@stamhoofd/backend 2.137.5 → 2.138.1

package/src/endpoints/auth/OpenIDConnectAuthTokenEndpoint.ts

@@ -32,10 +32,10 @@ export class OpenIDConnectAuthTokenEndpoint extends Endpoint<Params, Query, Body
     async handle(request: DecodedRequest<Params, Query, Body>) {
         // Check webshop and/or organization
         await Context.setUserOrganizationScope();
-        await Context.authenticate({ allowWithoutAccount: false });
+        const { token: sessionToken } = await Context.authenticate({ allowWithoutAccount: false });
 
         // Create a SSO auth token that can only be used once
-        const token = await SSOService.createToken();
+        const token = await SSOService.createToken(sessionToken);
 
         return new Response(OpenIDAuthTokenResponse.create({
             ssoAuthToken: token,

package/src/endpoints/auth/RegenerateRecoveryCodesEndpoint.ts

@@ -0,0 +1,51 @@
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { RecoveryCodes } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { RecoveryCodeHelper } from '../../helpers/RecoveryCodeHelper.js';
+import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
+import { TwoFactorAuditLogService } from '../../services/TwoFactorAuditLogService.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = undefined;
+type ResponseBody = RecoveryCodes;
+
+/**
+ * Regenerate the user's recovery codes (replacing the previous batch). Returns the new
+ * plaintext codes once. Requires the user to already have a factor enrolled.
+ */
+export class RegenerateRecoveryCodesEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa/recovery-codes', {});
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope();
+        const { user } = await Context.authenticateFresh({ allowWithoutAccount: true, allowUnscoped: true });
+
+        if (!(await TwoFactorHelper.userHasFactors(user.id))) {
+            throw new SimpleError({
+                code: 'no_factors',
+                message: 'You need at least one two-factor method before generating recovery codes',
+                human: $t('%Zgz'),
+                statusCode: 400,
+            });
+        }
+
+        const codes = await RecoveryCodeHelper.regenerateForUser(user.id);
+
+        await TwoFactorAuditLogService.logRecoveryCodesRegenerated(user);
+
+        return new Response(RecoveryCodes.create({ codes }));
+    }
+}

package/src/endpoints/auth/RegisterPasskeyEndpoint.ts

@@ -0,0 +1,99 @@
+import type { Decoder } from '@simonbackx/simple-encoding';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { WebauthnChallenge, WebauthnCredential } from '@stamhoofd/models';
+import type { MFAEnrollmentResult } from '@stamhoofd/structures';
+import { MFAMethodType, WebauthnRegistrationRequest } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
+import { WebauthnHelper } from '../../helpers/WebauthnHelper.js';
+import { TwoFactorAuditLogService } from '../../services/TwoFactorAuditLogService.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = WebauthnRegistrationRequest;
+type ResponseBody = MFAEnrollmentResult;
+
+/**
+ * Verify and store a newly registered passkey. On the user's first factor this also
+ * returns recovery codes, and during forced enrollment it issues a full session token.
+ */
+export class RegisterPasskeyEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    bodyDecoder = WebauthnRegistrationRequest as Decoder<WebauthnRegistrationRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa/passkeys', {});
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope();
+        const { user, setupToken, token } = await Context.authenticateMFAEnrollment();
+
+        if (!user.canUsePasskeys()) {
+            throw new SimpleError({
+                code: 'passkeys_not_available',
+                message: 'Passkeys are not available for this account',
+                human: $t('%ZhE'),
+                statusCode: 400,
+            });
+        }
+
+        const challenge = await WebauthnChallenge.consumeForUser(user.id);
+        if (!challenge) {
+            throw new SimpleError({
+                code: 'invalid_challenge',
+                message: 'No valid registration challenge found',
+                human: $t('%Zi9'),
+                statusCode: 400,
+            });
+        }
+
+        const result = await WebauthnHelper.verifyRegistration(request.body.response, challenge);
+        if (!result) {
+            throw new SimpleError({
+                code: 'invalid_passkey',
+                message: 'Could not verify the passkey',
+                human: $t('%Zhr'),
+                statusCode: 400,
+            });
+        }
+
+        if (await WebauthnCredential.getByCredentialId(result.credentialId)) {
+            throw new SimpleError({
+                code: 'passkey_already_registered',
+                message: 'This passkey is already registered',
+                human: $t('%Zhf'),
+                statusCode: 400,
+            });
+        }
+
+        const wasFirstFactor = !(await TwoFactorHelper.userHasFactors(user.id));
+
+        const credential = new WebauthnCredential();
+        credential.userId = user.id;
+        credential.credentialId = result.credentialId;
+        credential.rpId = result.rpId;
+        credential.publicKey = result.publicKey;
+        credential.counter = result.counter;
+        credential.transports = result.transports ? JSON.stringify(result.transports) : null;
+        credential.backedUp = result.backedUp;
+        credential.backupEligible = result.backupEligible;
+        credential.name = request.body.name?.trim() || '';
+        credential.providerId = result.providerId;
+        credential.providerName = result.providerName;
+        await credential.save();
+
+        await TwoFactorAuditLogService.logMethodAdded(user, MFAMethodType.Passkey, credential.name || credential.providerName || '');
+
+        return new Response(await TwoFactorHelper.completeEnrollment(user, setupToken, wasFirstFactor, token));
+    }
+}

package/src/endpoints/auth/RegisterPasskeyOptionsEndpoint.ts

@@ -0,0 +1,49 @@
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { WebauthnChallenge, WebauthnCredential } from '@stamhoofd/models';
+import { WebauthnRegistrationOptions } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { WebauthnHelper } from '../../helpers/WebauthnHelper.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = undefined;
+type ResponseBody = WebauthnRegistrationOptions;
+
+/**
+ * Generate WebAuthn registration options (a challenge) for enrolling a new passkey.
+ */
+export class RegisterPasskeyOptionsEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa/passkeys/options', {});
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope();
+        const { user } = await Context.authenticateMFAEnrollment();
+
+        if (!user.canUsePasskeys()) {
+            throw new SimpleError({
+                code: 'passkeys_not_available',
+                message: 'Passkeys are not available for this account',
+                human: $t('%ZhE'),
+                statusCode: 400,
+            });
+        }
+
+        const existing = await WebauthnCredential.getForUser(user.id);
+        const options = await WebauthnHelper.generateRegistration(user, existing);
+        await WebauthnChallenge.createFor(user.id, options.challenge);
+
+        return new Response(WebauthnRegistrationOptions.create({ options }));
+    }
+}

package/src/endpoints/auth/SetupTOTPEndpoint.ts

@@ -0,0 +1,54 @@
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { MFATOTP } from '@stamhoofd/models';
+import { TOTPSetupResponse } from '@stamhoofd/structures';
+
+import { Context } from '../../helpers/Context.js';
+import { TOTPHelper } from '../../helpers/TOTPHelper.js';
+
+type Params = Record<string, never>;
+type Query = undefined;
+type Body = undefined;
+type ResponseBody = TOTPSetupResponse;
+
+/**
+ * Start enrolling a new TOTP authenticator. Creates an unconfirmed row and returns the
+ * secret (shown once). Confirm it with ConfirmTOTPEndpoint.
+ */
+export class SetupTOTPEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'POST') {
+            return [false];
+        }
+        const params = Endpoint.parseParameters(request.url, '/mfa/totp', {});
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOptionalOrganizationScope();
+        const { user } = await Context.authenticateMFAEnrollment();
+
+        // Drop any unconfirmed authenticators from earlier, abandoned setup attempts so
+        // they don't pile up as orphaned rows holding an (encrypted) unused secret.
+        await MFATOTP.deleteUnconfirmedForUser(user.id);
+
+        const secret = TOTPHelper.generateSecret();
+        const totp = new MFATOTP();
+        totp.userId = user.id;
+        totp.name = '';
+        totp.secret = TOTPHelper.encrypt(secret);
+        totp.confirmedAt = null;
+        await totp.save();
+
+        const otpauthUri = TOTPHelper.keyuri(user.email, secret);
+
+        return new Response(TOTPSetupResponse.create({
+            totpId: totp.id,
+            secret,
+            otpauthUri,
+        }));
+    }
+}

package/src/endpoints/auth/SignupEndpoint.ts

@@ -2,7 +2,8 @@ import type { Decoder } from '@simonbackx/simple-encoding';
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { EmailVerificationCode, PasswordToken, Platform, sendEmailTemplate, User } from '@stamhoofd/models';
+import { EmailVerificationCode, PasswordToken, Platform, User } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../../helpers/EmailBuilder.js';
 import { EmailTemplateType, LoginMethod, NewUser, Recipient, Replacement, SignupResponse } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context.js';
@@ -33,7 +34,17 @@ export class SignupEndpoint extends Endpoint<Params, Query, Body, ResponseBody>
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setUserOrganizationScope({ willAuthenticate: false });
 
-        if (STAMHOOFD.userMode === 'platform') {
+        if (!organization) {
+            if (STAMHOOFD.userMode === 'organization') {
+                // Not supported for now
+                throw new SimpleError({
+                    code: 'not_supported',
+                    message: 'This platform does not support password login',
+                    human: $t(`%D7`),
+                    statusCode: 400,
+                });
+            }
+
             const platform = await Platform.getShared();
             if (!platform.config.loginMethods.has(LoginMethod.Password)) {
                 throw new SimpleError({

package/src/endpoints/auth/VerifyEmailEndpoint.ts

@@ -6,6 +6,7 @@ import { EmailVerificationCode, Token, User } from '@stamhoofd/models';
 import { Token as TokenStruct, VerifyEmailRequest } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context.js';
+import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
 import { BalanceItemService } from '../../services/BalanceItemService.js';
 
 type Params = Record<string, never>;
@@ -50,6 +51,11 @@ export class VerifyEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
             });
         }
 
+        // Read the (optional) session of the caller before consuming the code: a user that
+        // is already signed in is verifying a new email address from their account
+        // settings, and already passed their second factor for that session.
+        const authenticatedUser = await Context.optionalAuthenticatedUser();
+
         const code = await EmailVerificationCode.verify(organization?.id ?? null, request.body.token, request.body.code);
 
         if (!code) {
@@ -105,7 +111,17 @@ export class VerifyEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
             throw e;
         }
 
+        // Verifying an email is a single primary credential: if this user already has a
+        // second factor (or must enroll one), don't hand out a session without it. Unless
+        // the request already comes from a session of that same user (changing your email
+        // address while signed in): the second factor was checked when it was created.
+        if (authenticatedUser?.id !== user.id) {
+            await TwoFactorHelper.assertSecondFactorOrThrow(user, organization, request.request.getVersion());
+        }
+
         const token = await Token.createToken(user);
+        await user.markActive();
+
         const st = new TokenStruct(token);
         return new Response(st);
     }

package/src/endpoints/global/email/CreateEmailEndpoint.ts

@@ -8,6 +8,7 @@ import { EmailStatus, Email as EmailStruct, EmailTemplate as EmailTemplateStruct
 import { Context } from '../../../helpers/Context.js';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { EmailPreviewService } from '../../../services/EmailPreviewService.js';
+import { EmailSendService } from '../../../services/EmailSendService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -132,7 +133,7 @@ export class CreateEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
         }
 
         await model.save();
-        await model.buildExampleRecipient(true);
+        await EmailSendService.buildExampleRecipient(model, true);
         await model.updateCount();
 
         if (request.body.status === EmailStatus.Sending || request.body.status === EmailStatus.Sent || request.body.status === EmailStatus.Queued) {
@@ -142,7 +143,7 @@ export class CreateEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     human: $t('%1Cw'),
                 });
             }
-            await model.queueForSending();
+            await EmailSendService.queueForSending(model);
         }
 
         // Delete open drafts with the same content, from the same user

package/src/endpoints/global/email/PatchEmailEndpoint.ts

@@ -9,6 +9,7 @@ import { patchObject } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Context } from '../../../helpers/Context.js';
 import { EmailPreviewService } from '../../../services/EmailPreviewService.js';
+import { EmailSendService } from '../../../services/EmailSendService.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -196,7 +197,7 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
         await model.save();
 
         if (rebuild) {
-            await model.buildExampleRecipient();
+            await EmailSendService.buildExampleRecipient(model);
             await model.updateCount();
         }
 
@@ -209,7 +210,7 @@ export class PatchEmailEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             }
 
             // Preview the sending status
-            await model.queueForSending();
+            await EmailSendService.queueForSending(model);
         }
 
         return new Response(await EmailPreviewService.getPreviewStructure(model, { allLanguages: true }));

package/src/endpoints/global/email-recipients/GetEmailRecipientsEndpoint.ts

@@ -5,7 +5,8 @@ import { assertSort, getSortFilter, LimitedFilteredRequest, PaginatedResponse, P
 
 import type { Decoder } from '@simonbackx/simple-encoding';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { EmailRecipient, fillRecipientReplacements } from '@stamhoofd/models';
+import { EmailRecipient } from '@stamhoofd/models';
+import { fillRecipientReplacements } from '../../../helpers/EmailBuilder.js';
 import type { SQLFilterDefinitions, SQLSortDefinitions } from '@stamhoofd/sql';
 import { applySQLSorter, compileToSQLFilter } from '@stamhoofd/sql';
 import { Context } from '../../../helpers/Context.js';

package/src/endpoints/global/email-recipients/RetryEmailRecipientEndpoint.ts

@@ -6,6 +6,7 @@ import { EmailStatus, PermissionLevel } from '@stamhoofd/structures';
 
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Context } from '../../../helpers/Context.js';
+import { EmailSendService } from '../../../services/EmailSendService.js';
 
 type Params = { id: string };
 type Query = undefined;
@@ -76,7 +77,7 @@ export class RetryEmailRecipientEndpoint extends Endpoint<Params, Query, Body, R
         }
 
         // Retry
-        await model.resumeSending(emailRecipient.id);
+        await EmailSendService.resumeSending(model, emailRecipient.id);
 
         await emailRecipient.refresh();
 

package/src/endpoints/global/files/ExportToExcelEndpoint.ts

@@ -4,7 +4,8 @@ import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import type { XlsxTransformerSheet } from '@stamhoofd/excel-writer';
 import { ArchiverWriterAdapter, exportToExcel, XlsxWriter } from '@stamhoofd/excel-writer';
-import { Platform, RateLimiter, sendEmailTemplate } from '@stamhoofd/models';
+import { Platform, RateLimiter } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../../../helpers/EmailBuilder.js';
 import { QueueHandler } from '@stamhoofd/queues';
 import type { ExcelExportType, IPaginatedResponse, LimitedFilteredRequest, Platform as PlatformStruct } from '@stamhoofd/structures';
 import { EmailTemplateType, ExcelExportRequest, ExcelExportResponse, Replacement, Version } from '@stamhoofd/structures';

package/src/endpoints/global/files/UploadFile.ts

@@ -133,7 +133,7 @@ export class UploadFile extends Endpoint<Params, Query, Body, ResponseBody> {
             throw new SimpleError({
                 code: 'invalid_file_type',
                 message: 'Unsupported file type ' + (file.mimetype ?? 'unknown') + ' for file ' + (file.originalFilename ?? 'unknown'),
-                human: $t('Dit type bestand kan je niet uploaden.'),
+                human: $t('%ZiD'),
                 field: 'file',
                 statusCode: 400,
             });

package/src/endpoints/global/files/UploadImage.ts

@@ -140,7 +140,7 @@ export class UploadImage extends Endpoint<Params, Query, Body, ResponseBody> {
                 throw new SimpleError({
                     code: 'invalid_file_type',
                     message: 'Unsupported image type ' + (file.mimetype ?? 'unknown') + ' for file ' + (file.originalFilename ?? 'unknown'),
-                    human: $t('Dit soort afbeelding kan je niet opladen.'),
+                    human: $t('%ZhP'),
                     field: 'file',
                     statusCode: 400,
                 });

package/src/endpoints/global/members/SendMemberSecurityCodeEndpoint.ts

@@ -3,7 +3,8 @@ import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import type { Organization } from '@stamhoofd/models';
-import { AuditLog, Member, Platform, RateLimiter, sendEmailTemplate } from '@stamhoofd/models';
+import { AuditLog, Member, Platform, RateLimiter } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../../../helpers/EmailBuilder.js';
 import { AuditLogReplacement, AuditLogReplacementType, AuditLogSource, AuditLogType, EmailTemplateType, Recipient, Replacement, SecurityCodeSendMethod, SendMemberSecurityCodeRequest, SendMemberSecurityCodeResponse } from '@stamhoofd/structures';
 import type { Country } from '@stamhoofd/types/Country';
 import { Formatter } from '@stamhoofd/utility';

package/src/endpoints/global/platform/GetPlatformAdminsEndpoint.ts

@@ -4,6 +4,7 @@ import { User } from '@stamhoofd/models';
 import { OrganizationAdmins } from '@stamhoofd/structures';
 
 import { Context } from '../../../helpers/Context.js';
+import { TwoFactorHelper } from '../../../helpers/TwoFactorHelper.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -34,10 +35,12 @@ export class GetPlatformAdminsEndpoint extends Endpoint<Params, Query, Body, Res
 
         // Get all admins
         const admins = await User.getPlatformAdmins();
+        const users = admins.map(user => user.getStructure());
+        await TwoFactorHelper.fillTwoFactorStatus(users);
 
         return new Response(
             OrganizationAdmins.create({
-                users: admins.map(user => user.getStructure()),
+                users,
             }),
         );
     }

package/src/endpoints/global/platform/PatchPlatformEnpoint.test.ts

@@ -1,7 +1,7 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import type { Organization } from '@stamhoofd/models';
 import { OrganizationFactory, Platform, RegistrationPeriod, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
-import { PermissionLevel, Permissions, PlatformConfig, Platform as PlatformStruct, Version } from '@stamhoofd/structures';
+import { PermissionLevel, Permissions, PlatformConfig, PlatformPrivateConfig, Platform as PlatformStruct, Version } from '@stamhoofd/structures';
 
 import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
 import { TestUtils } from '@stamhoofd/test-utils';
@@ -22,6 +22,40 @@ describe('Endpoint.PatchPlatform', () => {
         return await testServer.test(endpoint, request);
     };
 
+    const setPlatformRequiresTwoFactor = async (requireTwoFactor: boolean) => {
+        const platform = await Platform.getForEditing();
+        platform.privateConfig.requireTwoFactor = requireTwoFactor;
+        await platform.save();
+    };
+
+    test('Should save whether two-factor authentication is required for platform admins', async () => {
+        const organization = await new OrganizationFactory({ }).create();
+
+        const admin = await new UserFactory({
+            globalPermissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+        const token = await Token.createToken(admin);
+
+        try {
+            const response = await patchPlatform({
+                patch: PlatformStruct.patch({
+                    privateConfig: PlatformPrivateConfig.patch({
+                        requireTwoFactor: true,
+                    }),
+                }),
+                organization,
+                token,
+            });
+
+            expect(response.body.privateConfig?.requireTwoFactor).toBe(true);
+            expect((await Platform.getForEditing()).privateConfig.requireTwoFactor).toBe(true);
+        }
+        finally {
+            // The platform row is shared by every test file
+            await setPlatformRequiresTwoFactor(false);
+        }
+    });
+
     describe('userMode organization', () => {
         beforeEach(async () => {
             TestUtils.setEnvironment('userMode', 'organization');

package/src/endpoints/global/platform/PatchPlatformEnpoint.ts

@@ -82,6 +82,14 @@ export class PatchPlatformEndpoint extends Endpoint<
                     request.body.privateConfig.emails,
                 );
             }
+
+            if (request.body.privateConfig.requireTwoFactor !== undefined) {
+                if (!Context.auth.hasPlatformFullAccess()) {
+                    throw Context.auth.error();
+                }
+
+                platform.privateConfig.requireTwoFactor = request.body.privateConfig.requireTwoFactor;
+            }
         }
 
         let shouldUpdateSetupSteps = false;

package/src/endpoints/global/platform/SignOutPlatformAdminsEndpoint.test.ts

@@ -0,0 +1,92 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import type { Organization } from '@stamhoofd/models';
+import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { PermissionLevel, Permissions } from '@stamhoofd/structures';
+import { STExpect, TestUtils } from '@stamhoofd/test-utils';
+
+import { testServer } from '../../../../tests/helpers/TestServer.js';
+import { SignOutPlatformAdminsEndpoint } from './SignOutPlatformAdminsEndpoint.js';
+
+describe('Endpoint.SignOutPlatformAdmins', () => {
+    const endpoint = new SignOutPlatformAdminsEndpoint();
+
+    beforeEach(() => {
+        TestUtils.setEnvironment('userMode', 'platform');
+    });
+
+    const signOut = async (organization: Organization, token: Token) => {
+        const request = Request.buildJson('POST', '/platform/admins/sign-out', organization.getApiHost());
+        request.headers.authorization = 'Bearer ' + token.accessToken;
+        return await testServer.test(endpoint, request);
+    };
+
+    const createPlatformAdmin = async (level = PermissionLevel.Full) => {
+        return await new UserFactory({
+            globalPermissions: Permissions.create({ level }),
+        }).create();
+    };
+
+    const tokenExists = async (token: Token) => {
+        return !!(await Token.getByAccessToken(token.accessToken, true));
+    };
+
+    test('all sessions of all platform admins are signed out, except the one making the request', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const admin = await createPlatformAdmin();
+        const otherAdmin = await createPlatformAdmin();
+
+        // An admin of an organization is not a platform admin
+        const organizationAdmin = await new UserFactory({
+            organization,
+            permissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+        organizationAdmin.organizationId = null;
+        await organizationAdmin.save();
+
+        const currentToken = await Token.createToken(admin, new Date());
+        const secondDeviceOfAdmin = await Token.createToken(admin, new Date());
+        const otherAdminToken = await Token.createToken(otherAdmin, new Date());
+        const organizationAdminToken = await Token.createToken(organizationAdmin, new Date());
+
+        const response = await signOut(organization, currentToken);
+
+        expect(response.body.count).toBe(2);
+        expect(await tokenExists(currentToken)).toBe(true);
+        expect(await tokenExists(secondDeviceOfAdmin)).toBe(false);
+        expect(await tokenExists(otherAdminToken)).toBe(false);
+        expect(await tokenExists(organizationAdminToken)).toBe(true);
+    });
+
+    test('a platform admin without full access cannot sign out the other admins', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const admin = await createPlatformAdmin(PermissionLevel.Write);
+        const otherAdmin = await createPlatformAdmin();
+        const otherAdminToken = await Token.createToken(otherAdmin, new Date());
+
+        await expect(signOut(organization, await Token.createToken(admin, new Date()))).rejects.toThrow(STExpect.simpleError({
+            code: 'permission_denied',
+        }));
+        expect(await tokenExists(otherAdminToken)).toBe(true);
+    });
+
+    test('an admin of an organization cannot sign out the platform admins', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        const organizationAdmin = await new UserFactory({
+            organization,
+            permissions: Permissions.create({ level: PermissionLevel.Full }),
+        }).create();
+        organizationAdmin.organizationId = null;
+        await organizationAdmin.save();
+
+        const platformAdmin = await createPlatformAdmin();
+        const platformAdminToken = await Token.createToken(platformAdmin, new Date());
+
+        await expect(signOut(organization, await Token.createToken(organizationAdmin, new Date()))).rejects.toThrow(STExpect.simpleError({
+            code: 'permission_denied',
+        }));
+        expect(await tokenExists(platformAdminToken)).toBe(true);
+    });
+});