@stamhoofd/backend 2.143.1 → 2.145.0

package/src/helpers/StripeSettlementSync.test.ts

@@ -662,91 +662,6 @@ describe('StripeSettlementSync', () => {
         expect(after).toEqual(rowIds);
     });
 
-    test('a payment that moved to another payout is swept', async () => {
-        const payment = await createPayment();
-        const otherPayment = await createPayment({ price: 50_00_00 });
-        const payout = stripeMocker.createPayout({ amount: 15000, arrivalDate, stripeAccount: stripeAccount.accountId });
-
-        stripeMocker.createBalanceTransaction({
-            type: 'payment',
-            amount: 10000,
-            created,
-            payout: payout.id,
-            stripeAccount: stripeAccount.accountId,
-            source: stripeMocker.createChargeObject({ metadata: { payment: payment.id } }),
-        });
-        const moved = stripeMocker.createBalanceTransaction({
-            type: 'payment',
-            amount: 5000,
-            created,
-            payout: payout.id,
-            stripeAccount: stripeAccount.accountId,
-            source: stripeMocker.createChargeObject({ metadata: { payment: otherPayment.id } }),
-        });
-
-        const sync = createConnectedSync();
-        expect(await sync.syncPayouts({ start })).toEqual({ synced: 1, skipped: 0, failed: 0 });
-
-        const settlement = await getSettlement(payout);
-        expect(await PaymentSettlement.select().where('settlementId', settlement.id).count()).toBe(2);
-
-        // Stripe moved the second payment to a later payout
-        moved.payout = stripeMocker.createId('po');
-        payout.amount = 10000;
-
-        expect(await sync.syncPayouts({ start, force: true })).toEqual({ synced: 1, skipped: 0, failed: 0 });
-
-        const lines = await PaymentSettlement.select().where('settlementId', settlement.id).fetch();
-        expect(lines).toHaveLength(1);
-        expect(lines[0].paymentId).toBe(payment.id);
-        expect((await getSettlement(payout)).unexplainedAmount).toBe(0);
-    });
-
-    test('an application fee that moved to another payout is only unlinked', async () => {
-        const payment = await createPayment();
-        const payout = stripeMocker.createPayout({ amount: 250, arrivalDate });
-        const movedFee = stripeMocker.createBalanceTransaction({
-            type: 'application_fee',
-            amount: 250,
-            created,
-            payout: payout.id,
-            source: stripeMocker.createApplicationFee({
-                amount: 250,
-                account: stripeAccount.accountId,
-                originatingTransaction: stripeMocker.createChargeObject({ metadata: { payment: payment.id, serviceFee: '30' } }),
-            }),
-        });
-
-        const sync = createSync();
-        expect(await sync.syncPayouts({ start })).toEqual({ synced: 1, skipped: 0, failed: 0 });
-
-        const settlement = await getSettlement(payout);
-        const applicationFeeId = ((movedFee.source as StripeObject)).id;
-        expect(await ApplicationFee.select().where('settlementId', settlement.id).count()).toBe(2);
-
-        movedFee.payout = stripeMocker.createId('po');
-        payout.amount = 0;
-
-        expect(await sync.syncPayouts({ start, force: true })).toEqual({ synced: 1, skipped: 0, failed: 0 });
-
-        // The fee rows outlive the payout: they are only unlinked, and so are the deduction
-        // charges they point at (a foreign key forbids deleting those)
-        const fees = await ApplicationFee.select().where('externalId', applicationFeeId).fetch();
-        expect(fees).toHaveLength(2);
-        for (const fee of fees) {
-            expect(fee.settlementId).toBeNull();
-        }
-        const deductions = await SettlementCharge.select().where('applicationFeeId', applicationFeeId).fetch();
-        expect(deductions).toHaveLength(2);
-        for (const row of deductions) {
-            expect(row.settlementId).toBeNull();
-        }
-
-        const after = await getSettlement(payout);
-        expect(after.unexplainedAmount).toBe(0);
-        expect(after.pendingFees).toBe(0);
-    });
-
     describe('Payers we can no longer reach', () => {
         /**
          * A platform payout that only receives one application fee, plus the payout transaction.

package/src/helpers/StripeSettlementSync.ts

@@ -12,10 +12,10 @@ import { SettlementStatus } from '@stamhoofd/structures/settlements/SettlementSt
 import Stripe from 'stripe';
 
 import { ApplicationFeeService } from '../services/ApplicationFeeService.js';
-import { ReportedRows, SettlementService } from '../services/SettlementService.js';
+import { SettlementService } from '../services/SettlementService.js';
 import { ApplicationFeeDetails } from './ApplicationFeeDetails.js';
-import { passthroughFetch } from './passthroughFetch.js';
 import { getPaymentIdForStripeCharge } from './getPaymentIdForStripeCharge.js';
+import { passthroughFetch } from './passthroughFetch.js';
 import { WebmasterReport } from './WebmasterReport.js';
 
 /**
@@ -109,8 +109,7 @@ export class StripeSettlementSync {
     }
 
     /**
-     * Sync all paid payouts that arrived in the window. A failing payout is marked, reported and
-     * skipped so the other payouts still sync; the summary tells the caller how bad it was.
+     * Sync all paid payouts that arrived in the window.
      */
     async syncPayouts({ start, end, force = false, abort }: { start: Date; end?: Date; force?: boolean; abort?: AbortSignal }): Promise<{ synced: number; skipped: number; failed: number }> {
         const result = { synced: 0, skipped: 0, failed: 0 };
@@ -180,7 +179,7 @@ export class StripeSettlementSync {
 
         // Storing a fee can link it to a balance item right away (a month the legacy invoicer
         // billed). When it is already paid out, its payout needs the derived line for it
-        const invoicedFeeBalanceItemIds = new Set<string>();
+        const settledApplicationFeeBalanceItems = new Set<string>();
 
         try {
             for await (const transaction of this.stripe.balanceTransactions.list({
@@ -195,7 +194,7 @@ export class StripeSettlementSync {
                 abort?.throwIfAborted();
 
                 try {
-                    await this.#handleApplicationFee(transaction, { invoicedFeeBalanceItemIds });
+                    await this.#handleApplicationFee(transaction, { settledApplicationFeeBalanceItems });
                 } catch (e) {
                     // The month is only invoiced after a walk without errors, so an interrupted
                     // walk has to stop the walk itself instead of joining the errors of its
@@ -209,11 +208,11 @@ export class StripeSettlementSync {
         } catch (e) {
             // The payouts of the fees stored so far still need their derived lines, but failing to
             // update them may not hide what broke the walk
-            await SettlementService.updatePaymentSettlementsForAccountDeductionBalanceItems([...invoicedFeeBalanceItemIds]).catch(console.error);
+            await SettlementService.updatePaymentSettlementsForApplicationFeeBalanceItems([...settledApplicationFeeBalanceItems]).catch(console.error);
             throw e;
         }
 
-        await SettlementService.updatePaymentSettlementsForAccountDeductionBalanceItems([...invoicedFeeBalanceItemIds]);
+        await SettlementService.updatePaymentSettlementsForApplicationFeeBalanceItems([...settledApplicationFeeBalanceItems]);
 
         if (errors.length > 0) {
             throw new SimpleError({
@@ -234,7 +233,7 @@ export class StripeSettlementSync {
          * be updated afterwards. Filled while storing, not from the return value: a fee that is
          * stored before a later one throws still needs its derived line.
          */
-        invoicedFeeBalanceItemIds?: Set<string>;
+        settledApplicationFeeBalanceItems?: Set<string>;
     } = {}): Promise<{ fees: ApplicationFee[]; charges: SettlementCharge[] }> {
         const fee = transaction.source as Stripe.ApplicationFee;
         const payingAccountId = typeof fee.account === 'string' ? fee.account : fee.account.id;
@@ -317,7 +316,7 @@ export class StripeSettlementSync {
             // An invoiced fee is explained by the derived line of its fee payment instead of by
             // itself, so the payouts it sits in have to rebuild those lines
             if (storedFee.balanceItemId && storedFee.settlementId) {
-                options.invoicedFeeBalanceItemIds?.add(storedFee.balanceItemId);
+                options.settledApplicationFeeBalanceItems?.add(storedFee.balanceItemId);
             }
         }
 
@@ -467,12 +466,11 @@ export class StripeSettlementSync {
     }
 
     async #walkPayout(payout: Stripe.Payout, settlement: Settlement, abort: AbortSignal) {
-        const reported = new ReportedRows();
         let transactionCount = 0;
 
-        // Invoiced fees linked to or unlinked from this settlement during the walk: their fee
-        // payments' derived lines must follow
-        const invoicedFeeBalanceItemIds = new Set<string>();
+        // Keep track of all balance items linked to (settled) application fees that are created or updated.
+        // So we can update the settlement status of the associated payments
+        const settledApplicationFeeBalanceItems = new Set<string>();
 
         try {
             for await (const transaction of this.stripe.balanceTransactions.list({
@@ -482,67 +480,51 @@ export class StripeSettlementSync {
                     ? ['data.source', 'data.source.application_fee', 'data.source.application_fee.originating_transaction', 'data.source.charge']
                     : ['data.source', 'data.source.originating_transaction', 'data.source.charge'],
             })) {
-                // Between two transactions is a safe point to stop: only a complete walk sweeps
-                // and marks the settlement synced, so an interrupted one is re-walked from scratch
                 abort.throwIfAborted();
 
                 transactionCount += 1;
-                await this.#handleTransaction(transaction, settlement, reported, invoicedFeeBalanceItemIds);
+                await this.#handleTransaction(transaction, settlement, settledApplicationFeeBalanceItems);
             }
 
-            // Stripe reported nothing for money that did move: storing that as a complete sync
-            // would silently hide the whole payout
             if (transactionCount === 0 && settlement.amount !== 0) {
                 throw new SimpleError({
                     code: 'empty_payout',
                     message: 'Payout ' + payout.id + ' of ' + settlement.amount + ' has no balance transactions',
                 });
             }
-
-            // Only a complete walk may sweep: it can't tell a row that moved away from one this
-            // walk never reached
-            const { unlinkedFees } = await SettlementService.sweepSettlement(settlement, reported);
-            for (const fee of unlinkedFees) {
-                if (fee.balanceItemId) {
-                    invoicedFeeBalanceItemIds.add(fee.balanceItemId);
-                }
-            }
         } catch (e) {
             // The fee payments still follow the fees this walk linked before it broke (a fee may
             // never sit in a payout that has no line for it), but failing to update them may not
             // hide what broke the walk
-            await SettlementService.updatePaymentSettlementsForAccountDeductionBalanceItems([...invoicedFeeBalanceItemIds]).catch(console.error);
+            await SettlementService.updatePaymentSettlementsForApplicationFeeBalanceItems([...settledApplicationFeeBalanceItems]).catch(console.error);
             throw e;
         }
 
-        await SettlementService.updatePaymentSettlementsForAccountDeductionBalanceItems([...invoicedFeeBalanceItemIds]);
+        await SettlementService.updatePaymentSettlementsForApplicationFeeBalanceItems([...settledApplicationFeeBalanceItems]);
         await SettlementService.finishSync(settlement, { transactionCount });
     }
 
-    async #handleTransaction(transaction: Stripe.BalanceTransaction, settlement: Settlement, reported: ReportedRows, invoicedFeeBalanceItemIds: Set<string>) {
+    async #handleTransaction(transaction: Stripe.BalanceTransaction, settlement: Settlement, settledApplicationFeeBalanceItems: Set<string>) {
         const occurredAt = new Date(transaction.created * 1000);
 
-        // A plain string switch: the pinned SDK's type union misses some real-world types
-        // (e.g. network_cost)
         switch (transaction.type as string) {
             case 'charge':
             case 'payment': {
                 const payment = await this.#resolvePayment(transaction);
 
-                // A destination charge only passes through our balance on its way to the
-                // organization: its own payout settles it, ours stays out of it
-                if (payment.organizationId !== settlement.organizationId) {
-                    await this.#storePaidFeesForTransaction(transaction, settlement, reported, { paymentId: null });
+                if (!payment || payment.organizationId !== settlement.organizationId) {
+                    // Destination charge via the platform
+                    await this.#storePaidFeesForTransaction(transaction, settlement, { paymentId: null });
                     return;
                 }
 
-                reported.paymentLine(await SettlementService.upsertPaymentLine(settlement, {
+                await SettlementService.upsertPaymentLine(settlement, {
                     paymentId: payment.id,
                     amount: transaction.amount * 100,
                     externalId: transaction.id,
                     occurredAt,
-                }));
-                await this.#storePaidFeesForTransaction(transaction, settlement, reported, { paymentId: payment.id });
+                });
+                await this.#storePaidFeesForTransaction(transaction, settlement, { paymentId: payment.id });
                 await this.#updateTransferFee(transaction, settlement, payment);
                 await SettlementService.updateLegacySettlementReference(payment);
                 return;
@@ -559,30 +541,28 @@ export class StripeSettlementSync {
                 const isReturned = transaction.type === 'refund_failure';
                 const refunded = await this.#resolveRefundedPayment(transaction);
 
-                // The reverse of the pass-through above: refunding another organization's payment
-                // only moves the money back through our balance
                 if (refunded.organizationId !== settlement.organizationId) {
-                    await this.#storePaidFeesForTransaction(transaction, settlement, reported, { paymentId: null });
+                    // Destination charge via the platform
+                    await this.#storePaidFeesForTransaction(transaction, settlement, { paymentId: null });
                     return;
                 }
 
                 const payment = await this.#resolveReversingPayment(transaction, refunded, { negated: isReturned });
-                reported.paymentLine(await SettlementService.upsertPaymentLine(settlement, {
+                await SettlementService.upsertPaymentLine(settlement, {
                     paymentId: payment.id,
                     amount: transaction.amount * 100,
                     externalId: transaction.id,
                     occurredAt,
-                }));
-                await this.#storePaidFeesForTransaction(transaction, settlement, reported, { paymentId: payment.id });
+                });
+                await this.#storePaidFeesForTransaction(transaction, settlement, { paymentId: payment.id });
                 await SettlementService.updateLegacySettlementReference(payment);
                 return;
             }
 
             case 'application_fee': {
                 // The fee rows, now linked to the platform payout that contains them
-                const { fees } = await this.#handleApplicationFee(transaction, { settlementId: settlement.id, invoicedFeeBalanceItemIds });
-                reported.applicationFees(fees);
-                await this.#storePaidFeesForTransaction(transaction, settlement, reported, { paymentId: null });
+                await this.#handleApplicationFee(transaction, { settlementId: settlement.id, settledApplicationFeeBalanceItems });
+                await this.#storePaidFeesForTransaction(transaction, settlement, { paymentId: null });
                 return;
             }
 
@@ -612,7 +592,7 @@ export class StripeSettlementSync {
             case 'stripe_fee':
             case 'network_cost':
             case 'tax_fee': {
-                const charge = await SettlementService.upsertCharge({
+                await SettlementService.upsertCharge({
                     type: transaction.type === 'tax_fee' ? SettlementChargeType.Tax : SettlementChargeType.ProviderAccountFee,
                     externalId: transaction.id,
                     amount: transaction.amount * 100,
@@ -622,7 +602,6 @@ export class StripeSettlementSync {
                     description: transaction.description ?? '',
                     occurredAt,
                 });
-                reported.charge(charge);
                 return;
             }
 
@@ -630,7 +609,7 @@ export class StripeSettlementSync {
             case 'reserved_funds':
             case 'reserve_hold':
             case 'reserve_release': {
-                const charge = await SettlementService.upsertCharge({
+                await SettlementService.upsertCharge({
                     type: SettlementChargeType.Reserve,
                     externalId: transaction.id,
                     amount: transaction.amount * 100,
@@ -639,14 +618,13 @@ export class StripeSettlementSync {
                     description: transaction.description ?? '',
                     occurredAt,
                 });
-                reported.charge(charge);
                 return;
             }
 
             case 'adjustment':
             case 'payment_reversal': {
                 const paymentId = await this.#tryResolveAdjustmentPayment(transaction, settlement);
-                const charge = await SettlementService.upsertCharge({
+                await SettlementService.upsertCharge({
                     type: SettlementChargeType.Adjustment,
                     externalId: transaction.id,
                     amount: transaction.amount * 100,
@@ -657,8 +635,7 @@ export class StripeSettlementSync {
                     description: transaction.description ?? '',
                     occurredAt,
                 });
-                reported.charge(charge);
-                await this.#storePaidFeesForTransaction(transaction, settlement, reported, { paymentId });
+                await this.#storePaidFeesForTransaction(transaction, settlement, { paymentId });
                 return;
             }
 
@@ -672,7 +649,7 @@ export class StripeSettlementSync {
             case 'connect_collection_transfer':
             case 'stripe_balance_payment_debit':
             case 'stripe_balance_payment_debit_reversal': {
-                const charge = await SettlementService.upsertCharge({
+                await SettlementService.upsertCharge({
                     type: SettlementChargeType.BalanceMovement,
                     externalId: transaction.id,
                     amount: transaction.amount * 100,
@@ -681,8 +658,7 @@ export class StripeSettlementSync {
                     description: transaction.description ?? transaction.type,
                     occurredAt,
                 });
-                reported.charge(charge);
-                await this.#storePaidFeesForTransaction(transaction, settlement, reported, { paymentId: null });
+                await this.#storePaidFeesForTransaction(transaction, settlement, { paymentId: null });
                 return;
             }
 
@@ -703,7 +679,7 @@ export class StripeSettlementSync {
      * connected account also the application fee we charged. The amounts always come from the
      * balance transaction itself.
      */
-    async #storePaidFeesForTransaction(transaction: Stripe.BalanceTransaction, settlement: Settlement, reported: ReportedRows, { paymentId }: { paymentId: string | null }) {
+    async #storePaidFeesForTransaction(transaction: Stripe.BalanceTransaction, settlement: Settlement, { paymentId }: { paymentId: string | null }) {
         const occurredAt = new Date(transaction.created * 1000);
 
         for (const [index, detail] of (transaction.fee_details ?? []).entries()) {
@@ -712,11 +688,11 @@ export class StripeSettlementSync {
             }
 
             if (detail.type === 'application_fee') {
-                await this.#storePaidApplicationFeeForTransaction(transaction, detail, settlement, reported, { paymentId });
+                await this.#storePaidApplicationFeeForTransaction(transaction, detail, settlement, { paymentId });
                 continue;
             }
 
-            const charge = await SettlementService.upsertCharge({
+            await SettlementService.upsertCharge({
                 type: getFeeDetailType(detail, transaction),
                 externalId: transaction.id + ':fee:' + index,
                 amount: -detail.amount * 100,
@@ -729,7 +705,6 @@ export class StripeSettlementSync {
                 description: detail.description ?? '',
                 occurredAt,
             });
-            reported.charge(charge);
         }
     }
 
@@ -740,7 +715,7 @@ export class StripeSettlementSync {
      * applicationFeeId both sides of one kind sum to zero. This walk fills their settlementId; the
      * rows themselves usually already exist (created by the fee walk).
      */
-    async #storePaidApplicationFeeForTransaction(transaction: Stripe.BalanceTransaction, detail: Stripe.BalanceTransaction.FeeDetail, settlement: Settlement, reported: ReportedRows, { paymentId }: { paymentId: string | null }) {
+    async #storePaidApplicationFeeForTransaction(transaction: Stripe.BalanceTransaction, detail: Stripe.BalanceTransaction.FeeDetail, settlement: Settlement, { paymentId }: { paymentId: string | null }) {
         if (!this.stripeAccount) {
             throw new SimpleError({
                 code: 'unexpected_application_fee_detail',
@@ -803,7 +778,6 @@ export class StripeSettlementSync {
                 stripeAccountId: this.stripeAccount.id,
                 occurredAt,
             });
-            reported.charge(charge);
 
             // What the organization pays here is what we receive on the other side. The two are
             // written from different Stripe transactions, so a divergence would silently bill the
@@ -852,7 +826,7 @@ export class StripeSettlementSync {
         await payment.save();
     }
 
-    async #resolvePayment(transaction: Stripe.BalanceTransaction): Promise<Payment> {
+    async #resolvePayment(transaction: Stripe.BalanceTransaction): Promise<Payment | null> {
         const source = transaction.source;
         if (!source || typeof source === 'string' || source.object !== 'charge') {
             throw new SimpleError({
@@ -874,10 +848,13 @@ export class StripeSettlementSync {
 
         const payment = await Payment.getByID(paymentId);
         if (!payment) {
-            throw new SimpleError({
-                code: 'payment_not_found',
-                message: 'Payment ' + paymentId + ' referenced by charge ' + source.id + ' does not exist',
-            });
+            // Probably deleted
+
+            return null;
+            // throw new SimpleError({
+            //     code: 'payment_not_found',
+            //     message: 'Payment ' + paymentId + ' referenced by charge ' + source.id + ' does not exist',
+            // });
         }
 
         this.#assertPaymentScope(payment, source.id);

package/src/helpers/TwoFactorHelper.ts

@@ -1,13 +1,14 @@
 import { SimpleError } from '@simonbackx/simple-errors';
 import type { I18n } from '@stamhoofd/backend-i18n/I18n';
-import type { User } from '@stamhoofd/models';
-import { MFARecoveryCode, MFATOTP, MFAToken, Organization, Platform, RateLimiter, Token, WebauthnCredential } from '@stamhoofd/models';
+import type { User, Token } from '@stamhoofd/models';
+import { MFARecoveryCode, MFATOTP, MFAToken, Organization, Platform, RateLimiter, WebauthnCredential } from '@stamhoofd/models';
 import type { User as UserStruct } from '@stamhoofd/structures';
-import { MFAChallengeResponse, MFAEnrollmentResult, MFAMethodType, MFASetupResponse, MFAStatus, PasskeyCredential, RecoveryCodes, TOTPCredential, Token as TokenStruct } from '@stamhoofd/structures';
+import { MFAChallengeResponse, MFAEnrollmentResult, MFAMethodType, MFASetupResponse, MFAStatus, PasskeyCredential, RecoveryCodes, SessionLoginMethod, TOTPCredential, Token as TokenStruct } from '@stamhoofd/structures';
 
 import type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
 
 import { PasswordForgotService } from '../services/PasswordForgotService.js';
+import { SessionService } from '../services/SessionService.js';
 import { RecoveryCodeHelper } from './RecoveryCodeHelper.js';
 import { WebauthnHelper } from './WebauthnHelper.js';
 import { Formatter, Sorter } from '@stamhoofd/utility';
@@ -133,33 +134,33 @@ export class TwoFactorHelper {
      * credential was accepted.
      *
      * `loginMethod` describes the credential that was just verified:
-     *  - 'password': the account password. A single credential that says nothing about
+     *  - Password: the account password. A single credential that says nothing about
      *    whether the user still reads the email address on the account, so a required
      *    second factor must be set up here if the user does not have one yet — and a
      *    long-inactive admin has to confirm their email address before they may.
-     *  - 'email': a password token or email verification code. Also a single credential,
+     *  - Email: a password token or email verification code. Also a single credential,
      *    but one that only reaches someone who reads the account's email, so it is the way
      *    out of that email confirmation.
-     *  - 'sso': an external identity provider already authenticated the user, and is
+     *  - SSO: an external identity provider already authenticated the user, and is
      *    trusted to apply its own second factor. An enrolled factor is still verified
      *    (the user asked us to protect their account), but we do not force enrollment —
      *    unless the account ALSO has a password, because then the password remains a way
      *    in that bypasses whatever the provider enforces.
      */
-    static async getSecondFactorRequirement(user: User, organization: Organization | null, { loginMethod }: { loginMethod: 'password' | 'email' | 'sso' }): Promise<SecondFactorRequirement> {
+    static async getSecondFactorRequirement(user: User, organization: Organization | null, { loginMethod }: { loginMethod: SessionLoginMethod }): Promise<SecondFactorRequirement> {
         if (await TwoFactorHelper.userHasFactors(user.id)) {
-            return { type: 'challenge', challenge: await TwoFactorHelper.createLoginChallenge(user) };
+            return { type: 'challenge', challenge: await TwoFactorHelper.createLoginChallenge(user, { loginMethod }) };
         }
 
-        if (loginMethod === 'sso' && !user.hasPasswordBasedAccount()) {
+        if (loginMethod === SessionLoginMethod.SSO && !user.hasPasswordBasedAccount()) {
             return { type: 'none' };
         }
 
         if (await TwoFactorHelper.isTwoFactorRequired(user, organization)) {
-            if (loginMethod === 'password' && TwoFactorHelper.isInactiveForEnrollment(user)) {
+            if (loginMethod === SessionLoginMethod.Password && TwoFactorHelper.isInactiveForEnrollment(user)) {
                 return { type: 'confirm-email' };
             }
-            return { type: 'setup', setupToken: await MFAToken.createFor(user.id, 'setup') };
+            return { type: 'setup', setupToken: await MFAToken.createFor(user.id, 'setup', { loginMethod }) };
         }
 
         return { type: 'none' };
@@ -173,16 +174,14 @@ export class TwoFactorHelper {
     static async sendEnrollmentConfirmationEmail(user: User, organization: Organization | null, i18n: I18n): Promise<void> {
         try {
             enrollmentConfirmationRateLimiter.track(user.id);
-        }
-        catch {
+        } catch {
             // Sent often enough already.
             return;
         }
 
         try {
             await PasswordForgotService.sendPasswordRecoveryEmail(user, organization, i18n);
-        }
-        catch (e) {
+        } catch (e) {
             console.error('Could not send the two-factor enrollment confirmation email', e);
         }
     }
@@ -203,7 +202,7 @@ export class TwoFactorHelper {
      * whoever holds the link could enroll one and get a session anyway, and the client
      * needs a session to let the user choose a password before enrolling.
      */
-    static async assertSecondFactorOrThrow(user: User, organization: Organization | null, version: number, { loginMethod, i18n, allowTemporarySession = false }: { loginMethod: 'password' | 'email'; i18n: I18n; allowTemporarySession?: boolean }): Promise<void> {
+    static async assertSecondFactorOrThrow(user: User, organization: Organization | null, version: number, { loginMethod, i18n, allowTemporarySession = false }: { loginMethod: SessionLoginMethod.Password | SessionLoginMethod.Email; i18n: I18n; allowTemporarySession?: boolean }): Promise<void> {
         const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod });
 
         if (requirement.type === 'confirm-email') {
@@ -228,7 +227,7 @@ export class TwoFactorHelper {
         }
 
         if (requirement.type === 'setup') {
-            const temporaryToken = allowTemporarySession ? new TokenStruct(await Token.createToken(user, new Date())) : null;
+            const temporaryToken = allowTemporarySession ? new TokenStruct(await SessionService.createSession(user, { loginMethod, authenticatedAt: new Date() })) : null;
 
             throw new SimpleError({
                 code: 'require_mfa_setup',
@@ -313,7 +312,7 @@ export class TwoFactorHelper {
     /**
      * Create a login MFA session token and the challenge payload returned to the client.
      */
-    static async createLoginChallenge(user: User): Promise<MFAChallengeResponse> {
+    static async createLoginChallenge(user: User, { loginMethod }: { loginMethod: SessionLoginMethod }): Promise<MFAChallengeResponse> {
         const { methods, passkeys } = await TwoFactorHelper.getEnrolledMethods(user.id);
 
         let webauthnOptions: PublicKeyCredentialRequestOptionsJSON | null = null;
@@ -323,7 +322,7 @@ export class TwoFactorHelper {
             challenge = webauthnOptions.challenge;
         }
 
-        const mfaToken = await MFAToken.createFor(user.id, 'login', challenge);
+        const mfaToken = await MFAToken.createFor(user.id, 'login', { webauthnChallenge: challenge, loginMethod });
 
         return MFAChallengeResponse.create({
             token: mfaToken.token,
@@ -376,12 +375,12 @@ export class TwoFactorHelper {
         }
 
         // Before minting the new session, so it is never signed out by its own enrollment.
-        await Token.deleteOtherSessions(user.id, currentToken?.accessToken ?? null);
+        await SessionService.deleteOtherSessions({ userId: user.id, keepAccessToken: currentToken?.accessToken ?? null });
 
         let token: TokenStruct | null = null;
         if (setupToken) {
             await setupToken.consume();
-            const t = await Token.createToken(user, new Date());
+            const t = await SessionService.createSession(user, { loginMethod: setupToken.loginMethod, authenticatedAt: new Date() });
             await user.markActive();
             token = new TokenStruct(t);
         }
@@ -403,7 +402,7 @@ export class TwoFactorHelper {
             await MFARecoveryCode.deleteForUser(user.id);
         }
 
-        await Token.deleteOtherSessions(user.id, currentToken?.accessToken ?? null);
+        await SessionService.deleteOtherSessions({ userId: user.id, keepAccessToken: currentToken?.accessToken ?? null });
 
         return await TwoFactorHelper.buildStatus(user);
     }

package/src/helpers/streamForBreakdown.ts

@@ -14,7 +14,7 @@ import { fetchToAsyncIterator } from './fetchToAsyncIterator.js';
  * They are read page by page and added up right away, so they are never all in memory at once. Above
  * this many objects a breakdown takes too long to wait for, so we ask the user to narrow down instead.
  */
-export const MAX_BREAKDOWN_OBJECTS = 10000;
+export const MAX_BREAKDOWN_OBJECTS = 50_000;
 
 const PAGE_SIZE = 100;
 

package/src/services/AdminSessionService.ts

@@ -1,4 +1,6 @@
-import { Token, User } from '@stamhoofd/models';
+import { User } from '@stamhoofd/models';
+
+import { SessionService } from './SessionService.js';
 
 /**
  * Signs out administrators in bulk.
@@ -25,7 +27,7 @@ export class AdminSessionService {
      */
     static async signOutOrganizationAdmins(organizationId: string, keepAccessToken: string | null): Promise<number> {
         const admins = await User.getAdmins(organizationId);
-        return await Token.deleteForUsers(admins.map(a => a.id), keepAccessToken);
+        return await SessionService.deleteForUsers({ userIds: admins.map(a => a.id), keepAccessToken });
     }
 
     /**
@@ -36,6 +38,6 @@ export class AdminSessionService {
      */
     static async signOutPlatformAdmins(keepAccessToken: string | null): Promise<number> {
         const admins = await User.getPlatformAdmins();
-        return await Token.deleteForUsers(admins.map(a => a.id), keepAccessToken);
+        return await SessionService.deleteForUsers({ userIds: admins.map(a => a.id), keepAccessToken });
     }
 }

package/src/services/InvoiceService.ts

@@ -6,7 +6,7 @@ import { InvoiceCounter } from '@stamhoofd/models/helpers/InvoiceCounter.js';
 import type { Invoice as InvoiceStruct } from '@stamhoofd/structures';
 import { EmailTemplateType, PaymentStatus, Recipient, Replacement } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
-import { ViesHelper } from '../helpers/ViesHelper.js';
+import { ViesService } from '@stamhoofd/vies';
 import { WebmasterReport } from '../helpers/WebmasterReport.js';
 import { ApplicationFeeService } from './ApplicationFeeService.js';
 import { BalanceItemService } from './BalanceItemService.js';
@@ -35,7 +35,7 @@ export class InvoiceService {
         model.customer = struct.customer;
 
         if (model.customer.company) {
-            await ViesHelper.checkCompany(model.customer.company, model.customer.company);
+            await ViesService.checkCompany(model.customer.company, null, { forceValidation: true });
         }
 
         struct.updatePrices();