@stamhoofd/backend 2.137.5 → 2.138.1

package/src/endpoints/auth/DeleteTOTPEndpoint.ts

@@ -0,0 +1,62 @@
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { MFATOTP, WebauthnCredential } from '@stamhoofd/models';
+import type { MFAStatus } from '@stamhoofd/structures';
+import { MFAMethodType } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
+import { TwoFactorAuditLogService } from '../../services/TwoFactorAuditLogService.js';
+
+type Params = { id: string };
+type Query = undefined;
+type Body = undefined;
+type ResponseBody = MFAStatus;
+
+export class DeleteTOTPEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'DELETE') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa/totp/@id', { id: String });
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        const organization = await Context.setOptionalOrganizationScope();
+        const { user, token } = await Context.authenticateFresh({ allowWithoutAccount: true, allowUnscoped: true });
+
+        const totp = await MFATOTP.getByID(request.params.id);
+        if (!totp || totp.userId !== user.id) {
+            throw new SimpleError({
+                code: 'not_found',
+                message: 'TOTP authenticator not found',
+                human: $t('%ZgJ'),
+                statusCode: 404,
+            });
+        }
+
+        // Prevent removing the last factor when 2FA is required.
+        const confirmedTotp = await MFATOTP.getConfirmedForUser(user.id);
+        const passkeys = await WebauthnCredential.getForUser(user.id);
+        const remaining = confirmedTotp.filter(t => t.id !== totp.id).length + passkeys.length;
+        if (remaining === 0 && await TwoFactorHelper.isTwoFactorRequired(user, organization ?? Context.organization ?? null)) {
+            throw new SimpleError({
+                code: 'cannot_remove_last_factor',
+                message: 'Cannot remove the last two-factor method',
+                human: $t('%Zh4'),
+                statusCode: 400,
+            });
+        }
+
+        await totp.delete();
+
+        await TwoFactorAuditLogService.logMethodDeleted(user, MFAMethodType.TOTP, totp.name);
+
+        return new Response(await TwoFactorHelper.completeRemoval(user, token));
+    }
+}

package/src/endpoints/auth/DeleteUserEndpoint.ts

@@ -1,7 +1,7 @@
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 
-import { getDefaultEmailFrom, sendEmailTemplate } from '@stamhoofd/models';
+import { getDefaultEmailFrom, sendEmailTemplate } from '../../helpers/EmailBuilder.js';
 import { EmailTemplateType, Recipient } from '@stamhoofd/structures';
 import { Context } from '../../helpers/Context.js';
 

package/src/endpoints/auth/ForgotPasswordEndpoint.ts

@@ -1,7 +1,8 @@
 import type { Decoder } from '@simonbackx/simple-encoding';
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
-import { Platform, sendEmailTemplate, User } from '@stamhoofd/models';
+import { Platform, User } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../../helpers/EmailBuilder.js';
 import { EmailTemplateType, ForgotPasswordRequest, LoginMethod, Recipient, Replacement } from '@stamhoofd/structures';
 
 import { SimpleError } from '@simonbackx/simple-errors';

package/src/endpoints/auth/GetMFAChallengeEndpoint.ts

@@ -0,0 +1,56 @@
+import type { Decoder } from '@simonbackx/simple-encoding';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { MFAToken } from '@stamhoofd/models';
+import type { MFAChallengeResponse } from '@stamhoofd/structures';
+import { MFAChallengeRequest } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = MFAChallengeRequest;
+type ResponseBody = MFAChallengeResponse;
+
+/**
+ * Describe the second factors that can complete a pending login.
+ *
+ * Password logins receive this as the `meta` of the `require_mfa` error, but an SSO login
+ * ends in a browser redirect that can only carry the token itself. The client posts that
+ * token here to learn which methods it may offer.
+ *
+ * Holding the token means the primary credential was already accepted, and the response
+ * carries no secrets: only which method types are enrolled, plus fresh WebAuthn options.
+ */
+export class GetMFAChallengeEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    bodyDecoder = MFAChallengeRequest as Decoder<MFAChallengeRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa/challenge', {});
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope({ willAuthenticate: false });
+
+        const mfaToken = await MFAToken.getValid(request.body.token, 'login');
+        if (!mfaToken) {
+            throw new SimpleError({
+                code: 'invalid_mfa_token',
+                message: 'The MFA session is invalid or expired',
+                human: $t('%ZhJ'),
+                statusCode: 400,
+            });
+        }
+
+        return new Response(await TwoFactorHelper.describeLoginChallenge(mfaToken));
+    }
+}

package/src/endpoints/auth/GetMFAStatusEndpoint.ts

@@ -0,0 +1,31 @@
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import type { MFAStatus } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = undefined;
+type ResponseBody = MFAStatus;
+
+export class GetMFAStatusEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'GET') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa', {});
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope();
+        const { user } = await Context.authenticate({ allowWithoutAccount: true, allowUnscoped: true });
+
+        return new Response(await TwoFactorHelper.buildStatus(user));
+    }
+}

package/src/endpoints/auth/GetUserEndpoint.test.ts

@@ -1,6 +1,7 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { MemberFactory, OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
 
+import { MFATestHelper } from '../../../tests/helpers/MFATestHelper.js';
 import { testServer } from '../../../tests/helpers/TestServer.js';
 import { GetUserEndpoint } from './GetUserEndpoint.js';
 import { STExpect } from '@stamhoofd/test-utils';
@@ -22,6 +23,36 @@ describe('Endpoint.GetUser', () => {
         expect(response.body.id).toEqual(user.id);
     });
 
+    test('Two-factor authentication is reported on the user and on the accounts of a member', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({ organization }).create();
+        await new MemberFactory({ organization, user }).create();
+        await MFATestHelper.addConfirmedTOTP(user);
+
+        const token = await Token.createToken(user);
+        const r = Request.buildJson('GET', '/v1/user', organization.getApiHost());
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, r);
+        expect(response.body.hasTwoFactor).toBe(true);
+
+        // The same flag is what MemberAccountBox shows for every account of a member.
+        const member = response.body.members.members.find(m => m.users.some(u => u.id === user.id));
+        expect(member?.users.find(u => u.id === user.id)?.hasTwoFactor).toBe(true);
+    });
+
+    test('A user without a second factor is not reported as having two-factor authentication', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({ organization }).create();
+        const token = await Token.createToken(user);
+
+        const r = Request.buildJson('GET', '/v1/user', organization.getApiHost());
+        r.headers.authorization = 'Bearer ' + token.accessToken;
+
+        const response = await testServer.test(endpoint, r);
+        expect(response.body.hasTwoFactor).toBe(false);
+    });
+
     test('Request user details when not signed in is not working', async () => {
         const organization = await new OrganizationFactory({}).create();
         const r = Request.buildJson('GET', '/v1/user', organization.getApiHost());