@stamhoofd/backend 2.138.2 → 2.139.0

package/src/endpoints/organization/dashboard/payments/GetPaymentBreakdownEndpoint.ts

@@ -0,0 +1,111 @@
+import type { Decoder } from '@simonbackx/simple-encoding';
+import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Endpoint, Response } from '@simonbackx/simple-endpoints';
+import { StripeAccount } from '@stamhoofd/models';
+import type { PaymentGeneral } from '@stamhoofd/structures';
+import { StripeAccount as StripeAccountStruct } from '@stamhoofd/structures';
+import { BreakdownRequest } from '@stamhoofd/structures/breakdown/BreakdownRequest.js';
+import { PaymentBreakdownBuilder } from '@stamhoofd/structures/breakdown/PaymentBreakdownBuilder.js';
+import type { PaymentBreakdown } from '@stamhoofd/structures/PaymentBreakdown.js';
+import { Formatter } from '@stamhoofd/utility';
+import { loadOrdersForBreakdown } from '../../../../helpers/breakdownRelations.js';
+import { Context } from '../../../../helpers/Context.js';
+import { streamForBreakdown } from '../../../../helpers/streamForBreakdown.js';
+import { GetPaymentsEndpoint } from './GetPaymentsEndpoint.js';
+
+type Params = Record<string, never>;
+type Query = BreakdownRequest;
+type Body = undefined;
+type ResponseBody = PaymentBreakdown;
+
+/**
+ * The Stripe accounts the payments arrived on, so they can be named after their holder. There are only
+ * a few of them, so they are kept for as long as the breakdown runs.
+ */
+class StripeAccountCache {
+    // An account that no longer exists is remembered as null, so it is not looked up again on every page
+    private accounts = new Map<string, StripeAccountStruct | null>();
+
+    async load(payments: PaymentGeneral[]): Promise<StripeAccountStruct[]> {
+        const missing = Formatter.uniqueArray(
+            payments.flatMap(p => p.stripeAccountId && !this.accounts.has(p.stripeAccountId) ? [p.stripeAccountId] : []),
+        );
+
+        if (missing.length > 0) {
+            for (const id of missing) {
+                this.accounts.set(id, null);
+            }
+
+            for (const account of await StripeAccount.getByIDs(...missing)) {
+                this.accounts.set(account.id, StripeAccountStruct.create(account));
+            }
+        }
+
+        return [...this.accounts.values()].filter(account => account !== null);
+    }
+}
+
+/**
+ * Breaks a selection of payments down into where the money arrived, what it was for and which articles
+ * were paid.
+ *
+ * Reads the same payments the Excel export would and groups them with the same rules the rest of the
+ * app uses (see PaymentBreakdownBuilder in @stamhoofd/structures), so the numbers always describe
+ * exactly the payments that end up in the file.
+ */
+export class GetPaymentBreakdownEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    queryDecoder = BreakdownRequest as Decoder<BreakdownRequest>;
+
+    protected doesMatch(request: Request): [true, Params] | [false] {
+        if (request.method !== 'GET') {
+            return [false];
+        }
+
+        const params = Endpoint.parseParameters(request.url, '/payments/breakdown', {});
+
+        if (params) {
+            return [true, params as Params];
+        }
+        return [false];
+    }
+
+    async handle(request: DecodedRequest<Params, Query, Body>) {
+        await Context.setOrganizationScope();
+        const { user } = await Context.authenticate();
+
+        const organization = Context.organization;
+
+        if (!organization) {
+            throw Context.auth.error();
+        }
+
+        if (!await Context.auth.canManagePayments(organization.id)) {
+            throw Context.auth.error();
+        }
+
+        const builder = new PaymentBreakdownBuilder(request.query.path);
+        const stripeAccounts = new StripeAccountCache();
+
+        await streamForBreakdown<PaymentGeneral>({
+            userId: user.id,
+            filter: request.query.readFilter,
+            search: request.query.search,
+            count: async (countRequest) => {
+                return await (await GetPaymentsEndpoint.buildQuery(countRequest)).count();
+            },
+            fetch: async (pageRequest) => {
+                return await GetPaymentsEndpoint.buildData(pageRequest);
+            },
+            handle: async (payments) => {
+                builder.add(payments, {
+                    stripeAccounts: await stripeAccounts.load(payments),
+                    orders: await loadOrdersForBreakdown(
+                        payments.flatMap(p => p.balanceItemPayments.map(bp => bp.balanceItem.orderId)),
+                    ),
+                });
+            },
+        });
+
+        return new Response(builder.build(request.query.filter));
+    }
+}

package/src/endpoints/organization/dashboard/payments/GetPaymentsEndpoint.ts

@@ -5,12 +5,12 @@ import { SimpleError } from '@simonbackx/simple-errors';
 import { Payment } from '@stamhoofd/models';
 import { SQL, applySQLSorter, compileToSQLFilter } from '@stamhoofd/sql';
 import type { CountFilteredRequest, PaymentGeneral, StamhoofdFilter } from '@stamhoofd/structures';
-import { LimitedFilteredRequest, PaginatedResponse, TransferSettings, assertSort, getSortFilter } from '@stamhoofd/structures';
+import { LimitedFilteredRequest, PaginatedResponse, assertSort, getSortFilter } from '@stamhoofd/structures';
 
 import type { SQLResultNamespacedRow } from '@simonbackx/simple-database';
 import { AuthenticatedStructures } from '../../../../helpers/AuthenticatedStructures.js';
 import { Context } from '../../../../helpers/Context.js';
-import { paymentFilterCompilers } from '../../../../sql-filters/payments.js';
+import { getPaymentSearchFilter, paymentFilterCompilers } from '../../../../sql-filters/payments.js';
 import { paymentSorters } from '../../../../sql-sorters/payments.js';
 
 type Params = Record<string, never>;
@@ -69,83 +69,7 @@ export class GetPaymentsEndpoint extends Endpoint<Params, Query, Body, ResponseB
         }
 
         if (q.search) {
-            // todo
-
-            let searchFilter: StamhoofdFilter | null = null;
-            searchFilter = {
-                $or: [
-                    {
-                        customer: {
-                            name: {
-                                $contains: q.search,
-                            },
-                        },
-                    },
-                    {
-                        customer: {
-                            company: {
-                                name: {
-                                    $contains: q.search,
-                                },
-                            },
-                        },
-                    },
-                    {
-                        balanceItemPayments: {
-                            $elemMatch: {
-                                balanceItem: {
-                                    description: {
-                                        $contains: q.search,
-                                    },
-                                },
-                            },
-                        },
-                    },
-                    {
-                        transferDescription: {
-                            $contains: q.search,
-                        },
-                    },
-                ],
-            };
-
-            if (q.search.includes('@')) {
-                searchFilter = {
-                    $or: [
-                        {
-                            customer: {
-                                email: {
-                                    $contains: q.search,
-                                },
-                            },
-                        },
-                        {
-                            customer: {
-                                company: {
-                                    administrationEmail: {
-                                        $contains: q.search,
-                                    },
-                                },
-                            },
-                        },
-                    ],
-                };
-            }
-
-            const transferDescription = q.search.replaceAll('+', '').replaceAll('/', '');
-            if (transferDescription.length === '562100153542'.length && !isNaN(parseInt(transferDescription))) {
-                // Format to
-                const formatted = TransferSettings.structureOGM(transferDescription);
-
-                // Search for structured transfer
-                searchFilter = {
-                    transferDescription: formatted,
-                };
-            }
-
-            if (searchFilter) {
-                query.where(await compileToSQLFilter(searchFilter, filterCompilers));
-            }
+            query.where(await compileToSQLFilter(getPaymentSearchFilter(q.search), filterCompilers));
         }
 
         if (q instanceof LimitedFilteredRequest) {

package/src/endpoints/organization/dashboard/webshops/PatchWebshopOrdersEndpoint.ts

@@ -213,7 +213,7 @@ export class PatchWebshopOrdersEndpoint extends Endpoint<Params, Query, Body, Re
                         const balanceItemPayment = new BalanceItemPayment();
                         balanceItemPayment.balanceItemId = balanceItem.id;
                         balanceItemPayment.paymentId = payment.id;
-                        balanceItemPayment.organizationId = organization.id;
+                        balanceItemPayment.organizationId = payment.organizationId;
                         balanceItemPayment.price = balanceItem.price;
                         await balanceItemPayment.save();
 

package/src/endpoints/organization/shared/GetPaymentEndpoint.ts

@@ -20,7 +20,9 @@ export class GetPaymentEndpoint extends Endpoint<Params, Query, Body, ResponseBo
 
         const params = Endpoint.parseParameters(request.url, '/payments/@id', { id: String });
 
-        if (params) {
+        // /payments/count and /payments/breakdown are endpoints of their own, which are not guaranteed
+        // to be matched before this one
+        if (params && params.id !== 'count' && params.id !== 'breakdown') {
             return [true, params as Params];
         }
         return [false];

package/src/endpoints/organization/webshops/PlaceOrderEndpoint.ts

@@ -234,7 +234,7 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                 const balanceItemPayment = new BalanceItemPayment();
                 balanceItemPayment.balanceItemId = balanceItem.id;
                 balanceItemPayment.paymentId = payment.id;
-                balanceItemPayment.organizationId = organization.id;
+                balanceItemPayment.organizationId = payment.organizationId;
                 balanceItemPayment.price = balanceItem.price;
                 await balanceItemPayment.save();
 

package/src/excel-loaders/balance-item-payments.ts

@@ -0,0 +1,145 @@
+import { SimpleError } from '@simonbackx/simple-errors';
+import { BalanceItemPayment, Payment } from '@stamhoofd/models';
+import { applySQLSorter, compileToSQLFilter, SQL } from '@stamhoofd/sql';
+import type { IPaginatedResponse, LimitedFilteredRequest } from '@stamhoofd/structures';
+import { assertSort, ExcelExportType } from '@stamhoofd/structures';
+import { Formatter } from '@stamhoofd/utility';
+import { ExportToExcelEndpoint } from '../endpoints/global/files/ExportToExcelEndpoint.js';
+import { AuthenticatedStructures } from '../helpers/AuthenticatedStructures.js';
+import { Context } from '../helpers/Context.js';
+import { getNextPageRequest } from '../helpers/getNextPageRequest.js';
+import { balanceItemPaymentRootFilterCompilers } from '../sql-filters/balance-item-payments-root.js';
+import { getPaymentSearchFilter } from '../sql-filters/payments.js';
+import { balanceItemPaymentSorters } from '../sql-sorters/balance-item-payments.js';
+import type { PaymentWithItem } from './payments.js';
+import { getBalanceItemPaymentColumns, PaymentGeneralWithStripeAccount } from './payments.js';
+
+const sorters = balanceItemPaymentSorters;
+const filterCompilers = balanceItemPaymentRootFilterCompilers;
+
+/**
+ * What one payment paid for one balance item, as a row of its own.
+ *
+ * Money that is spread over several payments, or that paid for several things at once, only exists at
+ * this level: a breakdown that adds up parts of payments or of balance items selects them here, so the
+ * file holds exactly what was added up instead of the whole payments around it.
+ *
+ * A webshop order is not split into the articles that were ordered here, the way the payments export
+ * does: a row is one balance item payment, which is the unit that was counted.
+ */
+ExportToExcelEndpoint.loaders.set(ExcelExportType.BalanceItemPayments, {
+    fetch: async (requestQuery: LimitedFilteredRequest) => {
+        const balanceItemPayments = await fetchPage(requestQuery);
+
+        const response: IPaginatedResponse<PaymentWithItem[], LimitedFilteredRequest> = {
+            results: await toRows(balanceItemPayments),
+            next: getNextPageRequest(balanceItemPayments, requestQuery, sorters),
+        };
+
+        return response;
+    },
+    getSheets: () => [
+        {
+            id: 'balanceItemPayments',
+            name: $t(`%Ly`),
+            columns: getBalanceItemPaymentColumns(),
+        },
+    ],
+});
+
+/**
+ * Reads one page of balance item payments, joined to both parents so a filter can reach either of them.
+ */
+async function fetchPage(requestQuery: LimitedFilteredRequest): Promise<BalanceItemPayment[]> {
+    const organization = Context.organization;
+
+    if (!organization) {
+        throw Context.auth.error();
+    }
+
+    if (!await Context.auth.canManagePayments(organization.id)) {
+        throw Context.auth.error();
+    }
+
+    const query = BalanceItemPayment.select()
+        .setMaxExecutionTime(15 * 1000)
+        .join(
+            SQL.join(SQL.table('payments')).where(
+                SQL.column('payments', 'id'),
+                SQL.column('balance_item_payments', 'paymentId'),
+            ),
+        )
+        .join(
+            SQL.join(SQL.table('balance_items')).where(
+                SQL.column('balance_items', 'id'),
+                SQL.column('balance_item_payments', 'balanceItemId'),
+            ),
+        );
+
+    query.where(await compileToSQLFilter({ organizationId: organization.id }, filterCompilers));
+
+    if (requestQuery.filter) {
+        query.where(await compileToSQLFilter(requestQuery.filter, filterCompilers));
+    }
+
+    if (requestQuery.search) {
+        // Searching selects the same payments as the list this export started from, but a row here is
+        // one balance item payment, so the filter has to reach the payment it belongs to
+        query.where(await compileToSQLFilter({ payment: getPaymentSearchFilter(requestQuery.search) }, filterCompilers));
+    }
+
+    if (requestQuery.pageFilter) {
+        query.where(await compileToSQLFilter(requestQuery.pageFilter, filterCompilers));
+    }
+
+    requestQuery.sort = assertSort(requestQuery.sort, [{ key: 'id' }]);
+    applySQLSorter(query, requestQuery.sort, sorters);
+    query.limit(requestQuery.limit);
+
+    try {
+        return await query.fetch();
+    }
+    catch (error) {
+        if (error.message.includes('ER_QUERY_TIMEOUT')) {
+            throw new SimpleError({
+                code: 'timeout',
+                message: 'Query took too long',
+                human: $t(`%Cv`),
+            });
+        }
+        throw error;
+    }
+}
+
+/**
+ * Pairs every balance item payment with the payment it came in with, keeping the order of the page so
+ * the next page picks up where this one stopped.
+ */
+async function toRows(balanceItemPayments: BalanceItemPayment[]): Promise<PaymentWithItem[]> {
+    if (balanceItemPayments.length === 0) {
+        return [];
+    }
+
+    const paymentIds = Formatter.uniqueArray(balanceItemPayments.map(p => p.paymentId));
+    const payments = await AuthenticatedStructures.paymentsGeneral(await Payment.getByIDs(...paymentIds), true);
+
+    // One payment can pay for many rows, so it is only built once even though every row repeats it
+    const paymentsById = new Map<string, PaymentGeneralWithStripeAccount>(
+        payments.map(payment => [payment.id, PaymentGeneralWithStripeAccount.create(payment)]),
+    );
+
+    return balanceItemPayments.flatMap((balanceItemPayment) => {
+        const payment = paymentsById.get(balanceItemPayment.paymentId);
+        const detailed = payment?.balanceItemPayments.find(p => p.id === balanceItemPayment.id);
+
+        if (!payment || !detailed) {
+            // The payment was removed while the file was being written
+            return [];
+        }
+
+        return [{
+            payment,
+            balanceItemPayment: Object.assign(detailed, { customTitle: null }),
+        }];
+    });
+}

package/src/excel-loaders/index.ts

@@ -4,4 +4,5 @@ import './organizations.js';
 import './receivable-balances.js';
 import './event-notifications.js';
 import './balance-items.js';
+import './balance-item-payments.js';
 import './platform-memberships.js';

package/src/excel-loaders/payments.ts

@@ -9,7 +9,7 @@ import { ExportToExcelEndpoint } from '../endpoints/global/files/ExportToExcelEn
 import { GetPaymentsEndpoint } from '../endpoints/organization/dashboard/payments/GetPaymentsEndpoint.js';
 import { XlsxTransformerColumnHelper } from '../helpers/XlsxTransformerColumnHelper.js';
 
-type PaymentWithItem = {
+export type PaymentWithItem = {
     payment: PaymentGeneralWithStripeAccount;
     balanceItemPayment: PaymentExportBalanceItemPayment;
 };
@@ -82,46 +82,54 @@ ExportToExcelEndpoint.loaders.set(ExcelExportType.Payments, {
                 payment: data,
                 balanceItemPayment: p,
             })),
-            columns: [
-                ...getBalanceItemColumns(),
-
-                // Repeating columns need to de-transform again
-                ...[
-                    ...getGeneralColumns(),
-                    ...getInvoiceColumns(),
-                    ...getPayingOrganizationColumns(),
-                ].map((c) => {
-                    if ('match' in c) {
-                        return {
-                            ...c,
-                            match: (id: string) => {
-                                const result = c.match(id);
-                                if (!result) {
-                                    return result;
-                                }
-
-                                return result.map(cc => ({
-                                    ...cc,
-                                    getValue: (object: PaymentWithItem) => {
-                                        return cc.getValue(object.payment);
-                                    },
-                                }));
-                            },
-                        };
-                    }
-
-                    return {
-                        ...c,
-                        getValue: (object: PaymentWithItem) => {
-                            return c.getValue(object.payment);
-                        },
-                    };
-                }),
-            ],
+            columns: getBalanceItemPaymentColumns(),
         },
     ],
 });
 
+/**
+ * What one payment paying one part of one balance item is written out as: what it was for, plus the
+ * payment it came in with.
+ */
+export function getBalanceItemPaymentColumns(): XlsxTransformerColumn<PaymentWithItem>[] {
+    return [
+        ...getBalanceItemColumns(),
+
+        // Repeating columns need to de-transform again
+        ...[
+            ...getGeneralColumns(),
+            ...getInvoiceColumns(),
+            ...getPayingOrganizationColumns(),
+        ].map((c) => {
+            if ('match' in c) {
+                return {
+                    ...c,
+                    match: (id: string) => {
+                        const result = c.match(id);
+                        if (!result) {
+                            return result;
+                        }
+
+                        return result.map(cc => ({
+                            ...cc,
+                            getValue: (object: PaymentWithItem) => {
+                                return cc.getValue(object.payment);
+                            },
+                        }));
+                    },
+                };
+            }
+
+            return {
+                ...c,
+                getValue: (object: PaymentWithItem) => {
+                    return c.getValue(object.payment);
+                },
+            };
+        }),
+    ];
+}
+
 export function expandPaymentBalanceItemPayments(
     payment: PaymentGeneral,
     orderMap: Map<string, PaymentExportOrder>,

package/src/helpers/StripeInvoicer.ts

@@ -317,7 +317,7 @@ export class StripeReportInvoicer {
             const balanceItemPayment = new BalanceItemPayment();
             balanceItemPayment.balanceItemId = balanceItem.id;
             balanceItemPayment.paymentId = payment.id;
-            balanceItemPayment.organizationId = organization.id;
+            balanceItemPayment.organizationId = payment.organizationId;
             balanceItemPayment.price = balanceItem.priceWithVAT;
             await balanceItemPayment.save();
         }

package/src/helpers/TwoFactorHelper.ts

@@ -1,4 +1,5 @@
 import { SimpleError } from '@simonbackx/simple-errors';
+import type { I18n } from '@stamhoofd/backend-i18n/I18n';
 import type { User } from '@stamhoofd/models';
 import { MFARecoveryCode, MFATOTP, MFAToken, Organization, Platform, RateLimiter, Token, WebauthnCredential } from '@stamhoofd/models';
 import type { User as UserStruct } from '@stamhoofd/structures';
@@ -6,6 +7,7 @@ import { MFAChallengeResponse, MFAEnrollmentResult, MFAMethodType, MFASetupRespo
 
 import type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
 
+import { PasswordForgotService } from '../services/PasswordForgotService.js';
 import { RecoveryCodeHelper } from './RecoveryCodeHelper.js';
 import { WebauthnHelper } from './WebauthnHelper.js';
 import { Formatter, Sorter } from '@stamhoofd/utility';
@@ -29,6 +31,34 @@ export const mfaVerificationRateLimiter = new RateLimiter({
     ],
 });
 
+/**
+ * An admin who has to enroll a second factor, but never did, first has to prove they still
+ * read the email address on the account when they were inactive for this long. A dormant
+ * account is the one most likely to have a leaked or reused password, and enrolling a
+ * factor with only that password would hand the account to whoever holds it — protected by
+ * the very second factor the organization asked for.
+ */
+export const INACTIVE_ADMIN_ENROLLMENT_DAYS = 45;
+
+/**
+ * The confirmation email is triggered by a login attempt, so cap how often one account can
+ * send it: whoever knows the password could otherwise flood the mailbox. Like every rate
+ * limiter here this counts per process and in a window shared by all keys, so it thins out
+ * a flood rather than enforcing an exact number of emails.
+ */
+const enrollmentConfirmationRateLimiter = new RateLimiter({
+    limits: [
+        {
+            limit: 3,
+            duration: 60 * 60 * 1000,
+        },
+        {
+            limit: 10,
+            duration: 24 * 60 * 60 * 1000,
+        },
+    ],
+});
+
 /**
  * What still has to happen before a session may be issued for a user whose primary
  * credential was just accepted.
@@ -36,7 +66,8 @@ export const mfaVerificationRateLimiter = new RateLimiter({
 export type SecondFactorRequirement
     = | { type: 'none' }
         | { type: 'challenge'; challenge: MFAChallengeResponse }
-        | { type: 'setup'; setupToken: MFAToken };
+        | { type: 'setup'; setupToken: MFAToken }
+        | { type: 'confirm-email' };
 
 export class TwoFactorHelper {
     /**
@@ -87,21 +118,35 @@ export class TwoFactorHelper {
         return false;
     }
 
+    /**
+     * Whether the account was unused for long enough that its password alone is no longer
+     * enough to start a forced enrollment. Accounts that never signed in fall back to their
+     * creation date, so an admin who was just invited is not locked out right away.
+     */
+    static isInactiveForEnrollment(user: User): boolean {
+        const lastActiveAt = user.lastActiveAt ?? user.createdAt;
+        return lastActiveAt.getTime() < Date.now() - INACTIVE_ADMIN_ENROLLMENT_DAYS * 24 * 60 * 60 * 1000;
+    }
+
     /**
      * What still has to happen before a session may be handed out, after a primary
      * credential was accepted.
      *
      * `loginMethod` describes the credential that was just verified:
-     *  - 'password': a password, password token or email verification code. All of these
-     *    are single credentials owned by the user, so a required second factor must be
-     *    set up here if the user does not have one yet.
+     *  - 'password': the account password. A single credential that says nothing about
+     *    whether the user still reads the email address on the account, so a required
+     *    second factor must be set up here if the user does not have one yet — and a
+     *    long-inactive admin has to confirm their email address before they may.
+     *  - 'email': a password token or email verification code. Also a single credential,
+     *    but one that only reaches someone who reads the account's email, so it is the way
+     *    out of that email confirmation.
      *  - 'sso': an external identity provider already authenticated the user, and is
      *    trusted to apply its own second factor. An enrolled factor is still verified
      *    (the user asked us to protect their account), but we do not force enrollment —
      *    unless the account ALSO has a password, because then the password remains a way
      *    in that bypasses whatever the provider enforces.
      */
-    static async getSecondFactorRequirement(user: User, organization: Organization | null, { loginMethod }: { loginMethod: 'password' | 'sso' }): Promise<SecondFactorRequirement> {
+    static async getSecondFactorRequirement(user: User, organization: Organization | null, { loginMethod }: { loginMethod: 'password' | 'email' | 'sso' }): Promise<SecondFactorRequirement> {
         if (await TwoFactorHelper.userHasFactors(user.id)) {
             return { type: 'challenge', challenge: await TwoFactorHelper.createLoginChallenge(user) };
         }
@@ -111,17 +156,43 @@ export class TwoFactorHelper {
         }
 
         if (await TwoFactorHelper.isTwoFactorRequired(user, organization)) {
+            if (loginMethod === 'password' && TwoFactorHelper.isInactiveForEnrollment(user)) {
+                return { type: 'confirm-email' };
+            }
             return { type: 'setup', setupToken: await MFAToken.createFor(user.id, 'setup') };
         }
 
         return { type: 'none' };
     }
 
+    /**
+     * Send the password recovery link a long-inactive admin needs to get back to enrolling
+     * their second factor. Never throws: the login is blocked either way, and turning a
+     * mail failure into a 500 would only hide why the user cannot sign in.
+     */
+    static async sendEnrollmentConfirmationEmail(user: User, organization: Organization | null, i18n: I18n): Promise<void> {
+        try {
+            enrollmentConfirmationRateLimiter.track(user.id);
+        }
+        catch {
+            // Sent often enough already.
+            return;
+        }
+
+        try {
+            await PasswordForgotService.sendPasswordRecoveryEmail(user, organization, i18n);
+        }
+        catch (e) {
+            console.error('Could not send the two-factor enrollment confirmation email', e);
+        }
+    }
+
     /**
      * Enforce the second-factor / forced-enrollment step after a successful primary
      * authentication (password login, password-reset token, email verification). Throws a
-     * `require_mfa` or `require_mfa_setup` error when the user must still complete a second
-     * factor before a session may be issued; returns normally when the login may proceed.
+     * `require_mfa`, `require_mfa_setup` or `require_email_confirmation` error when the user
+     * must still do something before a session may be issued; returns normally when the
+     * login may proceed. The last one also emails the user the link they need to get past it.
      *
      * This MUST be called from every path that mints a full session from a single primary
      * credential, otherwise that path becomes an MFA bypass. The SSO callback is a redirect
@@ -132,8 +203,19 @@ export class TwoFactorHelper {
      * whoever holds the link could enroll one and get a session anyway, and the client
      * needs a session to let the user choose a password before enrolling.
      */
-    static async assertSecondFactorOrThrow(user: User, organization: Organization | null, version: number, { allowTemporarySession = false }: { allowTemporarySession?: boolean } = {}): Promise<void> {
-        const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: 'password' });
+    static async assertSecondFactorOrThrow(user: User, organization: Organization | null, version: number, { loginMethod, i18n, allowTemporarySession = false }: { loginMethod: 'password' | 'email'; i18n: I18n; allowTemporarySession?: boolean }): Promise<void> {
+        const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod });
+
+        if (requirement.type === 'confirm-email') {
+            await TwoFactorHelper.sendEnrollmentConfirmationEmail(user, organization, i18n);
+
+            throw new SimpleError({
+                code: 'require_email_confirmation',
+                message: 'Email confirmation required before two-factor authentication setup',
+                human: $t('Je account is beheerder en moet beveiligd worden met tweestapsverificatie, maar je logde al meer dan {days} dagen niet meer in. Bevestig eerst je e-mailadres: we stuurden je een e-mail met een link waarmee je opnieuw toegang krijgt en tweestapsverificatie kan instellen. Kreeg je geen e-mail? Dan kan je ook een nieuwe link aanvragen via wachtwoord vergeten.', { days: INACTIVE_ADMIN_ENROLLMENT_DAYS.toString() }),
+                statusCode: 403,
+            });
+        }
 
         if (requirement.type === 'challenge') {
             throw new SimpleError({