilder.js';
 import type { BaseOrganization, EmailRecipient as EmailRecipientStruct, Replacement, User as UserStruct } from '@stamhoofd/structures';
 import { EmailPreview, EmailRecipientFilter, EmailWithRecipients, getExampleRecipient } from '@stamhoofd/structures';
 import { ExampleReplacements } from '@stamhoofd/structures/email/exampleReplacements.js';