@stamhoofd/backend 2.137.5 → 2.138.1

package/src/services/EventNotificationService.ts

@@ -1,5 +1,6 @@
 import { SimpleError } from '@simonbackx/simple-errors';
-import { EventNotification, Member, MemberResponsibilityRecord, Organization, Platform, sendEmailTemplate, User } from '@stamhoofd/models';
+import { EventNotification, Member, MemberResponsibilityRecord, Organization, Platform, User } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 import type { EmailTemplateType } from '@stamhoofd/structures';
 import { PermissionLevel, Recipient, RecordCategory, Replacement } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';

package/src/services/InvoicePdfService.ts

@@ -295,7 +295,7 @@ export class InvoicePdfService {
                     throw new SimpleError({
                         code: 'pdf_creation_timeout',
                         message: 'Failed to generate invoice PDF',
-                        human: $t('Er ging iets mis bij het aanmaken van de factuur'),
+                        human: $t('%ZgV'),
                     });
                 }
             }
@@ -306,13 +306,13 @@ export class InvoicePdfService {
                 throw new SimpleError({
                     code: 'pdf_creation_timeout',
                     message: 'Failed to generate invoice PDF: timeout',
-                    human: $t('Er ging iets mis bij het aanmaken van de factuur'),
+                    human: $t('%ZgV'),
                 });
             }
             throw new SimpleError({
                 code: 'pdf_creation_failed',
                 message: 'Failed to generate invoice PDF',
-                human: $t('Er ging iets mis bij het aanmaken van de factuur'),
+                human: $t('%ZgV'),
             });
         } finally {
             clearTimeout(timeout);

package/src/services/InvoiceService.ts

@@ -1,6 +1,7 @@
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Email } from '@stamhoofd/email';
-import { BalanceItem, Invoice, InvoicedBalanceItem, Organization, Payment, sendEmailTemplate } from '@stamhoofd/models';
+import { BalanceItem, Invoice, InvoicedBalanceItem, Organization, Payment } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 import { InvoiceCounter } from '@stamhoofd/models/helpers/InvoiceCounter.js';
 import type { Invoice as InvoiceStruct } from '@stamhoofd/structures';
 import { EmailTemplateType, PaymentStatus, Recipient, Replacement } from '@stamhoofd/structures';
@@ -9,6 +10,7 @@ import { ViesHelper } from '../helpers/ViesHelper.js';
 import { BalanceItemService } from './BalanceItemService.js';
 import { InvoicePdfService } from './InvoicePdfService.js';
 import { InvoiceXMlService } from './InvoiceXMLService.js';
+import { OrganizationAdminService } from './OrganizationAdminService.js';
 
 export class InvoiceService {
     static async createFrom(organization: Organization, struct: InvoiceStruct, options?: { payments?: Payment[]; balanceItems?: BalanceItem[] }) {
@@ -435,7 +437,7 @@ export class InvoiceService {
         if (!email && invoice.payingOrganizationId) {
             const payingOrganization = await Organization.getByID(invoice.payingOrganizationId);
             if (payingOrganization) {
-                email = (await payingOrganization.getInvoicingToEmail()) ?? undefined;
+                email = (await OrganizationAdminService.getInvoicingToEmail(payingOrganization)) ?? undefined;
             }
         }
 

package/src/services/InvoiceXMLService.ts

@@ -7,6 +7,7 @@ import { Country } from '@stamhoofd/types/Country';
 import { Formatter, STMath } from '@stamhoofd/utility';
 import { v4 as uuidv4 } from 'uuid';
 import { InvoicePdfService } from './InvoicePdfService.js';
+import { OrganizationAdminService } from './OrganizationAdminService.js';
 
 export class InvoiceXMlService {
     static async buildXml(invoice: Invoice) {
@@ -68,7 +69,7 @@ export class InvoiceXMlService {
         if (!customerEmail && invoice.payingOrganizationId) {
             const payingOrganization = await Organization.getByID(invoice.payingOrganizationId);
             if (payingOrganization) {
-                customerEmail = (await payingOrganization.getInvoicingToEmail()) ?? null;
+                customerEmail = (await OrganizationAdminService.getInvoicingToEmail(payingOrganization)) ?? null;
             }
         }
 

package/src/services/OrderService.ts

@@ -1,6 +1,7 @@
 import { I18n } from '@stamhoofd/backend-i18n';
 import type { Organization, Payment, Ticket } from '@stamhoofd/models';
-import { Order, sendEmailTemplate, Webshop, WebshopCounter } from '@stamhoofd/models';
+import { Order, Webshop, WebshopCounter } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 import { EmailTemplateType, OrderStatus, PaymentMethod, Recipient, Replacement, WebshopPreview, WebshopStatus, WebshopTicketType } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 

package/src/services/OrganizationAdminService.test.ts

@@ -0,0 +1,47 @@
+import { AccessRight, PermissionLevel, PermissionRoleDetailed, Permissions } from '@stamhoofd/structures';
+import { OrganizationFactory, UserFactory } from '@stamhoofd/models';
+import { OrganizationAdminService } from './OrganizationAdminService.js';
+
+describe('Organization admin recipients', () => {
+    async function createOrganizationWithAdmins() {
+        const financeRole = PermissionRoleDetailed.create({
+            name: 'financial director',
+            accessRights: [AccessRight.OrganizationFinanceDirector],
+        });
+
+        const organization = await new OrganizationFactory({ roles: [financeRole] }).create();
+
+        const fullAdmin = await new UserFactory({
+            organization,
+            email: 'full-admin@example.com',
+            permissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+
+        const financeAdmin = await new UserFactory({
+            organization,
+            email: 'finance-admin@example.com',
+            permissions: Permissions.create({
+                level: PermissionLevel.None,
+                roles: [financeRole],
+            }),
+        }).create();
+
+        return { organization, fullAdmin, financeAdmin };
+    }
+
+    test('The finance admin recipients include a financial director without full access', async () => {
+        const { organization, fullAdmin, financeAdmin } = await createOrganizationWithAdmins();
+
+        const emails = (await OrganizationAdminService.getFinanceAdminRecipients(organization)).map(r => r.email);
+
+        expect(emails).toIncludeSameMembers([fullAdmin.email, financeAdmin.email]);
+    });
+
+    test('The regular admin recipients only include full admins', async () => {
+        const { organization, fullAdmin } = await createOrganizationWithAdmins();
+
+        const emails = (await OrganizationAdminService.getAdminRecipients(organization)).map(r => r.email);
+
+        expect(emails).toIncludeSameMembers([fullAdmin.email]);
+    });
+});

package/src/services/OrganizationAdminService.ts

@@ -0,0 +1,139 @@
+import type { Organization } from '@stamhoofd/models';
+import { Platform, Token, User } from '@stamhoofd/models';
+import type { EmailInterfaceRecipient } from '@stamhoofd/email';
+import type { OrganizationEmail } from '@stamhoofd/structures';
+import { AccessRight, Recipient } from '@stamhoofd/structures';
+import { Sorter } from '@stamhoofd/utility';
+
+/**
+ * Resolves which administrators of an organization should receive a given kind of email.
+ */
+export class OrganizationAdminService {
+    /**
+     * E-mail address when we receive replies for organization@stamhoofd.email.
+     * Note that this sould be private because it can contain personal e-mail addresses if the organization is not configured correctly
+     */
+    static async getReplyEmails(organization: Organization): Promise<EmailInterfaceRecipient[]> {
+        const sender: OrganizationEmail | undefined = organization.privateMeta.emails.find(e => e.default) ?? organization.privateMeta.emails[0];
+
+        if (sender) {
+            return [
+                {
+                    name: sender.name,
+                    email: sender.email,
+                },
+            ];
+        }
+
+        return await this.getAdminToEmails(organization);
+    }
+
+    static async getAdmins(organization: Organization) {
+        return await User.getAdmins(organization.id, { verified: true });
+    }
+
+    /**
+     * These email addresess are private
+     */
+    static async getFullAdmins(organization: Organization) {
+        const admins = await this.getAdmins(organization);
+        const platform = await Platform.getSharedStruct();
+
+        // Only full access
+        return admins.filter(a => a.permissions && a.permissions.forOrganization(organization, platform, { inheritFromPlatform: false })?.hasFullAccess());
+    }
+
+    /**
+     * These email addresess are private
+     */
+    static async getFinanceAdmins(organization: Organization) {
+        const admins = await this.getAdmins(organization);
+        const platform = await Platform.getSharedStruct();
+        const filtered = admins.filter(a => a.permissions && (a.permissions.forOrganization(organization, platform, { inheritFromPlatform: false })?.hasFullAccess() || a.permissions.forOrganization(organization, platform, { inheritFromPlatform: false })?.hasAccessRight(AccessRight.OrganizationFinanceDirector)));
+
+        // Only full access
+        return filtered;
+    }
+
+    /**
+     * These email addresess are private
+     */
+    static async getAdminToEmails(organization: Organization): Promise<EmailInterfaceRecipient[]> {
+        const filtered = await this.getFullAdmins(organization);
+
+        if (STAMHOOFD.environment === 'production') {
+            if (filtered.length > 1) {
+                // remove stamhoofd email addresses
+                const f = filtered.flatMap(f => f.getEmailTo()).filter(e => !e.email.endsWith('@stamhoofd.be') && !e.email.endsWith('@stamhoofd.nl'));
+                if (f.length > 0) {
+                    return f;
+                }
+            }
+        }
+
+        return filtered.flatMap(f => f.getEmailTo());
+    }
+
+    static adminsToRecipients(admins: User[]) {
+        return admins.flatMap((f) => {
+            return Recipient.create({
+                firstName: f.firstName,
+                lastName: f.lastName,
+                email: f.email,
+                replacements: [],
+            });
+        });
+    }
+
+    /**
+     * These email addresess are private
+     */
+    static async getAdminRecipients(organization: Organization): Promise<Recipient[]> {
+        const filtered = await this.getFullAdmins(organization);
+        return this.adminsToRecipients(filtered);
+    }
+
+    /**
+     * These email addresess are private
+     */
+    static async getFinanceAdminRecipients(organization: Organization): Promise<Recipient[]> {
+        const filtered = await this.getFinanceAdmins(organization);
+        return this.adminsToRecipients(filtered);
+    }
+
+    /**
+     * Returns one email for invoices. since in ubl we can only add one address.
+     * We choose the oldest user that was active in the last 3 months (otherwise the oldest user if noone was active)
+     */
+    static async getInvoicingToEmail(organization: Organization): Promise<string | undefined> {
+        const admins = await this.getAdmins(organization);
+
+        const tokens = await Token.select().where('userId', admins.map(a => a.id)).fetch();
+
+        // Sort by admins that were active in the last 3 months, then creation date
+        const cutoffDate = new Date(Date.now() - 1000 * 60 * 60 * 24 * 31 * 3);
+        admins.sort((a, b) => {
+            const aTokens = tokens.filter(t => t.userId === a.id);
+            const bTokens = tokens.filter(t => t.userId === b.id);
+            const aActive = !!aTokens.find(t => t.updatedAt > cutoffDate);
+            const bActive = !!bTokens.find(t => t.updatedAt > cutoffDate);
+            return Sorter.stack(
+                Sorter.byBooleanValue(aActive, bActive),
+                Sorter.byDateValue(b.createdAt, a.createdAt),
+            );
+        });
+
+        const platform = await Platform.getSharedStruct();
+        const filtered = admins.filter(a => a.verified && a.permissions && !a.email.endsWith('@stamhoofd.be') && (a.permissions.forOrganization(organization, platform, { inheritFromPlatform: false })?.hasFullAccess() || a.permissions.forOrganization(organization, platform, { inheritFromPlatform: false })?.hasAccessRight(AccessRight.OrganizationFinanceDirector)));
+
+        if (filtered.length > 0) {
+            return filtered.map(f => f.email)[0];
+        }
+        const filtered2 = admins.filter(a => a.verified && a.permissions && (a.permissions.forOrganization(organization, platform, { inheritFromPlatform: false })?.hasFullAccess() || a.permissions.forOrganization(organization, platform, { inheritFromPlatform: false })?.hasAccessRight(AccessRight.OrganizationFinanceDirector)));
+
+        if (filtered2.length > 0) {
+            return filtered2.map(f => f.email)[0];
+        }
+        return undefined;
+    }
+}

package/src/services/OrganizationEmailService.ts

@@ -1,9 +1,10 @@
 import { I18n } from '@stamhoofd/backend-i18n';
 import type { Organization } from '@stamhoofd/models';
-import { sendEmailTemplate } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 import { EmailTemplateType, Replacement, STPackageType } from '@stamhoofd/structures';
 import { Country } from '@stamhoofd/types/Country';
 import { Language } from '@stamhoofd/types/Language';
+import { OrganizationAdminService } from './OrganizationAdminService.js';
 
 export class OrganizationEmailService {
     static async sendEmailTemplate(organization: Organization, data: {
@@ -11,7 +12,7 @@ export class OrganizationEmailService {
         personal?: boolean;
         bcc?: boolean;
     }) {
-        const recipients = await organization.getAdminRecipients();
+        const recipients = await OrganizationAdminService.getAdminRecipients(organization);
         const defaultI18n = new I18n(Language.Dutch, Country.Belgium);
         const i18n = organization.i18n;
 

package/src/services/PaymentService.ts

@@ -1,6 +1,7 @@
 import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
 import type { Member, User } from '@stamhoofd/models';
-import { BalanceItem, BalanceItemPayment, Group, MolliePayment, Organization, PayconiqPayment, Payment, Platform, sendEmailTemplate, UsedRegisterCode } from '@stamhoofd/models';
+import { BalanceItem, BalanceItemPayment, Group, MolliePayment, Organization, PayconiqPayment, Payment, Platform, UsedRegisterCode } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 import { QueueHandler } from '@stamhoofd/queues';
 import type { Checkoutable, PaymentConfiguration, PrivatePaymentConfiguration } from '@stamhoofd/structures';
 import { AuditLogSource, BalanceItemPaymentDetailed, BalanceItemType, EmailTemplateType, Invoice, PaymentCustomer, PaymentGeneral, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, PaymentType, Recipient, Replacement, VATExcemptReason, Version } from '@stamhoofd/structures';
@@ -22,6 +23,7 @@ import { PaymentMandateService } from './PaymentMandateService.js';
 import { ReferralService } from './ReferralService.js';
 import { VATService } from './VATService.js';
 import { STPackageService } from './STPackageService.js';
+import { OrganizationAdminService } from './OrganizationAdminService.js';
 
 export class PaymentService {
     static async updateReversedPaymentsFor(payment: Payment) {
@@ -237,7 +239,7 @@ export class PaymentService {
         const payingOrganization = await Organization.getByID(payment.payingOrganizationId, true);
 
         await sendEmailTemplate(organization, {
-            recipients: await payingOrganization.getFinanceAdminRecipients(),
+            recipients: await OrganizationAdminService.getFinanceAdminRecipients(payingOrganization),
             defaultReplacements: [
                 Replacement.create({
                     token: 'payingOrganizationName',
@@ -274,7 +276,7 @@ export class PaymentService {
         const payingOrganization = await Organization.getByID(payment.payingOrganizationId, true);
 
         await sendEmailTemplate(organization, {
-            recipients: await payingOrganization.getFinanceAdminRecipients(),
+            recipients: await OrganizationAdminService.getFinanceAdminRecipients(payingOrganization),
             defaultReplacements: [
                 Replacement.create({
                     token: 'payingOrganizationName',

package/src/services/ReferralService.ts

@@ -6,6 +6,7 @@ import { BalanceItem, Organization, Platform, RegisterCode, UsedRegisterCode } f
 import { BalanceItemStatus, BalanceItemType } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { VATService } from './VATService.js';
+import { OrganizationAdminService } from './OrganizationAdminService.js';
 
 export class ReferralService {
     /**
@@ -76,7 +77,7 @@ export class ReferralService {
         }
 
         if (otherOrganization) {
-            const admins = await otherOrganization.getAdminToEmails();
+            const admins = await OrganizationAdminService.getAdminToEmails(otherOrganization);
             if (admins) {
                 if (code.invoiceValue) {
                     // Delay email until everything is validated and saved
@@ -196,7 +197,7 @@ export class ReferralService {
             await item.save();
         }
 
-        const admins = await receivingOrganization.getAdminRecipients();
+        const admins = await OrganizationAdminService.getAdminRecipients(receivingOrganization);
         if (admins) {
             if (code.invoiceValue) {
                 Email.send({

package/src/services/RegistrationService.ts

@@ -1,6 +1,7 @@
 import { ManyToOneRelation } from '@simonbackx/simple-database';
 import { encodeObject } from '@simonbackx/simple-encoding';
-import { BalanceItem, Document, Group, Member, Organization, Platform, Registration, RegistrationInvitation, sendEmailTemplate } from '@stamhoofd/models';
+import { BalanceItem, Document, Group, Member, Organization, Platform, Registration, RegistrationInvitation } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 import { QueueHandler } from '@stamhoofd/queues';
 import { AppliedRegistrationDiscount, AuditLogSource, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, EmailTemplateType, getAppHost, GroupType, Recipient, Replacement, StockReservation, Version } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';

package/src/services/SSOService.ts

@@ -10,6 +10,7 @@ import { Context } from '../helpers/Context.js';
 
 import type { ObjectWithHeaders } from '../helpers/CookieHelper.js';
 import { CookieHelper } from '../helpers/CookieHelper.js';
+import { TwoFactorHelper } from '../helpers/TwoFactorHelper.js';
 
 async function randomBytes(size: number): Promise<Buffer> {
     return new Promise((resolve, reject) => {
@@ -37,12 +38,24 @@ type SSOSessionContext = {
      * Link this method to this existing user and don't create a new token
      */
     userId?: string | null;
+
+    /**
+     * The session (access token) that has to count as freshly authenticated again once the
+     * provider confirms the identity of `userId`. Only set for a reauthentication flow.
+     */
+    reauthenticateAccessToken?: string | null;
 };
 
 export class SSOAuthToken {
     validUntil: Date;
     token: string;
     userId: string;
+
+    /**
+     * The session this token was requested with, so a reauthentication can mark it fresh
+     * again. Null for API users and other sessionless callers.
+     */
+    accessToken: string | null = null;
 }
 
 export class SSOService {
@@ -76,7 +89,7 @@ export class SSOService {
         }
     }
 
-    static async createToken() {
+    static async createToken(sessionToken: Token | null = null) {
         if (!Context.user) {
             throw new SimpleError({
                 code: 'invalid_user',
@@ -89,6 +102,7 @@ export class SSOService {
         token.validUntil = new Date(Date.now() + 1000 * 60 * 5);
         token.token = (await randomBytes(192)).toString('base64').toUpperCase();
         token.userId = Context.user.id;
+        token.accessToken = sessionToken?.accessToken ?? null;
 
         await this.clearExpiredTokensOrFromUser(token.userId);
         this.authTokens.set(token.token, token);
@@ -369,6 +383,7 @@ export class SSOService {
         }
 
         let user: User | undefined = undefined;
+        let reauthenticateAccessToken: string | null = null;
 
         if (data.authToken) {
             const token = await SSOService.validateToken(data.authToken);
@@ -384,10 +399,27 @@ export class SSOService {
                 }
 
                 this.validateEmail(user.email);
+
+                // Force reentry of login credentials (no automatic login)
+                // Sadly select_account is not reliable and sometimes works automatically
+                // since this would automatically link a possibly wrong user, we don't allow that
+                // we check this with the auth_time, so a user cannot really get around this
+                data.prompt = 'login';
+
+                if (data.reauthenticate) {
+                    if (!token.accessToken) {
+                        throw new SimpleError({
+                            code: 'invalid_token',
+                            message: 'Cannot reauthenticate without a session',
+                            statusCode: 400,
+                        });
+                    }
+                    reauthenticateAccessToken = token.accessToken;
+                }
             }
         }
 
-        return await this.startAuthCodeFlow(redirectUri, data.spaState, data.prompt, user);
+        return await this.startAuthCodeFlow(redirectUri, data.spaState, data.prompt, user, reauthenticateAccessToken);
     }
 
     validateRedirectUri(uri: string) {
@@ -422,7 +454,7 @@ export class SSOService {
         }
     }
 
-    async startAuthCodeFlow(redirectUri: string, spaState: string, prompt: string | null = null, user?: User): Promise<Response<undefined>> {
+    async startAuthCodeFlow(redirectUri: string, spaState: string, prompt: string | null = null, user?: User, reauthenticateAccessToken: string | null = null): Promise<Response<undefined>> {
         const code_verifier = generators.codeVerifier();
         const state = generators.state(); // this is the internal state backend <-> SSO provider
         const nonce = generators.nonce();
@@ -439,6 +471,7 @@ export class SSOService {
             providerType: this.provider,
             organizationId: this.organization?.id ?? null,
             userId: user?.id ?? null,
+            reauthenticateAccessToken,
         };
 
         try {
@@ -465,7 +498,8 @@ export class SSOService {
                 prompt: prompt ?? undefined,
                 login_hint: user?.email ?? undefined,
                 redirect_uri: this.externalRedirectUri,
-
+                max_age: prompt === 'login' ? 0 : undefined, // required to get auth_time in the response
+                claims: prompt === 'login' ? { id_token: { auth_time: { essential: true } } } : undefined,
                 // Google has this instead of the offline_access scope
                 access_type: this.provider === LoginProviderType.Google ? 'offline' : undefined,
             });
@@ -585,6 +619,21 @@ export class SSOServiceWithSession {
 
             this.service.validateEmail(claims.email);
 
+            if (this.session.userId) {
+                if (!claims.auth_time || claims.auth_time * 1000 < Date.now() - 1000 * 60 * 5) {
+                    if (STAMHOOFD.environment === 'development' || STAMHOOFD.environment === 'test') {
+                        // Dex does not support this (yet)
+                    } else {
+                        throw new SimpleError({
+                            code: 'invalid_user',
+                            message: 'No recent authentication',
+                            human: $t('%ZhH'),
+                            statusCode: 400,
+                        });
+                    }
+                }
+            }
+
             // Get user from database
             let user = await User.getForRegister(this.service.organization?.id ?? null, claims.email);
             if (!user) {
@@ -639,23 +688,66 @@ export class SSOServiceWithSession {
             const redirectUri = new URL(session.redirectUri);
 
             if (!this.session.userId) {
-                const token = await Token.createExpiredToken(user);
-
-                if (!token) {
+                // The identity provider authenticated the user, but that is only the first
+                // factor. A user who enrolled a second factor still has to pass it, and an
+                // account that also has a password must still enroll one when it is
+                // required — the password would otherwise stay a way in that skips
+                // whatever the provider enforces.
+                //
+                // This is a redirect, not a request/response pair, so the client gets the
+                // token of the pending step in the URL and picks the flow up from there.
+                const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, this.service.organization, { loginMethod: 'sso' });
+
+                if (requirement.type === 'challenge') {
+                    redirectUri.searchParams.set('oid_mfa', requirement.challenge.token);
+                    redirectUri.searchParams.set('s', session.spaState);
+                } else if (requirement.type === 'setup') {
+                    redirectUri.searchParams.set('oid_mfa_setup', requirement.setupToken.token);
+                    // Which methods to offer. Only a hint for the enrollment screen: the
+                    // enrollment endpoints check this themselves.
+                    redirectUri.searchParams.set('oid_mfa_passkeys', user.canUsePasskeys() ? '1' : '0');
+                    redirectUri.searchParams.set('s', session.spaState);
+                } else {
+                    const token = await Token.createExpiredToken(user);
+
+                    if (!token) {
+                        throw new SimpleError({
+                            code: 'error',
+                            message: 'Could not generate token',
+                            human: $t(`%D6`),
+                            statusCode: 500,
+                        });
+                    }
+
+                    const st = new TokenStruct(token);
+                    redirectUri.searchParams.set('oid_rt', st.refreshToken);
+                    redirectUri.searchParams.set('s', session.spaState);
+                }
+            } else if (this.session.reauthenticateAccessToken) {
+                // The provider confirmed the identity of the user that is already signed in,
+                // so their session counts as freshly authenticated again and the sensitive
+                // actions behind Context.authenticateFresh() unlock. This is the only way an
+                // SSO-only account can reach them: it has no password to confirm with.
+                const token = await Token.getByAccessToken(this.session.reauthenticateAccessToken);
+
+                if (!token || token.userId !== user.id) {
                     throw new SimpleError({
-                        code: 'error',
-                        message: 'Could not generate token',
-                        human: $t(`%D6`),
-                        statusCode: 500,
+                        code: 'invalid_token',
+                        message: 'The session to reauthenticate no longer exists',
+                        human: $t('%ZhJ'),
+                        statusCode: 401,
                     });
                 }
 
-                const st = new TokenStruct(token);
-                redirectUri.searchParams.set('oid_rt', st.refreshToken);
+                token.authenticatedAt = new Date();
+                await token.save();
+                await user.markActive();
+
                 redirectUri.searchParams.set('s', session.spaState);
+                redirectUri.searchParams.set('msg', $t('%Zhh'));
             } else {
                 redirectUri.searchParams.set('s', session.spaState);
-                redirectUri.searchParams.set('msg', 'Je account is succesvol gekoppeld');
+                redirectUri.searchParams.set('msg', $t('%Zh3'));
             }
 
             response.headers['location'] = redirectUri.toString();

package/src/services/STPackageService.ts

@@ -1,9 +1,11 @@
-import { BalanceItem, Organization, Platform, sendEmailTemplate, STPackage } from '@stamhoofd/models';
+import { BalanceItem, Organization, Platform, STPackage } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
 import { SQL } from '@stamhoofd/sql';
 import type { Company } from '@stamhoofd/structures';
 import { BalanceItemRelation, BalanceItemRelationType, BalanceItemStatus, BalanceItemType, EmailTemplateType, getPricingTypeName, Recipient, Replacement, STPackageStatus, STPackageType, STPackageTypeHelper, STPricingType, TranslatedString } from '@stamhoofd/structures';
 import { Formatter, STMath } from '@stamhoofd/utility';
 import { VATService } from './VATService.js';
+import { OrganizationAdminService } from './OrganizationAdminService.js';
 
 export class STPackageService {
     static async getActivePackages(organizationId: string) {
@@ -334,7 +336,7 @@ export class STPackageService {
             return;
         }
 
-        const admins = await organization.getFullAdmins();
+        const admins = await OrganizationAdminService.getFullAdmins(organization);
 
         const recipients = admins.map(admin =>
             Recipient.create({