@stamhoofd/backend 2.143.1 → 2.145.0

package/src/services/SessionService.ts

@@ -0,0 +1,357 @@
+import { Database } from '@simonbackx/simple-database';
+import { SimpleError } from '@simonbackx/simple-errors';
+import { Token, User, UserSession } from '@stamhoofd/models';
+import type { SessionDurations, SessionType } from '@stamhoofd/models/constants/sessions.js';
+import { ACCESS_TOKEN_DURATION, SESSION_DURATIONS, SSO_HANDOFF_TOKEN_DURATION } from '@stamhoofd/models/constants/sessions.js';
+import { SQLWhereSign } from '@stamhoofd/sql';
+import { SessionClientType, SessionDeviceType, SessionLoginMethod, SessionOS } from '@stamhoofd/structures';
+import type { SessionMetaData } from '@stamhoofd/structures';
+import crypto from 'crypto';
+import { v4 as uuidv4 } from 'uuid';
+
+import { contextStorage } from '../helpers/ContextStorage.js';
+
+const DAY = 24 * 60 * 60 * 1000;
+const MAX_SESSIONS = 15;
+const API_TOKEN_DURATION = 5 * 365 * DAY;
+
+async function randomBytes(size: number): Promise<Buffer> {
+    return await new Promise((resolve, reject) => {
+        crypto.randomBytes(size, (error, buffer) => error ? reject(error) : resolve(buffer));
+    });
+}
+
+export class SessionService {
+    /**
+     * @param authenticatedAt Pass the current date when a primary credential was verified
+     * as part of this request, so the session counts as "fresh" for sensitive actions.
+     */
+    static async createSession<U extends User>(user: U, { loginMethod = SessionLoginMethod.Password, authenticatedAt = null }: { loginMethod?: SessionLoginMethod; authenticatedAt?: Date | null } = {}): Promise<Token & { user: U }> {
+        const tokenId = uuidv4();
+        const session = await this.createUserSession(user, {
+            tokenId,
+            clientType: this.getClientType(),
+            loginMethod,
+            metaData: this.getMetaData(),
+        });
+        const token = await this.createToken(user, { session, tokenId });
+        token.authenticatedAt = authenticatedAt;
+        this.applyLimits({ token, session, user });
+        await token.save();
+        return token;
+    }
+
+    /**
+     * Used by the SSO callback: that is a browser redirect, so the only way to hand the
+     * session to the client is in the URL. Only the refresh token travels along, and the
+     * client exchanges it for a usable access token.
+     */
+    static async createSSOHandoff<U extends User>(user: U, { clientType = this.getClientType(), metaData = this.getMetaData() }: { clientType?: SessionClientType; metaData?: SessionMetaData } = {}): Promise<Token & { user: U }> {
+        const tokenId = uuidv4();
+        const session = await this.createUserSession(user, { tokenId, clientType, loginMethod: SessionLoginMethod.SSO, metaData });
+        const token = await this.createToken(user, { session, tokenId });
+
+        token.accessTokenValidUntil = new Date(Date.now() - 31 * DAY);
+        token.accessTokenValidUntil.setMilliseconds(0);
+        this.applyLimits({ token, session, user });
+        token.refreshTokenValidUntil = new Date(Math.min(token.refreshTokenValidUntil.getTime(), Date.now() + SSO_HANDOFF_TOKEN_DURATION));
+        token.refreshTokenValidUntil.setMilliseconds(0);
+        await token.save();
+        return token;
+    }
+
+    static async createApiSession<U extends User>(user: U): Promise<Token & { user: U }> {
+        const tokenId = uuidv4();
+        const session = await this.createUserSession(user, {
+            tokenId,
+            clientType: SessionClientType.Browser,
+            loginMethod: SessionLoginMethod.Password,
+            metaData: this.getFallbackMetaData(),
+        });
+        const token = await this.createToken(user, { session, tokenId });
+        token.accessTokenValidUntil = new Date(Date.now() + API_TOKEN_DURATION);
+        token.accessTokenValidUntil.setMilliseconds(0);
+        token.refreshTokenValidUntil = new Date(token.accessTokenValidUntil);
+        await token.save();
+        return token;
+    }
+
+    /**
+     * The new token continues the session of the old one, so it keeps its start date and
+     * cannot outlive it. Using the session is what postpones the inactivity limit.
+     */
+    static async rotateSession<U extends User>(oldToken: Token & { user: U }): Promise<Token & { user: U }> {
+        const session = await UserSession.getByID(oldToken.sessionId);
+        if (!session || session.userId !== oldToken.userId) {
+            throw this.invalidRefreshTokenError();
+        }
+
+        const durations = this.getDurations(session, oldToken.user);
+        if (durations.session !== null && session.startedAt.getTime() + durations.session <= Date.now()) {
+            await oldToken.delete();
+            throw this.invalidRefreshTokenError();
+        }
+
+        const isSSOHandoff = this.isSSOHandoff(oldToken, session);
+        const token = await this.createToken(oldToken.user, { session });
+
+        this.applyLimits({ token, session, user: oldToken.user });
+        await token.save();
+
+        const didRotate = isSSOHandoff
+            ? await this.consumeSSOHandoff({ sessionId: session.id, handoffTokenId: oldToken.id, tokenId: token.id })
+            : await this.replaceLastUsedToken({ sessionId: session.id, previousTokenId: oldToken.id, tokenId: token.id });
+        if (!didRotate) {
+            await token.delete();
+            throw this.invalidRefreshTokenError();
+        }
+
+        const metaData = this.getMetaData();
+        session.appVersion = metaData.appVersion ?? session.appVersion;
+        session.nativeAppVersion = metaData.nativeAppVersion ?? session.nativeAppVersion;
+        session.osVersion = metaData.osVersion ?? session.osVersion;
+        await session.save();
+        return token;
+    }
+
+    private static isSSOHandoff(token: Token, session: UserSession): boolean {
+        // Handoff access tokens expire before they are created; normal access tokens do not.
+        return session.loginMethod === SessionLoginMethod.SSO && token.accessTokenValidUntil < token.createdAt;
+    }
+
+    static async getByRefreshToken(refreshToken: string) {
+        const token = await Token.getByRefreshToken(refreshToken);
+        if (!token || token.user.isApiUser) {
+            return undefined;
+        }
+        if (token.refreshTokenValidUntil < new Date()) {
+            console.error('Detected an expired refresh token, deleting all sessions and tokens for user', token.userId);
+            await UserSession.delete().where('userId', token.userId).delete();
+            await Token.delete().where('userId', token.userId).delete();
+            return undefined;
+        }
+        return token;
+    }
+
+    static async activateToken(token: Token): Promise<boolean> {
+        const [result] = await Database.update(
+            'UPDATE `user_sessions` SET `lastActiveTokenId` = ? WHERE `id` = ? AND `lastUsedTokenId` = ?',
+            [token.id, token.sessionId, token.id],
+        );
+        if (result.affectedRows > 0) {
+            await Database.delete('DELETE FROM `tokens` WHERE `sessionId` = ? AND `id` != ?', [token.sessionId, token.id]);
+            return true;
+        }
+
+        const [sessions] = await Database.select('SELECT `id` FROM `user_sessions` WHERE `id` = ? AND `lastActiveTokenId` = ? LIMIT 1', [token.sessionId, token.id]);
+        return sessions.length > 0;
+    }
+
+    static async endSession(token: Token): Promise<void> {
+        await UserSession.delete().where('id', token.sessionId).delete();
+    }
+
+    static async deleteOtherSessions({ userId, keepAccessToken }: { userId: string; keepAccessToken: string | null }): Promise<number> {
+        const user = await User.getByID(userId);
+        if (user?.isApiUser) {
+            return 0;
+        }
+        return await this.deleteForUsers({ userIds: [userId], keepAccessToken });
+    }
+
+    static async deleteForUsers({ userIds, keepAccessToken }: { userIds: string[]; keepAccessToken: string | null }): Promise<number> {
+        if (userIds.length === 0) {
+            return 0;
+        }
+        const query = Token.delete().where('userId', userIds);
+        if (keepAccessToken) {
+            query.where(Token.primary.name, SQLWhereSign.NotEqual, keepAccessToken);
+        }
+        const { affectedRows } = await query.delete();
+        return affectedRows;
+    }
+
+    static async clearFor({ userId, keepAccessToken }: { userId: string; keepAccessToken: string }): Promise<void> {
+        await Database.delete('DELETE FROM `tokens` WHERE `userId` = ? AND `accessToken` != ?', [userId, keepAccessToken]);
+    }
+
+    private static invalidRefreshTokenError() {
+        return new SimpleError({
+            code: 'invalid_refresh_token',
+            message: 'Invalid refresh token',
+            statusCode: 400,
+        });
+    }
+
+    private static async createToken<U extends User>(user: U, { session, tokenId = uuidv4() }: { session: UserSession; tokenId?: string }): Promise<Token & { user: U }> {
+        if (user.isSystemUser) {
+            throw new SimpleError({
+                code: 'internal_error',
+                message: 'Cannot create token for system user',
+                statusCode: 500,
+            });
+        }
+
+        const token = new Token().setRelation(Token.user, user);
+        token.id = tokenId;
+        token.sessionId = session.id;
+        token.accessTokenValidUntil = new Date(Date.now() + ACCESS_TOKEN_DURATION);
+        token.accessTokenValidUntil.setMilliseconds(0);
+        token.refreshTokenValidUntil = new Date(token.accessTokenValidUntil);
+        token.accessToken = (await randomBytes(192)).toString('base64').toUpperCase();
+        token.refreshToken = (await randomBytes(192)).toString('base64').toUpperCase();
+        return token;
+    }
+
+    private static async createUserSession(user: User, { tokenId, clientType, loginMethod, metaData }: { tokenId: string; clientType: SessionClientType; loginMethod: SessionLoginMethod; metaData: SessionMetaData }): Promise<UserSession> {
+        const session = new UserSession();
+        session.id = uuidv4();
+        session.userId = user.id;
+        session.clientType = clientType;
+        session.loginMethod = loginMethod;
+        session.startedAt = new Date();
+        session.startedAt.setMilliseconds(0);
+        session.lastUsedTokenId = session.lastActiveTokenId = tokenId;
+        this.applyMetaData(session, metaData);
+
+        await Database.delete(
+            'DELETE FROM `user_sessions` WHERE `id` IN (SELECT `id` FROM (SELECT `id` FROM `user_sessions` WHERE `userId` = ? ORDER BY `startedAt` DESC LIMIT ? OFFSET ?) old_sessions)',
+            [user.id, MAX_SESSIONS - 1, MAX_SESSIONS - 1],
+        );
+        await session.save();
+        return session;
+    }
+
+    private static applyMetaData(session: UserSession, metaData: SessionMetaData): void {
+        session.deviceType = metaData.deviceType;
+        session.deviceName = metaData.deviceName;
+        session.osName = metaData.osName;
+        session.osVersion = metaData.osVersion;
+        session.appVersion = metaData.appVersion;
+        session.nativeAppVersion = metaData.nativeAppVersion;
+        session.browserName = metaData.browserName;
+    }
+
+    private static async replaceLastUsedToken({ sessionId, previousTokenId, tokenId }: { sessionId: string; previousTokenId: string; tokenId: string }): Promise<boolean> {
+        const [result] = await Database.update(
+            'UPDATE `user_sessions` SET `lastUsedTokenId` = ? WHERE `id` = ? AND (`lastUsedTokenId` = ? OR `lastActiveTokenId` = ?)',
+            [tokenId, sessionId, previousTokenId, previousTokenId],
+        );
+        if (result.affectedRows === 0) {
+            return false;
+        }
+        await Database.delete('DELETE FROM `tokens` WHERE `sessionId` = ? AND `id` != ? AND `id` != (SELECT `lastActiveTokenId` FROM `user_sessions` WHERE `id` = ?)', [sessionId, tokenId, sessionId]);
+        return true;
+    }
+
+    private static async consumeSSOHandoff({ sessionId, handoffTokenId, tokenId }: { sessionId: string; handoffTokenId: string; tokenId: string }): Promise<boolean> {
+        const [result] = await Database.update(
+            'UPDATE `user_sessions` SET `lastUsedTokenId` = ? WHERE `id` = ? AND `lastUsedTokenId` = ?',
+            [tokenId, sessionId, handoffTokenId],
+        );
+        if (result.affectedRows === 0) {
+            return false;
+        }
+        await Database.delete('DELETE FROM `tokens` WHERE `sessionId` = ? AND `id` != ?', [sessionId, tokenId]);
+        return true;
+    }
+
+    /**
+     * Only read when a session is created: it is a client provided header, and a rotation
+     * has to keep the value of the login instead of trusting the header again.
+     */
+    private static getClientType(): SessionClientType {
+        const platform = contextStorage.getStore()?.request.headers['x-platform'];
+        if (platform === 'ios') {
+            return SessionClientType.iOS;
+        }
+        if (platform === 'android') {
+            return SessionClientType.Android;
+        }
+        return SessionClientType.Browser;
+    }
+
+    /**
+     * Recalculated on every rotation, so a user that becomes an administrator during a
+     * session is limited from that moment on (counted from their login, as if they had the
+     * permissions all along).
+     */
+    private static getDurations(session: UserSession, user: User): SessionDurations {
+        return SESSION_DURATIONS[this.getSessionType(session, user)][session.clientType];
+    }
+
+    private static getSessionType(session: UserSession, user: User): SessionType {
+        // Before the permissions: whoever signs in through the identity provider stays
+        // dependent on it, member or administrator.
+        if (session.loginMethod === SessionLoginMethod.SSO) {
+            return 'sso';
+        }
+
+        const permissions = user.permissions;
+        if (!permissions || permissions.isEmpty) {
+            return 'user';
+        }
+
+        if (permissions.globalPermissions !== null) {
+            return 'platformAdmin';
+        }
+
+        return 'admin';
+    }
+
+    private static applyLimits({ token, session, user }: { token: Token; session: UserSession; user: User }) {
+        const durations = this.getDurations(session, user);
+        const sessionEndsAt = durations.session !== null ? (session.startedAt.getTime() + durations.session) : (Date.now() + durations.refreshToken);
+
+        token.refreshTokenValidUntil = new Date(Math.min(Date.now() + durations.refreshToken, sessionEndsAt));
+        token.refreshTokenValidUntil.setMilliseconds(0);
+
+        token.accessTokenValidUntil = new Date(Math.min(token.accessTokenValidUntil.getTime(), sessionEndsAt));
+        token.accessTokenValidUntil.setMilliseconds(0);
+    }
+
+    static getMetaData(): SessionMetaData {
+        const value = contextStorage.getStore()?.request.headers['x-session-metadata'];
+        return this.parseMetaData(typeof value === 'string' ? value : null);
+    }
+
+    static parseMetaData(value: string | null): SessionMetaData {
+        const fallback = this.getFallbackMetaData();
+        if (typeof value !== 'string' || value.length > 4096) {
+            return fallback;
+        }
+
+        try {
+            let parsed: Partial<SessionMetaData>;
+            try {
+                parsed = JSON.parse(value) as Partial<SessionMetaData>;
+            } catch {
+                parsed = JSON.parse(decodeURIComponent(value)) as Partial<SessionMetaData>;
+            }
+            const string = (candidate: unknown, max: number): string | null => typeof candidate === 'string' && candidate.length > 0 ? candidate.slice(0, max) : null;
+            return {
+                deviceType: Object.values(SessionDeviceType).includes(parsed.deviceType as SessionDeviceType) ? parsed.deviceType as SessionDeviceType : fallback.deviceType,
+                deviceName: string(parsed.deviceName, 255),
+                osName: Object.values(SessionOS).includes(parsed.osName as SessionOS) ? parsed.osName as SessionOS : null,
+                osVersion: string(parsed.osVersion, 64),
+                appVersion: string(parsed.appVersion, 64),
+                nativeAppVersion: string(parsed.nativeAppVersion, 64),
+                browserName: string(parsed.browserName, 64),
+            };
+        } catch {
+            return fallback;
+        }
+    }
+
+    private static getFallbackMetaData(): SessionMetaData {
+        return {
+            deviceType: SessionDeviceType.Desktop,
+            deviceName: null,
+            osName: null,
+            osVersion: null,
+            appVersion: null,
+            nativeAppVersion: null,
+            browserName: null,
+        };
+    }
+}

package/src/services/SettlementService.test.ts

@@ -9,7 +9,7 @@ import { BalanceItemStatus, BalanceItemType, PaymentMethod, PaymentProvider, Pay
 import { ApplicationFeeType } from '@stamhoofd/structures/settlements/ApplicationFeeType.js';
 import { SettlementChargeType } from '@stamhoofd/structures/settlements/SettlementChargeType.js';
 import { v4 as uuidv4 } from 'uuid';
-import { ReportedRows, SettlementService } from './SettlementService.js';
+import { SettlementService } from './SettlementService.js';
 
 describe('SettlementService', () => {
     let organization: Organization;
@@ -272,79 +272,7 @@ describe('SettlementService', () => {
         });
     });
 
-    describe('sweepSettlement', () => {
-        test('deletes payout-only rows, but unlinks what outlives the payout', async () => {
-            const payment = await createPayment();
-            const settlement = await SettlementService.upsertSettlement(settlementData());
-
-            const keptLine = await SettlementService.upsertPaymentLine(settlement, {
-                paymentId: payment.id, amount: 50_00_00, externalId: 'txn_kept', occurredAt: new Date(2026, 0, 14),
-            });
-            const movedLine = await SettlementService.upsertPaymentLine(settlement, {
-                paymentId: payment.id, amount: 10_00_00, externalId: 'txn_moved', occurredAt: new Date(2026, 0, 14),
-            });
-
-            // A derived fee line is never reported by a walk: it belongs to the fee payment
-            const derivedLine = await SettlementService.upsertPaymentLine(settlement, {
-                paymentId: payment.id, amount: 2_00_00, externalId: null, occurredAt: new Date(2026, 0, 14),
-            });
-
-            const { fee, charge: referencedCharge } = await createApplicationFee({ settlement });
-            const providerFee = await SettlementService.upsertCharge({
-                type: SettlementChargeType.ProviderTransactionFee,
-                externalId: 'txn_moved:fee:0',
-                amount: -30_00,
-                settlementId: settlement.id,
-                organizationId: organization.id,
-                occurredAt: new Date(2026, 0, 14),
-            });
-            const keptFee = await SettlementService.upsertCharge({
-                type: SettlementChargeType.ProviderTransactionFee,
-                externalId: 'txn_kept:fee:0',
-                amount: -25_00,
-                settlementId: settlement.id,
-                organizationId: organization.id,
-                occurredAt: new Date(2026, 0, 14),
-            });
-
-            // The deduction charge is linked to this settlement too, but no longer reported
-            referencedCharge.settlementId = settlement.id;
-            await referencedCharge.save();
-
-            const reported = new ReportedRows();
-            reported.paymentLine(keptLine);
-            reported.charge(keptFee);
-            const { unlinkedFees } = await SettlementService.sweepSettlement(settlement, reported);
-
-            expect(await PaymentSettlement.getByID(keptLine.id)).toBeDefined();
-            expect(await PaymentSettlement.getByID(movedLine.id)).toBeUndefined();
-            expect(await PaymentSettlement.getByID(derivedLine.id)).toBeDefined();
-            expect(await SettlementCharge.getByID(providerFee.id)).toBeUndefined();
-            expect((await SettlementCharge.getByID(keptFee.id))?.settlementId).toBe(settlement.id);
-
-            // A charge an application fee points at may never be deleted (foreign key), only unlinked
-            const unlinkedCharge = await SettlementCharge.getByID(referencedCharge.id);
-            expect(unlinkedCharge).toBeDefined();
-            expect(unlinkedCharge!.settlementId).toBe(null);
-
-            expect(unlinkedFees.map(f => f.id)).toEqual([fee.id]);
-            expect((await ApplicationFee.getByID(fee.id))!.settlementId).toBe(null);
-        });
-
-        test('keeps the application fees the walk reported', async () => {
-            const settlement = await SettlementService.upsertSettlement(settlementData());
-            const { fee } = await createApplicationFee({ settlement });
-
-            const reported = new ReportedRows();
-            reported.applicationFee(fee);
-            const { unlinkedFees } = await SettlementService.sweepSettlement(settlement, reported);
-
-            expect(unlinkedFees).toHaveLength(0);
-            expect((await ApplicationFee.getByID(fee.id))!.settlementId).toBe(settlement.id);
-        });
-    });
-
-    describe('updatePaymentSettlementsForAccountDeductionPayment', () => {
+    describe('updatePaymentSettlementsForApplicationFeePayment', () => {
         test('one line per payout, summing the fees it contained', async () => {
             const { payment, balanceItem } = await createFeePayment(3_25_00);
             const first = await SettlementService.upsertSettlement(settlementData({ settledAt: new Date(2026, 0, 10) }));
@@ -357,7 +285,7 @@ describe('SettlementService', () => {
             // A fee that isn't paid out yet doesn't produce a line
             const { fee: pending } = await createApplicationFee({ balanceItemId: balanceItem.id, amount: 25_00 });
 
-            await SettlementService.updatePaymentSettlementsForAccountDeductionPayment(payment);
+            await SettlementService.updatePaymentSettlementsForApplicationFeePayment(payment);
 
             const lines = await PaymentSettlement.select().where('paymentId', payment.id).fetch();
             expect(lines).toHaveLength(2);
@@ -374,7 +302,7 @@ describe('SettlementService', () => {
             // Paying out the last fee completes the payment
             pending.settlementId = second.id;
             await pending.save();
-            await SettlementService.updatePaymentSettlementsForAccountDeductionPayment(payment);
+            await SettlementService.updatePaymentSettlementsForApplicationFeePayment(payment);
 
             const completed = await PaymentSettlement.select().where('paymentId', payment.id).fetch();
             expect(completed.reduce((total, line) => total + line.amount, 0)).toBe(payment.price);
@@ -387,10 +315,10 @@ describe('SettlementService', () => {
             await createApplicationFee({ settlement, balanceItemId: first.balanceItem.id, amount: 1_00_00 });
             await createApplicationFee({ settlement, balanceItemId: second.balanceItem.id, amount: 2_00_00 });
 
-            await SettlementService.updatePaymentSettlementsForAccountDeductionPayment(first.payment);
-            await SettlementService.updatePaymentSettlementsForAccountDeductionPayment(second.payment);
+            await SettlementService.updatePaymentSettlementsForApplicationFeePayment(first.payment);
+            await SettlementService.updatePaymentSettlementsForApplicationFeePayment(second.payment);
             // Re-running may not duplicate: the lines have no externalId to upsert on
-            await SettlementService.updatePaymentSettlementsForAccountDeductionPayment(first.payment);
+            await SettlementService.updatePaymentSettlementsForApplicationFeePayment(first.payment);
 
             const lines = await PaymentSettlement.select().where('settlementId', settlement.id).fetch();
             expect(lines).toHaveLength(2);
@@ -403,19 +331,19 @@ describe('SettlementService', () => {
             const settlement = await SettlementService.upsertSettlement(settlementData());
             const { fee } = await createApplicationFee({ settlement, balanceItemId: balanceItem.id, amount: 1_00_00 });
 
-            await SettlementService.updatePaymentSettlementsForAccountDeductionPayment(payment);
+            await SettlementService.updatePaymentSettlementsForApplicationFeePayment(payment);
             expect(await PaymentSettlement.select().where('paymentId', payment.id).count()).toBe(1);
 
             fee.settlementId = null;
             await fee.save();
-            await SettlementService.updatePaymentSettlementsForAccountDeductionPayment(payment);
+            await SettlementService.updatePaymentSettlementsForApplicationFeePayment(payment);
 
             expect(await PaymentSettlement.select().where('paymentId', payment.id).count()).toBe(0);
         });
 
         test('other payment methods are left alone', async () => {
             const payment = await createPayment();
-            await SettlementService.updatePaymentSettlementsForAccountDeductionPayment(payment);
+            await SettlementService.updatePaymentSettlementsForApplicationFeePayment(payment);
             expect(await PaymentSettlement.select().where('paymentId', payment.id).count()).toBe(0);
         });
     });
@@ -464,7 +392,7 @@ describe('SettlementService', () => {
             const { payment, balanceItem } = await createFeePayment(1_00_00);
             fee.balanceItemId = balanceItem.id;
             await fee.save();
-            await SettlementService.updatePaymentSettlementsForAccountDeductionPayment(payment);
+            await SettlementService.updatePaymentSettlementsForApplicationFeePayment(payment);
 
             const invoiced = await Settlement.getByID(settlement.id);
             expect(invoiced!.pendingFees).toBe(0);
@@ -476,7 +404,7 @@ describe('SettlementService', () => {
             const { payment, balanceItem } = await createFeePayment(1_00_00);
             const { fee } = await createApplicationFee({ settlement, balanceItemId: balanceItem.id, amount: 1_00_00 });
 
-            await SettlementService.updatePaymentSettlementsForAccountDeductionPayment(payment);
+            await SettlementService.updatePaymentSettlementsForApplicationFeePayment(payment);
             await SettlementService.finishSync(settlement, { transactionCount: 1 });
             expect(settlement.pendingFees).toBe(0);
             expect(settlement.unexplainedAmount).toBe(0);
@@ -484,7 +412,7 @@ describe('SettlementService', () => {
             // The payout no longer contains the fee: its line goes, and so does what it explained
             fee.settlementId = null;
             await fee.save();
-            await SettlementService.updatePaymentSettlementsForAccountDeductionPayment(payment);
+            await SettlementService.updatePaymentSettlementsForApplicationFeePayment(payment);
 
             const unlinked = await Settlement.getByID(settlement.id);
             expect(unlinked!.pendingFees).toBe(0);