@stamhoofd/backend 2.138.1 → 2.139.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.138.1",
+    "version": "2.139.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -65,20 +65,20 @@
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
         "@simplewebauthn/server": "13.3.2",
-        "@stamhoofd/backend-env": "2.138.1",
-        "@stamhoofd/backend-i18n": "2.138.1",
-        "@stamhoofd/backend-middleware": "2.138.1",
-        "@stamhoofd/crons": "2.138.1",
-        "@stamhoofd/email": "2.138.1",
-        "@stamhoofd/excel-writer": "2.138.1",
-        "@stamhoofd/logging": "2.138.1",
-        "@stamhoofd/models": "2.138.1",
-        "@stamhoofd/object-differ": "2.138.1",
-        "@stamhoofd/queues": "2.138.1",
-        "@stamhoofd/sql": "2.138.1",
-        "@stamhoofd/structures": "2.138.1",
-        "@stamhoofd/types": "2.138.1",
-        "@stamhoofd/utility": "2.138.1",
+        "@stamhoofd/backend-env": "2.139.0",
+        "@stamhoofd/backend-i18n": "2.139.0",
+        "@stamhoofd/backend-middleware": "2.139.0",
+        "@stamhoofd/crons": "2.139.0",
+        "@stamhoofd/email": "2.139.0",
+        "@stamhoofd/excel-writer": "2.139.0",
+        "@stamhoofd/logging": "2.139.0",
+        "@stamhoofd/models": "2.139.0",
+        "@stamhoofd/object-differ": "2.139.0",
+        "@stamhoofd/queues": "2.139.0",
+        "@stamhoofd/sql": "2.139.0",
+        "@stamhoofd/structures": "2.139.0",
+        "@stamhoofd/types": "2.139.0",
+        "@stamhoofd/utility": "2.139.0",
         "archiver": "7.0.1",
         "argon2": "0.44.0",
         "axios": "1.18.1",
@@ -102,7 +102,7 @@
         "uuid": "14.0.1"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.138.1",
+        "@stamhoofd/test-utils": "2.139.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.2",
         "@types/mailparser": "3.4.6",
@@ -117,5 +117,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "ea8e0dcbc22e86969883fa09e920931896110781"
+    "gitHead": "8c2cb66c10f96ca53aa07c20f410d6b8fa5a3291"
 }

package/src/crons/fake-settlements.test.ts

@@ -0,0 +1,165 @@
+import type { Organization } from '@stamhoofd/models';
+import { OrganizationFactory, Payment, StripeAccount } from '@stamhoofd/models';
+import { PaymentMethod, PaymentProvider, PaymentStatus, PaymentType, Settlement } from '@stamhoofd/structures';
+import { TestUtils } from '@stamhoofd/test-utils';
+import { Formatter } from '@stamhoofd/utility';
+import { v4 as uuidv4 } from 'uuid';
+import { createFakeSettlements } from './fake-settlements.js';
+
+describe('Cron.fake-settlements', () => {
+    let organization: Organization;
+
+    beforeEach(async () => {
+        TestUtils.setEnvironment('environment', 'development');
+        organization = await new OrganizationFactory({}).create();
+    });
+
+    /**
+     * A moment in a week that has already ended. Week 0 is the current week, so anything from week 2
+     * on is a week that is paid out no matter which day the test runs on.
+     */
+    const inWeek = (weeksAgo: number) => {
+        return Formatter.luxon(new Date()).startOf('week').minus({ weeks: weeksAgo }).plus({ days: 2, hours: 12 }).toJSDate();
+    };
+
+    const createPayment = async ({ price = 50_0000, paidAt = inWeek(2), provider = PaymentProvider.Mollie as PaymentProvider | null, status = PaymentStatus.Succeeded, method = PaymentMethod.Bancontact, type = PaymentType.Payment, organizationId = undefined as string | undefined, stripeAccountId = null as string | null }: {
+        price?: number;
+        paidAt?: Date | null;
+        provider?: PaymentProvider | null;
+        status?: PaymentStatus;
+        method?: PaymentMethod;
+        type?: PaymentType;
+        organizationId?: string;
+        stripeAccountId?: string | null;
+    } = {}) => {
+        const payment = new Payment();
+        payment.organizationId = organizationId ?? organization.id;
+        payment.method = method;
+        payment.provider = provider;
+        payment.status = status;
+        payment.type = type;
+        payment.price = price;
+        payment.paidAt = paidAt;
+        payment.stripeAccountId = stripeAccountId;
+        await payment.save();
+        return payment;
+    };
+
+    const createStripeAccount = async (forOrganization: Organization) => {
+        const stripeAccount = new StripeAccount();
+        stripeAccount.organizationId = forOrganization.id;
+        stripeAccount.accountId = 'acct_' + uuidv4();
+        await stripeAccount.save();
+        return stripeAccount;
+    };
+
+    const getSettlement = async (payment: Payment) => {
+        const updated = await Payment.getByID(payment.id);
+        return updated!.settlement;
+    };
+
+    test('Payments of the same week and provider are paid out together', async () => {
+        const first = await createPayment({ price: 50_0000 });
+        const second = await createPayment({ price: 25_0000 });
+        const refund = await createPayment({ price: -10_0000, type: PaymentType.Refund });
+
+        await createFakeSettlements();
+
+        const settlement = await getSettlement(first);
+        expect(settlement).toMatchObject({
+            settledAt: Formatter.luxon(inWeek(2)).startOf('week').plus({ weeks: 1, days: 2 }).toJSDate(),
+
+            // Refunds are taken out of the payout, just like the provider does
+            amount: 65_0000,
+        });
+
+        // All payments of the week point to the same payout
+        expect(await getSettlement(second)).toEqual(settlement);
+        expect(await getSettlement(refund)).toEqual(settlement);
+    });
+
+    test('Every week gets its own payout', async () => {
+        const older = await createPayment({ paidAt: inWeek(3) });
+        const newer = await createPayment({ paidAt: inWeek(2) });
+
+        await createFakeSettlements();
+
+        const olderSettlement = await getSettlement(older);
+        const newerSettlement = await getSettlement(newer);
+
+        expect(olderSettlement).not.toBeNull();
+        expect(newerSettlement).not.toBeNull();
+        expect(olderSettlement!.id).not.toBe(newerSettlement!.id);
+        expect(olderSettlement!.reference).not.toBe(newerSettlement!.reference);
+        expect(olderSettlement!.settledAt.getTime()).toBeLessThan(newerSettlement!.settledAt.getTime());
+    });
+
+    test('Money held on another account is paid out separately', async () => {
+        const otherOrganization = await new OrganizationFactory({}).create();
+        const stripeAccount = await createStripeAccount(organization);
+        const otherStripeAccount = await createStripeAccount(organization);
+
+        const mollie = await createPayment({ price: 50_0000 });
+        const otherMollie = await createPayment({ price: 30_0000, organizationId: otherOrganization.id });
+        const stripe = await createPayment({ price: 20_0000, provider: PaymentProvider.Stripe, stripeAccountId: stripeAccount.id });
+        const otherStripe = await createPayment({ price: 15_0000, provider: PaymentProvider.Stripe, stripeAccountId: otherStripeAccount.id });
+
+        await createFakeSettlements();
+
+        const settlements = [
+            await getSettlement(mollie),
+            await getSettlement(otherMollie),
+            await getSettlement(stripe),
+            await getSettlement(otherStripe),
+        ];
+
+        // Same week, but four accounts: four payouts, each holding only its own money
+        expect(settlements.map(s => s!.amount)).toEqual([50_0000, 30_0000, 20_0000, 15_0000]);
+        expect(new Set(settlements.map(s => s!.id)).size).toBe(4);
+        expect(new Set(settlements.map(s => s!.reference)).size).toBe(4);
+    });
+
+    test('Payments that a provider would still be holding on to are not paid out', async () => {
+        // The payout of the current week didn't happen yet
+        const thisWeek = await createPayment({ paidAt: new Date() });
+
+        const pending = await createPayment({ status: PaymentStatus.Pending });
+        const failed = await createPayment({ status: PaymentStatus.Failed });
+
+        // These providers don't hold on to the money
+        const transfer = await createPayment({ method: PaymentMethod.Transfer, provider: null });
+        const payconiq = await createPayment({ provider: PaymentProvider.Payconiq, method: PaymentMethod.Payconiq });
+
+        await createFakeSettlements();
+
+        for (const payment of [thisWeek, pending, failed, transfer, payconiq]) {
+            expect(await getSettlement(payment)).toBeNull();
+        }
+    });
+
+    test('A payment that was already paid out keeps its own payout', async () => {
+        const settlement = Settlement.create({
+            id: 'stl_1',
+            reference: '1234.1234.1234',
+            settledAt: inWeek(1),
+            amount: 100_0000,
+        });
+
+        const payment = await createPayment();
+        payment.settlement = settlement;
+        await payment.save();
+
+        await createFakeSettlements();
+
+        expect(await getSettlement(payment)).toEqual(settlement);
+    });
+
+    test('Nothing is paid out outside development', async () => {
+        TestUtils.setEnvironment('environment', 'staging');
+        const payment = await createPayment();
+
+        await createFakeSettlements();
+
+        expect(await getSettlement(payment)).toBeNull();
+    });
+});

package/src/crons/fake-settlements.ts

@@ -0,0 +1,117 @@
+/**
+ * Development only: payment providers pay out on their own schedule and those payouts never reach a
+ * local machine, so online payments stay 'not paid out yet' forever. This mimics a weekly payout per
+ * provider account, so everything built on top of payouts has data to show.
+ */
+
+import { registerCron } from '@stamhoofd/crons';
+import { Order, Payment } from '@stamhoofd/models';
+import { SQL } from '@stamhoofd/sql';
+import { PaymentStatus, Settlement } from '@stamhoofd/structures';
+import { SETTLING_PAYMENT_PROVIDERS } from '@stamhoofd/structures/PaymentSettlement.js';
+import { Formatter } from '@stamhoofd/utility';
+import type { DateTime } from 'luxon';
+
+registerCron('fake-settlements', createFakeSettlements);
+
+/**
+ * Days between the end of a week and the payout of the payments of that week.
+ */
+const PAYOUT_DELAY_DAYS = 2;
+
+/**
+ * Maximum number of payments that are settled in one go: a development database can be a copy of a
+ * production one, so a week can hold a lot of payments.
+ */
+const BATCH_SIZE = 1000;
+
+export async function createFakeSettlements() {
+    if (STAMHOOFD.environment !== 'development') {
+        return;
+    }
+
+    const now = new Date();
+
+    // Pay out week per week, oldest first, until we reach a week that isn't paid out yet
+    for (;;) {
+        const oldest = await selectUnsettledPayments().orderBy('paidAt', 'ASC').first(false);
+        if (!oldest?.paidAt) {
+            break;
+        }
+
+        const weekStart = Formatter.luxon(oldest.paidAt).startOf('week');
+        const weekEnd = weekStart.plus({ weeks: 1 });
+        const settledAt = weekEnd.plus({ days: PAYOUT_DELAY_DAYS }).toJSDate();
+
+        if (settledAt > now) {
+            // Every remaining payment is in this week or a later one, so all of them still have to
+            // be paid out
+            break;
+        }
+
+        // Nothing is left before this week, so this selects exactly the payments of this week. What
+        // doesn't fit in one batch is picked up by the next round, in the same payout
+        const payments = await selectUnsettledPayments().where('paidAt', '<', weekEnd.toJSDate()).limit(BATCH_SIZE).fetch();
+        await settleWeek(payments, weekStart, settledAt);
+    }
+}
+
+/**
+ * Succeeded payments of a provider that pays out, that weren't paid out yet.
+ */
+function selectUnsettledPayments() {
+    return Payment.select().where(
+        SQL.where('status', PaymentStatus.Succeeded)
+            .and('provider', SETTLING_PAYMENT_PROVIDERS)
+            .and('settlement', null)
+            .and('paidAt', '>', null),
+    );
+}
+
+/**
+ * A provider pays out per account it holds the money on: a Stripe account, or the Mollie account of
+ * the organization that received the payment.
+ */
+function getPayoutAccount(payment: Payment): string {
+    return payment.provider + '-' + (payment.stripeAccountId ?? payment.organizationId ?? 'platform');
+}
+
+async function settleWeek(payments: Payment[], weekStart: DateTime, settledAt: Date) {
+    const groups = new Map<string, Payment[]>();
+
+    for (const payment of payments) {
+        const account = getPayoutAccount(payment);
+        const group = groups.get(account);
+
+        if (group) {
+            group.push(payment);
+        } else {
+            groups.set(account, [payment]);
+        }
+    }
+
+    const week = weekStart.weekYear + '-W' + weekStart.weekNumber.toString().padStart(2, '0');
+
+    for (const [account, group] of groups) {
+        const id = 'fake-settlement-' + account + '-' + week;
+
+        // Every account gets its own payout, so the reference has to tell them apart
+        const reference = 'DEV ' + week + ' (' + account.slice(-8) + ')';
+        const amount = group.reduce((total, payment) => total + payment.price, 0);
+
+        for (const payment of group) {
+            payment.settlement = Settlement.create({ id, reference, settledAt, amount });
+            await payment.save();
+
+            // Mark order as 'updated', or the frontend won't pull in the updates
+            const order = await Order.getForPayment(null, payment.id);
+            if (order) {
+                order.updatedAt = new Date();
+                order.forceSaveProperty('updatedAt');
+                await order.save();
+            }
+        }
+
+        console.log('Created settlement ' + reference + ' of ' + Formatter.price(amount) + ' for ' + group.length + ' payments');
+    }
+}

package/src/crons/index.ts

@@ -9,6 +9,7 @@ import './delete-expired-mfa-tokens.js';
 import './delete-archived-data.js';
 import './mollie-chargebacks.js';
 import './mollie-refunds.js';
+import './fake-settlements.js';
 import './invoices.js';
 import './service-fees.js';
 import './members-fees.js';

package/src/endpoints/auth/CreateTokenEndpoint.ts

@@ -150,7 +150,7 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                 // Second factor / forced enrollment: block the session until the user
                 // completes (or first sets up) a second factor. Shared with every other
                 // grant that mints a session from a single primary credential.
-                await TwoFactorHelper.assertSecondFactorOrThrow(user, organization, request.request.getVersion());
+                await TwoFactorHelper.assertSecondFactorOrThrow(user, organization, request.request.getVersion(), { loginMethod: 'password', i18n: request.i18n });
 
                 const token = await Token.createToken(user, new Date());
 
@@ -311,7 +311,10 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                 // Forced enrollment (the user has no factor yet) additionally returns a
                 // temporary session token: this flow is also used to choose a first
                 // password (invites), which the client can only do with a session.
-                await TwoFactorHelper.assertSecondFactorOrThrow(passwordToken.user, organization, request.request.getVersion(), { allowTemporarySession: true });
+                //
+                // The link was emailed to the account, so this is also how a long-inactive
+                // admin confirms their email address and gets to enroll after all.
+                await TwoFactorHelper.assertSecondFactorOrThrow(passwordToken.user, organization, request.request.getVersion(), { loginMethod: 'email', i18n: request.i18n, allowTemporarySession: true });
 
                 // Important to create a new token before adjusting the old token
                 const token = await Token.createToken(passwordToken.user, new Date());

package/src/endpoints/auth/ForgotPasswordEndpoint.test.ts

@@ -0,0 +1,45 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { EmailMocker } from '@stamhoofd/email';
+import { EmailTemplateFactory, OrganizationFactory, PasswordToken, UserFactory } from '@stamhoofd/models';
+import { EmailTemplateType } from '@stamhoofd/structures';
+
+import { testServer } from '../../../tests/helpers/TestServer.js';
+import { ForgotPasswordEndpoint } from './ForgotPasswordEndpoint.js';
+
+const endpoint = new ForgotPasswordEndpoint();
+
+describe('Endpoint.ForgotPassword', () => {
+    beforeEach(async () => {
+        await new EmailTemplateFactory({ type: EmailTemplateType.ForgotPassword }).create();
+        await new EmailTemplateFactory({ type: EmailTemplateType.ForgotPasswordButNoAccount }).create();
+    });
+
+    function request(host: string, email: string) {
+        return Request.buildJson('POST', '/forgot-password', host, { email });
+    }
+
+    test('the recovery link is emailed to the stored address, not the one that was typed', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({ organization, password: 'test-password-1234' }).create();
+
+        await testServer.test(endpoint, request(organization.getApiHost(), user.email.toUpperCase()));
+
+        const emails = await EmailMocker.transactional.getSucceededEmails();
+        expect(emails).toHaveLength(1);
+        expect(emails[0].to).toContain(user.email);
+
+        const [passwordToken] = await PasswordToken.select().where('userId', user.id).fetch();
+        expect(passwordToken).toBeDefined();
+        expect(emails[0].html).toContain(encodeURIComponent(passwordToken.token));
+    });
+
+    test('an unknown address still gets an email, so it does not leak who has an account', async () => {
+        const organization = await new OrganizationFactory({}).create();
+
+        await testServer.test(endpoint, request(organization.getApiHost(), 'nobody@example.com'));
+
+        const emails = await EmailMocker.transactional.getSucceededEmails();
+        expect(emails).toHaveLength(1);
+        expect(emails[0].to).toContain('nobody@example.com');
+    });
+});

package/src/endpoints/auth/ForgotPasswordEndpoint.ts

@@ -3,7 +3,7 @@ import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { Platform, User } from '@stamhoofd/models';
 import { sendEmailTemplate } from '../../helpers/EmailBuilder.js';
-import { EmailTemplateType, ForgotPasswordRequest, LoginMethod, Recipient, Replacement } from '@stamhoofd/structures';
+import { EmailTemplateType, ForgotPasswordRequest, LoginMethod, Recipient } from '@stamhoofd/structures';
 
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Context } from '../../helpers/Context.js';
@@ -74,28 +74,7 @@ export class ForgotPasswordEndpoint extends Endpoint<Params, Query, Body, Respon
             return new Response(undefined);
         }
 
-        const recoveryUrl = await PasswordForgotService.getPasswordRecoveryUrl(user, organization, request.i18n);
-
-        // Create e-mail builder
-        await sendEmailTemplate(organization, {
-            recipients: [
-                Recipient.create({
-                    firstName: user.firstName,
-                    lastName: user.lastName,
-                    email: request.body.email,
-                    replacements: [
-                        Replacement.create({
-                            token: 'resetUrl',
-                            value: recoveryUrl,
-                        }),
-                    ],
-                }),
-            ],
-            template: {
-                type: EmailTemplateType.ForgotPassword,
-            },
-            type: 'transactional',
-        });
+        await PasswordForgotService.sendPasswordRecoveryEmail(user, organization, request.i18n);
 
         return new Response(undefined);
     }

package/src/endpoints/auth/MFA.test.ts

@@ -1,15 +1,17 @@
 import { Endpoint, Request } from '@simonbackx/simple-endpoints';
 import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
-import { AuditLog, EmailVerificationCode, MFARecoveryCode, MFATOTP, MFAToken, Organization, PasswordToken, Platform, Token, User, UserFactory, OrganizationFactory, WebauthnChallenge, WebauthnCredential } from '@stamhoofd/models';
-import { AuditLogReplacementType, AuditLogType, MFAMethodType, PermissionLevel, Permissions, Token as TokenStruct } from '@stamhoofd/structures';
+import { EmailMocker } from '@stamhoofd/email';
+import { AuditLog, EmailTemplateFactory, EmailVerificationCode, MFARecoveryCode, MFATOTP, MFAToken, Organization, PasswordToken, Platform, Token, User, UserFactory, OrganizationFactory, WebauthnChallenge, WebauthnCredential } from '@stamhoofd/models';
+import { AuditLogReplacementType, AuditLogType, EmailTemplateType, MFAMethodType, PermissionLevel, Permissions, Token as TokenStruct } from '@stamhoofd/structures';
 import { authenticator } from 'otplib';
 import crypto from 'crypto';
 
 import { MFATestHelper } from '../../../tests/helpers/MFATestHelper.js';
 import { testServer } from '../../../tests/helpers/TestServer.js';
 import { RECOVERY_CODE_ALPHABET, RecoveryCodeHelper } from '../../helpers/RecoveryCodeHelper.js';
-import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
+import { INACTIVE_ADMIN_ENROLLMENT_DAYS, TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
 import { WebauthnHelper } from '../../helpers/WebauthnHelper.js';
+import { PasswordForgotService } from '../../services/PasswordForgotService.js';
 import { ConfirmTOTPEndpoint } from './ConfirmTOTPEndpoint.js';
 import { CreateTokenEndpoint } from './CreateTokenEndpoint.js';
 import { DeletePasskeyEndpoint } from './DeletePasskeyEndpoint.js';
@@ -511,6 +513,188 @@ describe('MFA', () => {
         });
     });
 
+    // -----------------------------------------------------------------------
+    // Forced enrollment of accounts that were not used for a long time
+    // -----------------------------------------------------------------------
+    describe('inactive admins confirm their email before enrolling', () => {
+        const day = 24 * 60 * 60 * 1000;
+
+        beforeEach(async () => {
+            // Without a template no email is built at all, and the assertions below would
+            // pass on a version that never sends one.
+            await new EmailTemplateFactory({ type: EmailTemplateType.ForgotPassword }).create();
+        });
+
+        async function inactiveAdmin({ inactiveDays = INACTIVE_ADMIN_ENROLLMENT_DAYS + 1, requireTwoFactor = true }: { inactiveDays?: number; requireTwoFactor?: boolean } = {}) {
+            const organization = await new OrganizationFactory({}).create();
+            organization.privateMeta.requireTwoFactor = requireTwoFactor;
+            await organization.save();
+
+            const user = await new UserFactory({ organization, password, permissions: Permissions.create({ level: PermissionLevel.Full }) }).create();
+            user.lastActiveAt = new Date(Date.now() - inactiveDays * day);
+            await user.save();
+            return { organization, user };
+        }
+
+        async function passwordTokensFor(user: User): Promise<PasswordToken[]> {
+            return await PasswordToken.select().where('userId', user.id).fetch();
+        }
+
+        async function recoveryEmailsFor(user: User) {
+            return (await EmailMocker.transactional.getSucceededEmails()).filter(e => e.to.includes(user.email));
+        }
+
+        test('a long inactive admin is locked out and gets a password recovery link', async () => {
+            const { organization, user } = await inactiveAdmin();
+
+            const err = await captureError(testServer.test(tokenEndpoint, passwordLogin(organization, user.email, password)));
+            expect(err.code).toBe('require_email_confirmation');
+            expect(err.statusCode).toBe(403);
+
+            const [passwordToken] = await passwordTokensFor(user);
+            expect(passwordToken).toBeDefined();
+
+            // The link in the email is the one that gets them back in.
+            const emails = await recoveryEmailsFor(user);
+            expect(emails).toHaveLength(1);
+            expect(emails[0].html).toContain(encodeURIComponent(passwordToken.token));
+
+            // No setup token was handed out: the enrollment may not start from the password alone.
+            expect(await MFAToken.select().where('userId', user.id).fetch()).toHaveLength(0);
+            expect((await User.getByID(user.id))!.lastActiveAt!.getTime()).toBeLessThan(Date.now() - INACTIVE_ADMIN_ENROLLMENT_DAYS * day);
+        });
+
+        test('an admin who signed in recently is only forced to enroll', async () => {
+            const { organization, user } = await inactiveAdmin({ inactiveDays: INACTIVE_ADMIN_ENROLLMENT_DAYS - 1 });
+
+            const err = await captureError(testServer.test(tokenEndpoint, passwordLogin(organization, user.email, password)));
+            expect(err.code).toBe('require_mfa_setup');
+            expect(await passwordTokensFor(user)).toHaveLength(0);
+            expect(await recoveryEmailsFor(user)).toHaveLength(0);
+        });
+
+        test('a long inactive platform admin is locked out too', async () => {
+            await setPlatformRequiresTwoFactor(true);
+            const user = await new UserFactory({ password, globalPermissions: Permissions.create({ level: PermissionLevel.Full }) }).create();
+            user.lastActiveAt = new Date(Date.now() - (INACTIVE_ADMIN_ENROLLMENT_DAYS + 1) * day);
+            await user.save();
+
+            const err = await captureError(testServer.test(tokenEndpoint, passwordLogin(null, user.email, password)));
+            expect(err.code).toBe('require_email_confirmation');
+        });
+
+        test('an inactive admin who already enrolled is challenged as usual', async () => {
+            const { organization, user } = await inactiveAdmin();
+            const { secret } = await addConfirmedTOTP(user);
+
+            const challenge = await requireMfa(organization, user.email, password);
+            const response = await testServer.test(tokenEndpoint, mfaGrant(organization, { mfa_token: challenge.token, method: 'TOTP', code: authenticator.generate(secret) }));
+            expect(response.body).toBeInstanceOf(TokenStruct);
+            expect(await passwordTokensFor(user)).toHaveLength(0);
+        });
+
+        test('an inactive user without permissions logs in normally', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            organization.privateMeta.requireTwoFactor = true;
+            await organization.save();
+
+            const user = await new UserFactory({ organization, password }).create();
+            user.lastActiveAt = new Date(Date.now() - 400 * day);
+            await user.save();
+
+            const response = await testServer.test(tokenEndpoint, passwordLogin(organization, user.email, password));
+            expect(response.body).toBeInstanceOf(TokenStruct);
+        });
+
+        test('an inactive admin is not blocked when 2FA is not required', async () => {
+            const { organization, user } = await inactiveAdmin({ requireTwoFactor: false });
+
+            const response = await testServer.test(tokenEndpoint, passwordLogin(organization, user.email, password));
+            expect(response.body).toBeInstanceOf(TokenStruct);
+        });
+
+        test('an admin who never signed in is judged on the creation date', async () => {
+            const { organization, user } = await inactiveAdmin();
+            user.lastActiveAt = null;
+            await user.save();
+
+            const fresh = await captureError(testServer.test(tokenEndpoint, passwordLogin(organization, user.email, password)));
+            expect(fresh.code).toBe('require_mfa_setup');
+
+            user.createdAt = new Date(Date.now() - (INACTIVE_ADMIN_ENROLLMENT_DAYS + 1) * day);
+            await user.save();
+
+            const stale = await captureError(testServer.test(tokenEndpoint, passwordLogin(organization, user.email, password)));
+            expect(stale.code).toBe('require_email_confirmation');
+        });
+
+        test('the emailed link confirms the email address and unlocks the enrollment', async () => {
+            const { organization, user } = await inactiveAdmin();
+            await captureError(testServer.test(tokenEndpoint, passwordLogin(organization, user.email, password)));
+
+            const [passwordToken] = await passwordTokensFor(user);
+            expect(passwordToken).toBeDefined();
+
+            const err = await captureError(testServer.test(tokenEndpoint, Request.buildJson('POST', '/oauth/token', organization.getApiHost(), { grant_type: 'password_token', token: passwordToken.token })));
+            expect(err.code).toBe('require_mfa_setup');
+            expect((err.meta as { setupToken: string }).setupToken).toBeTruthy();
+        });
+
+        test('an email verification code also unlocks the enrollment', async () => {
+            const { organization, user } = await inactiveAdmin();
+
+            const code = await EmailVerificationCode.createFor(user, user.email);
+            const err = await captureError(testServer.test(new VerifyEmailEndpoint(), Request.buildJson('POST', '/verify-email', organization.getApiHost(), { token: code.token, code: code.code })));
+            expect(err.code).toBe('require_mfa_setup');
+        });
+
+        test('repeated logins stop sending new recovery links', async () => {
+            const { organization, user } = await inactiveAdmin();
+
+            for (let i = 0; i < 6; i++) {
+                const err = await captureError(testServer.test(tokenEndpoint, passwordLogin(organization, user.email, password)));
+                expect(err.code).toBe('require_email_confirmation');
+            }
+
+            expect(await passwordTokensFor(user)).toHaveLength(3);
+            expect(await recoveryEmailsFor(user)).toHaveLength(3);
+        });
+
+        test('a failing email does not turn the lockout into a server error', async () => {
+            const { organization, user } = await inactiveAdmin();
+            const send = vi.spyOn(PasswordForgotService, 'sendPasswordRecoveryEmail').mockRejectedValue(new Error('Mail server down'));
+
+            try {
+                const err = await captureError(testServer.test(tokenEndpoint, passwordLogin(organization, user.email, password)));
+                expect(err.code).toBe('require_email_confirmation');
+                expect(send).toHaveBeenCalledOnce();
+            }
+            finally {
+                send.mockRestore();
+            }
+        });
+
+        test('the limit is only crossed after a full 45 days', async () => {
+            const { user } = await inactiveAdmin();
+
+            // A minute on either side of the limit, so the datetime column losing
+            // milliseconds cannot decide the outcome.
+            user.lastActiveAt = new Date(Date.now() - INACTIVE_ADMIN_ENROLLMENT_DAYS * day + 60 * 1000);
+            expect(TwoFactorHelper.isInactiveForEnrollment(user)).toBe(false);
+
+            user.lastActiveAt = new Date(Date.now() - INACTIVE_ADMIN_ENROLLMENT_DAYS * day - 60 * 1000);
+            expect(TwoFactorHelper.isInactiveForEnrollment(user)).toBe(true);
+        });
+
+        test('an SSO login of an inactive admin is not blocked', async () => {
+            // The identity provider authenticated the user, so there is nothing to confirm.
+            const { organization, user } = await inactiveAdmin();
+
+            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: 'sso' });
+            expect(requirement.type).toBe('setup');
+        });
+    });
+
     // -----------------------------------------------------------------------
     // Enrollment + management while logged in (happy paths)
     // -----------------------------------------------------------------------